VyOS Documentation

Release 1.5.x (circinus)

VyOS maintainers and contributors

Jul 09, 2024

 CONTENTS

1 About 2

2 History 3

3 Changelog 6

4 Installation and Image Management 290

5 Quick Start 371

6 Command Line Interface 378

7 Configuration Overview 380

8 Configuration Guide 394

9 Operation Mode 1053

10 VyOS Automation 1061

11 Troubleshooting 1128

12 Configuration Blueprints 1136

13 Configuration Blueprints (autotest) 1239

14 Build VyOS 1266

15 Development 1282

16 Issues/Feature requests 1294

17 Upstream packages 1297

18 Debugging 1299

19 Testing 1303

20 Write Documentation 1307

21 Coverage 1315

22 Copyright Notice 2276

i
Index 2277

ii
 VyOS Documentation, Release 1.5.x (circinus)

Get / Build VyOS Quickly Build your own Image or take a look at how to download a free or supported version.
Install VyOS Read about how to install VyOS on Bare Metal or in a Virtual Environment and how to use an image
with the usual cloud providers
Configuration and Operation Use the Quickstart Guide, to have a fast overview. Or go deeper and set up advanced
routing, VRFs, or VPNs for example.
Automate Integrate VyOS in your automation Workflow with Ansible, have your own local scripts, or configure VyOS
with the HTTPS-API.
Examples Get some inspiration from the Configuration Blueprints to build your infrastructure.
Contribute and Community
There are many ways to contribute to the project.
Add missing parts or improve the Documentation.
Discuss in Slack or the Forum.
Or you can pick up a Task and fix the code.

CONTENTS 1
 CHAPTER

ONE

ABOUT

VyOS is an open source network operating system based on Debian GNU/Linux.

VyOS provides a free routing platform that competes directly with other commercially available solutions from well
known network providers. Because VyOS runs on standard amd64, i586 and ARM systems, it is able to be used as a
router and firewall platform for cloud deployments.
We use multiple live versions of our manual, hosted thankfully by https://readthedocs.org. We will provide one version
of the manual for every VyOS major version starting with VyOS 1.2 which will receive Long-term support (LTS).
The manual version is selected/specified by it’s Git branch name. You can switch between versions of the documentation
by selecting the appropriate branch on the bottom left corner.
VyOS CLI syntax may change between major (and sometimes minor) versions. Please always refer to the documentation
matching your current, running installation. If a change in the CLI is required, VyOS will ship a so called migration
script which will take care of adjusting the syntax. No action needs to be taken by you.

2
 CHAPTER

TWO

HISTORY

2.1 In the beginning. . .

There once was a network operating system based on Debian GNU/Linux, called Vyatta.*0 2006 onwards, it was a
great free software alternative to Cisco IOS and Jupiter JUNOS. It came in two editions: Vyatta Core (previously
Vyatta Community Edition) that was completely free software, and Vyatta Subscription Edition that had proprietary
features and was only available to paying customers.†0
Vyatta was acquired by Brocade Communication Systems in 2012. Shortly after, Brocade renamed Vyatta Subscription
Edition to Brocade vRouter, discontinued Vyatta Core and shut down the community forum without a notice. The bug
tracker and Git repositories followed next year.
It’s worth noting that by the time Brocade acquired Vyatta, development of Vyatta Core was already stagnated. Vyatta
Subscription Edition (and thus, Vyatta development as a whole) had been replacing core components with proprietary
software, meaning few features made it to Vyatta Core, and those that did were bug-ridden and hamstrung.
In 2013, soon after Vyatta Core was abandoned, the community forked the last Vyatta Core version (6.6R1) and VyOS
Project came into being. Sentrium SL was established by VyOS maintainers in 2014 to fund VyOS development by
selling support, consulting services and prebuilt long-term support images.
Brocade was acquired by Broadcom in 2016 and sold what remains of erstwhile Vyatta to AT&T in 2017, who in turn
sold it to Ciena in 2021.

2.2 Major releases

VyOS major versions used to be named after elements in order of atomic numbers. With 1.2, this naming scheme was
replaced with the much cooler scheme of Latin names of IAU designated constellations by solid angle area, starting
from the smallest.
0 From the Sanskrit adjective “Vyātta” (), meaning opened.
0 A business model comparable to that of Redis, rather than that of VyOS today.

3
 VyOS Documentation, Release 1.5.x (circinus)

2.2.1 Hydrogen (1.0)

Released just in time for holidays on 22 December 2013, Hydrogen was the first major VyOS release. It fixed features
that were broken in Vyatta Core 6.6 (such as IPv4 BGP peer groups and DHCPv6 relay) and introduced command
scripting, a task scheduler and web proxy LDAP authentication.

2.2.2 Helium (1.1)

Helium was released on 9 October 2014, exactly on the day VyOS Project first came into being in the previous year.
Helium came with a lot of new features, including an event handler and support for L2TPv3, 802.1ad QinQ and IGMP
proxy, as well as experimental support for VXLAN and DMVPN (the latter of which was also broken in Vyatta Core
due to its reliance on a proprietary NHRP implementation).

2.2.3 Crux (1.2)

Crux (the Southern Cross) came out on 28 January 2019 and was the first major release of VyOS as we know it today.
The underlying Debian base was upgraded from Squeeze (6) to Jessie (8).
Although Crux came with too many new features to mention here, some noteworthy ones are: an mDNS repeater,
a broadcast relay, a high-performance PPPoE server, an HFSC scheduler, as well as support for Wireguard, unicast
VRRP, RPKI for BGP and fully 802.1ad-compliant QinQ ethertype. The telnet server and support for P2P filtering
were removed.
Crux is the first version to feature the modular image build system. CLI definitions began to be written in the modern,
verifiable XML templates. Python APIs were introduced for command scripting and configuration migration. Intro-
duction of new Perl and shell code was proscribed and the rewriting of legacy Perl code in pure Python began with
Crux.
As of 2022, Crux is still supported and maintained.

2.2.4 Equuleus (1.3)

The current long-term support version of VyOS, Equuleus (the Pony) came out on 21 December 2021, once again in
time for the winter holidays.
Equuleus brought many long-desired features with it, most notably an SSTP VPN server, an IPoE server, an Open-
Connect VPN server and a serial console server, in addition to reworked support for WWAN interfaces, support for
GENEVE and MACSec interfaces, VRF, IS-IS routing, preliminary support for MPLS and LDP, and many other ini-
tialisms.
As of 2022, Equuleus is in the stable.

2.2.5 Sagitta (1.4)

Sagitta (the Arrow) is the codename of the current development branch, so there’s no VyOS 1.4 yet.

2.2. Major releases 4

 VyOS Documentation, Release 1.5.x (circinus)

2.2.6 Circinus (1.5)

Circinus (the Compass) is the codename of the upcoming development branch, so there’s no VyOS 1.5 yet.

2.3 A note on copyright

Unlike Vyatta, VyOS never had (nor will ever have) proprietary code. The only proprietary material in VyOS is non-
code assets, such as graphics and the trademark “VyOS”.‡0 This means you can build your own long-term support
images (as the entire toolchain we use is free software) and even distribute them, given you rename it and remove
such assets before building. Although note that we do not provide support for images distributed by a third-party. See
the artwork license and the end-user license agreement at /usr/share/vyos/EULA in any pre-built image for more
precise information.

0 This is not unlike how Linus Torvalds owns the trademark “Linux”.

2.3. A note on copyright 5

 CHAPTER

THREE

CHANGELOG

3.1 1.5 Circinus

3.1.1 2024-04-26

• T6259 (feature): PKI: Support RFC822 (email) names in SAN

3.1.2 2024-04-25

• T6263 (bug): Multicast: Could not commit multicast config with multicast join group
using source-address
• T5833 (bug): Not all AFIs compatible with VRF

3.1.3 2024-04-24

• T6255 (bug): Static table description should not contain white-space

• T6226 (feature): add HAPROXY `tcp-request content accept` related block to
load-balancing reverse proxy config
• T6109 (bug): remote syslog do not get all the logs
• T6262 (default): Update the boot splash for VyOS 1.5 ISO
• T6217 (feature): VRRP contrack-sync script change name of the logger
• T6244 (feature): Spacing of "Show System Uptime" hard to parse

3.1.4 2024-04-23

• T6260 (bug): image-tools: remove failed image directory if 'No space left on
device' error
• T6261 (default): Typo in op_mode connect_disconnect print statement for
check_ppp_running
• T6237 (feature): IPSec remote access VPN: ability to set EAP ID of clients

6
 VyOS Documentation, Release 1.5.x (circinus)

3.1.5 2024-04-22

• T5996 (bug): unescape backslashes for config save, compare commands

3.1.6 2024-04-21

• T6191 (bug): Policy Route TCP-MSS Behavior Different from 1.3.x

• T5535 (feature): disable-directed-broadcast should be moved to firewall
global-options

3.1.7 2024-04-20

• T6252 (bug): gre tunnel - doesn't allow configure jumbo frame more than 8024

3.1.8 2024-04-19

• T6221 (bug): Enabling VRF breaks connectivity

• T6035 (bug): QoS policy shaper queue-type random-detect requires limit avpkt
• T6246 (feature): Enable basic haproxy http-check configuration options
• T6242 (feature): Loadbalancer reverse-proxy: SSL backend skip CA certificate
verification

3.1.9 2024-04-17

• T6168 (bug): add system image does not set default boot to current console type in
compatibility mode
• T6243 (bug): Update vyos-http-api-tools for package idna security advisory
• T6154 (enhancment): Installer should ask for password twice
• T5966 (default): Adjust dynamic dns configuration address subpath to be more
intuitive and other op-mode adjustments
• T5723 (default): mdns repeater: Always reload systemd daemon before applying
changes
• T5722 (bug): Failing to add route in failover if gateway not in the same interface
network
• T5612 (default): Miscellaneous improvements and fixes for dynamic DNS configuration
• T5574 (default): Support per-service cache management for dynamic dns providers

3.1. 1.5 Circinus 7

 VyOS Documentation, Release 1.5.x (circinus)

3.1.10 2024-04-16

• T6099 (bug): Suppress unsupported interfaces from appearing in messages log by

Telegraf

3.1.11 2024-04-15

• T6163 (bug): kea-dhcp4-server crashes due to incorrect lease file permissions after
1.5-rolling-202403120022 -> 1.5-rolling-202403230018 upgrade
• T6100 (bug): NAT config migration error in 1.4.0-epa1 if invalid address/network
defined in 1.3.6 version
• T6174 (bug): can't view dhcp server leases if logged in as a tacacs account
• T5734 (bug): OpenVPN server dh-params that are not in PKI error

3.1.12 2024-04-14

• T6210 (feature): Add container ability to configure capability sys-nice

3.1.13 2024-04-13

• T6173 (bug): Build Causes Errors When "--version" Contains Slashes ("/")
• T2518 (feature): Support NAT for ipv6(NPT)

3.1.14 2024-04-12

• T6214 (bug): Error when using some constraints

• T6213 (bug): Firewall group constraints
• T6222 (bug): VRRP rfc3768-compatibility not working correctly when resulting
interface name is over 15 characters
• T6218 (bug): Container network interface in VRF fails to generate IPv6 link-local
address
• T5044 (feature): High Availability in DHCPv6 -ISC DHCP Failover/Kea
• T6166 (bug): Tech support generation error for custom output location
• T344 (feature): Software basesd FastPath

3.1.15 2024-04-11

• T4516 (feature): Rewrite system image manipulation tools in Python

• T4548 (feature): GRUB loader configuration rework
• T6228 (bug): Cleanup of not existing units

3.1. 1.5 Circinus 8

 VyOS Documentation, Release 1.5.x (circinus)

3.1.16 2024-04-10

• T6207 (bug): image-tools: restore ability to copy config.boot.default on image

install
• T6106 (bug): Valid commit error for route-reflector-client option defined in
peer-group
• T5750 (bug): Upgrade from 1.3.4 to 1.4 Rolling fails QoS
• T5740 (bug): Generate wiregurad keys via HTTP-API fails
• T5858 (bug): Show conntrack statistics formatting is all over the place

3.1.17 2024-04-09

• T6121 (feature): Extend service config-sync for sections vpn, policy, vrf

3.1.18 2024-04-08

• T6197 (bug): IPoE-server interface client-subnet looks broken or works with the
wrong logic
• T6196 (bug): Route-map and summary-only do not work in BGP aggregation at the same
time
• T6068 (feature): dhcp server: allow switching between load-balanced and hotspare
mode

3.1.19 2024-04-07

• T6205 (bug): ipoe: error in migration script logic while renaming mac-address to
mac node
• T5862 (bug): Default MTU is not acceptable in some environments
• T6208 (feature): container: rename "cap-add" CLI node to "capability"
• T6188 (feature): Add Firewall Rule Description to "show firewall" commands
• T1244 (default): Support for StartupResync in conntrackd

3.1.20 2024-04-06

• T6203 (enhancment): Remove obsoleted xml lib

• T6202 (bug): Multi-Protocol BGP is broken by 6PE patch in upstream FRR 9.1

3.1. 1.5 Circinus 9

 VyOS Documentation, Release 1.5.x (circinus)

3.1.21 2024-04-05

• T6089 (bug): [1.3.6->1.4.0-epa1 Migration] "ospf passive-interface default"

incorrectly added
• T2590 (bug): DHCPv6 not updating nameservers and search domains since replacing
isc-dhcp-client with WIDE dhcp6c
• T6199 (feature): spring cleaning - drop unused Python imports

3.1.22 2024-04-04

• T6119 (default): Use a compliant TOML parser

• T6171 (feature): dhcp server fail-over - Rename fail-over node
• T6128 (bug): minisign.pub is wrong on https://vyos.net/get/nightly-builds/
• T5882 (feature): vyos-utils: move to Dune as build system
• T5864 (default): 'show ntp' Commands Not Working
• T3843 (bug): l2tp configuration not cleared after delete
• T2187 (feature): Python Unit testing
• T788 (bug): Nightly builds are not signed

3.1.23 2024-04-03

• T6198 (feature): configverify: add common helper for PKI certificate validation
• T6192 (feature): Multi VRF support for SSH

3.1.24 2024-04-02

• T6167 (bug): VNI not set on VRF after reboot

• T6151 (default): BGP VRF - Route-leaking not work when the next-hop is a recursive
route.
• T6033 (bug): hsflowd fails to start when using a tunnel interface

3.1.25 2024-04-01

• T6195 (feature): dropbear: package upgrade 2022.83-1 -> 2022.83-1+deb12u1

• T6193 (bug): dhcp-client: invalid warning "is not a DHCP interface but uses DHCP
name-server option" for VLAN interfaces
• T6178 (bug): Reverse-proxy should check that certificate exists during commit

3.1. 1.5 Circinus 10

 VyOS Documentation, Release 1.5.x (circinus)

3.1.26 2024-03-31

• T6186 (bug): Fix regression in 'set system image default-boot'

• T5832 (feature): Keepalived: Allow using the 'dev' statement on excluded-addresses

3.1.27 2024-03-29

• T6159 (bug): Openvpn Server Op-cmd adds heading "OpenVPN status on vtunx" for every
client connection

3.1.28 2024-03-28

• T6147 (bug): Conntrack not working as expected with global state-policy

• T6175 (bug): op-mode: "renew dhcp interface <name>" does not check if it's an
actual DHCP interface
• T6102 (bug): Clear dhcp-server lease throws python exception on 1.5-rolling

3.1.29 2024-03-26

• T6066 (bug): Setting same network in different ospf area will raise exception

3.1.30 2024-03-25

• T6145 (bug): Service config-sync does not rely on priorities but must

3.1.31 2024-03-24

• T6161 (feature): Output container images as JSON

• T6165 (bug): grub: vyos-grub-update failed to start on "slow" systems
• T6085 (bug): VTI interfaces are in UP state by default
• T6152 (bug): Kernel panic for ZimaBoard 232

3.1.32 2024-03-23

• T6160 (bug): isis: NameError: name 'process' is not defined

• T6131 (bug): Disabling openvpn interface(s) causes OSPF to fail to load on reboot
• T4022 (feature): Add package nat-rtsp-dkms

3.1. 1.5 Circinus 11

 VyOS Documentation, Release 1.5.x (circinus)

3.1.33 2024-03-22

• T6136 (bug): Configuring a dynamic address group, config script did not check
whether the group was created
• T6130 (bug): [1.3.6->1.4.0-epa2 Migration] BGP "set community" missing
• T6090 (bug): [1.3.6->1.4.0-epa1 Migration] policy route fails due tcp flag case
sensitivity
• T6155 (default): ixgbe: failed to initialize because an unsupported SFP+ module
type was detected.
• T6125 (feature): Support 802.1ad (0x88a8) vlan filtering for bridge

3.1.34 2024-03-21

• T6143 (feature): Increase configuration timeout range for service config-sync

3.1.35 2024-03-20

• T6133 (feature): Add domain-name to commit-archive

• T6129 (feature): bgp: add route-map option "as-path exclude all"

3.1.36 2024-03-19

• T6127 (bug): Ability to view logs for rules with Offload not functional
• T6138 (bug): Conntrack table op-mode fails with flowtable offload entries

3.1.37 2024-03-15

• T6118 (feature): radvd: RFC8781: add nat64prefix support

3.1.38 2024-03-12

• T6020 (bug): VRRP health-check script is not applied correctly in keepalived.conf

• T5646 (bug): QoS policy limiter broken if class without match

3.1.39 2024-03-11

• T6098 (bug): Description doesnt seem to allow for non international characters
• T2998 (bug): SNMP v3 oid "exclude" option doesn't work
• T6107 (bug): Nginx does not allow big config queries for configure endpoint API
• T6096 (bug): Config commits are not synced properly because 00vyos-sync is deleted
by vyos-router
• T6093 (bug): Incorrect dhcp-options vendor-class-id regex
• T6083 (feature): ethtool: move string parsing to JSON parsing

3.1. 1.5 Circinus 12

 VyOS Documentation, Release 1.5.x (circinus)

• T6069 (bug): HTTP API segfault during concurrent configuration requests

• T6057 (feature): Add ability to disable syslog for conntrackd
• T5504 (feature): Keepalived VRRP ability to set more than one peer-address
• T5717 (feature): ospfv3 - add allow to set metric-type to ospf redistribution while
frr docs says its possible.
• T6071 (bug): firewall: CLI description limit of 256 characters cause config upgrade
issues

3.1.40 2024-03-08

• T6086 (bug): NAT does not work with network-groups

• T6094 (bug): Destination Nat not Making Firewall Rules
• T6061 (bug): connection-status nat destination firewall filter not working in 1.4.
0-epa1
• T6075 (bug): Applying firewall rules with a non-existent interface group

3.1.41 2024-03-07

• T6104 (bug): Regression in commit-archive for non-interactive configuration

• T6084 (bug): OpenNHRP DMVPN configuration file clean after reboot if we have any
IPSec configuration
• T5348 (bug): Service config-sync can freeze the secondary router if it has
commit-archive location
• T6073 (bug): Conntrack/NAT not being disabled when VRFs are defined
• T6095 (default): Tab completion for "set interfaces wireless wlan0 country-code"
incorrect country "uk"

3.1.42 2024-03-06

• T6079 (bug): dhcp: migration fails for duplicate static-mapping

• T6063 (default): Kea DHCP: Expose match-client-id setting
• T5992 (default): DHCP: show dhcp server leases not showing all leases

3.1.43 2024-03-05

• T5903 (bug): NHRP don´t start on reboot from version 1.5-rolling-202401010026

• T2447 (feature): Additional Boot Argument Configuration to limit CPU C-States

3.1. 1.5 Circinus 13

 VyOS Documentation, Release 1.5.x (circinus)

3.1.44 2024-03-04

• T6087 (feature): ospfv3: add support to redistribute IS-IS routes

3.1.45 2024-03-02

• T6081 (bug): QoS policy shaper target and interval wrong calcuations

3.1.46 2024-02-29

• T6078 (feature): Update ethtool to 6.6

• T6077 (feature): banner: implement ASCII contest winner default logo
• T6074 (feature): container: do not allow deleting images which have a container
running

3.1.47 2024-02-28

• T4270 (bug): dns forwarding - When "ignore-hosts-file" is unset, local hostname of

router resolves to 127.0.1.1

3.1.48 2024-02-26

• T6064 (bug): Can not build VyOS if repository it not cloned to a branch
• T5754 (default): Update to StrongSwan 5.9.11

3.1.49 2024-02-25

• T6060 (feature): op-mode: container: support removing all container images at once

3.1.50 2024-02-24

• T5909 (bug): Container registry with authentication prevents config load (section
container) after reboot

3.1.51 2024-02-23

• T5376 (bug): Conntrack FTP helper does not work properly

3.1. 1.5 Circinus 14

 VyOS Documentation, Release 1.5.x (circinus)

3.1.52 2024-02-22

• T6048 (bug): Exception in event handler script

3.1.53 2024-02-21

• T6050 (bug): Wrong scripting commands descriptions in accel-ppp services

• T3771 (feature): DHCPv6 server prefix delegation - dynamically add route to
delegated prefix via requesting router

3.1.54 2024-02-19

• T5971 (default): Create the same view of ppp section for all accel-ppp services
• T6029 (default): Rewrite Accel-PPP services to an identical feature set
• T3722 (bug): op-mode IPSec show vpn ike sa always shows L-TIME 0

3.1.55 2024-02-18

• T6043 (bug): VxLAN and bridge error bug

• T6041 (bug): image-tools: install fails from PXE boot into live iso due to
restrictive logic

3.1.56 2024-02-17

• T5972 (feature): login: add possibility to disable individual local user accounts

3.1.57 2024-02-16

• T6009 (bug): Firewall - Time not working properly when not using UTC
• T6005 (bug): Error on adding a wireguard interface to OSPFv3
• T6019 (feature): Bump nftables and libnftnl version
• T6001 (default): Add option to enable resolve-via-default
• T5965 (bug): WWAN modems using raw-ip do not work with dhclient/dhcp6c
• T5245 (bug): Wireless interfaces do not get IPv6 link-local address assigned

3.1. 1.5 Circinus 15

 VyOS Documentation, Release 1.5.x (circinus)

3.1.58 2024-02-15

• T5977 (bug): nftables: Operation not supported when using match-ipsec in outbound
firewall
• T2612 (bug): HTTPS API, changing API key fails but goes through
• T5989 (bug): IP subnets not usable in UPnP ACLs
• T5719 (default): mdns repeater: Add op-mode commands
• T4839 (feature): Dynamic Firewall groups

3.1.59 2024-02-14

• T6034 (feature): rpki: move file based SSH keys for authentication to PKI subsystem
• T5981 (bug): IPsec site-to-site migrated PKI ca certificates are created with an '@'
• T5930 (bug): vrf - route-leak not work using route-target both command.
• T5709 (bug): IPoE-server fails if next pool mentioned but not defined
• T2044 (bug): RPKI doesn't boot properly
• T6032 (feature): bgp: add EVPN MAC-VRF Site-of-Origin support
• T5960 (default): Rewriting authentication section in accel-ppp services

3.1.60 2024-02-13

• T5928 (bug): Configuration fails to load on boot if offloading has VLAN interfaces
defined
• T5064 (bug): Value validation for domain-groups seems to be broken

3.1.61 2024-02-12

• T6010 (bug): Support setting multiple values in BGP path-attribute

• T6004 (bug): RPKI is not configured
• T5952 (default): DHCP allow same MAC Address on same subnet
• T5849 (feature): Add SRv6 route commands

3.1.62 2024-02-10

• T6023 (bug): rpki: add support for CLI knobs expire-interval and retry-interval

3.1. 1.5 Circinus 16

 VyOS Documentation, Release 1.5.x (circinus)

3.1.63 2024-02-09

• T6028 (bug): QoS policy shaper wrong class_id_max and default_minor_id

• T6026 (bug): QoS hide attempts to delete qdisc from devices
• T5788 (feature): frr: update to 9.1 release
• T5703 (bug): QoS config on pppoe interface resets back to fq_codel after tunnel
reboots
• T5685 (feature): Keepalived VRRP prefix is not necessary for the virtual address

3.1.64 2024-02-08

• T6014 (feature): Bump keepalived version

• T5910 (bug): Grub problem(?) Serial Console no longer working
• T6021 (bug): QoS r2q wrong calculation

3.1.65 2024-02-07

• T6017 (bug): Update vyos-http-api-tools for security advisory

• T6016 (bug): Resolve intermittent failures in cleanup function after failed image
install
• T6024 (feature): bgp: add additional missing FRR features
• T6011 (feature): rpki: known-hosts-file is no longer supported by FRR CLI - remove
VyOS CLI node
• T5998 (feature): replay_window setting under vpn in config

3.1.66 2024-02-06

• T6018 (default): smoketest: updating http-api framework requires a pause before

test
• T5921 (bug): Trying to commit an OpenConnect configuration without any local users
results in an exception
• T5687 (feature): Implement ECS settings for PowerDNS recursor

3.1.67 2024-02-05

• T5974 (bug): QoS policy shaper is currently miscalculating bandwidth and ceil values
for the default class
• T5865 (feature): Rewrite ipv6 pool section to ipv6 named pools in Accel-ppp services

3.1. 1.5 Circinus 17

 VyOS Documentation, Release 1.5.x (circinus)

3.1.68 2024-02-02

• T5739 (bug): Password recovery does not work if public keys are configured
• T5955 (feature): Rootless containers/set uid/gid for container
• T6003 (feature): Add 'show rpki as-number' and 'show rpki prefix'
• T5848 (feature): Add triple-isolate flow isolation option to CAKE QoS policy

3.1.69 2024-02-01

• T5995 (bug): Kernel NIC-drivers for Huawei NICs are not properly enabled
• T5978 (bug): ethernet: hw-tc-offload does not actually get enabled on the NIC
• T5979 (enhancment): Add configurable kernel boot parameters
• T5973 (bug): vrf: RTNETLINK answers: File exists
• T5967 (bug): Multi-hop BFD connections can't be established; please add minimum-ttl
option.
• T5619 (default): Update the Intel ixgbe driver due to issues with Intel X533

3.1.70 2024-01-31

• T6000 (bug): [1.3.x -> 1.5.x] migrating threw exception in /opt/vyatta/etc/

config-migrate/migrate/https/5-to-6, performed workaround
• T5999 (bug): load-balancing reverse-proxy can't configure root as a redirect

3.1.71 2024-01-30

• T5980 (feature): Add image-tools support for configurable kernel boot options

3.1.72 2024-01-29

• T5988 (bug): image-tools: a check of valid image name is missing from 'add image'
• T5994 (bug): Fix typo in 'remote' module preventing 'add system image' via ftp

3.1.73 2024-01-26

• T5957 (bug): Firewall fails to delete inbound-interface name

• T5779 (bug): custom conntrack timeout rule not applicable
• T5984 (feature): Add user util numactl

3.1. 1.5 Circinus 18

 VyOS Documentation, Release 1.5.x (circinus)

3.1.74 2024-01-25

• T5983 (bug): image-tools: minor regression in pruning version files in

compatibility mode
• T5927 (bug): QoS policy shaper-hfsc class does not have a `bandwidth` node but
requires one in the check
• T5834 (bug): Rename 'enable-default-log' to 'default-log'

3.1.75 2024-01-22

• T5968 (feature): hsflowd: add VRF support

• T5961 (bug): QoS policy shaper vif with ceiling fails on commit
• T5958 (bug): QoS policy shaper-hfsc is not implemented
• T5969 (feature): op-mode: list multicast group membership

3.1.76 2024-01-21

• T5799 (bug): vyos unbootable after 1.4-rolling-202308240020 to 1.

5-rolling-202312010026 upgrade
• T5787 (bug): dhcp-server allows duplicate static-mapping for the same IP address
• T5912 (bug): DHCP Static mapping don't work on every first lease
• T5692 (enhancment): NTP leap smear
• T5954 (feature): Enable nvme_hwmon and drivetemp in KERNEL

3.1.77 2024-01-20

• T5964 (bug): disconnect interface wwan0 throws exception

• T5948 (bug): pdns-recursor crashes on restart if hostfile-update is enabled and dhcp
client sends hostname with trailing dot
• T5945 (bug): Missing minisign public key for rolling release
• T5922 (bug): Firewall - bug in zone config
• T5915 (bug): Firewall zone - Re add op-mode commands
• T5724 (feature): About dhcp client hooks
• T5721 (bug): Error in migrating configuration from VyOS 1.4
• T5550 (bug): Source validation on interface does not work properly
• T5239 (bug): frr 'hostname' missing or incorrect, and domain-name missing totally
• T4726 (default): Add completion and validation for the accel-ppp RADIUS vendor
option
• T4085 (feature): Rewrite L2TP/PPTP/SSTP/PPPoE services to get_config_dict
• T5963 (bug): QoS policy shaper rate calculations could be wrong for some ethernet
devices

3.1. 1.5 Circinus 19

 VyOS Documentation, Release 1.5.x (circinus)

• T5876 (bug): Dhcp bug in latest 1.5 rolling releases

• T5962 (feature): QoS policy set default speed to 100mbit or 1gbit instead of 10mbit

3.1.78 2024-01-19

• T5897 (bug): VyOS with Cloud-init and VRF stucks at reboot/shutdown process
• T5554 (bug): Disable sudo for PAM RADIUS
• T4754 (default): Improvement: system login: show configured 2FA OTP key
• T5857 (bug): show interfaces wireless info
• T5841 (default): Remove old ssh-session-cleanup.service
• T5884 (default): Minor description fix (op-mode: generate wireguard)
• T5781 (default): Add ability to add additional minisign keys

3.1.79 2024-01-18

• T5863 (bug): Failure to Load Config on Recent 1.5 Versions

• T4638 (bug): Deleting a parent interface does not delete its underlying VLAN
interfaces
• T5953 (default): Rename 'close_action' value from `hold` to `trap` in IPSEC IKE

3.1.80 2024-01-17

• T5923 (bug): Config mode system_console.py is not aware of revised GRUB file
structure
• T4658 (feature): Rename DPD action `hold` to `trap`

3.1.81 2024-01-16

• T5859 (bug): Invalid format of pool range in accel-ppp services

• T5842 (feature): Rewrite PPTP service to get_config_dict
• T5801 (feature): Rewrite L2TP service to get_config_dict
• T5688 (default): Create the same view of pool configuration for all accel-ppp
services

3.1. 1.5 Circinus 20

 VyOS Documentation, Release 1.5.x (circinus)

3.1.82 2024-01-15

• T5944 (bug): "reboot in 1" not working

• T5936 (bug): [1.3.5 -> 1.4.0-RC1 Migration] OSPF Passive Interface Configuration Not
Working Correctly
• T5247 (bug): the bug of the command "show interfaces system"
• T5901 (bug): Cloud-init and DHCP exit hook errors
• T2556 (bug): "show interfaces vrrp" does not return any interface

3.1.83 2024-01-12

• T5925 (feature): Containers change systemd KillMode

• T5919 (bug): Firewall - opmode for ipv6
• T5306 (default): bgp config migration failed with v6only option configured with
peer-group
• T3429 (bug): Hyper-V integration services not working on VyOS 1.4 (sagitta/current)

3.1.84 2024-01-11

• T5713 (bug): strip-private doesn't strip string after "secret"

• T5532 (bug): After add system image the boot stuck and works again after the second
reboot
• T5814 (bug): VyOS 1.3 to 1.4 LTS Firewall ruleset migration script breaks
configuration
• T3191 (bug): PAM RADIUS freezing when accounting does not configured on RADIUS
server
• T5917 (feature): Restore annotations of (running)/(default boot) in select image
list
• T5916 (default): Added segment routing check for index size and SRGB size
• T5913 (feature): Allow for Peer-Groups in ipv4-labeled-unicast SAFI

3.1.85 2024-01-10

• T5918 (bug): Verification problem for `set vpn ipsec interface`

• T5911 (bug): pki: service update ignored if certificate name contains a hyphen (-)
• T5886 (feature): Add support for ACME protocol (LetsEncrypt)
• T5766 (bug): http: rewrite conf-mode script to get_config_dict()
• T4256 (feature): Display static DHCP server leases in the operational command output
• T5902 (bug): http: remove virtual-host configuration in webserver
• T3316 (feature): Use Kea DHCP(v6) instead of ISC DHCP(v6)

3.1. 1.5 Circinus 21

 VyOS Documentation, Release 1.5.x (circinus)

• T5791 (default): Update dynamic dns configuration path to be consistent with other
areas of VyOS
• T5708 (default): Additional dynamic dns improvements to align with ddclient 3.11.1
release
• T5573 (bug): Fix ddclient cache entries
• T5614 (default): Add conntrack helper matching on firewall

3.1.86 2024-01-09

• T5898 (bug): Replace partprobe with partx due to unable to install VyOS
• T5840 (feature): Upgrade Kea to 2.4.x
• T5838 (feature): Add Infiniband kernel modules
• T5785 (bug): API output of show container image broken
• T5249 (feature): Add rollback-soft feature to rollback without a reboot
• T2511 (feature): Migrate vyatta-op-quagga to new XML format
• T5905 (bug): pki: IPsec and VTI interface priority inversion when using x509
site-to-site peer

3.1.87 2024-01-08

• T5888 (bug): Firewall upgrade fails because of icmpv6

• T5844 (bug): HTTPS API doesn't start without configured keys even when GraphQL
authentication type is set to token
• T5904 (feature): op-mode: add "show ipv6 route vrf <name> <prefix>" command

3.1.88 2024-01-07

• T5899 (feature): VyOS vm images use bookworm repo

• T5887 (feature): Upgrade Linux Kernel to 6.6.y (2023 LTS edition)

3.1.89 2024-01-06

• T3214 (bug): OpenVPN IPv6 fixes

3.1.90 2024-01-05

• T5894 (feature): Extend get_config_dict() with additional parameter with_pki that

defaults to False

3.1. 1.5 Circinus 22

 VyOS Documentation, Release 1.5.x (circinus)

3.1.91 2024-01-03

• T5880 (bug): verify_source_interface should not allow dynamic interfaces like ppp,
l2tp, ipoe or sstpc client interfaces
• T5879 (bug): tunnel: sourceing from dynamic pppoe0 interface will fail on reboots

3.1.92 2024-01-02

• T5885 (default): image-tools: relax restriction on image-name length from 32 to 64

3.1.93 2024-01-01

• T5883 (bug): Preserve file ownership in /config subdirs on add system image
• T5474 (feature): Establish common file name pattern for XML conf mode commands

3.1.94 2023-12-30

• T5875 (bug): login: removing and re-adding a user keeps the home directory but UID
will change, thus SSH keys no longer work
• T5653 (feature): Command to display fingerprint

3.1.95 2023-12-29

• T5829 (bug): Can't Add IPv6 Address to Containers

• T5852 (bug): Reboots fail with eapol WAN interface
• T5869 (bug): vyos.template.first_host_address() does not honor RFC4291 section 2.6.1

3.1.96 2023-12-28

• T5827 (bug): image-tools: 'show system image' Command Not in Order

• T4163 (feature): [BMP-BGP] Routing monitoring feature
• T5867 (feature): Upgrade podman to Debian Trixie version 4.7.x
• T5866 (feature): Add op-mode command to restart IPv6 RA daemon
• T5861 (bug): Flavor build system fails with third-party packages
• T5854 (feature): Extend override-default script to allow embedded defaultValue
settings
• T5792 (default): Upgrade ddclient 3.11.2 release

3.1. 1.5 Circinus 23

 VyOS Documentation, Release 1.5.x (circinus)

3.1.97 2023-12-25

• T5855 (feature): Migrate "set service lldp snmp enable" -> `set service lldp snmp"
• T5837 (bug): vyos.configdict.node_changed does not return keys per adding
• T5856 (bug): SNMP service removal fails

3.1.98 2023-12-23

• T5678 (feature): Improvements in PPPoE configuration

3.1.99 2023-12-22

• T5804 (bug): SNAT "any" interface error

3.1.100 2023-12-21

• T5807 (bug): NAT66 op-mode bugs

• T5778 (bug): The show dhcp server leases operation mode command does not work as
expected
• T5775 (default): Migrated Firewall Global State Policy ineffective on latest
firewall zone config
• T5676 (bug): NAT66 source rule with negation source/destination prefix causes
TypeError
• T5637 (bug): Firewall default-action log
• T5796 (bug): Openconnect - HTTPS security headers are missing

3.1.101 2023-12-20

• T5823 (feature): Protocol BGP add default values for config dictionary
• T5798 (enhancment): reverse-proxy load-balancing service should support multiple
certificates for frontend

3.1.102 2023-12-19

• T5828 (default): Fix GRUB installation on arm64

3.1. 1.5 Circinus 24

 VyOS Documentation, Release 1.5.x (circinus)

3.1.103 2023-12-18

• T5751 (feature): Adjust new image tools for non-interactive use

• T5831 (feature): show system image should reverse order by addition date
• T5825 (bug): image-tools: restore authentication on 'add system image'
• T5821 (bug): image-tools: restore vrf-aware 'add system image'
• T5819 (bug): Don't echo password on install image
• T5806 (bug): Clear old raid data on new install image
• T5789 (bug): image-tools should copy ssh host keys on image update
• T5758 (default): Restore scanning configs when live installing

3.1.104 2023-12-15

• T5824 (bug): busybox cannot connect some websites from initramfs

• T5770 (bug): MACsec not encrypting
• T5803 (default): git/github: Adjust configuration for safe and baseline defaults

3.1.105 2023-12-14

• T5773 (bug): Unable to load config via HTTP

• T5816 (bug): BGP Large Community List Validation Broken
• T5812 (bug): rollback check max revision number does not work
• T5749 (feature): Show MAC address VRF and MTU by default for "show interfaces"
• T5774 (bug): commit-archive to FTP server broken after update (VyOS 1.5-rolling)
• T5826 (default): Add dmicode as an explicit dependency
• T5793 (default): mdns-repeater: Cleanup avahi-daemon configuration in /etc

3.1.106 2023-12-13

• T591 (feature): Support SRv6

3.1.107 2023-12-12

• T5815 (enhancment): Add load_config module

3.1. 1.5 Circinus 25

 VyOS Documentation, Release 1.5.x (circinus)

3.1.108 2023-12-11

• T5741 (bug): WAN Load Balancing failover route tables aren't created

3.1.109 2023-12-10

• T5658 (default): Add VRF support for mtr

3.1.110 2023-12-09

• T5808 (bug): op-mode: ipv6 ospfv3 graceful-restart description contains incorrect

info
• T5802 (bug): ping (ip or hostname) interface <tab> produces error
• T5747 (feature): op-mode add MAC VRF and MTU for show interfaces summary
• T3983 (bug): show pki certificate Doesnt show x509 certificates

3.1.111 2023-12-08

• T5782 (enhancment): Use a single config mode script for https and http-api
• T5768 (enhancment): Remove auxiliary http-api.conf for simplification of http-api
config mode script

3.1.112 2023-12-04

• T5769 (bug): VTI tunnels lose their v6 Link Local addresses when set down/up

3.1.113 2023-12-03

• T5753 (feature): Add VXLAN vnifilter support

• T5759 (feature): Change VXLAN default MTU to 1500 bytes

3.1.114 2023-11-27

• T5763 (bug): Fix imprecise check for remote file name in vyos-load-config.py
• T5783 (feature): frr: smoketests must notice any daemon crash

3.1. 1.5 Circinus 26

 VyOS Documentation, Release 1.5.x (circinus)

3.1.115 2023-11-26

• T5760 (feature): DHCP client custom dhcp-options

• T2405 (feature): archive to GIT or other platform

3.1.116 2023-11-25

• T5655 (bug): commit-archive: Ctrl+C should not eror out with stack trace, signal
should be cought

3.1.117 2023-11-24

• T5776 (feature): Enable VFIO support

• T5402 (bug): VRRP router with rfc3768-compatibility sends multiple ARP replies

3.1.118 2023-11-23

• T5659 (bug): VPP cannot add interface to dataplane if it already has an address
configured

3.1.119 2023-11-22

• T5767 (feature): Add reboot and poweroff the system via API
• T5729 (bug): Firewall, nat and policy route - Switch to valueless
• T5681 (feature): Interface match - Simplified and unified cli
• T5643 (feature): NAT - Allow interface groups on nat rules
• T5616 (feature): Firewall mark - Add capabilities for matching firewall mark
• T5590 (default): Firewall "log enable" logs every packet

3.1.120 2023-11-21

• T5762 (bug): http: api: smoketests fail as they can not establish IPv6 connection
to uvicorn backend server

3.1.121 2023-11-18

• T1354 (feature): Add support for VLAN-Aware bridges

3.1. 1.5 Circinus 27

 VyOS Documentation, Release 1.5.x (circinus)

3.1.122 2023-11-16

• T5726 (bug): HTTPS API image cannot be updated

• T5738 (feature): Extend XML building blocks
• T5736 (feature): igmp: migrate "protocols igmp" to "protocols pim"
• T5733 (feature): pim(6): rewrite FRR PIM daemon configuration to get_config_dict()
and add missing IGMP features
• T5689 (default): FRR 9.0.1 in VyOS current segfaults on show rpki prefix $prefix
• T5595 (feature): Multicast - PIM bfd feature enable

3.1.123 2023-11-15

• T5695 (feature): Build FRR with LUA scripts --enable-scripting option

• T5677 (bug): show lldp neighbors generates TypeError when neighbor has no `descr`
• T5728 (bug): Improve compatibility between OpenVPN on VyOS 1.5 and OpenVPN Connect
Client
• T5732 (bug): generate firewall rule-resequence drops geoip country-code from output
• T5661 (enhancment): Add show show ssh dynamic-protection attacker and show log ssh
dynamic-protection

3.1.124 2023-11-13

• T5698 (feature): EVPN ESI Multihoming

• T5563 (bug): container: Container environment variable cannot be set
• T5706 (bug): Systemd-udevd high CPU utilization for multiple dynamic ppp/l2tp/ipoe
interfaces

3.1.125 2023-11-10

• T5727 (bug): validator: Use native URL validator instead of regex-based validator

3.1.126 2023-11-08

• T5720 (bug): PPPoE-server adding new interface does not work

• T5716 (bug): PPPoE-server shaper template bug down-limiter option does not rely on
fwmark
• T5702 (feature): Add ability to set include_ifmib_iface_prefix and
ifmib_max_num_ifaces for SNMP
• T5693 (feature): Adding variable vyos_persistence_dir (and improve variable
vyos_rootfs_dir)
• T5648 (bug): ldpd neighbour template errors
• T5564 (bug): Both show firewall group and show firewall summary fails

3.1. 1.5 Circinus 28

 VyOS Documentation, Release 1.5.x (circinus)

• T5559 (feature): Selective proxy-arp/proxy-ndp when doing SNAT/DNAT

• T5541 (bug): Zone-Based Firewalling in VyOS Sagitta 1.4

3.1.127 2023-11-07

• T5586 (feature): Disable by default SNMP for Keepalived VRRP

3.1.128 2023-11-06

• T5705 (bug): rsyslog - Not working when using facility=all

• T5704 (feature): PPPoE-server add max-starting option
• T5707 (bug): Wireguard peer public key update leaves redundant peers and breaks
connectivity

3.1.129 2023-11-03

• T5700 (bug): Monitoring telegraf deprecated plugins inputs outputs

3.1.130 2023-11-02

• T5701 (feature): Update telegraf package

3.1.131 2023-11-01

• T5690 (bug): Change to definition of environment variable 'vyos_rootfs_dir' is

incorrect

3.1.132 2023-10-31

• T5699 (feature): vxlan: migrate "external" CLI know to "parameters external"

• T5668 (feature): Disable VXLAN bridge learning and enable neigh_suppress when using
EVPN

3.1.133 2023-10-27

• T5663 (bug): pmacct package contains unwanted data

• T5652 (bug): Config migrate to image upgrade does not properly generate home
directory

3.1. 1.5 Circinus 29

 VyOS Documentation, Release 1.5.x (circinus)

3.1.134 2023-10-26

• T5683 (bug): reverse-proxy pki filenames mismatch

• T5600 (bug): Firewall - Remove or extend constraint on 'interface-name'
• T5598 (bug): unknown parameter 'nf_conntrack_helper' ignored
• T5571 (bug): Firewall does not delete networks from the table raw
• T4903 (bug): conntrack ignore does not suppotr IPv6 addresses
• T4309 (feature): Support network/address-groups and ipv6-network/ipv6-address-groups
in conntrack ignore
• T5594 (bug): VRRP - Error if using IPv6 Link Local as hello source address
• T5606 (feature): IPSec VPN: Allow multiple CAs certificates
• T5568 (default): Install image from live ISO always defaults boot to KVM entry
• T5558 (default): Update config test to check resulting migrations

3.1.135 2023-10-23

• T5299 (bug): QoS shaper ceiling does not work

• T5667 (feature): BGP label-unicast - enable ecmp

3.1.136 2023-10-22

• T5254 (bug): Modification of any interface setting sets MTU back to default when MTU
has been inherited from a bond
• T5671 (feature): vxlan: change port to IANA assigned default port

3.1.137 2023-10-21

• T5670 (bug): bridge: missing member interface validator

• T5617 (feature): Add an option to exclude single values to the numeric validator

3.1.138 2023-10-20

• T5233 (bug): Op-mode flow-accounting netflow with disable-imt errors

• T5232 (bug): Flow-accounting uacctd.service cannot restart correctly

3.1. 1.5 Circinus 30

 VyOS Documentation, Release 1.5.x (circinus)

3.1.139 2023-10-19

• T4913 (default): Rewrite the wireless op mode in the new style

3.1.140 2023-10-18

• T5642 (bug): op cmd: generate tech-support archive: does not work

• T5521 (bug): Home owner directory changed to vyos for the user after reboot

3.1.141 2023-10-17

• T5662 (bug): Fix indexing error in configdep script organization

• T5644 (bug): Firewall groups deletion can break config

3.1.142 2023-10-16

• T5165 (feature): Policy local-route ability set protocol and port

3.1.143 2023-10-14

• T5629 (bug): Policy local-route bug after migration to destination node address

3.1.144 2023-10-12

• T5649 (bug): vyos-1x should generate XML cache after building command templates for
less cryptic error on typo

3.1.145 2023-10-10

• T5589 (bug): Nonstripped binaries exists in VyOS

• T5489 (feature): Change to BBR as TCP congestion control, or at least make it an
config option

3.1.146 2023-10-08

• T5630 (feature): pppoe: allow to specify MRU in addition to already configurable

MTU

3.1. 1.5 Circinus 31

 VyOS Documentation, Release 1.5.x (circinus)

3.1.147 2023-10-06

• T5576 (feature): Add bgp remove-private-as all option

3.1.148 2023-10-05

• T4320 (default): Remove legacy version files in vyatta-cfg-system/cfg-version

3.1.149 2023-10-04

• T5632 (feature): Add jq package to parse JSON files

• T3655 (bug): NAT Problem with VRF
• T5585 (bug): Fix file access mode for dynamic dns configuration

3.1.150 2023-10-03

• T5618 (bug): Flow-accounting crushes when IMT is enabled

• T5579 (bug): Log firewall - Wrong command after firewall refactor
• T5561 (feature): NAT - Inbound or outbound interface should not be mandatory
• T5626 (feature): Only select required Kernel CGROUP controllers
• T5628 (feature): op-mode: login: DeprecationWarning: 'spwd'

3.1.151 2023-09-28

• T5596 (feature): bgp: add new features from FRR 9

• T5412 (feature): Add support for extending config-mode dependencies in supplemental
package

3.1.152 2023-09-24

• T5604 (bug): List of debian archives is out of date (non-free-firmware is missing)

• T5591 (feature): Cleanup of FRR daemons-file and various FRR fixes

3.1.153 2023-09-22

• T5602 (feature): For reverse-proxy type of load-balancing feature, support "backup"

option in backends configuration
• T5609 (enhancment): Add util to get drive device name from id
• T5608 (enhancment): Rewrite add/delete raid member to Python and remove from
vyatta-op
• T5607 (bug): Adjust RAID smoketest for non-deterministic SCSI device probing

3.1. 1.5 Circinus 32

 VyOS Documentation, Release 1.5.x (circinus)

3.1.154 2023-09-20

• T5588 (bug): Add kernel conntrack_bridge module

• T5241 (feature): Support veth interfaces to working with netns
• T5592 (feature): salt: upgrade minion to 3005.2

3.1.155 2023-09-19

• T5597 (feature): isis: add new features from FRR 9.

3.1.156 2023-09-18

• T5575 (bug): ARP/NDP table-size isnt set properly

3.1.157 2023-09-15

• T5587 (bug): Firwall can not pass the smoketest

• T5581 (feature): Add "show ip nht" op-mode command (IPv4 nexthop tracking table)

3.1.158 2023-09-11

• T5562 (bug): Smoketests fail for vyos:current (test_netns.py)

• T5551 (bug): Missing check for boot_configuration_complete raises error in
vyos-save-config.py
• T5353 (bug): config-mgmt: normalize archive updates and commit log entries

3.1.159 2023-09-10

• T5555 (bug): Fix timezone migrator (system 13-to-14)

3.1.160 2023-09-09

• T5423 (bug): ipsec: no output for op-cmd "show vpn ike secrets"

3.1.161 2023-09-08

• T5560 (bug): VyOS version in current branch should be changed from 1.4 to 1.5

3.1. 1.5 Circinus 33

 VyOS Documentation, Release 1.5.x (circinus)

3.1.162 2023-09-07

• T5556 (bug): reboot now and poweroff does not work

3.1.163 2023-09-06

• T5548 (bug): HAProxy renders timeouts incorrectly

3.2 1.4 Sagitta

3.2.1 2024-04-25

• T6263 (bug): Multicast: Could not commit multicast config with multicast join group
using source-address
• T5833 (bug): Not all AFIs compatible with VRF

3.2.2 2024-04-24

• T6255 (bug): Static table description should not contain white-space

• T6226 (feature): add HAPROXY `tcp-request content accept` related block to
load-balancing reverse proxy config
• T6109 (bug): remote syslog do not get all the logs
• T6217 (feature): VRRP contrack-sync script change name of the logger
• T6244 (feature): Spacing of "Show System Uptime" hard to parse

3.2.3 2024-04-23

• T6260 (bug): image-tools: remove failed image directory if 'No space left on
device' error
• T6261 (default): Typo in op_mode connect_disconnect print statement for
check_ppp_running
• T6237 (feature): IPSec remote access VPN: ability to set EAP ID of clients

3.2.4 2024-04-22

• T5996 (bug): unescape backslashes for config save, compare commands

• T6103 (bug): DHCP-server bootfile-name double slash syntax weird behaviour
• T6080 (default): Default NTP server settings
• T5986 (bug): Container: Error on commit when environment variable value contains \n
line break

3.2. 1.4 Sagitta 34

 VyOS Documentation, Release 1.5.x (circinus)

3.2.5 2024-04-21

• T6191 (bug): Policy Route TCP-MSS Behavior Different from 1.3.x

• T5535 (feature): disable-directed-broadcast should be moved to firewall
global-options

3.2.6 2024-04-20

• T6252 (bug): gre tunnel - doesn't allow configure jumbo frame more than 8024

3.2.7 2024-04-19

• T6221 (bug): Enabling VRF breaks connectivity

• T6035 (bug): QoS policy shaper queue-type random-detect requires limit avpkt
• T6246 (feature): Enable basic haproxy http-check configuration options
• T6242 (feature): Loadbalancer reverse-proxy: SSL backend skip CA certificate
verification

3.2.8 2024-04-17

• T6168 (bug): add system image does not set default boot to current console type in
compatibility mode
• T6243 (bug): Update vyos-http-api-tools for package idna security advisory
• T6154 (enhancment): Installer should ask for password twice
• T5966 (default): Adjust dynamic dns configuration address subpath to be more
intuitive and other op-mode adjustments
• T5723 (default): mdns repeater: Always reload systemd daemon before applying
changes
• T5722 (bug): Failing to add route in failover if gateway not in the same interface
network
• T5612 (default): Miscellaneous improvements and fixes for dynamic DNS configuration
• T5574 (default): Support per-service cache management for dynamic dns providers
• T5360 (bug): ddclient generating abuse

3.2.9 2024-04-15

• T6100 (bug): NAT config migration error in 1.4.0-epa1 if invalid address/network

defined in 1.3.6 version
• T5734 (bug): OpenVPN server dh-params that are not in PKI error

3.2. 1.4 Sagitta 35

 VyOS Documentation, Release 1.5.x (circinus)

3.2.10 2024-04-14

• T6210 (feature): Add container ability to configure capability sys-nice

3.2.11 2024-04-13

• T6173 (bug): Build Causes Errors When "--version" Contains Slashes ("/")
• T2518 (feature): Support NAT for ipv6(NPT)
• T6238 (default): vyos-build Check pull request title requires the python script
• T6235 (default): Git check PR status: conflicts and resolution

3.2.12 2024-04-12

• T5872 (default): ipsec remote access VPN: support dhcp-interface

• T6216 (bug): Upgrade error from 1.3 to 1.4 - Firewall using character '+'
• T6214 (bug): Error when using some constraints
• T6213 (bug): Firewall group constraints
• T6148 (bug): Reset vpn ipsec command breaks tunnel and does not reset SAs that are
down
• T1487 (default): DNS (pdns_recursor) stats logs not saved to disk
• T6222 (bug): VRRP rfc3768-compatibility not working correctly when resulting
interface name is over 15 characters
• T6218 (bug): Container network interface in VRF fails to generate IPv6 link-local
address
• T5959 (default): Streamline dns forwarding service
• T5846 (default): Refactor and simplify DUID definition in conf-mode
• T5631 (feature): Ability to export the current configuration in JSON format
• T5615 (default): Narrow down spurious name conflict with mdns
• T5530 (default): Add LFA to IS-IS
• T5195 (default): Break up the vyos.util module
• T5124 (bug): Python3 deprecation distutils.version import LooseVersion
• T1871 (feature): add MTU option when configure limiter traffic-policy
• T874 (feature): Support for Two Factor Authentication for CLI access via Google
Authenticator/OTP
• T6204 (default): Remove shebang lines from Python modules
• T6166 (bug): Tech support generation error for custom output location
• T6062 (feature): container: add support for image manipulation based on tag name
• T5877 (default): Reduce unnecessary nesting in system domain-search path and improve
smoketest

3.2. 1.4 Sagitta 36

 VyOS Documentation, Release 1.5.x (circinus)

• T5871 (default): ipsec remote access VPN: specify "cacerts" to disambiguate mulitple
remote access configurations
• T5870 (default): ipsec remote access VPN: add x509 ("pubkey") authentication
• T5772 (default): Require HTTPS API server configurations to include at least one key
if key-based auth is used
• T5447 (feature): Allow static MACsec keys with peers
• T4221 (default): Add a template filter for converting scalars to single-item lists
• T3766 (feature): containers: Expanding options for networking and building
containers

3.2.13 2024-04-11

• T4516 (feature): Rewrite system image manipulation tools in Python

• T4548 (feature): GRUB loader configuration rework
• T3774 (bug): atop logs are not limited in size
• T3574 (default): Add constraintGroup for combining validators with logical AND
• T3474 (default): Revisit storing syntax version of interface definitions in XML file
• T160 (feature): Support NAT64
• T6228 (bug): Cleanup of not existing units

3.2.14 2024-04-10

• T6207 (bug): image-tools: restore ability to copy config.boot.default on image

install
• T5750 (bug): Upgrade from 1.3.4 to 1.4 Rolling fails QoS
• T5858 (bug): Show conntrack statistics formatting is all over the place
• T4734 (feature): Feature Request: openvpn: add OTP 2FA support

3.2.15 2024-04-09

• T3409 (feature): Add back TCP-MSS Clamp to PMTU

• T6121 (feature): Extend service config-sync for sections vpn, policy, vrf

3.2.16 2024-04-08

• T6197 (bug): IPoE-server interface client-subnet looks broken or works with the
wrong logic
• T6196 (bug): Route-map and summary-only do not work in BGP aggregation at the same
time
• T6068 (feature): dhcp server: allow switching between load-balanced and hotspare
mode

3.2. 1.4 Sagitta 37

 VyOS Documentation, Release 1.5.x (circinus)

3.2.17 2024-04-07

• T6205 (bug): ipoe: error in migration script logic while renaming mac-address to
mac node
• T6039 (bug): cloud-init DNS search-domain causes configuration migration/validation
error
• T5862 (bug): Default MTU is not acceptable in some environments
• T6208 (feature): container: rename "cap-add" CLI node to "capability"
• T6188 (feature): Add Firewall Rule Description to "show firewall" commands
• T1244 (default): Support for StartupResync in conntrackd

3.2.18 2024-04-06

• T6203 (enhancment): Remove obsoleted xml lib

• T6202 (bug): Multi-Protocol BGP is broken by 6PE patch in upstream FRR 9.1

3.2.19 2024-04-05

• T6089 (bug): [1.3.6->1.4.0-epa1 Migration] "ospf passive-interface default"

incorrectly added
• T2590 (bug): DHCPv6 not updating nameservers and search domains since replacing
isc-dhcp-client with WIDE dhcp6c
• T6199 (feature): spring cleaning - drop unused Python imports

3.2.20 2024-04-04

• T6119 (default): Use a compliant TOML parser

• T6171 (feature): dhcp server fail-over - Rename fail-over node
• T6115 (bug): Build from Git tags fail
• T5122 (feature): Move "archive-areas" to defaults.toml to support
"non-free-firmware" repository
• T5121 (bug): Incorrect "architecture" config loaded
• T4951 (default): Add an op mode exception for cases when operations fail due to
insufficient system resources
• T4883 (default): Add a description field for routing tables
• T4796 (bug): build-vyos-image ignores multiple options
• T4795 (feature): Cleanup custom python validators
• T4761 (default): Add a generic URL validator
• T3843 (bug): l2tp configuration not cleared after delete
• T3681 (default): The VMware Tools resume script did not run successfully in this
virtual machine.

3.2. 1.4 Sagitta 38

 VyOS Documentation, Release 1.5.x (circinus)

• T1991 (feature): Rework time services

• T5711 (default): Put the version data file inside the ISO image
• T5672 (default): Remove the old-style command definition importer
• T5639 (default): Group vyos-1x dependencies by their VyOS components and specify
their purpose
• T5638 (default): Add support for requiring numeric values to be ranges rather than
single numbers
• T5634 (default): Remove support for Blowfish and DES from OpenVPN
• T5605 (default): Do not generate keysize option in OpenVPN configs
• T5582 (default): Add a command to force NTP sync
• T5449 (default): Add options for TCP MSS probing
• T4440 (default): Add OCI compliant image labels to vyos-build and vyos containers
• T671 (enhancment): Identify and remove dead code
• T5109 (feature): Improve OCaml XML validator
• T1449 (feature): Add opportunity to include custom default configs (few) at building

3.2.21 2024-04-03

• T6198 (feature): configverify: add common helper for PKI certificate validation
• T6192 (feature): Multi VRF support for SSH

3.2.22 2024-04-02

• T6167 (bug): VNI not set on VRF after reboot

• T6151 (default): BGP VRF - Route-leaking not work when the next-hop is a recursive
route.
• T6033 (bug): hsflowd fails to start when using a tunnel interface

3.2.23 2024-04-01

• T6195 (feature): dropbear: package upgrade 2022.83-1 -> 2022.83-1+deb12u1

• T6193 (bug): dhcp-client: invalid warning "is not a DHCP interface but uses DHCP
name-server option" for VLAN interfaces
• T6178 (bug): Reverse-proxy should check that certificate exists during commit

3.2. 1.4 Sagitta 39

 VyOS Documentation, Release 1.5.x (circinus)

3.2.24 2024-03-31

• T6186 (bug): Fix regression in 'set system image default-boot'

• T5832 (feature): Keepalived: Allow using the 'dev' statement on excluded-addresses

3.2.25 2024-03-28

• T6147 (bug): Conntrack not working as expected with global state-policy

• T6175 (bug): op-mode: "renew dhcp interface <name>" does not check if it's an
actual DHCP interface

3.2.26 2024-03-26

• T6066 (bug): Setting same network in different ospf area will raise exception

3.2.27 2024-03-25

• T6145 (bug): Service config-sync does not rely on priorities but must

3.2.28 2024-03-24

• T6161 (feature): Output container images as JSON

• T6165 (bug): grub: vyos-grub-update failed to start on "slow" systems
• T6085 (bug): VTI interfaces are in UP state by default
• T6152 (bug): Kernel panic for ZimaBoard 232

3.2.29 2024-03-23

• T6160 (bug): isis: NameError: name 'process' is not defined

• T6131 (bug): Disabling openvpn interface(s) causes OSPF to fail to load on reboot
• T4022 (feature): Add package nat-rtsp-dkms

3.2.30 2024-03-22

• T6136 (bug): Configuring a dynamic address group, config script did not check
whether the group was created
• T6130 (bug): [1.3.6->1.4.0-epa2 Migration] BGP "set community" missing
• T6090 (bug): [1.3.6->1.4.0-epa1 Migration] policy route fails due tcp flag case
sensitivity
• T6155 (default): ixgbe: failed to initialize because an unsupported SFP+ module
type was detected.
• T6125 (feature): Support 802.1ad (0x88a8) vlan filtering for bridge
• T5624 (default): Remove /etc/debian_version from the image

3.2. 1.4 Sagitta 40

 VyOS Documentation, Release 1.5.x (circinus)

3.2.31 2024-03-21

• T6143 (feature): Increase configuration timeout range for service config-sync

3.2.32 2024-03-20

• T6133 (feature): Add domain-name to commit-archive

• T6129 (feature): bgp: add route-map option "as-path exclude all"

3.2.33 2024-03-19

• T6127 (bug): Ability to view logs for rules with Offload not functional
• T6138 (bug): Conntrack table op-mode fails with flowtable offload entries

3.2.34 2024-03-15

• T6118 (feature): radvd: RFC8781: add nat64prefix support

3.2.35 2024-03-12

• T6020 (bug): VRRP health-check script is not applied correctly in keepalived.conf

• T5646 (bug): QoS policy limiter broken if class without match
• T2433 (feature): Improve CLI value validator performance
• T1436 (bug): Config entries with default values do not correctly show as changed

3.2.36 2024-03-11

• T6098 (bug): Description doesnt seem to allow for non international characters
• T6070 (bug): bnx2x NIC causes a commit error due to incorrect implementation of EEE
status reading
• T2998 (bug): SNMP v3 oid "exclude" option doesn't work
• T6107 (bug): Nginx does not allow big config queries for configure endpoint API
• T6096 (bug): Config commits are not synced properly because 00vyos-sync is deleted
by vyos-router
• T6093 (bug): Incorrect dhcp-options vendor-class-id regex
• T6083 (feature): ethtool: move string parsing to JSON parsing
• T6069 (bug): HTTP API segfault during concurrent configuration requests
• T6057 (feature): Add ability to disable syslog for conntrackd
• T5504 (feature): Keepalived VRRP ability to set more than one peer-address
• T5717 (feature): ospfv3 - add allow to set metric-type to ospf redistribution while
frr docs says its possible.

3.2. 1.4 Sagitta 41

 VyOS Documentation, Release 1.5.x (circinus)

• T6071 (bug): firewall: CLI description limit of 256 characters cause config upgrade
issues

3.2.37 2024-03-08

• T6086 (bug): NAT does not work with network-groups

• T6094 (bug): Destination Nat not Making Firewall Rules
• T6061 (bug): connection-status nat destination firewall filter not working in 1.4.
0-epa1
• T6075 (bug): Applying firewall rules with a non-existent interface group

3.2.38 2024-03-07

• T6104 (bug): Regression in commit-archive for non-interactive configuration

• T6084 (bug): OpenNHRP DMVPN configuration file clean after reboot if we have any
IPSec configuration
• T5348 (bug): Service config-sync can freeze the secondary router if it has
commit-archive location
• T6073 (bug): Conntrack/NAT not being disabled when VRFs are defined
• T6095 (default): Tab completion for "set interfaces wireless wlan0 country-code"
incorrect country "uk"

3.2.39 2024-03-06

• T6079 (bug): dhcp: migration fails for duplicate static-mapping

3.2.40 2024-03-05

• T5903 (bug): NHRP don´t start on reboot from version 1.5-rolling-202401010026

• T2447 (feature): Additional Boot Argument Configuration to limit CPU C-States

3.2.41 2024-03-04

• T6054 (bug): load-balancing wan - doesn't configure a list of ports

• T6087 (feature): ospfv3: add support to redistribute IS-IS routes

3.2. 1.4 Sagitta 42

 VyOS Documentation, Release 1.5.x (circinus)

3.2.42 2024-03-02

• T6081 (bug): QoS policy shaper target and interval wrong calcuations

3.2.43 2024-02-29

• T6078 (feature): Update ethtool to 6.6

• T6077 (feature): banner: implement ASCII contest winner default logo
• T6074 (feature): container: do not allow deleting images which have a container
running

3.2.44 2024-02-28

• T6055 (bug): PKI error: "failed to install x value" when executed the command from
conf mode
• T4270 (bug): dns forwarding - When "ignore-hosts-file" is unset, local hostname of
router resolves to 127.0.1.1

3.2.45 2024-02-27

• T6065 (bug): Duplicate lines in build-vyos-image script cause sagitta build to fail
• T5080 (bug): Conntrack enabled by default

3.2.46 2024-02-26

• T6064 (bug): Can not build VyOS if repository it not cloned to a branch
• T5754 (default): Update to StrongSwan 5.9.11

3.2.47 2024-02-25

• T6060 (feature): op-mode: container: support removing all container images at once

3.2.48 2024-02-24

• T5909 (bug): Container registry with authentication prevents config load (section
container) after reboot

3.2. 1.4 Sagitta 43

 VyOS Documentation, Release 1.5.x (circinus)

3.2.49 2024-02-23

• T5376 (bug): Conntrack FTP helper does not work properly

• T970 (feature): Hostname Support in NAT and Firewall Rules
• T4940 (feature): Interface debugging

3.2.50 2024-02-22

• T6048 (bug): Exception in event handler script

• T3902 (bug): Firewall does not load on boot, address-group not found, even though it
exists

3.2.51 2024-02-21

• T6050 (bug): Wrong scripting commands descriptions in accel-ppp services

3.2.52 2024-02-19

• T5971 (default): Create the same view of ppp section for all accel-ppp services
• T6029 (default): Rewrite Accel-PPP services to an identical feature set
• T3722 (bug): op-mode IPSec show vpn ike sa always shows L-TIME 0

3.2.53 2024-02-18

• T6043 (bug): VxLAN and bridge error bug

• T6041 (bug): image-tools: install fails from PXE boot into live iso due to
restrictive logic

3.2.54 2024-02-17

• T5972 (feature): login: add possibility to disable individual local user accounts

3.2.55 2024-02-16

• T6009 (bug): Firewall - Time not working properly when not using UTC
• T6005 (bug): Error on adding a wireguard interface to OSPFv3
• T2113 (bug): OpenVPN Options error: you cannot use --verify-x509-name with
--compat-names or --no-name-remapping
• T6019 (feature): Bump nftables and libnftnl version
• T3471 (bug): DHCP hook is not able to detect all running DHCP instances
• T6015 (default): "journalctl_charon" file does not contain data in the generated
"ipsec debug-archive" file
• T6001 (default): Add option to enable resolve-via-default

3.2. 1.4 Sagitta 44

 VyOS Documentation, Release 1.5.x (circinus)

• T5965 (bug): WWAN modems using raw-ip do not work with dhclient/dhcp6c
• T5418 (bug): PPPoE-Server Client IP pool Subnet
• T5245 (bug): Wireless interfaces do not get IPv6 link-local address assigned

3.2.56 2024-02-15

• T5977 (bug): nftables: Operation not supported when using match-ipsec in outbound
firewall
• T2612 (bug): HTTPS API, changing API key fails but goes through
• T5989 (bug): IP subnets not usable in UPnP ACLs
• T5890 (default): OTP key generation is broken
• T5719 (default): mdns repeater: Add op-mode commands
• T4839 (feature): Dynamic Firewall groups
• T4801 (feature): Support for building AWS-ready ISO
• T3993 (enhancment): Extend HTTP API GraphQL support
• T3991 (bug): PKI operational command return traceback
• T3780 (bug): VTI not being brought down when tunnel is down
• T3001 (feature): Disable spectre mitigation patches from CLI
• T562 (feature): PDNS: Add support for authoritative dns server
• T71 (feature): Add virtual IP and route installation policy options for IPsec
• T5496 (default): `show firewall` error
• T4038 (default): Rewrite `vyatta-image-tools.pl` in Python
• T4997 (default): Add DHCP client user hooks dir
• T775 (feature): Config Sync between two VyOS routers
• T381 (feature): config nodes for EasyRSA CAs
• T118 (feature): Native Zabbix Support

3.2.57 2024-02-14

• T6034 (feature): rpki: move file based SSH keys for authentication to PKI subsystem
• T5981 (bug): IPsec site-to-site migrated PKI ca certificates are created with an '@'
• T5930 (bug): vrf - route-leak not work using route-target both command.
• T5709 (bug): IPoE-server fails if next pool mentioned but not defined
• T4119 (bug): Issue with l2tp remote-access ipv6 configuration
• T2044 (bug): RPKI doesn't boot properly
• T6032 (feature): bgp: add EVPN MAC-VRF Site-of-Origin support
• T5960 (default): Rewriting authentication section in accel-ppp services

3.2. 1.4 Sagitta 45

 VyOS Documentation, Release 1.5.x (circinus)

3.2.58 2024-02-13

• T5928 (bug): Configuration fails to load on boot if offloading has VLAN interfaces
defined
• T5482 (bug): Chrony NTP Server Fails To Sync Time
• T5064 (bug): Value validation for domain-groups seems to be broken

3.2.59 2024-02-12

• T6010 (bug): Support setting multiple values in BGP path-attribute

• T6004 (bug): RPKI is not configured
• T5952 (default): DHCP allow same MAC Address on same subnet
• T5849 (feature): Add SRv6 route commands

3.2.60 2024-02-10

• T6023 (bug): rpki: add support for CLI knobs expire-interval and retry-interval
• T1090 (default): Webproxy overhaul

3.2.61 2024-02-09

• T6028 (bug): QoS policy shaper wrong class_id_max and default_minor_id

• T6026 (bug): QoS hide attempts to delete qdisc from devices
• T5788 (feature): frr: update to 9.1 release
• T5703 (bug): QoS config on pppoe interface resets back to fq_codel after tunnel
reboots
• T5685 (feature): Keepalived VRRP prefix is not necessary for the virtual address

3.2.62 2024-02-08

• T6014 (feature): Bump keepalived version

• T5910 (bug): Grub problem(?) Serial Console no longer working
• T6021 (bug): QoS r2q wrong calculation

3.2.63 2024-02-07

• T6017 (bug): Update vyos-http-api-tools for security advisory

• T6016 (bug): Resolve intermittent failures in cleanup function after failed image
install
• T6024 (feature): bgp: add additional missing FRR features
• T6011 (feature): rpki: known-hosts-file is no longer supported by FRR CLI - remove
VyOS CLI node

3.2. 1.4 Sagitta 46

 VyOS Documentation, Release 1.5.x (circinus)

• T5998 (feature): replay_window setting under vpn in config

3.2.64 2024-02-06

• T6018 (default): smoketest: updating http-api framework requires a pause before

test
• T5921 (bug): Trying to commit an OpenConnect configuration without any local users
results in an exception
• T5687 (feature): Implement ECS settings for PowerDNS recursor

3.2.65 2024-02-05

• T5974 (bug): QoS policy shaper is currently miscalculating bandwidth and ceil values
for the default class
• T5865 (feature): Rewrite ipv6 pool section to ipv6 named pools in Accel-ppp services

3.2.66 2024-02-02

• T5739 (bug): Password recovery does not work if public keys are configured
• T5955 (feature): Rootless containers/set uid/gid for container
• T5941 (bug): [1.3.5 -> 1.4.0-RC1 Migration] Orphaned Configuration Nodes Cause
Issues
• T6003 (feature): Add 'show rpki as-number' and 'show rpki prefix'
• T5848 (feature): Add triple-isolate flow isolation option to CAKE QoS policy

3.2.67 2024-02-01

• T5995 (bug): Kernel NIC-drivers for Huawei NICs are not properly enabled
• T5978 (bug): ethernet: hw-tc-offload does not actually get enabled on the NIC
• T5979 (enhancment): Add configurable kernel boot parameters
• T5973 (bug): vrf: RTNETLINK answers: File exists
• T5967 (bug): Multi-hop BFD connections can't be established; please add minimum-ttl
option.
• T5619 (default): Update the Intel ixgbe driver due to issues with Intel X533

3.2. 1.4 Sagitta 47

 VyOS Documentation, Release 1.5.x (circinus)

3.2.68 2024-01-31

• T6000 (bug): [1.3.x -> 1.5.x] migrating threw exception in /opt/vyatta/etc/

config-migrate/migrate/https/5-to-6, performed workaround
• T5999 (bug): load-balancing reverse-proxy can't configure root as a redirect

3.2.69 2024-01-30

• T5980 (feature): Add image-tools support for configurable kernel boot options

3.2.70 2024-01-29

• T5988 (bug): image-tools: a check of valid image name is missing from 'add image'
• T5994 (bug): Fix typo in 'remote' module preventing 'add system image' via ftp

3.2.71 2024-01-26

• T5957 (bug): Firewall fails to delete inbound-interface name

• T5779 (bug): custom conntrack timeout rule not applicable
• T5984 (feature): Add user util numactl

3.2.72 2024-01-25

• T5983 (bug): image-tools: minor regression in pruning version files in

compatibility mode
• T5927 (bug): QoS policy shaper-hfsc class does not have a `bandwidth` node but
requires one in the check
• T5834 (bug): Rename 'enable-default-log' to 'default-log'

3.2.73 2024-01-22

• T5968 (feature): hsflowd: add VRF support

• T5975 (bug): GraphQL expects script otp.py that does not exists in 1.4
• T5961 (bug): QoS policy shaper vif with ceiling fails on commit
• T5958 (bug): QoS policy shaper-hfsc is not implemented
• T5160 (feature): Firewall refactor
• T5969 (feature): op-mode: list multicast group membership

3.2. 1.4 Sagitta 48

 VyOS Documentation, Release 1.5.x (circinus)

3.2.74 2024-01-21

• T5799 (bug): vyos unbootable after 1.4-rolling-202308240020 to 1.

5-rolling-202312010026 upgrade
• T5787 (bug): dhcp-server allows duplicate static-mapping for the same IP address
• T5692 (enhancment): NTP leap smear
• T5954 (feature): Enable nvme_hwmon and drivetemp in KERNEL

3.2.75 2024-01-20

• T5915 (bug): Firewall zone - Re add op-mode commands

• T5805 (bug): Missed per-interface statistic in telegraf
• T5724 (feature): About dhcp client hooks
• T5577 (bug): Optimize PAM configs for RADIUS/TACACS+
• T5550 (bug): Source validation on interface does not work properly
• T5267 (bug): Another corruption on upgrade
• T5239 (bug): frr 'hostname' missing or incorrect, and domain-name missing totally
• T5219 (bug): ddclient: Cloudflare doesn't require login
• T5217 (feature): Add firewall SYNPROXY
• T5203 (feature): load-balancing wan add systemd unit instead of old
vyatta-wanloadbalance.init
• T5199 (bug): Salt-minion cannot connect to server in python 3.10 and up
• T5138 (feature): Add patch to accel-ppp build L2TP LNS use Calling-Number as RADIUS
Calling-Station-ID
• T5054 (bug): ipsec: "show vpn ipsec remote-access" does not list active connections
• T5053 (bug): Vyatta-cfg Post-Removal Hook Tries to Disable Deleted Service
• T5035 (feature): Add more actions to policy route rule
• T4990 (bug): Commit results may not be properly saved if power is cut immediately
after a successful commit
• T4988 (default): Expose time and size conversion functions as Jinja2 filters
• T4986 (feature): Ability to filter traffic originating from the router itself via
firewall
• T4963 (default): vyos.ethtool: improve/fix driver name detection
• T4935 (bug): ospfv3: "not-advertise" and "advertise" conflict
• T4897 (bug): Setting 'source-address' or `source-interface` on existing vxlan
interface doesn't work
• T4888 (default): Rewrite the conntrack sync script using vyos.opmode
• T4863 (feature): need an option for route policy to apply to dynamic interfaces
l2tp*/ipoe*/pppoe* (for TCP MSS setting)
• T4817 (feature): Please add support for RFC 9234

3.2. 1.4 Sagitta 49

 VyOS Documentation, Release 1.5.x (circinus)

• T4765 (default): Normalize field names in op mode JSON outputs

• T4751 (enhancment): Feature Request: system login: 2FA OTP key generator in VyOS
CLI
• T4726 (default): Add completion and validation for the accel-ppp RADIUS vendor
option
• T4722 (default): Improve abbreviation/acronym consistency
• T4172 (feature): Patch ndppd to not read route table if there are no auto prefixes
• T4085 (feature): Rewrite L2TP/PPTP/SSTP/PPPoE services to get_config_dict
• T4031 (feature): Ability to configure DMVPN in vrf
• T4030 (bug): SR-IOV and interface renaming bug
• T4014 (feature): Add “command” and “arg” configuration options for containers
• T3965 (default): arm: Extend configure scripts to allow for arm builds
• T3813 (bug): Some custom sysctl parameters can't be applied bug
• T3778 (bug): Abnormal network communication and settings
• T3591 (bug): OpenVPN with/without VRF not working (NordVPN)
• T3372 (feature): Support public HTTPS repos in live-build
• T5963 (bug): QoS policy shaper rate calculations could be wrong for some ethernet
devices
• T5962 (feature): QoS policy set default speed to 100mbit or 1gbit instead of 10mbit
• T5697 (bug): event-handler keep failing
• T4779 (default): Make raw op mode command outputs use bytes for data amount values

3.2.76 2024-01-19

• T5897 (bug): VyOS with Cloud-init and VRF stucks at reboot/shutdown process
• T5554 (bug): Disable sudo for PAM RADIUS
• T4754 (default): Improvement: system login: show configured 2FA OTP key
• T5857 (bug): show interfaces wireless info
• T5841 (default): Remove old ssh-session-cleanup.service
• T5543 (bug): Fix source address handling in static joins
• T5884 (default): Minor description fix (op-mode: generate wireguard)
• T5781 (default): Add ability to add additional minisign keys

3.2. 1.4 Sagitta 50

 VyOS Documentation, Release 1.5.x (circinus)

3.2.77 2024-01-18

• T5863 (bug): Failure to Load Config on Recent 1.5 Versions

• T4638 (bug): Deleting a parent interface does not delete its underlying VLAN
interfaces
• T5953 (default): Rename 'close_action' value from `hold` to `trap` in IPSEC IKE
• T905 (bug): The command show remote-config does not work for remote-platform openvpn

3.2.78 2024-01-17

• T5923 (bug): Config mode system_console.py is not aware of revised GRUB file
structure
• T4658 (feature): Rename DPD action `hold` to `trap`
• T5932 (bug): 1.4-rolling-202304120317 to 1.4.0-rc1: dynamic dns migration fail

3.2.79 2024-01-16

• T5951 (bug): [1.4.0-RC2] show hardware dmi Operational Mode Command Broken
• T5937 (bug): [1.3.5 -> 1.4.0-RC1 Migration] IPv6 BGP Neighbor Peer Groups Missing /
Not Migrated
• T5889 (bug): Migration NAT 5-to-6 bug
• T5859 (bug): Invalid format of pool range in accel-ppp services
• T5842 (feature): Rewrite PPTP service to get_config_dict
• T5801 (feature): Rewrite L2TP service to get_config_dict
• T5688 (default): Create the same view of pool configuration for all accel-ppp
services

3.2.80 2024-01-15

• T5944 (bug): "reboot in 1" not working

• T5936 (bug): [1.3.5 -> 1.4.0-RC1 Migration] OSPF Passive Interface Configuration Not
Working Correctly
• T5247 (bug): the bug of the command "show interfaces system"
• T5901 (bug): Cloud-init and DHCP exit hook errors
• T4856 (bug): DHCP-client exit hook for IPsec is incorrect
• T2556 (bug): "show interfaces vrrp" does not return any interface

3.2. 1.4 Sagitta 51

 VyOS Documentation, Release 1.5.x (circinus)

3.2.81 2024-01-14

• T4428 (feature): Update ddclient to newer version

3.2.82 2024-01-12

• T5925 (feature): Containers change systemd KillMode

• T5920 (bug): Quick Start documentation contains error
• T5919 (bug): Firewall - opmode for ipv6
• T5306 (default): bgp config migration failed with v6only option configured with
peer-group
• T3429 (bug): Hyper-V integration services not working on VyOS 1.4 (sagitta/current)

3.2.83 2024-01-11

• T5896 (bug): Config Error on Boot with Podman and Firewall

• T5532 (bug): After add system image the boot stuck and works again after the second
reboot
• T5512 (bug): build linux-firmware script cannot expand asterisks if firmware name is
a glob string
• T5379 (bug): show system updates doesnt seem to be working
• T5275 (default): Add op mode commands for exporting certificates to PEM files with
correct headers
• T5274 (default): Add a deprecation warning for OpenVPN site-to-site with pre-shared
secret
• T5262 (default): Warn the user about unsaved config on reboot/shutdown attempts
• T5257 (feature): Cannont assign netflow source ip to ip in non default VRF
• T5026 (feature): Python3 modules crypt and spwd are deprecated
• T5814 (bug): VyOS 1.3 to 1.4 LTS Firewall ruleset migration script breaks
configuration
• T4610 (bug): Firewall with 20K entries cannot load after reboot
• T3191 (bug): PAM RADIUS freezing when accounting does not configured on RADIUS
server
• T5917 (feature): Restore annotations of (running)/(default boot) in select image
list
• T5916 (default): Added segment routing check for index size and SRGB size
• T5913 (feature): Allow for Peer-Groups in ipv4-labeled-unicast SAFI

3.2. 1.4 Sagitta 52

 VyOS Documentation, Release 1.5.x (circinus)

3.2.84 2024-01-10

• T5918 (bug): Verification problem for `set vpn ipsec interface`

• T5911 (bug): pki: service update ignored if certificate name contains a hyphen (-)
• T5886 (feature): Add support for ACME protocol (LetsEncrypt)
• T5766 (bug): http: rewrite conf-mode script to get_config_dict()
• T5144 (default): Modernize dynamic dns operation
• T4689 (feature): Support RFS(Receive Flow Steering)
• T4659 (feature): Use vtysh to display bridge and some interface parameter
information
• T4646 (bug): USB serial output console does not work
• T4577 (bug): WWAN commit failed which simple config
• T4502 (feature): Consider implementing (NAT/other) flow table offload
• T4446 (default): Unified CLI for displaying neithbors (ARP, IP, and NDP)
• T4427 (default): Remove the vyos-utils package list from vyos-build
• T4300 (feature): Extend list of supported interfaces for Cloud-init Network
Configuration
• T4250 (bug): Organize logrotate settings to avoid duplicates
• T4236 (feature): Generate ovpn openvpn client configuration files
• T4222 (feature): Support for TWAMP as round-trip metric
• T3833 (bug): Cloud-init not finding data source in OpenStack
• T5902 (bug): http: remove virtual-host configuration in webserver
• T3499 (bug): Podman is not compatible with nat rules
• T3430 (bug): Cloud-init failing with “Unable to render networking” on VyOS 1.3
• T3011 (bug): router becomes unreachable for few minutes when vti interfaces goes
down
• T5791 (default): Update dynamic dns configuration path to be consistent with other
areas of VyOS
• T5708 (default): Additional dynamic dns improvements to align with ddclient 3.11.1
release
• T5573 (bug): Fix ddclient cache entries
• T5012 (feature): Control network configuration from Cloud-Init config
• T3116 (feature): Support back-end L4 level load balancing
• T5614 (default): Add conntrack helper matching on firewall
• T4782 (enhancment): Allow multiple CA certificates (on e.g. EAPoL)
• T2199 (default): Rewrite firewall in new XML/Python style

3.2. 1.4 Sagitta 53

 VyOS Documentation, Release 1.5.x (circinus)

3.2.85 2024-01-09

• T5898 (bug): Replace partprobe with partx due to unable to install VyOS
• T5838 (feature): Add Infiniband kernel modules
• T5785 (bug): API output of show container image broken
• T5410 (feature): Improve `utils.convert.convert_data()` to process all stdtypes
• T5269 (default): OpenVPN non-TLS site-to-site mode deprecation
• T5249 (feature): Add rollback-soft feature to rollback without a reboot
• T4944 (default): Prevent op mode functions from returning bare literals in raw
output
• T4910 (default): Rewrite the remote access VPN op mode in the new style
• T4470 (feature): Rewrite load-balancing wan to XML/Python
• T3763 (bug): wireguard checks if port already binding
• T3489 (bug): NUMA has been disabled for the past few years and no-one has noticed
• T3476 (feature): Update availability check
• T2845 (bug): BGP conf_mode unable to delete configuration with peer-group
• T2844 (bug): BGP conf_mode errors disable-send-community
• T2755 (default): Requirements for partial interface setup
• T2721 (enhancment): Set FQ-CoDel as the default queueing mechanism for every class
in Shaper
• T2511 (feature): Migrate vyatta-op-quagga to new XML format
• T2302 (default): Convert configuration scripts from executables to modules and use a
script runner
• T2281 (feature): DHCP and Static IPs on Same Interface
• T2216 (default): Containerized third-party applications for VyOS
• T2171 (feature): Unify creation and manipulation of interfaces
• T1759 (feature): Replacing Vyatta::Interface perl
• T2408 (enhancment): DHCP Relay upstream and downstream interfaces
• T1297 (feature): Add GARP settings to VRRP/keepalived

3.2.86 2024-01-08

• T5888 (bug): Firewall upgrade fails because of icmpv6

• T5844 (bug): HTTPS API doesn't start without configured keys even when GraphQL
authentication type is set to token
• T5664 (bug): 1.4 user has no permissions?
• T5215 (default): Add a built-in ICMP health check for VRRP groups
• T5045 (bug): BFD is not starting after upgrade to 1.4-rolling-202302150317
• T4193 (default): Add support for transparent firewall

3.2. 1.4 Sagitta 54

 VyOS Documentation, Release 1.5.x (circinus)

• T3754 (default): Make config scripts more testable

• T3663 (default): Use inotify file watching where applicable
• T3480 (bug): Does not possible to change console baud-rate
• T2897 (default): Remove cluster command
• T5904 (feature): op-mode: add "show ipv6 route vrf <name> <prefix>" command

3.2.87 2024-01-07

• T5891 (bug): OpenVPN IPv6 config issue with 1.4-rc1

• T5887 (feature): Upgrade Linux Kernel to 6.6.y (2023 LTS edition)

3.2.88 2024-01-06

• T3670 (feature): Option to disable HTTP port 80 redirect

3.2.89 2024-01-05

• T3642 (feature): PKI configuration

• T5894 (feature): Extend get_config_dict() with additional parameter with_pki that
defaults to False

3.2.90 2024-01-04

• T4072 (feature): Feature Request: Firewall on bridge interfaces

• T3459 (default): Inform the user when unable to install outdated image

3.2.91 2024-01-03

• T5880 (bug): verify_source_interface should not allow dynamic interfaces like ppp,
l2tp, ipoe or sstpc client interfaces
• T5879 (bug): tunnel: sourceing from dynamic pppoe0 interface will fail on reboots
• T4500 (bug): Missing firewall logs

3.2.92 2024-01-02

• T5885 (default): image-tools: relax restriction on image-name length from 32 to 64

3.2. 1.4 Sagitta 55

 VyOS Documentation, Release 1.5.x (circinus)

3.2.93 2024-01-01

• T5883 (bug): Preserve file ownership in /config subdirs on add system image
• T5474 (feature): Establish common file name pattern for XML conf mode commands

3.2.94 2023-12-30

• T5875 (bug): login: removing and re-adding a user keeps the home directory but UID
will change, thus SSH keys no longer work
• T5653 (feature): Command to display fingerprint

3.2.95 2023-12-29

• T5829 (bug): Can't Add IPv6 Address to Containers

• T5852 (bug): Reboots fail with eapol WAN interface
• T5869 (bug): vyos.template.first_host_address() does not honor RFC4291 section 2.6.1

3.2.96 2023-12-28

• T4163 (feature): [BMP-BGP] Routing monitoring feature

• T5867 (feature): Upgrade podman to Debian Trixie version 4.7.x
• T5866 (feature): Add op-mode command to restart IPv6 RA daemon
• T5861 (bug): Flavor build system fails with third-party packages
• T5854 (feature): Extend override-default script to allow embedded defaultValue
settings
• T5792 (default): Upgrade ddclient 3.11.2 release

3.2.97 2023-12-25

• T5855 (feature): Migrate "set service lldp snmp enable" -> `set service lldp snmp"
• T5837 (bug): vyos.configdict.node_changed does not return keys per adding
• T5856 (bug): SNMP service removal fails

3.2.98 2023-12-24

• T5853 (default): Typo interfaces-virtual-ethernet.xml.in

3.2. 1.4 Sagitta 56

 VyOS Documentation, Release 1.5.x (circinus)

3.2.99 2023-12-22

• T5804 (bug): SNAT "any" interface error

• T4760 (bug): VyOS does not support running multiple instances of DHCPv6 clients

3.2.100 2023-12-21

• T5778 (bug): The show dhcp server leases operation mode command does not work as
expected
• T5775 (default): Migrated Firewall Global State Policy ineffective on latest
firewall zone config
• T5637 (bug): Firewall default-action log
• T5796 (bug): Openconnect - HTTPS security headers are missing
• T3580 (feature): Refactoring firewall ipv6 rule icmpv6
• T2898 (feature): Support NDP proxy
• T2229 (feature): PPPOE Default Queue type selection

3.2.101 2023-12-20

• T5823 (feature): Protocol BGP add default values for config dictionary
• T5798 (enhancment): reverse-proxy load-balancing service should support multiple
certificates for frontend

3.2.102 2023-12-19

• T5828 (default): Fix GRUB installation on arm64

3.2.103 2023-12-18

• T5751 (feature): Adjust new image tools for non-interactive use

• T5831 (feature): show system image should reverse order by addition date
• T5825 (bug): image-tools: restore authentication on 'add system image'
• T5821 (bug): image-tools: restore vrf-aware 'add system image'
• T5819 (bug): Don't echo password on install image
• T5806 (bug): Clear old raid data on new install image
• T5789 (bug): image-tools should copy ssh host keys on image update
• T5758 (default): Restore scanning configs when live installing

3.2. 1.4 Sagitta 57

 VyOS Documentation, Release 1.5.x (circinus)

3.2.104 2023-12-15

• T5824 (bug): busybox cannot connect some websites from initramfs

• T5803 (default): git/github: Adjust configuration for safe and baseline defaults

3.2.105 2023-12-14

• T5773 (bug): Unable to load config via HTTP

• T5816 (bug): BGP Large Community List Validation Broken
• T5812 (bug): rollback check max revision number does not work
• T5749 (feature): Show MAC address VRF and MTU by default for "show interfaces"
• T5774 (bug): commit-archive to FTP server broken after update (VyOS 1.5-rolling)
• T5826 (default): Add dmicode as an explicit dependency
• T5793 (default): mdns-repeater: Cleanup avahi-daemon configuration in /etc

3.2.106 2023-12-13

• T591 (feature): Support SRv6

3.2.107 2023-12-12

• T4704 (feature): Allow to set metric (MED) to rtt with rtt,+rtt or -rtt
• T5815 (enhancment): Add load_config module
• T5413 (default): Deny the opportunity to use one public/private key pair on both
wireguard peers.

3.2.108 2023-12-11

• T5741 (bug): WAN Load Balancing failover route tables aren't created

3.2.109 2023-12-10

• T5658 (default): Add VRF support for mtr

3.2.110 2023-12-09

• T5808 (bug): op-mode: ipv6 ospfv3 graceful-restart description contains incorrect

info
• T5802 (bug): ping (ip or hostname) interface <tab> produces error
• T5747 (feature): op-mode add MAC VRF and MTU for show interfaces summary
• T3983 (bug): show pki certificate Doesnt show x509 certificates

3.2. 1.4 Sagitta 58

 VyOS Documentation, Release 1.5.x (circinus)

3.2.111 2023-12-08

• T5782 (enhancment): Use a single config mode script for https and http-api
• T5768 (enhancment): Remove auxiliary http-api.conf for simplification of http-api
config mode script
• T5809 (default): Enable GRUB support for gzip compressed kernels

3.2.112 2023-12-04

• T5769 (bug): VTI tunnels lose their v6 Link Local addresses when set down/up

3.2.113 2023-12-03

• T5753 (feature): Add VXLAN vnifilter support

• T5759 (feature): Change VXLAN default MTU to 1500 bytes

3.2.114 2023-11-30

• T4601 (bug): dhcp : relay agent IP address issue.

3.2.115 2023-11-28

• T4276 (bug): IPsec peers dh-group negotiation issue with pfs enabled and multiple
proposals configured with IKEv1

3.2.116 2023-11-27

• T5763 (bug): Fix imprecise check for remote file name in vyos-load-config.py
• T5783 (feature): frr: smoketests must notice any daemon crash

3.2.117 2023-11-26

• T5760 (feature): DHCP client custom dhcp-options

• T2405 (feature): archive to GIT or other platform

3.2.118 2023-11-25

• T5655 (bug): commit-archive: Ctrl+C should not eror out with stack trace, signal
should be cought
• T4946 (default): Rewrite "add system image" in the new op-mode
• T4454 (default): `install-image` should check free storage

3.2. 1.4 Sagitta 59

 VyOS Documentation, Release 1.5.x (circinus)

3.2.119 2023-11-24

• T5776 (feature): Enable VFIO support

• T5402 (bug): VRRP router with rfc3768-compatibility sends multiple ARP replies
• T3895 (default): VYOS firewall rules do not adhere to time schedule unless placed in
UTC mode.

3.2.120 2023-11-23

• T4891 (bug): BFD flapping loop

• T4867 (bug): "show bgp neighbors ... advertised-routes" and some other commands fail
for IPv4 neighbors

3.2.121 2023-11-22

• T5767 (feature): Add reboot and poweroff the system via API
• T5729 (bug): Firewall, nat and policy route - Switch to valueless
• T5681 (feature): Interface match - Simplified and unified cli
• T4877 (bug): Need verification in using import vrf and import vpn, export vpn
commands
• T4021 (bug): Long commit time on bridge interface with 1-4094 allowed VLAN tags
• T5338 (feature): Add 'mpls bgp forwarding' feature
• T3818 (bug): BGP export route-map only works after bgpd restart
• T5590 (default): Firewall "log enable" logs every packet
• T5426 (default): Add exceptions in vici functions calls

3.2.122 2023-11-21

• T5762 (bug): http: api: smoketests fail as they can not establish IPv6 connection
to uvicorn backend server

3.2.123 2023-11-20

• T2816 (default): Rewrite IPsec scripts with the new XML/Python approach

3.2. 1.4 Sagitta 60

 VyOS Documentation, Release 1.5.x (circinus)

3.2.124 2023-11-18

• T1354 (feature): Add support for VLAN-Aware bridges

3.2.125 2023-11-16

• T5726 (bug): HTTPS API image cannot be updated

• T5738 (feature): Extend XML building blocks
• T5736 (feature): igmp: migrate "protocols igmp" to "protocols pim"
• T5733 (feature): pim(6): rewrite FRR PIM daemon configuration to get_config_dict()
and add missing IGMP features
• T5689 (default): FRR 9.0.1 in VyOS current segfaults on show rpki prefix $prefix
• T5595 (feature): Multicast - PIM bfd feature enable
• T3638 (bug): Passwords With Dollar Sign Set Incorrectly

3.2.126 2023-11-15

• T5695 (feature): Build FRR with LUA scripts --enable-scripting option

• T5665 (bug): radius user not working
• T5728 (bug): Improve compatibility between OpenVPN on VyOS 1.5 and OpenVPN Connect
Client
• T5732 (bug): generate firewall rule-resequence drops geoip country-code from output
• T5661 (enhancment): Add show show ssh dynamic-protection attacker and show log ssh
dynamic-protection
• T1276 (bug): dhcp relay + VLAN fails

3.2.127 2023-11-13

• T5698 (feature): EVPN ESI Multihoming

• T5563 (bug): container: Container environment variable cannot be set
• T5706 (bug): Systemd-udevd high CPU utilization for multiple dynamic ppp/l2tp/ipoe
interfaces

3.2.128 2023-11-10

• T5727 (bug): validator: Use native URL validator instead of regex-based validator

3.2. 1.4 Sagitta 61

 VyOS Documentation, Release 1.5.x (circinus)

3.2.129 2023-11-08

• T5720 (bug): PPPoE-server adding new interface does not work

• T5716 (bug): PPPoE-server shaper template bug down-limiter option does not rely on
fwmark
• T5702 (feature): Add ability to set include_ifmib_iface_prefix and
ifmib_max_num_ifaces for SNMP
• T5648 (bug): ldpd neighbour template errors
• T5564 (bug): Both show firewall group and show firewall summary fails
• T5559 (feature): Selective proxy-arp/proxy-ndp when doing SNAT/DNAT
• T5541 (bug): Zone-Based Firewalling in VyOS Sagitta 1.4
• T5513 (bug): Anomalies in show firewall command after refactoring
• T4864 (bug): `show firewall` command errors

3.2.130 2023-11-07

• T5586 (feature): Disable by default SNMP for Keepalived VRRP

3.2.131 2023-11-06

• T5705 (bug): rsyslog - Not working when using facility=all

• T5704 (feature): PPPoE-server add max-starting option
• T5707 (bug): Wireguard peer public key update leaves redundant peers and breaks
connectivity
• T4269 (feature): node.def generator should automatically add default values

3.2.132 2023-11-05

• T4020 (feature): Add ability to control FRR daemons options

3.2.133 2023-11-03

• T5700 (bug): Monitoring telegraf deprecated plugins inputs outputs

• T5018 (bug): Redirect to IFB removed after change in qos policy

3.2. 1.4 Sagitta 62

 VyOS Documentation, Release 1.5.x (circinus)

3.2.134 2023-11-02

• T5701 (feature): Update telegraf package

3.2.135 2023-11-01

• T5690 (bug): Change to definition of environment variable 'vyos_rootfs_dir' is

incorrect

3.2.136 2023-10-31

• T5699 (feature): vxlan: migrate "external" CLI know to "parameters external"

• T5668 (feature): Disable VXLAN bridge learning and enable neigh_suppress when using
EVPN

3.2.137 2023-10-27

• T5652 (bug): Config migrate to image upgrade does not properly generate home
directory
• T4057 (bug): Commit time for deleting sflow configuration ~1.5 min

3.2.138 2023-10-26

• T5683 (bug): reverse-proxy pki filenames mismatch

• T4903 (bug): conntrack ignore does not suppotr IPv6 addresses
• T4309 (feature): Support network/address-groups and ipv6-network/ipv6-address-groups
in conntrack ignore
• T5606 (feature): IPSec VPN: Allow multiple CAs certificates
• T5650 (default): Progressbars suffer from staircasing effect
• T5568 (default): Install image from live ISO always defaults boot to KVM entry
• T3509 (default): No BCP38 for IPv6 on VyOS

3.2.139 2023-10-23

• T5299 (bug): QoS shaper ceiling does not work

• T5667 (feature): BGP label-unicast - enable ecmp
• T5337 (bug): MPLS/BGP: Route leak does not happen from the VPNv4 table to specific
vrf

3.2. 1.4 Sagitta 63

 VyOS Documentation, Release 1.5.x (circinus)

3.2.140 2023-10-22

• T5254 (bug): Modification of any interface setting sets MTU back to default when MTU
has been inherited from a bond
• T5671 (feature): vxlan: change port to IANA assigned default port

3.2.141 2023-10-21

• T5670 (bug): bridge: missing member interface validator

• T5617 (feature): Add an option to exclude single values to the numeric validator
• T5414 (bug): dhcp-server does not allow valid bootfile-names
• T5261 (feature): Add AWS gateway load-balanceing tunnel handler (gwlbtun)
• T5260 (bug): Python3 module crypt is deprecated
• T5191 (default): Replace underscores with hyphens in command-line options generated
by vyos.opmode
• T5172 (default): Set Python3 version dependency for vyos-1x to 3.10
• T4956 (default): 'show hardware cpu' issue on arm64
• T4837 (default): Expose "show ip route summary" in the op mode API
• T4770 (feature): Rewrite OpenVPN op-mode to vyos.opmode format
• T4657 (bug): op-mode scripts with type hints in `return` do not work
• T4604 (bug): bgpd eats huge amount of memory (about 500Megs a day)
• T4432 (default): Display load average normalized according to the number of CPU
cores
• T4416 (default): Convert 'traceroute' operation to the new syntax and expand
available options using python
• T4402 (bug): OpenVPN client-ip-pool option is broken
• T3433 (default): A review of the use of racist language in VyOS
• T2719 (feature): Standardized op mode script structure

3.2.142 2023-10-20

• T5233 (bug): Op-mode flow-accounting netflow with disable-imt errors

• T5232 (bug): Flow-accounting uacctd.service cannot restart correctly

3.2. 1.4 Sagitta 64

 VyOS Documentation, Release 1.5.x (circinus)

3.2.143 2023-10-19

• T4913 (default): Rewrite the wireless op mode in the new style

3.2.144 2023-10-18

• T5642 (bug): op cmd: generate tech-support archive: does not work

• T5521 (bug): Home owner directory changed to vyos for the user after reboot

3.2.145 2023-10-17

• T5662 (bug): Fix indexing error in configdep script organization

• T5235 (bug): SSH keys with special characters cannot be applied via Cloud-init

3.2.146 2023-10-16

• T5165 (feature): Policy local-route ability set protocol and port

3.2.147 2023-10-14

• T5629 (bug): Policy local-route bug after migration to destination node address

3.2.148 2023-10-13

• T5227 (feature): mDNS reflector should allow additional domains to browse and allow
filtering services
• T5166 (feature): Remove local minisign package from build repo for 1.4
• T5118 (bug): Cleanup vestigial ntp completion script
• T5115 (default): Support custom port for name servers for forwarding zones
• T5113 (default): PDNS: Support custom port for DNS forwarders
• T5112 (feature): Enable support for Network Time Security (NTS) for chrony
• T5143 (enhancment): Apply constraint on powerdns forward-zones configuration

3.2.149 2023-10-12

• T5649 (bug): vyos-1x should generate XML cache after building command templates for
less cryptic error on typo

3.2. 1.4 Sagitta 65

 VyOS Documentation, Release 1.5.x (circinus)

3.2.150 2023-10-10

• T5489 (feature): Change to BBR as TCP congestion control, or at least make it an

config option
• T5479 (bug): Helper leftovers found in nftables (firewall) even with all helpers
disabled
• T5436 (bug): vyos-preconfig-bootup.script is missing
• T5014 (feature): Destination NAT - Add Load Balancing capabilities

3.2.151 2023-10-08

• T5630 (feature): pppoe: allow to specify MRU in addition to already configurable

MTU

3.2.152 2023-10-06

• T5096 (feature): Change 'accept' firewall rule action from 'return' to 'accept'
• T5576 (feature): Add bgp remove-private-as all option
• T3506 (default): Migrate loadkey command to op-mode

3.2.153 2023-10-05

• T4320 (default): Remove legacy version files in vyatta-cfg-system/cfg-version

3.2.154 2023-10-04

• T5632 (feature): Add jq package to parse JSON files

• T3655 (bug): NAT Problem with VRF
• T5585 (bug): Fix file access mode for dynamic dns configuration

3.2.155 2023-10-03

• T5618 (bug): Flow-accounting crushes when IMT is enabled

• T5561 (feature): NAT - Inbound or outbound interface should not be mandatory
• T5553 (feature): Firewall - Add action continue
• T5250 (bug): Firewall - show firewall group
• T4383 (bug): Flow Accounting returns permission error and fails to start
• T5626 (feature): Only select required Kernel CGROUP controllers
• T5628 (feature): op-mode: login: DeprecationWarning: 'spwd'

3.2. 1.4 Sagitta 66

 VyOS Documentation, Release 1.5.x (circinus)

3.2.156 2023-10-01

• T936 (feature): Reimplementation of tech-support diagnostic file generation

3.2.157 2023-09-30

• T5048 (bug): QoS doesn't work correctly root task

• T4989 (bug): QoS Policy Limiter - classes for marked traffic do not work

3.2.158 2023-09-28

• T5596 (feature): bgp: add new features from FRR 9

• T5412 (feature): Add support for extending config-mode dependencies in supplemental
package

3.2.159 2023-09-26

• T5480 (bug): Ability to disable SNMP for VRRP keepalived service

3.2.160 2023-09-25

• T5533 (bug): Keepalived VRRP IPv6 group enters in FAULT state

3.2.161 2023-09-24

• T5511 (feature): Cleanup of unused directories (and files) in order to shrink

image-size

3.2.162 2023-09-23

• T5518 (default): Add MLD protocol support

3.2.163 2023-09-22

• T5602 (feature): For reverse-proxy type of load-balancing feature, support "backup"

option in backends configuration
• T5609 (enhancment): Add util to get drive device name from id
• T5608 (enhancment): Rewrite add/delete raid member to Python and remove from
vyatta-op
• T5607 (bug): Adjust RAID smoketest for non-deterministic SCSI device probing

3.2. 1.4 Sagitta 67

 VyOS Documentation, Release 1.5.x (circinus)

3.2.164 2023-09-20

• T5588 (bug): Add kernel conntrack_bridge module

• T5271 (default): Add support for peer-fingerprint to OpenVPN
• T5241 (feature): Support veth interfaces to working with netns
• T5238 (default): interface virtual-etherne - error when it doesn't use a peer
• T5592 (feature): salt: upgrade minion to 3005.2

3.2.165 2023-09-19

• T5597 (feature): isis: add new features from FRR 9.

• T4284 (feature): QoS: rewrite to XML and Python

3.2.166 2023-09-18

• T5419 (feature): Software/Hardware fastpath with nftables flowtable

3.2.167 2023-09-15

• T5581 (feature): Add "show ip nht" op-mode command (IPv4 nexthop tracking table)

3.2.168 2023-09-11

• T5567 (bug): vyos-1x: webproxy: maximum-object-size allowed ranges not in sync

with Equuleus
• T5551 (bug): Missing check for boot_configuration_complete raises error in
vyos-save-config.py
• T5353 (bug): config-mgmt: normalize archive updates and commit log entries
• T3424 (default): PPPoE IA-PD doesn't work in VRF
• T2773 (feature): EIGRP support for VRF

3.2.169 2023-09-10

• T5565 (bug): Builds as vyos-999-timestamp instead of vyos-1.4-rolling-timestamp

• T5555 (bug): Fix timezone migrator (system 13-to-14)
• T5529 (bug): Missing symbolic link in linux-firmware package.

3.2. 1.4 Sagitta 68

 VyOS Documentation, Release 1.5.x (circinus)

3.2.170 2023-09-09

• T5540 (bug): vyos-1x: Wrong VHT configuration for WiFi 802.11ac

• T5423 (bug): ipsec: no output for op-cmd "show vpn ike secrets"
• T3700 (feature): Support VLAN tunnel mapping of VLAN aware bridges

3.2.171 2023-09-08

• T5502 (bug): Firewall - wrong parser for inbound and/or outbound interface
• T5460 (feature): Firewall - remove config-trap
• T5450 (feature): Firewall interface group - Allow inverted matcher
• T4426 (default): Add arpwatch to the image
• T4356 (bug): DHCP v6 client only supports single interface configuration

3.2.172 2023-09-07

• T5510 (feature): Shrink imagesize and improve read performance by changing

mksquashfs syntax

3.2.173 2023-09-06

• T5542 (bug): ipoe-server: external-dhcp(dhcp-relay) not woking / not implemented

• T5548 (bug): HAProxy renders timeouts incorrectly
• T5544 (feature): Allow CAP_SYS_MODULE to be set on containers

3.2.174 2023-09-05

• T5524 (feature): Add config directory to liveCD

• T5519 (bug): Function `call` sometimes hangs
• T5508 (bug): Configuration Migration Fails to New Netfilter Firewall Syntax
• T5495 (feature): Enable snmp module also for frr/ldpd
• T2958 (bug): DHCP server doesn't work from a live CD
• T5428 (bug): dhcp: client renewal fails when running inside VRF

3.2. 1.4 Sagitta 69

 VyOS Documentation, Release 1.5.x (circinus)

3.2.175 2023-09-04

• T5536 (bug): show dhcp client leases caues No module named 'vyos.validate'
• T5506 (bug): Container bridge interfaces do not have a link-local address

3.2.176 2023-09-03

• T5538 (bug): Change order within variable lb_config_tmpl to fit order of manpage and
fix some typos
• T4612 (feature): Support arbitrary netmasks in firewall rules

3.2.177 2023-08-31

• T5190 (feature): Cloud-Init cannot fetch Meta-data on machines where the main
Ethernet interface is not eth0
• T4895 (bug): Tag nodes are overwritten when configured by Cloud-Init from User-Data
• T4776 (bug): NVME storage is not detected properly during installation
• T5531 (feature): Containers add label option
• T5525 (default): Change dev.packages.vyos.net repo to rolling-packages.vyos.net
vyos-build:current uses

3.2.178 2023-08-30

• T4933 (default): Malformed lines cause vyos.util.colon_separated_to_dict fail with a

nondescript error
• T4790 (bug): RADIUS login does not work if sum of timeouts more than 50s
• T4113 (bug): Incorrect GRUB configuration parsing
• T5520 (bug): Likely source of corruption on system update exposed by change in
coreutils for Bookworm
• T4151 (feature): IPV6 local PBR Support
• T4485 (default): OpenVPN: Allow multiple CAs certificates

3.2.179 2023-08-29

• T3940 (bug): DHCP client does not remove IP address when stopped by the
02-vyos-stopdhclient hook
• T3713 (default): Create a meta-package for user utilities
• T3339 (bug): Cloud-Init domain search setting not applied
• T3577 (bug): Generating vpn x509 key pair fails with command not found

3.2. 1.4 Sagitta 70

 VyOS Documentation, Release 1.5.x (circinus)

3.2.180 2023-08-28

• T4745 (bug): CLI TAB issue with values with '-' at the beginning in conf mode
• T5472 (bug): NAT redirect should not require port

3.2.181 2023-08-27

• T4759 (bug): domain-group on policy route not working

• T1097 (feature): Make firewall groups work everywhere that's appropropriate

3.2.182 2023-08-26

• T5039 (bug): Can't add new local user

• T5023 (bug): PKI commit fails to update dependents
• T4512 (feature): enable-default-log on zone-policy
• T5003 (default): Upgrade base system to Debian 12 "Bookworm"

3.2.183 2023-08-25

• T5468 (feature): Remove unused manpages to free up space

• T5463 (feature): Containers allow publish IPv6 address port
• T4412 (bug): commit archive: reboot not working with sftp
• T3702 (feature): Policy: Allow routing by fwmark
• T3536 (default): Unable to list all available routes

3.2.184 2023-08-24

• T5448 (feature): Add service zabbix-agent

• T5006 (bug): Http api segfault with concurrent requests
• T5505 (feature): system: zebra route-map is not removed from FRR
• T5305 (bug): REST API configure operation should not be defined as async
• T4292 (feature): Rewrite vyatta-save-config.pl to Python

3.2.185 2023-08-23

• T5478 (bug): Cannot configure resolver-cache options for firewall

• T5466 (feature): L3VPN - label allocation mode
• T5453 (bug): Fix nat66 - broken after load-balance was introduced in nat
• T5446 (bug): bgp: validity check for bestpath med option
• T5500 (feature): Minor fixes to configtree render

3.2. 1.4 Sagitta 71

 VyOS Documentation, Release 1.5.x (circinus)

• T5469 (default): Incorrect dependency set in the openvpn-dco package when building
VyOS for arm64
• T5387 (feature): dhcp6c: add a no release option
• T5491 (feature): Hostapd - AP-Mode - allow white-/blacklisting of Clients
• T4889 (default): Add nftables NAT REDIRECT [to localhost] to CLI

3.2.186 2023-08-22

• T5407 (bug): Static routes pointed to container networks fail to persist after
reboot

3.2.187 2023-08-20

• T5470 (bug): wlan: can not disable interface if SSID is not configured

3.2.188 2023-08-18

• T5488 (bug): System conntrack ignore does not take any effect

3.2.189 2023-08-17

• T4202 (bug): NFT: Zone policies fail to apply when "l2tp+" is in the interface list
• T5409 (feature): Add 'set interfaces wireguard wgX threaded'
• T5476 (feature): netplug: replace Perl helper scripts with a Python equivalent
• T5223 (bug): tunnel key doesn't clear
• T5490 (feature): login: add missing regex for home direcotry and radius server key

3.2.190 2023-08-16

• T5483 (bug): Residual dhcp-server test file causing zabbix-agent smoketest to fail

3.2.191 2023-08-15

• T5293 (feature): Support for Floating Rules (Global Firewall-Rules that are
automatically applied before all other Zone Rules)
• T5273 (default): Add op mode commands for displaying certificate details and
fingerprints
• T5270 (default): Make OpenVPN `tls dh-params` optional

3.2. 1.4 Sagitta 72

 VyOS Documentation, Release 1.5.x (circinus)

3.2.192 2023-08-14

• T5477 (bug): op-mode pki.py should use Config for defaults

• T5461 (feature): Improve rootfs directory variable
• T5457 (feature): Add environmental variable pointing to current rootfs directory
• T5440 (bug): Restore pre/postconfig scripts if user deleted them

3.2.193 2023-08-12

• T5467 (bug): ospf(v3): removing an interface from the OSPF process does not clear
FRR configuration

3.2.194 2023-08-11

• T5465 (feature): adjust-mss: config migration fails if applied to a VLAN or Q-in-Q

interface
• T2665 (bug): vyos.xml.defaults for tag nodes
• T5434 (enhancment): Replace remaining calls of vyos.xml library
• T5319 (enhancment): Remove remaining workarounds for incorrect defaults
• T5464 (feature): ipv6: add support for per-interface dad (duplicate address
detection) setting

3.2.195 2023-08-10

• T5416 (bug): Ignoring "ipsec match-none" for firewall

• T5329 (bug): Wireguard interface as GRE tunnel source causes configuration error on
boot

3.2.196 2023-08-09

• T5452 (bug): Uncaught error in generate_cache during vyos-1x build

• T5443 (enhancment): Add merge_defaults as Config method
• T5435 (enhancment): Expose utility function for default values at path

3.2.197 2023-08-07

• T5406 (bug): "update webproxy blacklists" fails when vrf is being configured
• T5302 (bug): QoS class with multiple matches generates one filter rule but expects
several rules
• T5266 (bug): QoS- HTB error when match with a dscp parameter for queue-type
'priority'
• T5071 (bug): QOS-Rewrite: DSCP match missing

3.2. 1.4 Sagitta 73

 VyOS Documentation, Release 1.5.x (circinus)

3.2.198 2023-08-06

• T5420 (feature): nftables - upgrade to latest 1.0.8

• T5445 (feature): dyndns: add possibility to specify update interval (timeout)

3.2.199 2023-08-05

• T5291 (bug): vyatta-cfg-cmd-wrapper missing ${vyos_libexec_dir} variable

• T5290 (bug): Failing commits for SR-IOV interfaces using ixgbevf driver due to
change speed/duplex settings
• T5439 (bug): Upgrade to FRR version 9.0 added new daemons which must be adjusted

3.2.200 2023-08-04

• T5427 (bug): Change migration script len arguments checking

3.2.201 2023-08-03

• T5301 (bug): NTP: chrony only allows one bind address

• T5154 (bug): Chrony - multiple listen addresses

3.2.202 2023-08-02

• T5374 (feature): Ability to set 24-hour time format

• T5350 (bug): Confusing warning message when committing VRRP config
• T5430 (bug): bridge: vxlan interfaces are not listed as bridgable in completion
helpers
• T5429 (bug): vxlan: source-interface is not honored and throws config error
• T5415 (feature): Upgrade FRR to version 9.0
• T5422 (feature): Support LXD Agent

3.2.203 2023-08-01

• T5399 (bug): "show ntp" fails when vrf is being configured

• T5346 (bug): MPLS sysctl not persistent for L2TP interfaces
• T5343 (feature): BGP peer group VPNv4 & VPNv6 Address Family Support
• T5339 (feature): Geneve interface - option to use IPv4 as inner protocol
• T5335 (bug): ISIS: error when loading config from file

3.2. 1.4 Sagitta 74

 VyOS Documentation, Release 1.5.x (circinus)

3.2.204 2023-07-31

• T5421 (feature): Add arg to completion helper 'list_interfaces' to filter out vlan
subinterfaces

3.2.205 2023-07-29

• T5403 (feature): Add support for extending xml cache

3.2.206 2023-07-28

• T4602 (bug): DHCP `ping-check` enabled by default

• T5411 (feature): Remove old background monitoring implementation
• T5317 (enhancment): configtree: remove mutable references
• T5316 (enhancment): configtree: use a single pass of the diff algorithm

3.2.207 2023-07-27

• T5368 (feature): FastNetmon service ids ddos-protection add support sflow mode

3.2.208 2023-07-26

• T5398 (bug): FRR mangles container network interface names

• T5365 (bug): Container systemd units require authentication
• T4974 (feature): OpenVPN- Data Channel Offload(DCO)

3.2.209 2023-07-25

• T5377 (feature): ospf: add graceful restart FRR feature (RFC 3623)

3.2.210 2023-07-21

• T5373 (bug): LLDP seems to be running even if its disabled on all interfaces
• T5328 (default): bgp: Incorrect warning showed for address-family configured with
neighbor as interface
• T5363 (bug): Bash history file does not exists after reboot and ony other file in
home directory
• T5385 (bug): reference_tree: catch parse error on non-transcluded files
• T5361 (bug): "monitor log" behaves like "show log"

3.2. 1.4 Sagitta 75

 VyOS Documentation, Release 1.5.x (circinus)

3.2.211 2023-07-20

• T5362 (bug): `set high-availability vrrp global-parameters version 3` seems to have

no effect
• T5355 (bug): IPSec: OP cmd : "show vpn ike sa" does not show output
• T5330 (enhancment): Keep track of source of config dict value when merging defaults
• T4497 (feature): ping cannot force ipv4 or ipv6
• T4288 (bug): IPsec tunnel will break when ESP timeout

3.2.212 2023-07-19

• T5340 (bug): SNMP and VRF

• T5059 (feature): add 'disable' option to DHCP relay config

3.2.213 2023-07-17

• T2051 (bug): Throughput anomalies

3.2.214 2023-07-16

• T141 (feature): TACACS+ Support

3.2.215 2023-07-15

• T5341 (feature): Improve CLI for high-availability virtual-server to work with

multiple ports

3.2.216 2023-07-14

• T5358 (bug): 99-ipsec-dhclient-hook prevents DHCP stateless routes from being

installed in VRF table
• T4376 (bug): DNAT with multiwan and policy routing, incoming connections only work
on primary interface
• T305 (default): loadbalancing does not work with one pppoe connection and another
connection of either dhcp or static

3.2. 1.4 Sagitta 76

 VyOS Documentation, Release 1.5.x (circinus)

3.2.217 2023-07-13

• T4713 (bug): vyos@vyos:~$ show nat destination rules | doesn't work

• T2315 (feature): Ability to have right address-family for BGP peers.

3.2.218 2023-07-12

• T5347 (bug): Compare commit revision bug

• T5161 (default): BFD Static Route Monitoring
• T5105 (bug): DHCP Server - Wrong error message
• T4927 (bug): Need to change restart to reload-or-restart in Webproxy module
• T3835 (bug): vyos router 1.2.7 snmp Dos bug
• T5352 (default): Fix missing dependency for netavark
• T4959 (feature): Add container registry authentication config for containers

3.2.219 2023-07-11

• T5314 (bug): QOS Default classes are not configured with correct qdisc
• T4862 (bug): webproxy domain-block does not work
• T4844 (bug): Incorrect permissions of the safeguard DB directory
• T4815 (bug): Fix various name server config issues
• T4810 (bug): Op-mode show/monitor log pppoe interface does not show any logs
• T4758 (feature): Rewrite show dhcp server to vyos.opmode format
• T4262 (bug): install image doesn't respect chosen root partition size
• T3810 (bug): webproxy squidguard rules don't work properly after rewriting to
python.
• T1928 (bug): Is the 'Welcome to VyOS' message when using SSH an information leak?
• T1877 (default): Feature Request: Allow NAT to use network and address groups
• T4813 (feature): L3VPN over GRE Tunnels
• T4943 (bug): Radius SSH login displays "permission denied" on 1.4 rolling release
• T4542 (default): route-map: "match prefix-len" incorrect behavior
• T4392 (default): Multiline login banner text reports error on commit

3.2. 1.4 Sagitta 77

 VyOS Documentation, Release 1.5.x (circinus)

3.2.220 2023-07-10

• T5345 (bug): Error incorrectly raised in revised multi_to_list when tag node value
name == tag node name
• T3578 (bug): Prefix-List(6) update cause empty prefix-list(6)
• T762 (feature): Include rulseset in firewall

3.2.221 2023-07-06

• T5336 (feature): Add Swedish keyboard-layout

3.2.222 2023-07-04

• T5333 (bug): Policy base routing PBR generetes incorrect rules with name POSTROUTING
• T5081 (feature): ISIS and OSPF syncronization with IGP-LDP sync

3.2.223 2023-07-03

• T5295 (bug): QoS shaper incorrect rate limit the traffic

• T5334 (feature): ospf: add support for External Route Summarisation Type-5 and
Type-7

3.2.224 2023-07-02

• T5332 (bug): Show policy route not working when no interface is configured

3.2.225 2023-07-01

• T5304 (feature): Containers add bind-propagation option rshared

• T5296 (bug): QoS class cannot calculate correctly the default bandwidth auto
• T5210 (bug): IPSec cosmetic bug for Warning vti inrerface
• T5277 (bug): Dhcpv6-relay does not start on boot

3.2.226 2023-06-30

• T5315 (feature): vrrp: add support for version 3

• T5283 (bug): IPoE server assigns network address
• T5313 (bug): UDP broadcast relay - missing verify() that relay interfaces have an IP
address assigned

3.2. 1.4 Sagitta 78

 VyOS Documentation, Release 1.5.x (circinus)

3.2.227 2023-06-29

• T5320 (enhancment): Add warning when entering config mode after a boot configuration
error

3.2.228 2023-06-28

• T1237 (feature): Static Route Path Monitoring, failover

3.2.229 2023-06-26

• T5159 (bug): DHCPv6-server leases op-command shows warning message even if

configured

3.2.230 2023-06-25

• T5240 (bug): Service router-advert failed to start radvd with more then 3
name-servers
• T5312 (bug): Nonescaped special character in help text

3.2.231 2023-06-24

• T5303 (bug): Rsyslog.service is not working

• T5298 (bug): Add RFKILL support into kernel.
• T5308 (enhancment): Remove workarounds for incorrect defaults in get_interface_dict
• T5228 (enhancment): Simplify get_config_dict and add argument with_defaults
• T5310 (bug): Need some help troubleshooting NIC detection.

3.2.232 2023-06-22

• T5297 (default): Utility function to check if config under node has been changed
between revisions

3.2.233 2023-06-20

• T5300 (bug): verification of port availability can return false negative on boot
• T5248 (feature): Ability to load config via API in JSON format

3.2. 1.4 Sagitta 79

 VyOS Documentation, Release 1.5.x (circinus)

3.2.234 2023-06-19

• T5281 (feature): Add kernel options for vhost-net

• T5072 (default): QOS-Rewrite: protocol name used literally
• T4969 (bug): QoS Policy - Unable to set class match mark number

3.2.235 2023-06-18

• T5256 (bug): QoS expects protocol number but not protocol name

3.2.236 2023-06-13

• T5258 (bug): git Actions use ubuntu-22.04 instead of deprecated ubuntu-18.04 for PR
conflicts checker
• T5222 (feature): Add load-balancing reverse-proxy based on haproxy
• T5213 (feature): Accel-ppp sending accounting interim updates acct-interim-interval
option
• T5171 (feature): Use XML for conf-mode "load-balancing wan" instead of legacy
templates

3.2.237 2023-06-12

• T5282 (bug): Poweroff now does not work

• T5264 (feature): Add Mellanox Technologies firmware flash module mlxfw to kernel
• T5286 (feature): Remove XDP support

3.2.238 2023-06-10

• T5231 (feature): Add op-mode for load-balancing reverse-proxy

3.2.239 2023-06-09

• T5253 (bug): MPLS config removed at boot when wireguard interfaces present

3.2.240 2023-06-05

• T5259 (bug): Openconnect cannot pass migration 1-to-2

3.2. 1.4 Sagitta 80

 VyOS Documentation, Release 1.5.x (circinus)

3.2.241 2023-06-02

• T5252 (bug): Route distinguisher and route targets changing upon adding interface to
new VRF
• T5251 (bug): Uncaught errors for functions delete/delete_value in Python module
configtree.py

3.2.242 2023-06-01

• T5127 (bug): VPNv4/VPNv6 routes are not reinstalled following link flap

3.2.243 2023-05-28

• T5244 (feature): dropbear: update to 2022.83

• T5242 (feature): interfaces: smoketest: automatically detect "capabilities"
• T5234 (feature): Add bash identifier for given VRF instance

3.2.244 2023-05-25

• T5237 (feature): interfaces virtual-ethernet - Extend capabilitys of Vlans/QinQ

• T4686 (feature): Provides support for veth

3.2.245 2023-05-24

• T4605 (feature): Firewall change default table names

• T4550 (feature): router-advert: Add deprecate-prefix & decrement-lifetimes options

3.2.246 2023-05-23

• T4916 (feature): Rewrite IPsec authentication

3.2.247 2023-05-22

• T5214 (bug): PPPoE-server incorrect warning if a named pool is defined

• T4977 (feature): Babel routing protocol support

3.2. 1.4 Sagitta 81

 VyOS Documentation, Release 1.5.x (circinus)

3.2.248 2023-05-21

• T4733 (default): Feature Request: dhcp server: add VRF support

• T5218 (enhancment): Revise vyos xml lib for bug fixes and extensions

3.2.249 2023-05-17

• T5226 (default): Deduplicate and standardize validators and constraints for hostname
and IP address
• T5225 (bug): BGP allowas-in unusable
• T5208 (bug): Failed to start nvmf-autoconnect.service during the boot

3.2.250 2023-05-16

• T5194 (default): Add reference tree to vyos1x-config

3.2.251 2023-05-15

• T3896 (feature): Extend ocserv support to allow for per-group configs

3.2.252 2023-05-12

• T2778 (feature): Migrate "system syslog" to get_config_dict() to support new

features
• T2769 (feature): Add VRF support for syslog

3.2.253 2023-05-10

• T5209 (bug): dhclient load-balancing exit hook 04-dhcp-wanlb returned non-zero exit
status
• T5065 (bug): Mixing `destination port xxx` and `destination group port-group yyy` in
firewall rules doesn't work, but can be commited
• T5060 (feature): add a VRRP 'maintenance mode'

3.2.254 2023-05-09

• T5202 (bug): After removal load-balancing a pid remained which used in

dhclient-exit-hooks

3.2. 1.4 Sagitta 82

 VyOS Documentation, Release 1.5.x (circinus)

3.2.255 2023-05-06

• T5206 (bug): ethtool.py:Ethtool.__init__ has always true conditional due to typo

3.2.256 2023-05-05

• T5082 (feature): container: switch to netavark network stack

3.2.257 2023-05-04

• T5193 (feature): Ability to specify NS records to specify NS servers for subdomains

• T3891 (bug): X550-T2/Possibly other X550/X540 cards no link on VyOS
• T5010 (bug): bgp: EVPN route-target not honored
• T5196 (feature): wwan: op-mode should inform user if there is no WWAN interface

3.2.258 2023-05-03

• T5163 (feature): Policy route-map add match source-protocol

3.2.259 2023-05-02

• T5042 (bug): Command 'show vpn ipsec remote-access' does not work

3.2.260 2023-04-27

• T5185 (bug): Static IPv6 route with blackhole fails

• T5175 (bug): http-api: error in MultiPart parser for FastAPI version >= 0.91.0
• T5183 (bug): IPv6 route6 problem
• T5181 (bug): Wrong dependencies or priorities for zebra vni vrf interfaces and bgpd
• T5128 (feature): Policy route - Allow wildcard interfaces
• T5055 (feature): Firewall - Add packet type matcher (pkttype)
• T5050 (feature): Firewall - Add options for logging packets
• T5037 (feature): Firewall - Add queue action
• T5176 (bug): http-api: update vyos-http-api-tools for FastAPI security
vulnerability
• T5174 (bug): vrf: ensure no duplicate VNIs can be created
• T5123 (default): Display route originator in show ospf table command

3.2. 1.4 Sagitta 83

 VyOS Documentation, Release 1.5.x (circinus)

3.2.261 2023-04-25

• T5179 (bug): multi nodes defined in XML are not properly represented as list in
get_config_dict()

3.2.262 2023-04-17

• T5052 (bug): Error displaying dhcpv6 prefix delegation leases

• T5150 (feature): Rework CLI definitions to apply route-maps between routing daemons
and zebra/kernel
• T3734 (bug): Move EVPN VRF up in FRR config

3.2.263 2023-04-13

• T5152 (bug): Telegraf agent hostname isn't qualified

• T4727 (feature): Add RADIUS rate limit support to PPTP server
• T4939 (bug): VRRP command no-preempt not work as expected
• T4791 (default): Consistent normalization of 'raw' output of op-mode scripts for CLI
and API
• T3608 (default): Standardize warnings from configure scripts

3.2.264 2023-04-11

• T4924 (bug): Systemctl strongswan.service for some reason is not disabled

• T4197 (bug): Vyos arm64-latest build issue with telegraf pkg
• T4051 (bug): Connected routes strange / not working

3.2.265 2023-04-10

• T5151 (bug): EAP-TLS TLSv1.0/1.1 regression after T5003

• T5148 (bug): OpenVPN cannot start due to could not load plugin shared object /
openvpn-otp.so
• T5110 (bug): Show frr op-mode vtysh_pam: Failed in account validation
• T5078 (feature): VyOS BGP does not support 'show bgp neighbors $NB filtered-routes'
• T5070 (feature): show bgp nexthop unavailable in VRF
• T5061 (bug): All containers restart on config change

3.2. 1.4 Sagitta 84

 VyOS Documentation, Release 1.5.x (circinus)

3.2.266 2023-04-07

• T5149 (bug): op-mode openvpn should not raise error in case interface is disabled

3.2.267 2023-04-06

• T5147 (bug): Can't Commit with Container Network

• T5142 (feature): One of the requirements is to use a system auditing tool to monitor
and log all security-relevant events.
• T5125 (feature): Add op-mode commands for hsflowd based sflow

3.2.268 2023-04-05

• T5145 (feature): Add maxsyslogins maximum number of all logins on system

• T5135 (default): Rewrite opennhrp script using vyos.ipsec library
• T4975 (bug): CLI does not work after cutting off the power or reset
• T5136 (bug): Possible config corruption on upgrade

3.2.269 2023-04-04

• T5141 (feature): Add numbers for dhclient-exit-hooks.d to enforce script order

execution
• T5093 (bug): Command 'reset vpn ipsec-profile' doesn't work
• T4362 (bug): Wan Load Balancing - Can't create routing tables

3.2.270 2023-04-03

• T5139 (feature): IKE life-time should start from 0 for disable rekey
• T4173 (bug): Wan Load Balancing - Error on firewall NAT rules

3.2.271 2023-04-02

• T5134 (feature): Try if netavark networks can be moved to a VRF instance

3.2.272 2023-04-01

• T5047 (bug): Recreate only a specific container

• T5132 (default): Operational command "show isis vrf XXX route | neighbord" aren't
working

3.2. 1.4 Sagitta 85

 VyOS Documentation, Release 1.5.x (circinus)

3.2.273 2023-03-31

• T5129 (feature): Add AWS build flavour

• T5126 (feature): http-api: add 'allow-client' to restrict IP address of client
connections

3.2.274 2023-03-30

• T5130 (bug): op-mode: drop remaining reference to obsoleted 'show_interfaces.py'

• T4866 (feature): Rewrite show_interfaces to standardized form
• T366 (bug): SNMP Query for BGP Tunnels Returns IPv4 Tunnels Only

3.2.275 2023-03-29

• T5100 (feature): Update FRR to 8.5

• T5094 (bug): FRR systemd logs unknow key LimitNOFILESoft
• T5085 (bug): ospfv3 route-map not applied in FRR configuration
• T5056 (bug): IPoE server vlan-mon is not working
• T5033 (bug): generate-public-key command fails for address with multiple public keys
like GitHub
• T4876 (bug): mpls - LSP broken on FRR 8.4.1
• T5097 (bug): the operational command "show interfaces ethernet ethx" doesn't reflect
a call to 'clear counters'
• T5089 (enhancment): Add unit test of config_diff
• T5088 (enhancment): Add lexicographical-numeric compare function for vytree/
configtree
• T5087 (enhancment): Add support for lexical ordering of nodes in config_tree
• T4885 (feature): Rewrite 'clear interfaces counters' from Perl to Python
• T4846 (bug): L3VPN- network command doesn't install direct connected prefix

3.2.276 2023-03-28

• T5043 (feature): Need to create reset command for IKEv2 remote-access vpn
connections

3.2. 1.4 Sagitta 86

 VyOS Documentation, Release 1.5.x (circinus)

3.2.277 2023-03-27

• T5099 (feature): IPoE server add option 'next-pool' for named ip pools
• T5106 (feature): Extend generation of API client requests to configsession native
functions and composite requests
• T5104 (bug): DHCP default route issues with static routes in VRFs
• T5079 (feature): xml: schema extension to support defaultValues on tagNodes
• T5114 (feature): bgp: implement new CLI commands introduced in FRR 8.5

3.2.278 2023-03-23

• T5108 (feature): Get rate limit for L2TP/PPTP/SSTP/IPoE in raw format

• T5086 (feature): Integrate hsflowd for sflow accounting
• T5107 (bug): Raise error in op-mode dns.py instead of calling exit

3.2.279 2023-03-22

• T5068 (feature): Generate op-mode API client requests along with schema generation

3.2.280 2023-03-21

• T5098 (feature): PPPoE client holdoff configuration

• T3694 (bug): Static routes not installed into kernel nor frr
• T5102 (feature): ospf: "redistribute babel" is always set

3.2.281 2023-03-20

• T5057 (bug): IPoE server incorrect interface regex

• T5095 (feature): Return list instead of dict for 'raw' output of op-mode openvpn

3.2.282 2023-03-19

• T4925 (feature): Need to add the possibility to configure Pseudo-Random Functions

(PRF) in IKEv2

3.2. 1.4 Sagitta 87

 VyOS Documentation, Release 1.5.x (circinus)

3.2.283 2023-03-17

• T5092 (bug): IPoE-server named pool must not rely on the authentication type
• T5091 (bug): IPoE server with RADIUS authentication does not verify radius
configuration

3.2.284 2023-03-16

• T5073 (bug): IPoE-server interface option failed to parse

• T5063 (bug): IPoE-server ethX vlan must not be used with client-subnet
• T5058 (feature): Extend template filter range_to_regex
• T3083 (feature): Add feature event-handler
• T2516 (bug): vyos-container: cannot configure ethernet interface

3.2.285 2023-03-13

• T5074 (bug): Show IPSEC SA failed if remote access IKEv2 vpn is used.
• T4973 (bug): show dhcp server leases error for lease time 4294967295

3.2.286 2023-03-11

• T5076 (feature): CI/CD: Docker container is bloated by legacy and conflicting

dependencies

3.2.287 2023-03-09

• T5066 (bug): Different GRE tunnel but same tunnel keys error
• T4952 (feature): Improve interface completion helper CLI experience

3.2.288 2023-03-08

• T4381 (default): OpenVPN: Add "Tunnel IP" column in "show openvpn server"
operational command
• T4872 (bug): Op-mode show openvpn misses a case when parsing for tunnel IP

3.2.289 2023-03-07

• T2838 (bug): Ethernet device names changing, multiple hw-id being added
• T5051 (feature): Use Literal types to provide op-mode CLI choices and API enums
• T4900 (default): Cache intermediary results of get_config_diff in Config instance

3.2. 1.4 Sagitta 88

 VyOS Documentation, Release 1.5.x (circinus)

3.2.290 2023-03-05

• T5040 (default): Generate API GraphQL schema on installation, rather than

dynamically

3.2.291 2023-03-03

• T4625 (enhancment): Update ocserv to current revision (1.1.6)

3.2.292 2023-03-02

• T4967 (feature): Ability to set hostname for the container

3.2.293 2023-03-01

• T5015 (bug): Invalid format character error at hfsc class settings help text

3.2.294 2023-02-28

• T5029 (feature): Nginx change default root directory and fix regex
• T5025 (bug): Time-zone validation failed
• T4955 (bug): Openconnect radiusclient.conf generating with extra authserver
• T4843 (feature): Command-line arguments in container config
• T4219 (feature): support incoming-interface (iif) in local PBR
• T3903 (bug): Containers: after command "reboot" the host system will reboot after
1.5 minutes

3.2.295 2023-02-27

• T5028 (feature): Add package exfatprogs to VyOS

• T4985 (bug): reset vpn ipsec-peer command with peer name does not work

3.2.296 2023-02-26

• T4979 (feature): Add API request 'show_user_info' for UI

3.2. 1.4 Sagitta 89

 VyOS Documentation, Release 1.5.x (circinus)

3.2.297 2023-02-25

• T5008 (bug): MACsec CKN of 32 chars is not allowed in CLI, but works fine
• T5007 (bug): Interface multicast setting is invalid
• T5027 (bug): OpenVPN options and site-to-site cannot pass smoketest
• T4978 (bug): KeyError: 'memory' container_config['memory'] on upgrading to 1.
4-rolling-202302041536
• T5034 (bug): Migrate multicast CLI node to valueLess
• T4948 (feature): pppoe: add CLI option to allow definition of host-uniq flag

3.2.298 2023-02-24

• T5030 (bug): HTTPS-API delete key without id error

3.2.299 2023-02-23

• T5013 (feature): Extend accelppp.py op-mode to get subnet start stop info from
config
• T5002 (feature): Add uk (United Kingdom) keymap

3.2.300 2023-02-22

• T5024 (bug): check-qemu-install VM is not shutdown the first time

• T5011 (bug): Some interface drivers don't support min_mtu and max_mtu and verify_mtu
check should be skipped

3.2.301 2023-02-21

• T5021 (bug): IPsec SA is closed before negotiating a new one or it is negotiated on

every second if big life-time is set in swanctl.conf
• T5020 (feature): Extend openvpn.py op-mode to get a list of configured clients

3.2.302 2023-02-20

• T5005 (feature): Skip user authentication for PPPoE Server with noauth option

3.2. 1.4 Sagitta 90

 VyOS Documentation, Release 1.5.x (circinus)

3.2.303 2023-02-16

• T4971 (feature): Radius attribute "Framed-Pool" for PPPoE

3.2.304 2023-02-15

• T4991 (bug): Restore path level information to compare output

3.2.305 2023-02-14

• T4968 (bug): VPN IPsec check dpd and close action for empty values
• T1993 (feature): Extended pppoe rate-limiter

3.2.306 2023-02-13

• T4905 (feature): Convert show nhrp tunnel to tabulate format

• T4153 (bug): Monitor bandwidth-test initiate not working

3.2.307 2023-02-12

• T4998 (bug): pppoe username validation too restrictive (regression)

3.2.308 2023-02-11

• T2603 (feature): pppoe-server: reduce min MTU

3.2.309 2023-02-10

• T4857 (feature): SNMP - Implement FRR SNMP recommendations

• T4995 (feature): pppoe, wwan and sstp-client - rename user -> username on
authentication

3.2.310 2023-02-07

• T4980 (bug): chrony not listening as a server

• T4868 (bug): L2TP ppp-options ipv6 does not work without ipv6 pool but should
• T4117 (bug): Does not possible to configure PoD/CoA for L2TP vpn

3.2. 1.4 Sagitta 91

 VyOS Documentation, Release 1.5.x (circinus)

3.2.311 2023-02-01

• T4970 (default): pin OCaml pcre package to avoid JIT support

3.2.312 2023-01-31

• T4964 (bug): FRR bgp address-family l2vpn-evpn route-target export/import not

working
• T4780 (feature): Firewall - Add interface group
• T4157 (default): Add jinja2 to pip test requirements

3.2.313 2023-01-30

• T4958 (feature): Add OpenConnect RADIUS Accounting support

• T4954 (bug): DNS cannot be configured via Network-Config v1 received from
ConfigDrive / Cloud-Init
• T4118 (default): IPsec syntax overhaul

3.2.314 2023-01-29

• T4965 (default): empty description in firewall group causes configuration error on

migration

3.2.315 2023-01-28

• T4961 (bug): Uncaught configtree error allows ntp migration 1-to-2 to fail silentlly
on config.boot.default

3.2.316 2023-01-27

• T4960 (bug): Bugs in `cc_vyos.py` code (Cloud-Init)

3.2.317 2023-01-26

• T4886 (feature): Firewall and Policy - Add connection mark

• T4957 (bug): config-mgmt should not attempt to archive config at boot
• T4962 (bug): Fix typo in regex in vyos.config_mgmt compare function
• T4912 (default): Rewrite the IGMP op mode in the new style

3.2. 1.4 Sagitta 92

 VyOS Documentation, Release 1.5.x (circinus)

3.2.318 2023-01-25

• T4941 (bug): Accel-ppp IPoE incompatibility with kernel 6.1

3.2.319 2023-01-24

• T4947 (feature): Support mounting container volumes as ro or rw

3.2.320 2023-01-23

• T4798 (default): Migrate the file-exists validator away from Python

• T4683 (enhancment): Add kitty-terminfo package to build
• T4953 (bug): Remove convert_kwargs_to_snake_case decorator in dynamic generation of
GraphQL resolvers
• T4875 (default): Replace Python validator 'interface-name' to avoid Python startup
cost
• T4664 (bug): Add validation to reject whitespace in tag node value names

3.2.321 2023-01-22

• T4906 (bug): ipsec connections shows only one connection as up

3.2.322 2023-01-21

• T4799 (bug): PowerDNS >= 4.7 does not get reloaded by vyos-hostsd
• T4878 (bug): Any interface bonding changes cause interface flapping
• T4387 (default): Create additional smoketests for multiwan PBR & load-balanced
configurations

3.2.323 2023-01-20

• T4551 (bug): IPsec rekeying collisions bug

• T4942 (feature): Rewrite vyatta-config-mgmt to Python/XML

3.2.324 2023-01-17

• T4938 (bug): Interface input ifb does not work

• T4902 (bug): snmpd: exclude container storage from monitoring
• T4140 (bug): Lack of SNMP IANA mibs

3.2. 1.4 Sagitta 93

 VyOS Documentation, Release 1.5.x (circinus)

3.2.325 2023-01-15

• T4832 (feature): dhcp: Add IPv6-only dhcp option support (RFC 8925)
• T4937 (feature): ocserv: upgrade package to version 1.1.6
• T4918 (bug): Odd show interface behavior
• T3008 (feature): Migrate from ntpd to chronyd

3.2.326 2023-01-13

• T4911 (default): Rewrite the LLDP op mode in the new format

• T4928 (feature): Upgrade Linux Kernel to 6.1.y (2022 LTS edition)

3.2.327 2023-01-12

• T4934 (bug): ospf: Fix inter-area route summarization

• T4929 (feature): Update Intel QAT drivers to 4.20.0-00001

3.2.328 2023-01-10

• T4880 (feature): Expose 'add/delete container image' in HTTP-API

3.2.329 2023-01-09

• T4922 (feature): Add ssh-client source-interface CLI option

• T4524 (bug): Squid webproxy not working properly

3.2.330 2023-01-08

• T4920 (bug): ospf: Fix `passive-interface default` option

3.2.331 2023-01-07

• T4884 (bug): Missing a community6 in snmpd config

3.2.332 2023-01-05

• T4904 (feature): Allow multiple ports for high-availability virtual-server

• T4789 (feature): Ability to get L2TP/PPTP/SSTP sessions info in a machine readable
format
• T3937 (default): Rewrite "show system memory" in Python to make it usable as a
library function

3.2. 1.4 Sagitta 94

 VyOS Documentation, Release 1.5.x (circinus)

3.2.333 2023-01-04

• T4848 (bug): Minor bug in OpenConnect server with default route

• T4656 (feature): Support the listen-host config field of openconnect server

3.2.334 2023-01-03

• T4907 (bug): nat source translations couldn't show metrics

3.2.335 2023-01-02

• T4893 (feature): l2tp add ppp-options IPv6 interface identifier

• T4717 (feature): Connect to console server by name
• T725 (feature): Cake and FQ-PIE

3.2.336 2022-12-31

• T4898 (feature): Add mtu config option for dummy interfaces

3.2.337 2022-12-30

• T4834 (bug): Limit container network name to 15 characters

• T4901 (bug): Update Podman to v4.3.1
• T4899 (bug): Podman systemd services not being installed correctly

3.2.338 2022-12-28

• T4593 (feature): Upgrade strongswan to 5.9.8

3.2.339 2022-12-26

• T4511 (bug): IPv6 DNS lookup

• T4809 (feature): radvd: Allow use of AdvRASrcAddress

3.2.340 2022-12-25

• T3579 (feature): Rewrite vyatta-conntrack in new XML and Python flavour

3.2. 1.4 Sagitta 95

 VyOS Documentation, Release 1.5.x (circinus)

3.2.341 2022-12-24

• T4890 (bug): show conntrack table ipv4 fail

• T4879 (bug): IPSec migration failed with missing remote-id
• T4870 (feature): Containers switch to using overlay driver for podman storage

3.2.342 2022-12-23

• T4792 (feature): Add SSTP VPN client

3.2.343 2022-12-21

• T4887 (bug): Schema generation from op-mode functions should set default 'false' on
boolean arguments

3.2.344 2022-12-18

• T4882 (bug): Missing ICMPv6 type names in firewall configuration

3.2.345 2022-12-15

• T4671 (bug): linux-firmware package is missing symlinks defined in WHENCE file

3.2.346 2022-12-14

• T4881 (bug): Return opmode.Error on openconnect.py show_sessions

3.2.347 2022-12-12

• T4861 (feature): Openconnect restart on adding users - Aborts all active connections

3.2.348 2022-12-09

• T4865 (bug): container impossible to generate local image from a file if it requires
install some pkgs

3.2.349 2022-12-05

• T4860 (bug): Openconnect server incorrect unconfigured check

• T4804 (bug): PPPoE server incorrect unconfigured check
• T4854 (feature): BGP-route reflector allows to apply route-maps

3.2. 1.4 Sagitta 96

 VyOS Documentation, Release 1.5.x (circinus)

3.2.350 2022-12-04

• T4825 (feature): interfaces veth/veth-pairs -standalone used

• T4805 (bug): PPPoE server does not restart service if pool was changed

3.2.351 2022-12-02

• T4830 (bug): nat66 - Error in port translation rules

• T4859 (bug): Correct calling of config mode script dependencies from http-api.py
• T4820 (enhancment): Support for inter-config-mode script dependencies
• T4858 (bug): L3VPN- Route Distinguisher notations
• T1024 (feature): Policy Based Routing by DSCP

3.2.352 2022-12-01

• T4841 (feature): add fan control

• T4847 (bug): Correct calling of config mode script dependencies from pki.py

3.2.353 2022-11-29

• T4842 (bug): Routing config broken if mpls config exists

• T4845 (default): Add smoketest to detect cycles in config-mode script dependency
calls

3.2.354 2022-11-27

• T4739 (feature): ISIS and OSPF segment routing being refactored

3.2.355 2022-11-24

• T4794 (bug): show firewall name <name> - Can't use .items() on a list
• T4714 (feature): Delete unused ipset from the filecaps
• T3541 (bug): Route Map large community set additive is missing

3.2.356 2022-11-23

• T4836 (feature): Kernel: enable new features like switchdev, ESP in TCP and HSR
• T4835 (bug): SNMPD configuration incorrect for IPv6
• T4819 (feature): Allow printing Warning messages in multiple lines with \n
• T4807 (feature): Need to fix traceroute help completion
• T4660 (feature): Reorganize route map set community CLI
• T4526 (bug): keepalived-fifo.py unable to load config

3.2. 1.4 Sagitta 97

 VyOS Documentation, Release 1.5.x (circinus)

• T4793 (feature): Create warning message about disable-route-autoinstall when ipsec

vti is used
• T4492 (bug): Incorrect list of neighbors in help for "show bgp vrf VRF neighbors"
• T4496 (feature): ping vrf help does not list VRFs

3.2.357 2022-11-22

• T4823 (bug): swanctl.conf is broken when ipsec site-to-site peer set.

• T4706 (bug): NAT and NAT66 issues
• T4670 (feature): policy route - Update matching criteria

3.2.358 2022-11-21

• T4812 (feature): IPsec ability to show all configured connections

• T4829 (default): Tunnel argument to 'reset_peer' in ipsec.py should have type hint
Optional

3.2.359 2022-11-20

• T4827 (bug): route-map issues , not load configuration FRR

3.2.360 2022-11-19

• T4826 (bug): Wrong key type is used for SSH SK public keys
• T4720 (feature): Ability to configure SSH HostKeyAlgorithms
• T4828 (default): Raise appropriate op-mode errors in ipsec.py 'reset_peer'

3.2.361 2022-11-18

• T4821 (bug): Correct calling of config mode script dependencies from firewall.py

3.2.362 2022-11-17

• T4750 (feature): Support of higher level SSH keys (sk-ssh-ed25519)

3.2. 1.4 Sagitta 98

 VyOS Documentation, Release 1.5.x (circinus)

3.2.363 2022-11-15

• T4808 (feature): Add details of configtree operations to migration log

3.2.364 2022-11-12

• T4814 (bug): Regression in bundled powerdns version

3.2.365 2022-11-09

• T4800 (bug): undefined var includes_chroot_dir in build-vyos-image

3.2.366 2022-11-08

• T4771 (feature): Rewrite protocol BGP op-mode to vyos.opmode format

• T4806 (default): Update FRR to 8.4 in 1.4 version

3.2.367 2022-11-06

• T4803 (bug): The header 'Authorization' needs to be explictly allowed in http-api

CORS middleware

3.2.368 2022-11-05

• T4802 (feature): Ability to define per container shared-memory size

3.2.369 2022-11-01

• T4764 (bug): NAT tables vyos_nat and vyos_static_nat not deleting after deleting nat
• T4177 (bug): Strip-private doesn't work for service monitoring

3.2.370 2022-10-31

• T4786 (feature): Add package python3-pyhumps

• T1875 (feature): Add the ability to use network address as BGP neighbor (bgp listen
range)
• T4785 (feature): snmp: Allow !, @, * and # in community name
• T4787 (feature): ipsec: add support for road-warrior/remote-access RADIUS timeout

3.2. 1.4 Sagitta 99

 VyOS Documentation, Release 1.5.x (circinus)

3.2.371 2022-10-29

• T4783 (default): Add support for stunnel

• T4784 (feature): Add description node for static route/route6 tagNodes

3.2.372 2022-10-28

• T4291 (default): Consolidate component version read/write functions

3.2.373 2022-10-27

• T4763 (feature): Change XML for Show nat destination statistics

• T4762 (bug): Show nat rules with empty rules incorrect error
• T4778 (bug): Raise error UnconfiguredSubsystem if op-mode ipsec.py fails
initialization

3.2.374 2022-10-26

• T4773 (default): Add camel_case to snake_case conversion utility

3.2.375 2022-10-25

• T4574 (default): Add token based authentication to GraphQL API

3.2.376 2022-10-24

• T4772 (default): Return list of dicts in 'raw' output of route.py instead of dict
with redundant information

3.2.377 2022-10-23

• T3723 (bug): op-mode IPSec show vpn ipsec sa output with underscores

3.2.378 2022-10-21

• T4768 (default): Change name of api child node from 'gql' to 'graphql'

3.2. 1.4 Sagitta 100

 VyOS Documentation, Release 1.5.x (circinus)

3.2.379 2022-10-18

• T4684 (feature): Rewrite show ip route by protocol to vyos.opmode format

• T4533 (bug): Radius clients don’t have simple permissions
• T4753 (enhancment): Extend automatic generation of schema to query SystemStatus

3.2.380 2022-10-17

• T4725 (bug): Unable to reset vpn IPsec peer

3.2.381 2022-10-14

• T4672 (bug): RADIUS server disable does not work

• T4749 (enhancment): Use config_dict for conf_mode http-api.py

3.2.382 2022-10-13

• T4746 (bug): Monitoring nft. table vyos_filter by default does not exist but
telegraf checks this table
• T4744 (bug): BGP directly connected neighbors don't compatible with ebgp-multihop
• T4716 (feature): SSH ability to configure RekeyLimit
• T4343 (default): Expose powerdns network-timeout for service dns forwarding
• T4312 (bug): Telegraf configuration doesn't accept IPs for URL
• T4274 (default): Extend OpenConnect RADIUS Timeout to Permit 2FA Entry

3.2.383 2022-10-12

• T4747 (bug): Monitoring influxdb template input exec plugin does not work
• T4740 (bug): Show conntrack table ipv6 fail
• T4730 (bug): Conntrack-sync error - listen-address is not the correct type in config
as it should be

3.2.384 2022-10-11

• T4742 (bug): Autocomplete in policy route rule x set table / does not show the
tables created in the static protocols
• T4741 (bug): set firewall zone Local local-zone failed
• T4680 (bug): Telegraf prometheus-client listen-address invalid format

3.2. 1.4 Sagitta 101

 VyOS Documentation, Release 1.5.x (circinus)

3.2.385 2022-10-10

• T538 (feature): Support for network mapping in NAT

3.2.386 2022-10-09

• T4738 (enhancment): Extend automatic generation of schema definition files to native

configsession functions; use single resolver/directive

3.2.387 2022-10-08

• T4707 (feature): Enable OSPF segment routing

3.2.388 2022-10-07

• T4736 (bug): Error on JSON output of API query ShowConfig

3.2.389 2022-10-04

• T4708 (bug): 'show nat destination rules' throwing an error

• T4700 (feature): Firewall - Add interface match criteria
• T4699 (feature): Firewall - Add jump action - Add return action
• T4651 (feature): Firewall - Add options to match packet size
• T4702 (bug): Wireguard peers configuration is not synchronized with CLI
• T4685 (bug): Interface does not exist on boot when used as inbound-interface for
local policy route
• T4652 (feature): Upgrade PowerDNS recursor to 4.7 series
• T4582 (default): Router-advert: Preferred lifetime cannot equal valid lifetime in
PIOs

3.2.390 2022-09-29

• T4715 (feature): Auto logout user after a period of inactivity

• T4697 (bug): policy route: Generating ConfigError failes when tcp flag is missing
on set tcp-mss rule commit

3.2. 1.4 Sagitta 102

 VyOS Documentation, Release 1.5.x (circinus)

3.2.391 2022-09-27

• T4711 (feature): Ability to terminate user TTY and PTS sessions

• T4557 (feature): fastnetmon: allow configure limits per protocol (tcp, udp, icmp)

3.2.392 2022-09-21

• T4678 (feature): Rewrite service ipoe-server to get_config_dict

• T4703 (feature): accel-ppp: combine vlan-id and vlan-range into single CLI node

3.2.393 2022-09-20

• T4693 (bug): ISIS segment routing was broken...

3.2.394 2022-09-17

• T4666 (bug): EAP-TLS no longer allows TLSv1.0 after T4537, T4584

• T4665 (bug): Keepalived cannot use same VRID for VRRPv2 and VRRPv3

3.2.395 2022-09-16

• T4698 (enhancment): Drop validator name="range" and replace it with numeric

• T4695 (feature): Add 'es' and 'jp106' keymap option keyboard-layout
• T4669 (enhancment): Extend numeric.ml for inversion of values and range values

3.2.396 2022-09-15

• T4679 (bug): OpenVPN site-to-site incorrect check for IPv6 local and remote address
• T4691 (feature): Upgrade Linux Kernel to latest 5.15.y train
• T4630 (bug): Prevent attempts to use the same interface as a source interface for
pseudo-ethernet and MACsec at the same time
• T4696 (default): Extend bgp parameters for bgp bestpath peer-type multipath-relax

3.2.397 2022-09-12

• T4617 (feature): VRF specification is needed for telegraf prometheus-client

listen-address <address>
• T4690 (bug): Update GraphQL resolver for 'SystemStatus' following changes to
'show_uptime' op-mode script
• T4647 (feature): Add Google Virtual NIC (gVNIC) support
• T4170 (feature): Rename "policy ipv6-route" -> "policy route6"

3.2. 1.4 Sagitta 103

 VyOS Documentation, Release 1.5.x (circinus)

3.2.398 2022-09-09

• T4682 (feature): Rewrite 'show system storage' in standardized format

• T4681 (feature): Complete standardization of show_uptime.py

3.2.399 2022-09-06

• T4640 (enhancment): Integrate op-mode exception hierarchy into API

• T4597 (bug): Check bind port before assign service HTTPS API and openconnect
• T4674 (bug): API should show op-mode error message, if present
• T4673 (bug): op-mode bridge.py should raise error on show_fdb for nonexistent bridge
interface

3.2.400 2022-09-05

• T4668 (bug): Adding/removing members from bond doesn't work/results in incorrect

interface state
• T4663 (bug): Interface pseudo-ethernet does not change mode
• T4655 (bug): Firewall in 1.4 sets the default action 'accept' instead of 'drop'
• T4628 (bug): ConfigTree() throws ValueError() if tagNode contains whitespaces

3.2.401 2022-09-01

• T4606 (bug): monitor nat destination translation shows missing script

• T4435 (bug): Policy route and firewall - error when using undefined group
• T4147 (bug): New Firewall Implementation - proposed changes on group implementation

3.2.402 2022-08-31

• T4650 (feature): Rewire show nat translation to vyos.opmode format

• T4644 (bug): Check bind port before assign vpn sstp
• T4643 (bug): Smoketest exclude either sstp or openconnect from pki-misc default
listen port
• T4569 (feature): Rewrite show bridge to new format
• T4547 (bug): Show vpn ipsec sa show unexpected prefix 'B' in packets
• T4367 (bug): NAT - Config tmp file not available

3.2. 1.4 Sagitta 104

 VyOS Documentation, Release 1.5.x (circinus)

3.2.403 2022-08-29

• T4645 (bug): show nat source statistics lack argument --family

• T4634 (bug): Bgp neighbor disable-connected-check does not work
• T4631 (feature): Add port and protocol to nat66
• T4623 (feature): Add show conntrack statistics
• T4595 (bug): DPD interval and timeout do not work in DMVPN
• T4594 (feature): Rewrite op-mode IPsec to vyos.opmode format
• T4508 (bug): Problem with values of the same environment in different event handlers
• T4653 (bug): Interface offload options are not applied correctly
• T4546 (bug): Does not connect Cisco spoke to VyOS hub.
• T4061 (default): Add util function to check for completion of boot config
• T4654 (bug): RPKI cache incorrect description
• T4572 (bug): Add an option to force interface MTU to the value received from DHCP

3.2.404 2022-08-26

• T4642 (bug): proxy: hyphen not allowed in proxy URL

3.2.405 2022-08-25

• T4626 (bug): Error showing nat66 source and destination

• T4622 (feature): Firewall allow drop packets by TCP MSS size

3.2.406 2022-08-24

• T4641 (bug): prefix-list allows ipv6 prefix as input

• T4633 (feature): Change keepalived to v2.2.7

3.2.407 2022-08-23

• T4618 (bug): Traffic policy not set on virtual interfaces

• T4538 (bug): Macsec does not work correctly when the interface status changes.

3.2. 1.4 Sagitta 105

 VyOS Documentation, Release 1.5.x (circinus)

3.2.408 2022-08-22

• T4089 (bug): Show nat destination rules shows ip address instead of interface 'any'
• T4632 (bug): VLAN-aware bridge not working
• T4637 (feature): Upgrade to podman 4.2.0

3.2.409 2022-08-20

• T4596 (bug): "show openconnect-server sessions" command does not work in the
openconnect module

3.2.410 2022-08-19

• T4620 (bug): UPnP does not work due to incorrect template

• T4619 (bug): Static arp is not set if another entry is present
• T4611 (bug): UPnP rule IP should be a prefix instead of an address
• T4614 (feature): OpenConnect split-dns directive

3.2.411 2022-08-18

• T4613 (bug): UPnP configuration without listen option fail

• T4570 (bug): Exception when trying to set up VXLAN over Wireguard

3.2.412 2022-08-17

• T4598 (feature): nat66 - Add exclude options

• T4480 (default): add an ability to configure squid acl safe ports and acl ssl safe
ports

3.2.413 2022-08-16

• T4592 (bug): macsec: can not create two interfaces using the same source-interface
• T4584 (bug): hostap: create custom package build
• T4413 (default): Add an API endpoint with basic system stats
• T4537 (bug): MACsec not working with cipher gcm-aes-256

3.2. 1.4 Sagitta 106

 VyOS Documentation, Release 1.5.x (circinus)

3.2.414 2022-08-15

• T4609 (bug): Unable to Restart Container VyOS 1.4

• T4565 (bug): vlan aware bridge not working with - Kernel: T3318: update Linux
Kernel to v5.4.205 #249
• T3988 (default): Feature Request: IPsec Multiple local/remote prefix for the tunnel
• T2763 (feature): New SNMP resource request - SNMP over TCP

3.2.415 2022-08-14

• T4579 (bug): bridge: can not delete member interface CLI option when VLAN is
enabled
• T4421 (default): Add support for floating point numbers in the numeric validator
• T3507 (bug): Bond with mode LACP show u/u in show interfaces even if peer is not
configured

3.2.416 2022-08-12

• T4603 (feature): Need a config option to specify NAS-IP-Address for vpn l2tp

3.2.417 2022-08-10

• T4408 (feature): Add sshguard to protect against brut-forces

3.2.418 2022-08-08

• T4586 (feature): Add to NAT66: SNAT destination address and DNAT source address.

3.2.419 2022-08-04

• T4257 (feature): Discussion on changing BGP autonomous system number syntax

3.2.420 2022-08-02

• T4585 (feature): Rewrite op-mode containers to vyos.opmode

• T4515 (default): Reduce telegraf binary size

3.2. 1.4 Sagitta 107

 VyOS Documentation, Release 1.5.x (circinus)

3.2.421 2022-08-01

• T4581 (bug): 'show system cpu' not working

• T4578 (feature): Rewrite show dns forwarding statistics to new format

3.2.422 2022-07-31

• T4580 (bug): Handle the case of op-mode file names with hyphens in GraphQL schema/
resolver generation

3.2.423 2022-07-30

• T4575 (feature): vyos.utill add new wrapper "rc_cmd" to get the return code and
output
• T4562 (feature): Rewrite show vrf to new format
• T4545 (feature): Rewrite show nat source rules
• T4543 (bug): Show source nat statistics shows incorrect interface
• T4503 (default): Prevent op mode scripts from restarting services if there's a
commit in progress
• T4411 (feature): Add migration for service monitoring telegraf influxdb

3.2.424 2022-07-29

• T4554 (enhancment): Implement GraphQL resolvers for standardized op-mode scripts

• T4518 (feature): Add XML for CLI conf mode load-balancing wan
• T4544 (enhancment): Generate schema definitions from standardized op-mode scripts

3.2.425 2022-07-28

• T4531 (bug): NAT op-mode errors with exclude rules

• T3435 (bug): NAT rules show corruption

3.2.426 2022-07-27

• T4571 (bug): Sflow with vrf configured does not use vrf to validate agent-address IP
from vrf-configured interfaces
• T4552 (bug): Unable to reset IPsec IPv6 peer

3.2. 1.4 Sagitta 108

 VyOS Documentation, Release 1.5.x (circinus)

3.2.427 2022-07-26

• T4568 (bug): show vpn debug peer doesn't work

• T4556 (feature): fastnetmon: Allow configure white_list_path and populate with
hosts/networks that should be ignored.
• T4495 (feature): Combine BGP reset op commands

3.2.428 2022-07-25

• T4567 (default): Merge experimental branch of GraphQL development

• T4560 (bug): VRF and BGP neighbor local-as error
• T4493 (bug): Incorrect help for "show bgp neighbors"
• T1233 (bug): ipsec vpn sa showing down

3.2.429 2022-07-22

• T4145 (bug): Conntrack table not showing after firewall rewriting

3.2.430 2022-07-21

• T4555 (feature): fastnetmon: add IPv6 support

• T4553 (default): Allow to set ban time on ddos-protection configuration

3.2.431 2022-07-20

• T4056 (bug): Traffic policy not set in live configuration

3.2.432 2022-07-18

• T4523 (feature): OP-mode Extend conntrack output to get marks, zones and directions
• T4228 (bug): bond: OS error thrown when two bonds use the same member
• T4539 (feature): qat: update Intel QuickAssist release version 1.7.L.4.16.0-00017
• T4534 (bug): bond: bridge: error out if member interface is assigned to a VRF
instance
• T4525 (bug): Delete interface from VRF and add it to bonding error
• T4522 (feature): bond: add ability to specify mii monitor interval via CLI
• T4535 (feature): FRR: upgrade to stable/8.3 version
• T4521 (bug): bond: ARP monitor interval is not configured despite set via CLI
• T4540 (feature): firmware: update to Linux release 20220708

3.2. 1.4 Sagitta 109

 VyOS Documentation, Release 1.5.x (circinus)

3.2.433 2022-07-17

• T4028 (bug): FRR 8.1 routes not being applied to routing table after reboot if an
interface has 2 ip addresses

3.2.434 2022-07-15

• T4494 (bug): Cannot reset BGP peer within VRF

• T4536 (feature): FRR: move to systemd for daemon control

3.2.435 2022-07-14

• T4491 (bug): Use empty string for internal name of root node of config_tree

3.2.436 2022-07-13

• T1375 (feature): Add clear dhcp server lease function

3.2.437 2022-07-12

• T4527 (bug): Prevent to create VRF name default

• T4084 (default): Dehardcode the default login banner
• T3948 (feature): IPSec VPN: Add a new option "none" for the connection-type
• T235 (feature): Ability to configure manual IP Rules

3.2.438 2022-07-10

• T3836 (bug): Setting a default IPv6 route while getting IPv4 gateway via DHCP
removes the IPv4 gateway

3.2.439 2022-07-09

• T4507 (feature): IPoE-server add multiplier option for shaper

• T4499 (bug): NAT source translation not showing a single output
• T4468 (bug): web-proxy source group cannot start with a number bug
• T4373 (feature): PPPoE-server add multiplier option for shaper
• T3353 (bug): PPPoE server wrong vlan-range generating config
• T3648 (bug): op-mode: nat rules broken
• T4517 (feature): ip: Add options to enable directed broadcast forwarding

3.2. 1.4 Sagitta 110

 VyOS Documentation, Release 1.5.x (circinus)

3.2.440 2022-07-07

• T4456 (bug): NTP client in VRF tries to bind to interfaces outside VRF, logs many
messages
• T4509 (feature): Feature Request: DNS64

3.2.441 2022-07-06

• T4513 (bug): Webproxy monitor commands do not work

• T4299 (feature): Firewall - GeoIP filtering

3.2.442 2022-07-05

• T4378 (bug): Unable to submit wildcard ("*.example.com") A or AAAA records in dns

forwarder
• T2683 (default): no dual stack in system static-host-mapping host-name
• T478 (feature): Firewall address group (multi and nesting)

3.2.443 2022-07-04

• T4501 (bug): Syslog-identifier does not work in event handler

• T3600 (bug): DHCP Interface static route breaks PBR
• T4498 (feature): bridge: Add option to enable/disable IGMP/MLD snooping

3.2.444 2022-07-01

• T2455 (bug): No support for the IPv6 VTI

• T4490 (feature): BGP- warning message that AFI/SAFI is needed to establish the
neighborship
• T4489 (bug): MPLS sysctl not persistent for tunnel interfaces

3.2.445 2022-06-29

• T4477 (feature): router-advert: support RDNSS lifetime option

3.2.446 2022-06-28

• T4486 (bug): Container can't be deleted

• T4473 (bug): Use container network without network declaration error
• T4458 (feature): Firewall - add support for matching ip ttl in firewall rules
• T3907 (feature): Firewall - Set log levels

3.2. 1.4 Sagitta 111

 VyOS Documentation, Release 1.5.x (circinus)

3.2.447 2022-06-27

• T4484 (default): Firewall op-mode summary doesn't correctly handle address group
containing ranges

3.2.448 2022-06-25

• T4482 (bug): dhcp: toggle of "dhcp-options no-default-route" has no effect

• T4483 (feature): Upgrade fastnetmon to v1.2.2 community edition

3.2.449 2022-06-22

• T1748 (feature): vbash: beautify tab completion output/line breaks

3.2.450 2022-06-20

• T1856 (feature): Support configuring IPSec SA bytes

3.2.451 2022-06-18

• T4467 (bug): Validator Does Not Accept Signed Numbers

3.2.452 2022-06-17

• T4209 (bug): Firewall incorrect handler for recent count and time

3.2.453 2022-06-16

• T4352 (bug): wan-load balance - priority traffic rule doesn't work

3.2.454 2022-06-15

• T4450 (feature): Route-map - Extend options for ip|ipv6 address match

• T4449 (feature): Route-map - Extend options for ip next-hop match
• T990 (feature): Make DNAT/SNAT a valid state in firewall rules.

3.2.455 2022-06-12

• T4420 (feature): Feature Request: ocserv: show configured 2FA OTP key
• T4380 (default): Feature Request: ocserv: 2FA OTP key generator in VyOS CLI

3.2. 1.4 Sagitta 112

 VyOS Documentation, Release 1.5.x (circinus)

3.2.456 2022-06-10

• T4365 (bug): NAT - Error on setting up tables

• T4465 (feature): node.def generation misses whitespace on multiple use of <path>

3.2.457 2022-06-09

• T4444 (default): sstp: Feature request. Port number changing support

• T2580 (feature): Support for ip pools for ippoe

3.2.458 2022-06-08

• T4447 (bug): DHCPv6 prefix delegation `sla-id` limited to 128

3.2.459 2022-05-31

• T4212 (default): PermissionError when generating/installing server Certificate

(generate pki certificate sign ...)
• T4199 (bug): Commit failed when setting icmpv6 type any
• T4148 (bug): Firewall - Error messages not that clear as it were in old firewall
• T3659 (bug): Configuration won't accept IPv6 addresses for site-to-site VPN tunnel
prefixes/traffic selectors

3.2.460 2022-05-30

• T4315 (feature): Telegraf - Output to prometheus

3.2.461 2022-05-29

• T2473 (feature): Xml for EIGRP [conf_mode]

3.2.462 2022-05-28

• T4448 (feature): rip: add support for explicit version selection

3.2.463 2022-05-26

• T4442 (feature): HTTP API add action "reset"

3.2. 1.4 Sagitta 113

 VyOS Documentation, Release 1.5.x (circinus)

3.2.464 2022-05-25

• T4410 (feature): Telegraf - Output to Splunk

• T4382 (bug): Replacing legacy loadFile exposes missing steps in migration scripts
and other errors

3.2.465 2022-05-21

• T4437 (bug): flow-accounting: support IPv6 flow collectors

3.2.466 2022-05-20

• T4418 (feature): Telegraf - output Plugin azure-data-explorer

3.2.467 2022-05-19

• T4434 (bug): DMVPN: cisco-authentication password length is 8 characters

• T3938 (default): Rewrite the uptime script in Python to allow using it as a library
• T4334 (default): Make the config lexer reentrant

3.2.468 2022-05-17

• T4424 (bug): policy local-route6 shows ipv4 format

3.2.469 2022-05-16

• T4377 (default): generate tech-support archive includes previous archives

3.2.470 2022-05-12

• T4417 (bug): VRRP doesn't start with conntrack-sync

• T4100 (feature): Firewall increase maximum number of rules

3.2.471 2022-05-11

• T4405 (bug): DHCP client sometimes ignores `no-default-route` option of an interface

3.2. 1.4 Sagitta 114

 VyOS Documentation, Release 1.5.x (circinus)

3.2.472 2022-05-10

• T4156 (default): Adding DHCP Option 13 (bootfile-size)

• T1972 (feature): Allow setting interface name for virtual_ipaddress in VRRP VRID

3.2.473 2022-05-07

• T4361 (bug): `vyos.config.exists()` does not work for nodes with multiple values
• T4354 (bug): Slave interfaces fall out from bonding during configuration change
• T4419 (feature): vrf: support to disable IP forwarding within a given VRF

3.2.474 2022-05-06

• T4385 (bug): bgp: peer-group member cannot override remote-as of peer-group

3.2.475 2022-05-05

• T4414 (feature): Add route-map "as-path prepend last-as x" option

3.2.476 2022-05-03

• T4395 (feature): Extend show vpn debug

3.2.477 2022-05-01

• T4369 (bug): OpenVPN: daemon not restarted on changes to "openvpn-option" CLI node
• T4363 (bug): salt-minion: default mine_interval option is not set
• T4353 (feature): Add Jinja2 linter to vyos-1x build process

3.2.478 2022-04-29

• T4388 (bug): dhcp-server: missing constraint on tftp-server-name option

• T4366 (bug): geneve: interface is removed on changes to e.g. description

3.2.479 2022-04-28

• T4400 (bug): Container OP mode has delete where show and update should be

3.2. 1.4 Sagitta 115

 VyOS Documentation, Release 1.5.x (circinus)

3.2.480 2022-04-27

• T4398 (bug): IPSec site-to-site generates unexpected passthrough option

• T4397 (feature): arp: migrate static ARP entry configuration to get_config_dict()
and make it VRF aware
• T4357 (feature): Allow free-form setting of DHCPv6 server options

3.2.481 2022-04-26

• T4210 (bug): NAT source/destination negated ports throws an error

• T4235 (default): Add config tree diff algorithm

3.2.482 2022-04-25

• T4390 (feature): op-mode: extend "show log" and "monitor log" with additional
daemons/subsystems to read journalctl logs
• T4391 (bug): PPPoE: IPv6 not working after system boot

3.2.483 2022-04-24

• T4342 (bug): "show ip ospf neighbor address x.x.x.x" gives "unknown command" error

3.2.484 2022-04-23

• T4386 (default): Applying limiter on traffic-policy "in" fails, incorrectly reports

mirror or redirect policy in use

3.2.485 2022-04-22

• T4389 (feature): dhcp: add vendor option support for Ubiquity Unifi controller

3.2.486 2022-04-21

• T4384 (feature): pppoe: replace default-route CLI option with common CLI nodes
already present for DHCP

3.2.487 2022-04-20

• T4345 (bug): New firewall code does not accept "rate/time interval" syntax used in
old config
• T4231 (feature): Feature Request: ocserv: 2FA (password+OTP) support in
Openconnect

3.2. 1.4 Sagitta 116

 VyOS Documentation, Release 1.5.x (circinus)

3.2.488 2022-04-19

• T4379 (bug): PPPoE: default-route lost after applying additional static routes
• T4344 (bug): DHCP statistics not matching, conf-mode generates incorrect pool name
with dash
• T4268 (bug): Elevated LA while using VyOS monitoring feature

3.2.489 2022-04-18

• T4351 (bug): Openvpn conf-mode "openvpn-option" is not respected

• T4278 (default): vyos-vm-images: fix vagrant libvirt box
• T4368 (bug): bgp: AS specified for local as is the same as the remote as and this
is not allowed.
• T4370 (feature): vxlan: geneve: support configuration of df bit option

3.2.490 2022-04-15

• T4327 (default): Ethernet interface configuration fails on Hyper-V due to speed/

duplex/autoneg ethtool command error
• T4364 (feature): salt-minion: Upgrade to 3004 and migrate to get_config_dict()

3.2.491 2022-04-13

• T4333 (feature): Jinja2: add plugin to test if a variable is defined and not none
to reduce template complexity

3.2.492 2022-04-08

• T4331 (bug): IPv6 link local addresses are not configured when an interface is in a
VRF
• T4347 (default): Return complete and consistent error codes from HTTP API
• T4339 (bug): wwan: tab-completion results in "No such file or directory" if there
is no WWAN interface
• T4338 (bug): wwan: changing interface description should not trigger reconnect
• T4324 (bug): wwan: check alive script should only be run via cron if a wwan
interface is configured at all

3.2. 1.4 Sagitta 117

 VyOS Documentation, Release 1.5.x (circinus)

3.2.493 2022-04-07

• T4330 (bug): MTU settings cannot be applied when IPv6 is disabled

• T4346 (feature): Deprecate "system ipv6 disable" option to disable address family
within OS kernel
• T4319 (bug): The command "set system ipv6 disable" doesn't work as expected.
• T4341 (feature): login: disable user-account prior to deletion and wait until
deletion is complete
• T4336 (feature): isis: add support for MD5 authentication password on a circuit

3.2.494 2022-04-06

• T4308 (feature): Op-comm "Show log frr" to view specific protocol logs

3.2.495 2022-04-04

• T4329 (bug): Bgp policy route-map bug with set several extcommunity rt

3.2.496 2022-04-02

• T4335 (bug): open-vmdk fails to build under gcc-10.+

3.2.497 2022-04-01

• T4332 (bug): bgp: deterministic-med cannot be disabled while

addpath-tx-bestpath-per-AS is in use

3.2.498 2022-03-31

• T4326 (feature): Add bgp option no-suppress-duplicates

• T4323 (default): ospf6d crashes on latest vyos nightly

3.2.499 2022-03-29

• T3686 (bug): Bridging OpenVPN tap with no local-address breaks

• T3635 (default): Add ability to use mDNS repeater with VRRP

3.2. 1.4 Sagitta 118

 VyOS Documentation, Release 1.5.x (circinus)

3.2.500 2022-03-26

• T4321 (default): Allow BGP neighbors between different VIFs on the same VyOS

3.2.501 2022-03-24

• T4301 (bug): The "arp-monitor" option in bonding interface settings does not work
• T4294 (bug): Adding a new openvpn-option does not restart the OpenVPN process
• T4290 (bug): BGP source-interface fails to commit
• T4230 (bug): OpenVPN server configuration deleted after reboot when using a VRRP
virtual-address

3.2.502 2022-03-23

• T4314 (bug): Latest 1.4 Rolling release config migration error

3.2.503 2022-03-21

• T4304 (feature): [OSPF]import/export filter inter-area prefix

3.2.504 2022-03-20

• T4298 (default): vyos-vm-images: fix ansible group name and remove obsolete empty
command

3.2.505 2022-03-18

• T4286 (bug): Fix for firewall ipv6 name address validator

3.2.506 2022-03-15

• T4302 (feature): FRRouting upgrade to release 8.2.2

• T4293 (default): Add "set ip-next-hop unchanged" in route-map

3.2.507 2022-03-14

• T4275 (default): Incorrect val_help for local/remote prefix in ipsec vpn

3.2. 1.4 Sagitta 119

 VyOS Documentation, Release 1.5.x (circinus)

3.2.508 2022-03-12

• T4296 (bug): Interface config injected by Cloud-Init may interfere with VyOS native
• T4265 (feature): Add op-mode for bgp flowspec state and routes

3.2.509 2022-03-11

• T4297 (bug): Interface configuration saving fails for ice/iavf based interfaces
because they can't change speed/duplex settings

3.2.510 2022-03-09

• T3981 (feature): VRF support for flow-accounting

3.2.511 2022-03-05

• T4259 (bug): The conntrackd daemon can be started wrongly

3.2.512 2022-03-03

• T4283 (feature): Add support to "reject" routes - emit an ICMP unreachable when
matched

3.2.513 2022-03-01

• T4277 (feature): flow-accounting: support sending flow-data via VRF interface

3.2.514 2022-02-28

• T4273 (bug): ssh: Upgrade from 1.2.X to 1.3.0 breaks config

• T4115 (bug): reboot in <x> not working as expected
• T3656 (bug): IPSec 1.4 : "show vpn ike sa" does not show the correct default ike
version

3.2.515 2022-02-26

• T4272 (feature): lldp: migrate Python script to use get_config_dict()

3.2. 1.4 Sagitta 120

 VyOS Documentation, Release 1.5.x (circinus)

3.2.516 2022-02-24

• T4267 (bug): Error - Missing required "ip key" parameter

3.2.517 2022-02-23

• T4194 (bug): prefix-list no check for duplicate entries

• T4264 (bug): vxlan: interface is destroyed and rebuild on description change
• T4263 (bug): vyos.util.leaf_node_changed() dos not honor valueLess nodes

3.2.518 2022-02-21

• T4120 (feature): [VXLAN] add ability to set multiple unicast-remotes

3.2.519 2022-02-20

• T4254 (feature): VPN IPSec charon add options cisco_flexvpn and

install_virtual_ip_on
• T4249 (feature): Add support for device mapping in containers
• T3617 (bug): IPSec 1.4 generate invalid configuration
• T4261 (feature): MACsec: add DHCP client support
• T4203 (bug): Reconfigure DHCP client interface causes brief outages

3.2.520 2022-02-19

• T4258 (bug): [DHCP-SERVER] error parameter on Failover

3.2.521 2022-02-17

• T4255 (bug): Unexpected print of dict bridge on delete

• T4240 (bug): Cannot add wlan0 to bridge via configure
• T4154 (bug): Error add second gre tunnel with the same source interface

3.2.522 2022-02-16

• T4237 (bug): Conntrack-sync error - error adding listen-address command

3.2. 1.4 Sagitta 121

 VyOS Documentation, Release 1.5.x (circinus)

3.2.523 2022-02-15

• T4160 (bug): Firewall - Error in rules that matches everything except something
• T3006 (bug): Accel-PPP & vlan-mon config get invalid VLAN
• T3494 (bug): DHCPv6 leases traceback when PD using
• T1292 (bug): Issues while deleting all rules from a firewall

3.2.524 2022-02-13

• T4242 (bug): ethernet speed/duplex can never be switched back to auto/auto

• T4191 (bug): Lost access to host after VRF re-creating

3.2.525 2022-02-11

• T3872 (feature): Add configurable telegraf monitoring service

3.2.526 2022-02-08

• T4227 (bug): Typo in help completion of hello-time option of bridge interface

3.2.527 2022-02-07

• T4233 (bug): ssh: sync regex for allow/deny usernames to "system login"

3.2.528 2022-02-06

• T4223 (bug): policy route cannot have several entries with the same table
• T4216 (bug): Firewall: can't use negated groups in firewall rules
• T4178 (bug): policy based routing tcp flags issue
• T4164 (bug): PBR: network groups (as well as address and port groups) don't resolve
in `nftables_policy.conf`
• T3970 (feature): Add support for op-mode PKI direct install into an active config
session
• T3828 (bug): ipsec: Subtle change in "pfs enable" behavior from equuleus -> sagitta

3.2. 1.4 Sagitta 122

 VyOS Documentation, Release 1.5.x (circinus)

3.2.529 2022-02-05

• T4226 (bug): VRRP transition-script does not work for groups name which contains
-(minus) sign

3.2.530 2022-02-04

• T4196 (bug): DHCP server client-prefix-length parameter results in non-functional

leases

3.2.531 2022-02-03

• T4218 (bug): firewall: rule name is not allowed to start with a number
• T3643 (bug): show vpn ipsec sa doesn't show tunnels in "down" state

3.2.532 2022-02-01

• T4224 (bug): Ethernet interfaces configured for DHCP not working on latest rolling
snapshot (vyos-1.4-rolling-202201291849-amd64.iso)
• T4225 (bug): Performance degration with latest rolling release
• T4220 (bug): Commit broke dhclient 78b247b724f74bdabab0706aaa7f5b00e5809bc1
• T4138 (bug): NAT configuration allows to set incorrect port range and invalid port

3.2.533 2022-01-28

• T4184 (bug): NTP allow-clients address doesn't work it allows to use ntp server for
all addresses
• T4217 (bug): firewall: port-group requires protocol to be set - but not in VyOS 1.3

3.2.534 2022-01-27

• T4213 (default): ipv6 policy routing not working anymore

• T4188 (bug): Firewall does not correctly handle conntracking
• T3762 (feature): Support network and address groups for policy ipv6-route
• T3560 (feature): Ability to create groups of MAC addresses
• T3495 (feature): Modernising port/protocol definitions

3.2. 1.4 Sagitta 123

 VyOS Documentation, Release 1.5.x (circinus)

3.2.535 2022-01-25

• T4205 (feature): Disable Debian Version in SSH (DebianBanner->no)

• T4131 (bug): Show firewall group incorrect format members

3.2.536 2022-01-24

• T4204 (feature): Update Accel-PPP to a newer revision

• T1795 (default): Commit rollback by timeout

3.2.537 2022-01-23

• T4186 (bug): Firewall icmp type - Offered options not supported

• T4181 (bug): Firewall ipv6-network-group - incorrect description on helper

3.2.538 2022-01-21

• T4200 (bug): Assigning ipv6-name to interface is not generating nftables rules

• T4144 (bug): Firewall address-group - Improve error messages
• T4137 (bug): Firewall group configuration allows to set incorrect port range and
invalid port
• T4133 (bug): Firewall network group error with zone-based firewall rules

3.2.539 2022-01-20

• T4171 (bug): Interface config migration error on 1.2.8 -> 1.4 upgrade

3.2.540 2022-01-19

• T4195 (feature): [OSPF-ECMP]enable set maximun-path

3.2.541 2022-01-18

• T4159 (bug): Empty firewall group (address, network & port) generates invalid
nftables config, commit fails
• T4155 (bug): PBR: `set table main` fails in `firewall.py` with newer rolling
releases
• T3873 (feature): Zone based Firewall - Filter traffic in same zone
• T3286 (feature): Switch the firewall from iptables to nftables
• T292 (feature): [ZBF] Allow filtering intra zone traffic

3.2. 1.4 Sagitta 124

 VyOS Documentation, Release 1.5.x (circinus)

3.2.542 2022-01-17

• T3164 (bug): console-server ssh does not work with RADIUS PAM auth

3.2.543 2022-01-15

• T4183 (feature): IPv6 link-local address not accepted as wireguard peer

• T4150 (bug): VRRP with conntrack-sync does not work
• T4110 (feature): [IPV6-SSH/DNS} enable IPv6 link local adresses as listen-address
%eth0

3.2.544 2022-01-14

• T4182 (bug): Show vrrp if vrrp not configured bug

• T4179 (feature): Add op-mode CLI for show high-availability virtual-server

3.2.545 2022-01-13

• T4175 (bug): BGP configuration failed

• T4109 (feature): Extend high-availability/keepalived for support virtual-server lb

3.2.546 2022-01-12

• T4174 (bug): Validation fails when entering port range with upper port 65535
• T4162 (bug): VPN ipsec ike-group - Incorrect value help for ikev2-reauth
• T4161 (bug): Policy route-map - Incorrect value help for local preference
• T4152 (bug): NHRP shortcut-target holding-time does not work

3.2.547 2022-01-11

• T4149 (bug): [Firewall-IPV6] Error delete Fw rules on VIF/INT

• T3950 (bug): CLI backtrace on update if DNS not defined
• T4166 (bug): Debug output missing when frr.py called under vyos-configd

3.2.548 2022-01-10

• T3299 (bug): Allow the web proxy service to listen on all IP addresses
• T3115 (feature): Add support for firewall on L3 VIF bridge interface

3.2. 1.4 Sagitta 125

 VyOS Documentation, Release 1.5.x (circinus)

3.2.549 2022-01-09

• T4142 (bug): Input ifbX interfaces not displayed in op-mode

• T3914 (bug): VRRP rfc3768-compatibility doesn't work with unicast peers

3.2.550 2022-01-08

• T4116 (bug): Webproxy/Squid not working with IPv6 listen-address

3.2.551 2022-01-07

• T3924 (bug): VRRP stops working with VRF

3.2.552 2022-01-06

• T4135 (bug): Declare zone policy firewall without local zone errors
• T4130 (bug): Firewall state policy errors chain
• T4141 (bug): Set high-availability vrrp sync-group without members error

3.2.553 2022-01-04

• T4134 (bug): Incorrect firewall protocol completion help uppercase and duplicates
• T4132 (bug): Impossible to show a specific firewall group

3.2.554 2022-01-03

• T4126 (feature): Ability to set priority to site to site IPSec vpn tunnels
• T4052 (bug): Validator return traceback on VRRP configuration with the script path
not in config dir
• T4128 (bug): keepalived: Upgrade package to add VRF support

3.2.555 2021-12-31

• T4081 (bug): VRRP health-check script stops working when setting up a sync group

3.2.556 2021-12-30

• T4124 (feature): snmp: migrate to get_config_dict()

3.2. 1.4 Sagitta 126

 VyOS Documentation, Release 1.5.x (circinus)

3.2.557 2021-12-29

• T4111 (bug): IPSec generates wrong configuration colons for IPv6 peers
• T4023 (feature): Add grepcidr or similar functionality
• T4086 (default): system login banner is not removed on deletion.

3.2.558 2021-12-28

• T3380 (bug): "show vpn ike sa" does not display IPv6 peers

3.2.559 2021-12-27

• T3979 (bug): vyos-hostd unable to hostfile-update

• T2566 (bug): sstp not able to run tunnels ipv6 only
• T4093 (bug): SNMPv3 snmpd.conf generation bug
• T2764 (enhancment): Increase maximum number of NAT rules

3.2.560 2021-12-26

• T4104 (bug): RAID1: "add raid md0 member sda1" does not restore boot sector
• T4108 (default): OSPFv3: add support for auto-cost parameter
• T4107 (default): OSPFv3: add support for "default-information originate"

3.2.561 2021-12-25

• T4101 (bug): commit-archive: Use of uninitialized value $source_address in

concatenation
• T4099 (feature): flow-accounting: sync "source-ip" and "source-address" between
netflow and sflow ion CLI
• T4097 (feature): flow-accounting: migrate implementation to get_config_dict()
• T4105 (feature): flow-accounting: drop "sflow agent-address auto"
• T4106 (feature): flow-accounting: support specification of capture packet lenght
• T4102 (feature): OSPFv3: add support for NSSA area-type
• T4055 (feature): Add VRF support for HTTP(S) API service

3.2. 1.4 Sagitta 127

 VyOS Documentation, Release 1.5.x (circinus)

3.2.562 2021-12-24

• T3854 (bug): Missing op-mode commands for conntrack-sync

3.2.563 2021-12-23

• T3354 (default): Convert strip-private script from Perl to Python

3.2.564 2021-12-22

• T3678 (bug): VyOS 1.4: Invalid error message while deleting ipsec vpn configuration
• T3356 (feature): Script for remote file transfers

3.2.565 2021-12-21

• T4083 (bug): Cluster heartbeat doesn't start b.c lack of directory /run/heartbeat/
• T4070 (bug): NATv4 : inbound-interface type "any" is missing.
• T4053 (bug): VRRP impossible to set scripts out of the /config directory
• T3931 (bug): SSTP doesn't work after rewriting to PKI

3.2.566 2021-12-20

• T4088 (default): Fix typo in login banner

3.2.567 2021-12-19

• T3912 (default): Use a more informative default post-login banner

3.2.568 2021-12-17

• T4059 (bug): VRRP sync-group transition script does not persist after reboot

3.2.569 2021-12-16

• T4046 (feature): Sflow - Add Source address parameter

• T3556 (bug): Commit-archive via scp causes 100% CPU on boot
• T4076 (enhancment): Allow setting CORS options in HTTP API
• T4037 (default): HTTP transfers do not follow redirects
• T4029 (default): Broken SFTP uploads

3.2. 1.4 Sagitta 128

 VyOS Documentation, Release 1.5.x (circinus)

3.2.570 2021-12-15

• T4077 (bug): op-mode: bfd: drop "show protocols bfd" in favour of "show bfd"
• T4073 (bug): "show protocols bfd peer <>" shows incorrect peer information.

3.2.571 2021-12-14

• T4071 (feature): Allow HTTP API to bind to unix domain socket

3.2.572 2021-12-12

• T4069 (feature): BGP: add additional available parameters to VyOS CLI

• T4036 (bug): VXLAN incorrect raiseError if set multicast network instead of singe
address

3.2.573 2021-12-10

• T4068 (feature): Python: ConfigError should insert line breaks into the error
message

3.2.574 2021-12-09

• T4033 (bug): VRRP - Error security when setting scripts

• T4064 (bug): IP address for vif is not removed from the system when deleted in
configuration
• T4060 (enhancment): Extend configquery for use before boot configuration is complete
• T4058 (bug): BFD: add BGP and OSPF "bfd profile" support
• T4054 (bug): BFD profiles configuration incorrect behavior.

3.2.575 2021-12-07

• T4041 (servicerequest): "transition-script" doesn't work on "sync-group"

3.2.576 2021-12-06

• T4012 (feature): Add VRF support for TFTP

3.2. 1.4 Sagitta 129

 VyOS Documentation, Release 1.5.x (circinus)

3.2.577 2021-12-04

• T4049 (feature): support command-style output with compare command

• T4047 (bug): Wrong regex validation in XML definitions
• T4042 (bug): BGP L2VPN / EVPN and RD type 0 set
• T4048 (bug): BGP: L2VPN/EVPN and individual RD and RT settings for each VNI
• T4045 (bug): Unable to "format disk <new> like <old>"
• T4044 (feature): BFD: add vrf support
• T4043 (feature): BFD: add support for passive mode

3.2.578 2021-12-02

• T4035 (bug): Geneve interfaces aren't displayed by operational mode commands

3.2.579 2021-12-01

• T3695 (bug): OpenConnect reports commit success when ocserv fails to start due to
SSL cert/key file issues

3.2.580 2021-11-30

• T4010 (bug): DMVPN generates incorrect configuration life_time for swanctl.conf

• T3725 (feature): show configuration in json format

3.2.581 2021-11-29

• T3946 (enhancment): Automatically resize the root partition if the drive has extra
space

3.2.582 2021-11-28

• T3999 (bug): show lldp neighbor Traceback error

• T3928 (feature): Add OSPFv3 VRF support

3.2.583 2021-11-27

• T3755 (feature): ospf: adjust to new FRR 8 syntax where "no passive-interface "
moved to interface section
• T3753 (feature): frr: upgrade to stable/8.1 release train

3.2. 1.4 Sagitta 130

 VyOS Documentation, Release 1.5.x (circinus)

3.2.584 2021-11-26

• T3978 (bug): containers add network without declaring prefix raise ConfigError

3.2.585 2021-11-25

• T4006 (default): Add additional Linux capabilities to container configuration

• T3986 (bug): Incorrect description for vpn ipsec site-to-site authentication and
connection

3.2.586 2021-11-24

• T4015 (feature): Update Accel-PPP to a newer revision

• T3865 (bug): loadkey command help text missing escape sequence
• T1083 (feature): Implement persistent/random address and port mapping options for
NAT rules

3.2.587 2021-11-23

• T3990 (bug): WATCHFRR: crashlog and per-thread log buffering unavailable (due to
files left behind in /var/tmp/frr/ after reboot)

3.2.588 2021-11-20

• T3998 (bug): route-target completion incorrect description

3.2.589 2021-11-19

• T4003 (bug): API for "show interfaces ethernet" does not include the interface
description
• T4011 (bug): ethernet: deleting interface should place interface in admin down
state

3.2.590 2021-11-18

• T3612 (bug): IPoE Server address pool issues.

• T3995 (feature): OpenVPN: do not stop/start service on configuration change
• T4008 (feature): dhcp: change client retry interval form 300 -> 60 seconds
• T3795 (bug): WWAN: issues with non connected interface / no signal
• T3510 (bug): RADIUS usersname is not shown on CLI

3.2. 1.4 Sagitta 131

 VyOS Documentation, Release 1.5.x (circinus)

3.2.591 2021-11-17

• T3350 (bug): OpenVPN config file generation broken

• T3996 (bug): SNMP service error in log

3.2.592 2021-11-15

• T3994 (bug): VRF: unable to delete vrf when name contains numbers, hyphen or
underscore
• T3960 (bug): FRR Misconfig when using multiple VRF VNI
• T3724 (feature): Allow setting host-name in l2tp section of accel-ppp
• T645 (feature): Allow multiple prefixes in ipsec tunnel

3.2.593 2021-11-10

• T3966 (default): OpenVPN fix the smoketests

• T3834 (default): [OPENVPN] Support for Two Factor Authentication totp.
• T3982 (bug): DHCP server commit fails if static-mapping contains + or .

3.2.594 2021-11-09

• T3962 (bug): Image cannot be built without open-vm-tools

3.2.595 2021-11-07

• T3626 (bug): Configuring and disabling DHCP Server

3.2.596 2021-11-06

• T3514 (bug): NIC flap at any interface change

3.2.597 2021-11-05

• T3972 (bug): Removing vif-c interface raises KeyError

3.2.598 2021-11-04

• T3969 (bug): Container incorrect raiseError format if network doesn't exist

• T3662 (bug): Container configuration upgrade destroys system
• T3964 (bug): SSTP: local-user static-ip CLI node accepts invalid IPv4 addresses

3.2. 1.4 Sagitta 132

 VyOS Documentation, Release 1.5.x (circinus)

3.2.599 2021-11-03

• T3952 (default): Add sh bgp ipv4/ipv6 vpn command

• T3610 (bug): DHCP-Server creation for not primary IP address fails

3.2.600 2021-11-01

• T3958 (default): OpenVPN breaks the smoketests

• T3956 (bug): GRE tunnel - unable to move from source-interface to source-address,
commit error

3.2.601 2021-10-31

• T3945 (feature): Add route-map for bgp aggregate-address

• T3954 (bug): FTDI cable makes VyOS sagitta latest hang, /dev/serial unpopulated,
config system error
• T3943 (bug): "netflow source-ip" prevents image upgrades if IP address does not
exist locally

3.2.602 2021-10-29

• T3942 (feature): Generate IPSec debug archive from op-mode

3.2.603 2021-10-28

• T3951 (bug): After resetting vti ipsec tunnel old child SA still active
• T3941 (bug): "show vpn ipsec sa" shows established time of parent SA not child SA's
• T3916 (feature): Add additional Linux capabilities to container configuration

3.2.604 2021-10-27

• T3944 (bug): VRRP fails over when adding new group to master

3.2.605 2021-10-22

• T3897 (feature): Dynamic DNS doesn't work with IPv6 addresses

• T3832 (feature): Allow to set DHCP client-id in hexadecimal format
• T3188 (bug): Tunnel local-ip to dhcp-interface Change Fails to Update
• T3917 (default): Use Avahi as mDNS repeater for IPv6 support

3.2. 1.4 Sagitta 133

 VyOS Documentation, Release 1.5.x (circinus)

3.2.606 2021-10-21

• T3926 (bug): strip-private does not sanitize "cisco-authentication" from NHRP

configuration
• T3925 (feature): Tunnel: dhcp-interface not implemented - use source-interface
instead
• T3923 (feature): Kernel: Enable TLS/IPSec offload support for Mellanox ConnectX
NICs
• T3927 (feature): Kernel: Enable kernel support for HW offload of the TLS protocol

3.2.607 2021-10-20

• T3918 (bug): DHCPv6 prefix delegation incorrect verify error

• T3921 (bug): tunnel: KeyError when using dhcp-interface

3.2.608 2021-10-19

• T3396 (bug): syslog can't be configured with an ipv6 literal destination in 1.2.x

3.2.609 2021-10-18

• T3002 (default): VRRP change on IPSec interface causes packet routing issues

3.2.610 2021-10-17

• T3786 (bug): GRE tunnel source address 0.0.0.0 error

• T3217 (default): Save FRR configuration on each commit
• T3381 (bug): Change GRE tunnel failed
• T3254 (bug): Dynamic DNS status shows incorrect last update time
• T1243 (bug): BGP local-as accept wrong values
• T697 (bug): Clean up and sanitize package dependencies
• T578 (feature): Support Linux Container

3.2.611 2021-10-16

• T3879 (bug): GPG key verification fails when upgrading from a 1.3 beta version

3.2. 1.4 Sagitta 134

 VyOS Documentation, Release 1.5.x (circinus)

3.2.612 2021-10-15

• T3748 (bug): Container deletion bug

• T3693 (feature): ISIS Route redistribution ipv6 support missing
• T3676 (feature): Container option to add Linux capabilities
• T3613 (feature): Selectors for route-based IPsec tunnel (vti)
• T3692 (bug): VyOS build failing due to repo.saltstack.com
• T3673 (feature): BGP large-community del operation missing

3.2.613 2021-10-14

• T3811 (bug): NAT (op_mode): NAT op_mode command fails.

• T3801 (feature): containers: do not use podman CLI to create container networks

3.2.614 2021-10-13

• T3904 (bug): NTP pool associations silently fail

• T3277 (feature): DNS Forwarding - reverse zones

3.2.615 2021-10-12

• T3216 (bug): Removal of restricted-shell broke configure mode for RADIUS users
• T3881 (bug): Wrong description for container section restart
• T3868 (bug): Regex and/or wildcard not accepted with large-community-list
• T3701 (bug): ipoe server fails to start when configuring radius dynamic-author on
ipoe

3.2.616 2021-10-10

• T3750 (bug): pdns-recursor 4.4 issue with dont-query and private DNS servers
• T3885 (default): dhcpv6-pd: randomly generated DUID is not persisted
• T3899 (enhancment): Add support for hd44780 LCD displays

3.2.617 2021-10-09

• T3894 (bug): Tunnel Commit Failed if system does not have `eth0`

3.2. 1.4 Sagitta 135

 VyOS Documentation, Release 1.5.x (circinus)

3.2.618 2021-10-08

• T3893 (bug): MGRE Tunnel commit crash If sit tunnel available

3.2.619 2021-10-05

• T3741 (feature): [BGP] default no-ipv4-unicast - by default

3.2.620 2021-10-04

• T3888 (bug): Incorrect warning when poweroff command executed from configure mode.
• T3890 (feature): dhcp(v6): provide op-mode commands to retrieve both server and
client logfiles
• T3889 (feature): Migrate to journalctl when reading daemon logs

3.2.621 2021-10-03

• T3880 (bug): EFI boot shows error on display

3.2.622 2021-10-02

• T3882 (feature): Upgrade PowerDNs recursor to 4.5 series

• T3883 (bug): VRF - Delette vrf config on interface

3.2.623 2021-09-30

• T3874 (bug): D-Link Ethernet Interface not working.

• T3869 (default): Rewrite vyatta_net_name/vyatta_interface_rescan in Python

3.2.624 2021-09-28

• T3853 (default): nat66 rules gets deleted on reboot in 1.4-rolling-202109240217

3.2.625 2021-09-27

• T3863 (default): nat66: commit fails/hangs on non existing interface

3.2. 1.4 Sagitta 136

 VyOS Documentation, Release 1.5.x (circinus)

3.2.626 2021-09-26

• T3860 (bug): Error on pppoe, tunnel and wireguard interfaces for IPv6 EUI64
addresses
• T3857 (feature): reboot: send wall message to all users for information
• T3867 (bug): vxlan: multicast group address is not validated
• T3859 (bug): Add "log-adjacency-changes" to ospfv3 process
• T3826 (bug): PKI: op-mode - do input validation when listing certificates

3.2.627 2021-09-25

• T3657 (default): BGP neighbors ipv6 not able to establish with IPv6 link-local
addresses

3.2.628 2021-09-23

• T3850 (bug): Dots are no longer allowed in SSH public key names

3.2.629 2021-09-21

• T3847 (feature): keepalived/vrrp: migrate to get_config_dict() - cleanup

3.2.630 2021-09-20

• T3823 (bug): strip-private does not filter public IPv6 addresses

3.2.631 2021-09-19

• T3841 (feature): dhcp-server: add ping-check option to CLI

• T2738 (bug): Modifying configuration in the "interfaces" section from VRRP
transition scripts causes configuration lockup and high CPU utilization
• T3840 (feature): dns forwarding: Cache size should allow values > 10k
• T3672 (bug): DHCP-FO with multiple subnets results in invalid/non-functioning dhcpd.
conf configuration file output

3.2.632 2021-09-18

• T3831 (bug): External traffic stops routing when IPSEC tunnel comes up with
interface vti0
• T1968 (default): Allow multiple static routes in dhcp-server
• T3838 (feature): dhcp-server - sync cli for name-servers to other subsystems
• T3839 (feature): dhcp-server: Allow configuration of a DNS server and domain name
on the shared-network level

3.2. 1.4 Sagitta 137

 VyOS Documentation, Release 1.5.x (circinus)

3.2.633 2021-09-17

• T3830 (bug): ipsec: remote-id no longer included in IKE AUTH if not explicitly
specified

3.2.634 2021-09-11

• T3402 (feature): Add VyOS programming library for operational level commands

3.2.635 2021-09-10

• T3802 (bug): Commit fails if ethernet interface doesn't support flow control
• T3819 (bug): Upgrade Salt Stack 3002.3 -> 3003 release train
• T915 (feature): MPLS Support

3.2.636 2021-09-09

• T3812 (bug): Vyos and frr route-map config out of sync

• T3814 (bug): wireguard: commit error showing incorrect peer name from the
configured name
• T3805 (bug): OpenVPN insufficient privileges for rtnetlink when closing TUN/TAP
interface
• T3815 (bug): pki : the file command 'generate pki wireguard key-pair file' is not
working

3.2.637 2021-09-07

• T1894 (bug): FRR config not loaded after daemons segfault or restart
• T3807 (bug): Op Command "show interfaces wireguard" does not show the output

3.2.638 2021-09-06

• T3806 (bug): Don't set link local ipv6 address if MTU less then 1280
• T3803 (default): Add source-address option to the ping CLI
• T3431 (bug): Show version all bug
• T2920 (bug): Commit crash when adding the second mGRE tunnel with the same key

3.2. 1.4 Sagitta 138

 VyOS Documentation, Release 1.5.x (circinus)

3.2.639 2021-09-05

• T3804 (feature): cli: Migrate and merge "system name-servers-dhcp" into "system
name-server"

3.2.640 2021-09-04

• T3619 (bug): Performance Degradation 1.2 --> 1.3 | High ksoftirqd CPU usage

3.2.641 2021-09-03

• T3788 (bug): Keys are not allowed with ipip and sit tunnels
• T3634 (feature): Add op command option for ping for do not fragment bit to be set
• T3798 (feature): bgp: add support for "neighbor <X> local-as replace-as" option

3.2.642 2021-09-02

• T3792 (bug): login: A hypen present in a username from "system login user" is
replaced by an underscore
• T3790 (bug): Does not possible to configure PPTP static ip-address to users
• T2947 (bug): Nat translation many-many with prefix does not map 1-1.

3.2.643 2021-08-31

• T3789 (feature): Add custom validator for base64 encoded CLI data
• T3782 (default): Ingress Shaping with IFB No Longer Functional with 1.3

3.2.644 2021-08-30

• T3768 (default): Remove early syntaxVersion implementation

• T2941 (default): Using a non-ASCII character in the description field causes
UnicodeDecodeError in configsource.py
• T3787 (bug): Remove deprecated UDP fragmentation offloading option

3.2.645 2021-08-29

• T3708 (bug): isisd and gre-bridge commit error

• T3783 (bug): "set protocols isis spf-delay-ietf" is not working
• T2750 (default): Use m4 as a template processor

3.2. 1.4 Sagitta 139

 VyOS Documentation, Release 1.5.x (circinus)

3.2.646 2021-08-28

• T3743 (bug): l2tp doesn't work after reboot if outside-address not 0.0.0.0

3.2.647 2021-08-27

• T3182 (bug): Main blocker Task for FRR 7.4/7.5 series update
• T3568 (feature): Add XML for firewall conf-mode
• T2108 (default): Use minisign/signify instead of GPG for release signing

3.2.648 2021-08-26

• T3776 (default): Rename FRR daemon restart op-mode commands

• T3739 (feature): policy: route-map: add EVPN match support

3.2.649 2021-08-25

• T3773 (bug): Delete the "show system integrity" command (to prepare for a
re-implementation)
• T3775 (bug): Typo in generated Strongswan VPN-config

3.2.650 2021-08-24

• T3772 (bug): VRRP virtual interfaces are not shown in show interfaces

3.2.651 2021-08-23

• T3769 (feature): Containers: Network Bridging

3.2.652 2021-08-22

• T3090 (feature): Move 'adjust-mss' firewall options to the interface section.

• T3765 (default): container: additional op-mode commands

3.2.653 2021-08-20

• T1950 (default): Store VyOS configuration syntax version data in JSON file

3.2. 1.4 Sagitta 140

 VyOS Documentation, Release 1.5.x (circinus)

3.2.654 2021-08-19

• T3751 (bug): pki generate ca add new line after passphrase

• T3764 (bug): Unconfigurable IKE and ESP lifetime
• T3234 (bug): multi_to_list fails in certain cases, with root cause an element
redundancy in XML interface-definitions
• T3732 (feature): override-default helper should support adding defaultValues to
default less nodes
• T3759 (default): [L3VPN] VPNv4/VPNv6 add commands

3.2.655 2021-08-18

• T3752 (bug): generate pki certificate file xxx doesn't touch file

3.2.656 2021-08-16

• T3738 (default): openvpn fails if server and authentication are configured

• T1594 (bug): l2tpv3 error on IPv6 local-ip

3.2.657 2021-08-15

• T3756 (default): VyOS generates invalid QR code for wireguard clients

• T3757 (default): OSPF: add support to configure the area at an interface level

3.2.658 2021-08-14

• T3745 (feature): op-mode IPSec show vpn ipse sa sorting

3.2.659 2021-08-13

• T3749 (bug): V4/V6 Counters in network container validation aren't being reset
• T3728 (bug): FRR not respect configured RD and RT for L3VNI
• T3727 (bug): VPN IPsec ESP proposal and ESP presented in config missmatch
• T3740 (bug): HTTPs API breaks when the address is IPv6

3.2. 1.4 Sagitta 141

 VyOS Documentation, Release 1.5.x (circinus)

3.2.660 2021-08-12

• T3731 (bug): verify_accel_ppp_base_service return wrong config error for SSP

• T3405 (feature): PPPoE server unit-cache
• T2432 (default): dhcpd: Can't create new lease file: Permission denied
• T3746 (feature): Inform users logging into the system about a pending reboot
• T3744 (default): Dns forwarding statistics formatting missing a new line

3.2.661 2021-08-11

• T3709 (feature): Snmp: Allow enable MIDs/OIDs ipCidrRouteTable

3.2.662 2021-08-09

• T3720 (bug): IPSec set vti secondary address cause interface disable

3.2.663 2021-08-08

• T3705 (bug): IPSec: VTI interface does not honor default-esp-group

• T2027 (bug): get_config_dict is failing when the configuration section is empty/
missing

3.2.664 2021-08-05

• T3719 (bug): Restart vpn shows some missed files

3.2.665 2021-08-04

• T3704 (feature): Add ability to interact with Areca RAID adapers

• T3718 (bug): VPN IPsec IKE group by default not use DH-group 2

3.2.666 2021-08-02

• T3601 (default): Error in ssh keys for vmware cloud-init if ssh keys is left empty.

3.2.667 2021-08-01

• T3707 (bug): Ping incorrect ip host checks

3.2. 1.4 Sagitta 142

 VyOS Documentation, Release 1.5.x (circinus)

3.2.668 2021-07-31

• T3716 (feature): Linux kernel parameters ignore_routes_with_link_down- ignore

disconnected routing connections

3.2.669 2021-07-30

• T1176 (default): FRR - BGP replicating routes

• T1210 (feature): About IKEv2 IPSec VPN remote access

3.2.670 2021-07-23

• T3699 (bug): login: verify selected "system login user" name is not already used by
the base system.
• T3698 (default): Support bridge monitoring

3.2.671 2021-07-13

• T3679 (default): Point the unexpected exception message link to the new rolling
release location

3.2.672 2021-07-11

• T3665 (bug): Missing VRF support for VxLAN but already documented

3.2.673 2021-07-10

• T3636 (feature): SSTP / L2TP ipv6 support broken

3.2.674 2021-07-09

• T3667 (bug): brctl is damaged

3.2.675 2021-07-06

• T3660 (feature): Conntrack-Sync configuration command to specify destination udp

port for peer

3.2. 1.4 Sagitta 143

 VyOS Documentation, Release 1.5.x (circinus)

3.2.676 2021-07-03

• T57 (enhancment): Make it possible to disable the entire IPsec peer

3.2.677 2021-07-01

• T3658 (feature): Add support for dhcpdv6 fixed-prefix6

• T2035 (bug): Executing vyos-smoketest multiple times makes ssh test fail on
execution

3.2.678 2021-06-29

• T3593 (bug): PPPoE server called-sid format does not work

• T1441 (feature): Add support for IPSec XFRM interfaces

3.2.679 2021-06-25

• T3641 (feature): Upgrade base system from Debian Buster -> Debian Bullseye
• T3649 (feature): Add bonding additional hash-policy

3.2.680 2021-06-23

• T3647 (feature): Bullseye: gcc defaults to passing --as-needed to linker

3.2.681 2021-06-22

• T3629 (bug): IPoE server shifting address in the range

• T3645 (feature): Bullseye: ethtool changed output for ring-buffer information

3.2.682 2021-06-21

• T3563 (default): commit-archive breaks with IPv6 source addresses

3.2.683 2021-06-20

• T3637 (bug): vrf: bind-to-all didn't work properly

• T3639 (default): GCC preprocessor clobbers C comments

3.2. 1.4 Sagitta 144

 VyOS Documentation, Release 1.5.x (circinus)

3.2.684 2021-06-19

• T3633 (feature): Add LRO offload for interface ethernet

3.2.685 2021-06-18

• T3599 (default): Migrate NHRP to XML/Python

3.2.686 2021-06-17

• T3624 (feature): BGP: add support for extended community bandwidth definition

3.2.687 2021-06-16

• T3623 (default): Fix for dummy interface option in the operational command "clear
interfaces dummy"
• T3630 (feature): op-mode: add "show version kernel" command

3.2.688 2021-06-13

• T3620 (feature): Rename WWAN interface from wirelessmodem to wwan to use QMI
interface
• T2173 (feature): Add the ability to use VRF on VTI interfaces
• T3622 (feature): WWAN: add support for APN authentication
• T3606 (bug): SNMP unknown notification OID
• T3621 (bug): PPPoE interface does not validate if password is supplied when username
is set

3.2.689 2021-06-12

• T3611 (bug): WWAN interface (MC7710) no longer works on Kernel 5.10

• T1534 (bug): IPSec w/ IKEv2 Invalid local-address "any"
• T3616 (bug): Update to FastAPI causes regression in vyos-http-api-server

3.2.690 2021-06-11

• T3614 (bug): Container network name with hyphen fail

3.2. 1.4 Sagitta 145

 VyOS Documentation, Release 1.5.x (circinus)

3.2.691 2021-06-10

• T3250 (bug): PPPoE server: wrong local usernames

• T3138 (bug): ddclient improperly updated when apply rfc2136 config
• T2645 (default): Editing route-map action requires adding a new rule

3.2.692 2021-06-08

• T3605 (default): Allow to set prefer-global for ipv6-next-hop

• T3607 (feature): [route-map] set ipv6 next-hop prefer-global
• T3289 (bug): No description for node "service" conf-mode

3.2.693 2021-06-07

• T3461 (bug): OpenConnect Server redundancy check

• T3455 (bug): system users can not be added in "edit"
• T3588 (default): IPSec: migrate no longer available options from CLI which are now
hardcoded/enabled in strongSwan

3.2.694 2021-06-06

• T842 (feature): Adopt VyOS CLI to latest StrongSwan options and deprecated Keywords

3.2.695 2021-06-04

• T3595 (default): Cannot create new VTI interface

• T3592 (feature): Set default TTL 64 for tunnels

3.2.696 2021-06-03

• T3384 (feature): Support UDP bandwidth testing

3.2.697 2021-06-02

• T3233 (bug): Interface redirect to dum0

3.2. 1.4 Sagitta 146

 VyOS Documentation, Release 1.5.x (circinus)

3.2.698 2021-06-01

• T3585 (default): Fix NHRP module for updated interfaces tunnel syntax
• T3594 (bug): Disable by default service strongswan-starter

3.2.699 2021-05-30

• T3518 (bug): Warning messages when using SCP commit-archive

• T3093 (default): Add xml for vpn ipsec
• T1866 (bug): Commit archive over SFTP doesn't work with non-standard ports
• T3590 (feature): bgp: add option for limiting maximum number of prefixes to be sent
to a peer
• T3589 (feature): op-mode: support clearing out logfiles from CLI
• T2641 (feature): Rewrite vpn ipsec OP commands in new style XML syntax
• T3351 (feature): Installer checking MD5 checksums on the ISO image

3.2.700 2021-05-29

• T1944 (bug): FRR: Invalid route in BGP causes update storm, memory leak, and failure
of Zebra
• T1888 (feature): Update to StrongSwan 5.9.1

3.2.701 2021-05-27

• T3561 (feature): router-advert: support advertising specific routes

• T2669 (bug): DHCP-server overlapping ranges.

3.2.702 2021-05-26

• T3540 (bug): Keepalived memory utilisation issue when constantly getting its state
in JSON format

3.2.703 2021-05-24

• T3575 (bug): pseudo-ethernet: must check source-interface MTU

• T3571 (bug): Broken Show Tab Complete
• T3555 (bug): GRE TAP tunnel does not silent fragment packets / kernel fix available
• T3576 (bug): ISIS does not support IPV6

3.2. 1.4 Sagitta 147

 VyOS Documentation, Release 1.5.x (circinus)

3.2.704 2021-05-23

• T3570 (default): Prevent setting of a larger MTU on child interfaces

• T3573 (bug): as-path-prepend Description Invalid
• T3572 (feature): Basic Drive Diagnostic Tools

3.2.705 2021-05-22

• T3564 (default): Multiple BGP Confederation Peers Not Allowed

3.2.706 2021-05-21

• T3551 (bug): QoS control failure of VLAN sub interface

3.2.707 2021-05-20

• T3554 (feature): Add area-type stub for ospfv3

• T3565 (feature): sysctl: rewrite in XML and Python and drop from vyatta-cfg-system

3.2.708 2021-05-19

• T3562 (feature): Update Accel-PPP to a newer revision

• T3559 (feature): Add restart op-command for OpenConnect Server

3.2.709 2021-05-18

• T3525 (default): VMWare resume script syntax errors

3.2.710 2021-05-15

• T3549 (bug): DHCPv6 "service dhcpv6-server global-parameters name-server" is not

correctly exported to dhcpdv6.conf when multiple name-server entries are present
• T3532 (bug): Not possible to change ethertype after interface creation
• T3550 (bug): Router-advert completion typo
• T3547 (feature): conntrackd: remove deprecated config options
• T3535 (feature): Rewrite vyatta-conntrack-sync in new XML and Python flavor

3.2. 1.4 Sagitta 148

 VyOS Documentation, Release 1.5.x (circinus)

3.2.711 2021-05-14

• T3346 (bug): nat 4-to-5 migration script fails when a 'source' or 'destination' node
exists but there are no rules
• T3248 (default): Deal with VRRP mode-force command that exists in 1.2 but not in 1.3
• T3426 (default): add support for script arguments to vyos-configd

3.2.712 2021-05-13

• T3539 (bug): Typo in RPKI interface definition

• T439 (feature): local PBR support
• T3544 (feature): DHCP server should validate configuration before applying it
• T3543 (feature): Support for setting lacp_rate on LACP bonded interfaces

3.2.713 2021-05-12

• T3302 (default): Make vyos-configd relay stdout from scripts to the user's console
• T3542 (bug): udev net.rules not installed in image since may 2nd

3.2.714 2021-05-10

• T3374 (bug): IPv6 GRE Tunnel issues

3.2.715 2021-05-09

• T3530 (bug): BGP peer-group can't contain a hyphen

3.2.716 2021-05-06

• T3523 (bug): VRF BGP daemon route-map command missing

• T3519 (bug): Cannot add / assign L2TPv3 to vrf

3.2.717 2021-05-05

• T3520 (bug): Cannot add tunnel interface to isis within vrf

• T3335 (bug): Some OSPFv3 show commands do not work

3.2. 1.4 Sagitta 149

 VyOS Documentation, Release 1.5.x (circinus)

3.2.718 2021-05-04

• T3504 (feature): BGP Per Peer Graceful Restart

3.2.719 2021-05-02

• T3511 (bug): Update libnss-mapuser and libpam-radius packages from CUMULUS Linux

3.2.720 2021-05-01

• T3379 (feature): Add global-parameters name-server for dhcpv6-server

• T3491 (default): Change Kernel HZ to 1000

3.2.721 2021-04-29

• T3503 (bug): "route-reflector-client" fails when "remote-as" is "internal"

• T3502 (bug): "system ip multipath layer4-hashing" doesn't work

3.2.722 2021-04-28

• T3473 (bug): IPSec op-mode show sa error

3.2.723 2021-04-27

• T2946 (bug): Calling 'stty_size' causes show interfaces API to fail

3.2.724 2021-04-25

• T3490 (bug): priority inversion on PBR "policy route" create, breaks default route
from dhcp (live iso)
• T3468 (bug): Tunnel interfaces aren't suggested as being available for bridging
(regression)
• T3497 (bug): Prefix list with rule containing only action is not detected as error
during parse
• T3492 (bug): BGP Configuration Migration failed (badly!) from rolling 202102240218
to rolling 202104221210
• T1802 (feature): Wireguard QR code in cli for mobile devices

3.2. 1.4 Sagitta 150

 VyOS Documentation, Release 1.5.x (circinus)

3.2.725 2021-04-24

• T3472 (bug): commit-confirm script not found

• T3439 (bug): Commit-archive location not working for scp

3.2.726 2021-04-23

• T3395 (bug): WAN load-balancing fails with nexthop dhcp

• T3290 (bug): Disabling GRE conntrack module fails

3.2.727 2021-04-20

• T3488 (bug): Specifying an invalid "interface address" like dhcph leads to commit
error

3.2.728 2021-04-18

• T3481 (default): Exclude tag node values from key mangling

• T3475 (bug): XML dictionary cache unable to process syntaxVersion elements

3.2.729 2021-04-17

• T3470 (bug): as-override isn't applied to frr

3.2.730 2021-04-15

• T3386 (bug): PPPoE-server don't start with local authentication

• T3190 (feature): Unable to subtract value from local-preference in route-map

3.2.731 2021-04-14

• T3398 (bug): Can't commit

• T3055 (bug): op-mode incorrect naming for ipsec policy-based tunnels

3.2.732 2021-04-13

• T3436 (feature): Refactoring ospf op-mode for support vrf

• T3434 (feature): Refactoring bgp op-mode for support vrf

3.2. 1.4 Sagitta 151

 VyOS Documentation, Release 1.5.x (circinus)

3.2.733 2021-04-12

• T3454 (enhancment): dhclient reject option

• T3328 (bug): Bgp not possible to delete bgp route-map

3.2.734 2021-04-10

• T3460 (bug): bgp, Configuration FRR failed while commiting code

3.2.735 2021-04-09

• T3464 (bug): OSPF: route-map names containing a hypen are not "found"

3.2.736 2021-04-08

• T3462 (default): show ipv6 bgp -- missing

• T3463 (bug): Prevent IPv4 Route exchange with IPv6 neighbors

3.2.737 2021-04-05

• T3438 (bug): VRF: removing vif which belongs to a vrf, will delete the entire vrf
from the operating system
• T3418 (bug): BGP: system wide known interface can not be used as neighbor

3.2.738 2021-04-04

• T3457 (feature): Output the "monitor log" command in a colorful way

3.2.739 2021-03-31

• T3445 (bug): vyos-1x build include not all nodes

3.2.740 2021-03-30

• T3448 (bug): Loading vyos on a system without xdp installed fails

3.2.741 2021-03-29

• T3415 (feature): bridge: add support for isolated interfaces (private-vlan)

• T1711 (feature): BGP - migrate from tagNode to node (remove ASN from tagNode)

3.2. 1.4 Sagitta 152

 VyOS Documentation, Release 1.5.x (circinus)

3.2.742 2021-03-28

• T3440 (bug): HTTP API: give uvicorn time to initialize before restarting Nginx proxy

3.2.743 2021-03-27

• T3423 (bug): Cannot create ipv4 static route for default gateway in vrf

3.2.744 2021-03-26

• T3412 (default): HTTP API: move to FastAPI as web framework

• T2397 (feature): HTTP API: export OpenAPI definition

3.2.745 2021-03-24

• T3419 (bug): show interfaces | strip-private fails

3.2.746 2021-03-22

• T3284 (bug): merge/load fail silently if unable to resolve host

3.2.747 2021-03-21

• T3417 (default): ISIS: provide per VRF instance support

• T3416 (bug): NTP: when running inside a VRF op-mode commands do not work

3.2.748 2021-03-20

• T3392 (bug): vrrp over dhcp default route bug (unexpected vrf)
• T3373 (feature): Upgrade to SaltStack version 3002.5
• T3329 (default): "system conntrack ignore" rules can no longer be created due to an
iptables syntax change
• T3300 (feature): Add DHCP default route distance
• T3306 (feature): Extend set route-map aggregator as to 4 Bytes

3.2.749 2021-03-18

• T3411 (default): Extend the redirect_stdout context manager in vyos-configd to

redirect stdout from subprocesses
• T3271 (bug): qemu-kvm grub issue

3.2. 1.4 Sagitta 153

 VyOS Documentation, Release 1.5.x (circinus)

3.2.750 2021-03-17

• T3413 (bug): Configuring invalid IPv6 EUI64 address results in "OSError: illegal IP
address string passed to inet_pton"

3.2.751 2021-03-14

• T3345 (default): BGP: add per VRF instance support

• T3344 (default): Per VRF dynamic routing support
• T3325 (bug): Bgp listen-range wrong commit message
• T1513 (default): Move OSPF and RIP interface configuration under protocols

3.2.752 2021-03-13

• T3406 (bug): tunnel: interface no longer supports specifying encaplimit none - or

migrator is missing
• T3407 (bug): console-server: do not allow to spawn a console-server session on
serial port used by "system console"

3.2.753 2021-03-11

• T3305 (bug): Ingress qdisc does not work anymore in 1.3-rolling-202101 snapshot
• T2927 (bug): isc-dhcpd release and expiry events never execute

3.2.754 2021-03-09

• T3382 (bug): Error creating Console Server

3.2.755 2021-03-08

• T3387 (bug): Command "Monitor vpn ipsec" is not working

3.2.756 2021-03-07

• T3388 (bug): show interfaces doesn't display pppoeX

• T3211 (feature): ability to redistribute ISIS into other routing protocols

3.2. 1.4 Sagitta 154

 VyOS Documentation, Release 1.5.x (circinus)

3.2.757 2021-03-04

• T3377 (bug): show interfaces throws error

3.2.758 2021-03-02

• T3375 (bug): Interface becomes up at boot even when disabled

3.2.759 2021-02-28

• T3370 (bug): dhcp: Invalid domain name "private"

• T3369 (feature): VXLAN: add IPv6 underlay support
• T3363 (bug): VyOS-Build interactive prompt when using Podman
• T3320 (bug): Bgp neighbor peer-group without peer-group fail

3.2.760 2021-02-27

• T3365 (bug): Bgp neighbor interface ordering for remote-as

• T3225 (bug): Adding a BGP neighbor with an address on a local interface throws a
vyos.frr.CommitError: Configuration FRR failed while committing code: ''
• T3368 (feature): macsec: add support for gcm-aes-256 cipher
• T3173 (feature): Need 'nopmtudisc' option for tunnel interface

3.2.761 2021-02-26

• T3324 (bug): Bgp space in the password

• T3357 (default): HTTP-API redirect from http correct https port
• T3323 (bug): Bgp ttl-security and ebgp-multihop fail

3.2.762 2021-02-24

• T3303 (feature): Change welcome message on boot

3.2.763 2021-02-22

• T3322 (bug): Bgp neighbor timers not applyed to FRR config

• T3327 (bug): OSPFv3: Cannot add dummy interface

3.2. 1.4 Sagitta 155

 VyOS Documentation, Release 1.5.x (circinus)

3.2.764 2021-02-21

• T3331 (bug): Bgp unsuppress-map should be as "value leafNode"

• T3330 (bug): Bgp capability orf prefix-list fail
• T3163 (feature): ethernet ring-buffer can be set with an invalid value

3.2.765 2021-02-19

• T3326 (bug): OSPFv3: Cannot add L2TPv3 interface

• T3332 (bug): BGP unnumbered - UnboundLocalError: local variable 'peer_group'
referenced before assignment

3.2.766 2021-02-18

• T3259 (default): many dnat rules makes the vyos http api crash, even showConfig op
timeouts

3.2.767 2021-02-17

• T3312 (feature): SolarFlare NICs support

3.2.768 2021-02-16

• T3313 (bug): ospfv3 interface missing options

• T3318 (feature): Update Linux Kernel to v5.4.208 / 5.10.142

3.2.769 2021-02-15

• T3311 (bug): BGP Error: Remote AS must be set for neighbor or peer-group

3.2.770 2021-02-14

• T2848 (feature): bgp-add-path configuration options

3.2.771 2021-02-12

• T3301 (bug): Wrong format and valueHelp for policy as-path-list regex

3.2. 1.4 Sagitta 156

 VyOS Documentation, Release 1.5.x (circinus)

3.2.772 2021-02-11

• T3281 (default): Rewrite protocol RIPng [conf-mode] to new XML/Python style

• T3282 (default): Add XML for [conf-mode] RIPng
• T3279 (default): Rewrite protocol STATIC [op-mode] to new XML/Python style
• T3297 (bug): Optimize irrelevant error stack hints

3.2.773 2021-02-08

• T3295 (feature): Update Linux Kernel to v5.4.96 / 5.10.14

3.2.774 2021-02-05

• T3030 (feature): Support ERSPAN Tunnel Protocol

3.2.775 2021-02-04

• T3283 (feature): Support for IPv4 neigh tables

• T3280 (default): Add XML for [conf-mode] STATIC

3.2.776 2021-02-03

• T3278 (feature): Add XML for "protocols vrf" [conf-mode]

• T3239 (default): XML: override 'defaultValue' for mtu of certain interfaces; remove
workarounds
• T2910 (feature): XML: generator should support override of variables

3.2.777 2021-02-02

• T3018 (bug): Unclear behaviour when configuring vif and vif-s interfaces
• T3255 (default): Rewrite protocol RPKI to new XML/Python style
• T3263 (feature): OSPF Hello subsecond timer

3.2.778 2021-01-31

• T3276 (feature): Update Linux Kernel to v5.4.94 / 5.10.12

3.2. 1.4 Sagitta 157

 VyOS Documentation, Release 1.5.x (circinus)

3.2.779 2021-01-30

• T3240 (feature): Support per-interface DHCPv6 DUIDs

• T3273 (default): PPPoE static default-routes deleted on interface down when not
added by interface up

3.2.780 2021-01-29

• T3261 (bug): Does not possible to disable pppoe client interface.

• T3272 (default): OSPF: interface config is not removed

3.2.781 2021-01-27

• T3257 (feature): tcpdump supporting complete protocol

• T3244 (default): Rewrite protocol OSPFv3 to new XML/Python style

3.2.782 2021-01-26

• T3251 (bug): PPPoE client trying to authorize with the wrong username
• T3256 (default): Add XML for protocol RPKI [conf-mode]

3.2.783 2021-01-25

• T3249 (feature): Support operation mode forwarding table output

3.2.784 2021-01-24

• T3227 (bug): Latest releases don't work with RPKI (crash)

• T3230 (bug): RPKI can't be deleted
• T3221 (bug): FRR config
• T3245 (default): Add XML for protocol ospfv3 [conf-mode]

3.2.785 2021-01-23

• T3236 (default): Add XML for [conf-mode] OSPF

3.2. 1.4 Sagitta 158

 VyOS Documentation, Release 1.5.x (circinus)

3.2.786 2021-01-17

• T3222 (bug): Typo in BGP dampening description

• T3226 (bug): Repair bridge smoke test damage

3.2.787 2021-01-16

• T3215 (bug): Operational command "show ipv6 route" is broken

• T3157 (bug): salt-minion fails to start due to permission error accessing /root/.
salt/minion.log
• T3137 (feature): Let VLAN aware bridge approach the behavior of professional
equipment

3.2.788 2021-01-15

• T3210 (feature): ISIS three-way-handshake

• T3184 (feature): Add correct desctiptions for BGP neighbors

3.2.789 2021-01-14

• T3213 (bug): show interface command python error

3.2.790 2021-01-12

• T3205 (bug): Does not possible to configure tunnel mode gre-bridge

3.2.791 2020-12-20

• T3132 (feature): Enable egress flow accounting

3.2.792 2020-11-29

• T2297 (feature): NTP add support for pool configuration

3.3 1.3 Equuleus

3.3.1 2024-04-25

• T6249 (default): ISO builder fails because of changed buster-backport repository

3.3. 1.3 Equuleus 159

 VyOS Documentation, Release 1.5.x (circinus)

3.3.2 2024-04-23

• T6261 (default): Typo in op_mode connect_disconnect print statement for

check_ppp_running

3.3.3 2024-04-17

• T6243 (bug): Update vyos-http-api-tools for package idna security advisory

3.3.4 2024-04-12

• T3437 (bug): BGP Confederation Addition Causes Error

3.3.5 2024-04-10

• T6124 (bug): Docker equuleus build image doesn't build due to fpm

3.3.6 2024-04-08

• T6196 (bug): Route-map and summary-only do not work in BGP aggregation at the same
time

3.3.7 2024-04-07

• T1244 (default): Support for StartupResync in conntrackd

3.3.8 2024-04-05

• T2590 (bug): DHCPv6 not updating nameservers and search domains since replacing
isc-dhcp-client with WIDE dhcp6c

3.3.9 2024-04-04

• T4146 (bug): Nginx should not listen on port 80

• T1976 (default): deleting address-family under neighbor will disable neighbor
• T5625 (default): "restart vpn" does not work if ipsec-interfaces is not set
• T3020 (bug): The "scp" example is wrong in the bash-completion for "set system
config-management commit-archive location"
• T2250 (default): vyos-build "make iso" error if configure was ran outside of the
docker container
• T2139 (default): openvpn: allow "dh-file none" to disable DH for ECDH keys
• T2014 (default): Use vendor specific NTP Pool hostname
• T1118 (bug): Obsolete "utc" option in time selector in firewall
• T948 (feature): integrate aws cloud watch scripts into AMI

3.3. 1.3 Equuleus 160

 VyOS Documentation, Release 1.5.x (circinus)

3.3.10 2024-04-02

• T6150 (bug): Impossible to set a static IP address via Radius in IPoE

3.3.11 2024-04-01

• T6193 (bug): dhcp-client: invalid warning "is not a DHCP interface but uses DHCP
name-server option" for VLAN interfaces

3.3.12 2024-03-22

• T6110 (bug): dhcp server - If failover is defined, range is required

• T5624 (default): Remove /etc/debian_version from the image

3.3.13 2024-03-11

• T2998 (bug): SNMP v3 oid "exclude" option doesn't work

• T6096 (bug): Config commits are not synced properly because 00vyos-sync is deleted
by vyos-router
• T6057 (feature): Add ability to disable syslog for conntrackd
• T5504 (feature): Keepalived VRRP ability to set more than one peer-address

3.3.14 2024-03-07

• T3992 (bug): Traceback on adding interface to bridge with configured ip address

3.3.15 2024-03-06

• T6088 (bug): Configuration corrupted after saving and powercut or force reboot

3.3.16 2024-02-16

• T2113 (bug): OpenVPN Options error: you cannot use --verify-x509-name with
--compat-names or --no-name-remapping
• T5418 (bug): PPPoE-Server Client IP pool Subnet

3.3. 1.3 Equuleus 161

 VyOS Documentation, Release 1.5.x (circinus)

3.3.17 2024-02-15

• T2612 (bug): HTTPS API, changing API key fails but goes through
• T656 (enhancment): Rewrite wirelessmodem in new style XML interface definition

3.3.18 2024-02-14

• T2044 (bug): RPKI doesn't boot properly

3.3.19 2024-02-08

• T6014 (feature): Bump keepalived version

3.3.20 2024-02-07

• T6017 (bug): Update vyos-http-api-tools for security advisory

3.3.21 2024-02-02

• T5914 (bug): CVE-2023-48795 - Terrapin vulnerability

• T5739 (bug): Password recovery does not work if public keys are configured

3.3.22 2024-02-01

• T5967 (bug): Multi-hop BFD connections can't be established; please add minimum-ttl
option.

3.3.23 2024-01-22

• T4721 (feature): Static IPv6 Route Tags Missing

3.3.24 2024-01-20

• T5187 (bug): Update Realtek r8152 driver

• T5182 (bug): Update Intel ice driver
• T5180 (bug): initramfs-tools ignores firmware from updates directory
• T4990 (bug): Commit results may not be properly saved if power is cut immediately
after a successful commit
• T4039 (feature): Rsyslog to use 'protocol23format' for protocol UDP
• T3813 (bug): Some custom sysctl parameters can't be applied bug
• T2579 (feature): The root task for VRF features
• T2546 (feature): The root task for rewriting [op-mode] to XML
• T2452 (default): Serial console related issues

3.3. 1.3 Equuleus 162

 VyOS Documentation, Release 1.5.x (circinus)

3.3.25 2024-01-19

• T5543 (bug): Fix source address handling in static joins

3.3.26 2024-01-14

• T5715 (bug): IPSec VPN: restart vpn is not working

3.3.27 2024-01-13

• T5924 (bug): Build cannot pass the smoketest dialup-router-medium-vpn

3.3.28 2024-01-11

• T5275 (default): Add op mode commands for exporting certificates to PEM files with
correct headers
• T5274 (default): Add a deprecation warning for OpenVPN site-to-site with pre-shared
secret
• T3191 (bug): PAM RADIUS freezing when accounting does not configured on RADIUS
server

3.3.29 2024-01-10

• T4646 (bug): USB serial output console does not work

• T4466 (bug): intel i225-v nic does not detect link after boot
• T4222 (feature): Support for TWAMP as round-trip metric
• T1369 (bug): GCP Networking Failure

3.3.30 2024-01-09

• T3242 (bug): PPPoE Server overhead on virtual interfaces creation

• T2755 (default): Requirements for partial interface setup
• T2494 (bug): systemd dependencies issues
• T2343 (feature): Disable memory ballooning in VM templates
• T2254 (default): Provide more information on the build branch in the version data
• T2223 (feature): convert operational show interfaces to python/XML
• T1925 (bug): DMVPN is always listed as down in "show vpn ipsec sa"
• T1297 (feature): Add GARP settings to VRRP/keepalived

3.3. 1.3 Equuleus 163

 VyOS Documentation, Release 1.5.x (circinus)

3.3.31 2024-01-08

• T5318 (bug): Security Vulnerabilities for VyOS 1.3.3

• T3980 (bug): vrrp transition-script validator makes warning fatal and also causes a
python NameError exception
• T2799 (feature): VyOS Certificates Manager

3.3.32 2023-12-29

• T5852 (bug): Reboots fail with eapol WAN interface

3.3.33 2023-12-22

• T4760 (bug): VyOS does not support running multiple instances of DHCPv6 clients

3.3.34 2023-12-21

• T5714 (bug): IPSec VPN: op-mode: "show log vpn" does not show results
• T3039 (feature): Resize a root partition and filesystem automatically during
deployment in virtual environments
• T2404 (bug): Cannot change MTU
• T2353 (bug): Interface [conf_mode] errors parent task
• T5796 (bug): Openconnect - HTTPS security headers are missing

3.3.35 2023-12-19

• T2116 (feature): Processing configuration via Cloud-init User-Data

3.3.36 2023-12-18

• T2191 (feature): Using tallow to block sshd probes

3.3.37 2023-12-15

• T5824 (bug): busybox cannot connect some websites from initramfs

3.3. 1.3 Equuleus 164

 VyOS Documentation, Release 1.5.x (circinus)

3.3.38 2023-12-12

• T5817 (bug): Show openvpn server fails in some cases

• T5413 (default): Deny the opportunity to use one public/private key pair on both
wireguard peers.

3.3.39 2023-11-30

• T4601 (bug): dhcp : relay agent IP address issue.

3.3.40 2023-11-28

• T5777 (bug): frr: backport and upstream recent bgpd daemon crashes

3.3.41 2023-11-27

• T5763 (bug): Fix imprecise check for remote file name in vyos-load-config.py

3.3.42 2023-11-25

• T5655 (bug): commit-archive: Ctrl+C should not eror out with stack trace, signal
should be cought

3.3.43 2023-11-24

• T5402 (bug): VRRP router with rfc3768-compatibility sends multiple ARP replies

3.3.44 2023-11-22

• T5578 (bug): "ikev2-reauth" description contains outdated information

3.3.45 2023-11-15

• T5661 (enhancment): Add show show ssh dynamic-protection attacker and show log ssh
dynamic-protection
• T1276 (bug): dhcp relay + VLAN fails

3.3. 1.3 Equuleus 165

 VyOS Documentation, Release 1.5.x (circinus)

3.3.46 2023-11-07

• T5586 (feature): Disable by default SNMP for Keepalived VRRP

3.3.47 2023-11-06

• T4269 (feature): node.def generator should automatically add default values

3.3.48 2023-10-26

• T5684 (bug): services using VRF generates the error "Failed to load BPF prog:
'Operation not permitted'" when the system boots.
• T5594 (bug): VRRP - Error if using IPv6 Link Local as hello source address

3.3.49 2023-10-21

• T5670 (bug): bridge: missing member interface validator

• T5191 (default): Replace underscores with hyphens in command-line options generated
by vyos.opmode
• T4402 (bug): OpenVPN client-ip-pool option is broken
• T2719 (feature): Standardized op mode script structure

3.3.50 2023-10-19

• T5669 (bug): VXLAN interface changing port does not work

3.3.51 2023-10-17

• T5235 (bug): SSH keys with special characters cannot be applied via Cloud-init

3.3.52 2023-10-08

• T5630 (feature): pppoe: allow to specify MRU in addition to already configurable

MTU

3.3.53 2023-10-06

• T5576 (feature): Add bgp remove-private-as all option

3.3. 1.3 Equuleus 166

 VyOS Documentation, Release 1.5.x (circinus)

3.3.54 2023-10-04

• T5632 (feature): Add jq package to parse JSON files

3.3.55 2023-09-25

• T5533 (bug): Keepalived VRRP IPv6 group enters in FAULT state

3.3.56 2023-09-20

• T5271 (default): Add support for peer-fingerprint to OpenVPN

3.3.57 2023-09-11

• T5557 (bug): bgp: Use treat-as-withdraw for tunnel encapsulation attribute

CVE-2023-38802
• T3424 (default): PPPoE IA-PD doesn't work in VRF

3.3.58 2023-09-10

• T5555 (bug): Fix timezone migrator (system 13-to-14)

• T5545 (bug): sflow is not working

3.3.59 2023-09-08

• T4426 (default): Add arpwatch to the image

3.3.60 2023-09-05

• T5524 (feature): Add config directory to liveCD

• T2958 (bug): DHCP server doesn't work from a live CD
• T5428 (bug): dhcp: client renewal fails when running inside VRF

3.3.61 2023-09-04

• T5506 (bug): Container bridge interfaces do not have a link-local address

3.3. 1.3 Equuleus 167

 VyOS Documentation, Release 1.5.x (circinus)

3.3.62 2023-08-31

• T5190 (feature): Cloud-Init cannot fetch Meta-data on machines where the main
Ethernet interface is not eth0
• T5140 (bug): Firewall network-group problems
• T4895 (bug): Tag nodes are overwritten when configured by Cloud-Init from User-Data
• T4874 (default): Add Warning message to Equuleus
• T4855 (bug): Trying to create more than one tunnel of the same type to the same
address causes unhandled exception
• T4776 (bug): NVME storage is not detected properly during installation
• T3546 (feature): Add support for running scripts on PPPoE server session events
• T738 (feature): Add local-port and resolver port options for powerdns in CLI
configuration tree

3.3.63 2023-08-30

• T5221 (bug): BGP as-override behavior differs from new FRR and other vendors
• T4933 (default): Malformed lines cause vyos.util.colon_separated_to_dict fail with a
nondescript error
• T4790 (bug): RADIUS login does not work if sum of timeouts more than 50s
• T4475 (bug): route-map does not support ipv6 peer
• T4459 (bug): API service with VRF doesn't work in 1.3.1
• T4407 (bug): Network-config v2 is broken in Cloud-init 22.1 and VyOS 1.3
• T4113 (bug): Incorrect GRUB configuration parsing
• T1764 (bug): Use lists instead of whitespace-separated strings in vyos.config
• T4121 (bug): Nameservers from DHCP client cannot be used in specific cases
• T4151 (feature): IPV6 local PBR Support
• T4306 (default): Do not check for ditry repository when building release images

3.3.64 2023-08-29

• T3940 (bug): DHCP client does not remove IP address when stopped by the
02-vyos-stopdhclient hook
• T3713 (default): Create a meta-package for user utilities
• T3339 (bug): Cloud-Init domain search setting not applied
• T2640 (feature): Running VyOS inside Docker containers
• T3577 (bug): Generating vpn x509 key pair fails with command not found

3.3. 1.3 Equuleus 168

 VyOS Documentation, Release 1.5.x (circinus)

3.3.65 2023-08-28

• T4745 (bug): CLI TAB issue with values with '-' at the beginning in conf mode
• T2611 (bug): Prefix list names are shared between ipv4 and ipv6
• T2296 (default): Upgrade WALinux to 2.2.41
• T2123 (default): Configure 3 NTP servers
• T469 (bug): Problem after commit with errors

3.3.66 2023-08-25

• T4412 (bug): commit archive: reboot not working with sftp

• T3702 (feature): Policy: Allow routing by fwmark
• T3536 (default): Unable to list all available routes

3.3.67 2023-08-24

• T5006 (bug): Http api segfault with concurrent requests

• T5305 (bug): REST API configure operation should not be defined as async

3.3.68 2023-08-23

• T5387 (feature): dhcp6c: add a no release option

3.3.69 2023-08-20

• T5470 (bug): wlan: can not disable interface if SSID is not configured

3.3.70 2023-08-17

• T5486 (bug): Service dns dynamic cannot pass the smoketest

• T5223 (bug): tunnel key doesn't clear

3.3.71 2023-08-15

• T5273 (default): Add op mode commands for displaying certificate details and
fingerprints
• T5270 (default): Make OpenVPN `tls dh-params` optional

3.3. 1.3 Equuleus 169

 VyOS Documentation, Release 1.5.x (circinus)

3.3.72 2023-08-10

• T5329 (bug): Wireguard interface as GRE tunnel source causes configuration error on
boot

3.3.73 2023-07-24

• T5354 (feature): Add sshguard to protect against brut-forces for 1.3

3.3.74 2023-07-17

• T2051 (bug): Throughput anomalies

3.3.75 2023-07-14

• T305 (default): loadbalancing does not work with one pppoe connection and another
connection of either dhcp or static

3.3.76 2023-07-13

• T3045 (bug): Changes to Conntrack-Sync don't apply correctly (Mutlicast->UDP)

• T971 (bug): authentication public-keys options quoting issue

3.3.77 2023-07-12

• T5009 (bug): op-mode command: restart dhcp relay-agent not working

• T4927 (bug): Need to change restart to reload-or-restart in Webproxy module
• T3835 (bug): vyos router 1.2.7 snmp Dos bug
• T4959 (feature): Add container registry authentication config for containers
• T425 (feature): AWS CloudWatch monitoring scripts

3.3.78 2023-07-11

• T4862 (bug): webproxy domain-block does not work

• T4844 (bug): Incorrect permissions of the safeguard DB directory
• T4262 (bug): install image doesn't respect chosen root partition size
• T3810 (bug): webproxy squidguard rules don't work properly after rewriting to
python.
• T1928 (bug): Is the 'Welcome to VyOS' message when using SSH an information leak?
• T4737 (bug): FRRouting/zebra 7.5.1 does not redistribute routes to other protocols
• T3852 (bug): DHCP client issue - interface has two dhclient processes when link is
unpluged and then plug again

3.3. 1.3 Equuleus 170

 VyOS Documentation, Release 1.5.x (circinus)

• T2118 (bug): Failure to boot after power outage due to dirty filesystem and no fsck
in initramfs

3.3.79 2023-07-05

• T5331 (bug): ath10k_pci not functioning

3.3.80 2023-06-30

• T5315 (feature): vrrp: add support for version 3

• T5313 (bug): UDP broadcast relay - missing verify() that relay interfaces have an IP
address assigned

3.3.81 2023-06-26

• T5272 (default): Upgrade OpenVPN to 2.6 in Equuleus

• T5265 (bug): WAN load-balancing: missing completion helpers

3.3.82 2023-06-25

• T5240 (bug): Service router-advert failed to start radvd with more then 3
name-servers

3.3.83 2023-06-21

• T5280 (bug): Update Expired keys (2023-06-08) for PowerDNS

3.3.84 2023-06-13

• T5213 (feature): Accel-ppp sending accounting interim updates acct-interim-interval

option

3.3.85 2023-05-29

• T5243 (bug): Default route is inactive if an interface has multiple ip addresses of

the same subnet in 1.3.2 Equuleus

3.3. 1.3 Equuleus 171

 VyOS Documentation, Release 1.5.x (circinus)

3.3.86 2023-05-19

• T5186 (bug): QoS test cannot pass for 1.3

3.3.87 2023-05-12

• T2769 (feature): Add VRF support for syslog

3.3.88 2023-05-08

• T5212 (bug): snmp community name -error with special carracter

3.3.89 2023-04-27

• T5175 (bug): http-api: error in MultiPart parser for FastAPI version >= 0.91.0
• T5176 (bug): http-api: update vyos-http-api-tools for FastAPI security
vulnerability

3.3.90 2023-04-13

• T5152 (bug): Telegraf agent hostname isn't qualified

• T4727 (feature): Add RADIUS rate limit support to PPTP server
• T4939 (bug): VRRP command no-preempt not work as expected
• T3608 (default): Standardize warnings from configure scripts

3.3.91 2023-04-05

• T4975 (bug): CLI does not work after cutting off the power or reset
• T5136 (bug): Possible config corruption on upgrade

3.3.92 2023-04-01

• T5047 (bug): Recreate only a specific container

3.3.93 2023-03-31

• T5111 (bug): pppd-dns.service startup failed

3.3. 1.3 Equuleus 172

 VyOS Documentation, Release 1.5.x (circinus)

3.3.94 2023-03-29

• T5033 (bug): generate-public-key command fails for address with multiple public keys
like GitHub
• T5097 (bug): the operational command "show interfaces ethernet ethx" doesn't reflect
a call to 'clear counters'

3.3.95 2023-03-21

• T5098 (feature): PPPoE client holdoff configuration

3.3.96 2023-03-19

• T4925 (feature): Need to add the possibility to configure Pseudo-Random Functions

(PRF) in IKEv2

3.3.97 2023-03-16

• T3083 (feature): Add feature event-handler

• T2516 (bug): vyos-container: cannot configure ethernet interface

3.3.98 2023-03-09

• T5066 (bug): Different GRE tunnel but same tunnel keys error

3.3.99 2023-03-08

• T4381 (default): OpenVPN: Add "Tunnel IP" column in "show openvpn server"
operational command
• T4872 (bug): Op-mode show openvpn misses a case when parsing for tunnel IP

3.3.100 2023-03-07

• T2838 (bug): Ethernet device names changing, multiple hw-id being added
• T2649 (default): Ensure configration mode scripts conform to coding guidelines
• T4900 (default): Cache intermediary results of get_config_diff in Config instance

3.3. 1.3 Equuleus 173

 VyOS Documentation, Release 1.5.x (circinus)

3.3.101 2023-03-03

• T4625 (enhancment): Update ocserv to current revision (1.1.6)

3.3.102 2023-02-28

• T4955 (bug): Openconnect radiusclient.conf generating with extra authserver

• T4219 (feature): support incoming-interface (iif) in local PBR

3.3.103 2023-02-25

• T5008 (bug): MACsec CKN of 32 chars is not allowed in CLI, but works fine
• T5007 (bug): Interface multicast setting is invalid
• T5017 (bug): Bug with validator interface-name
• T4992 (bug): Incorrect check is_local_address for bgp neighbor with option
ip_nonlocal_bind set
• T4978 (bug): KeyError: 'memory' container_config['memory'] on upgrading to 1.
4-rolling-202302041536
• T4948 (feature): pppoe: add CLI option to allow definition of host-uniq flag

3.3.104 2023-02-22

• T5011 (bug): Some interface drivers don't support min_mtu and max_mtu and verify_mtu
check should be skipped

3.3.105 2023-02-18

• T4743 (feature): Enable IPv6 address for Dynamic DNS

3.3.106 2023-02-16

• T4971 (feature): Radius attribute "Framed-Pool" for PPPoE

3.3.107 2023-02-15

• T4993 (bug): Can't delete conntrack ignore rule

3.3. 1.3 Equuleus 174

 VyOS Documentation, Release 1.5.x (circinus)

3.3.108 2023-02-14

• T4999 (feature): vyos.util backport dict_search_recursive

• T1993 (feature): Extended pppoe rate-limiter

3.3.109 2023-02-13

• T4153 (bug): Monitor bandwidth-test initiate not working

3.3.110 2023-02-11

• T2603 (feature): pppoe-server: reduce min MTU

3.3.111 2023-02-08

• T1288 (feature): FRR: rewrite staticd backend (/opt/vyatta/share/vyatta-cfg/

templates/protocols/static/*)

3.3.112 2023-02-07

• T4117 (bug): Does not possible to configure PoD/CoA for L2TP vpn

3.3.113 2023-02-01

• T4970 (default): pin OCaml pcre package to avoid JIT support

3.3.114 2023-01-30

• T4954 (bug): DNS cannot be configured via Network-Config v1 received from

ConfigDrive / Cloud-Init

3.3.115 2023-01-24

• T4949 (feature): Backport "monitor log" and "show log" op-mode definitions from
current to equuleus
• T4947 (feature): Support mounting container volumes as ro or rw

3.3. 1.3 Equuleus 175

 VyOS Documentation, Release 1.5.x (circinus)

3.3.116 2023-01-23

• T4798 (default): Migrate the file-exists validator away from Python

• T4683 (enhancment): Add kitty-terminfo package to build
• T4875 (default): Replace Python validator 'interface-name' to avoid Python startup
cost
• T4664 (bug): Add validation to reject whitespace in tag node value names

3.3.117 2023-01-22

• T4906 (bug): ipsec connections shows only one connection as up

3.3.118 2023-01-21

• T4896 (bug): ospfv3: Fix broken not-advertise option

• T4799 (bug): PowerDNS >= 4.7 does not get reloaded by vyos-hostsd

3.3.119 2023-01-17

• T4902 (bug): snmpd: exclude container storage from monitoring

3.3.120 2023-01-15

• T4832 (feature): dhcp: Add IPv6-only dhcp option support (RFC 8925)
• T4918 (bug): Odd show interface behavior

3.3.121 2023-01-09

• T4922 (feature): Add ssh-client source-interface CLI option

3.3.122 2023-01-07

• T4884 (bug): Missing a community6 in snmpd config

3.3.123 2023-01-05

• T3937 (default): Rewrite "show system memory" in Python to make it usable as a

library function

3.3. 1.3 Equuleus 176

 VyOS Documentation, Release 1.5.x (circinus)

3.3.124 2023-01-03

• T4869 (bug): A network with `/32` or `/128` mask cannot be removed from a
network-group

3.3.125 2022-12-31

• T4898 (feature): Add mtu config option for dummy interfaces

3.3.126 2022-12-26

• T4511 (bug): IPv6 DNS lookup

• T4809 (feature): radvd: Allow use of AdvRASrcAddress

3.3.127 2022-12-18

• T4709 (bug): TCP MSS clamping broken in equuleus

3.3.128 2022-12-15

• T4671 (bug): linux-firmware package is missing symlinks defined in WHENCE file

3.3.129 2022-12-04

• T4825 (feature): interfaces veth/veth-pairs -standalone used

3.3.130 2022-12-02

• T4122 (bug): interface ip address config missing after upgrade from 1.2.8 to 1.3.0
(when redirect is configured?)
• T1024 (feature): Policy Based Routing by DSCP

3.3.131 2022-11-23

• T4793 (feature): Create warning message about disable-route-autoinstall when ipsec

vti is used

3.3. 1.3 Equuleus 177

 VyOS Documentation, Release 1.5.x (circinus)

3.3.132 2022-11-21

• T4812 (feature): IPsec ability to show all configured connections

3.3.133 2022-11-06

• T2913 (bug): Failure to install fpm while building builder docker image

3.3.134 2022-11-04

• T2417 (feature): Python validator cleanup

3.3.135 2022-11-01

• T4177 (bug): Strip-private doesn't work for service monitoring

3.3.136 2022-10-31

• T1875 (feature): Add the ability to use network address as BGP neighbor (bgp listen
range)
• T4785 (feature): snmp: Allow !, @, * and # in community name

3.3.137 2022-10-21

• T2189 (bug): Adding a large port-range will take ~ 20 minutes to commit

3.3.138 2022-10-18

• T4533 (bug): Radius clients don’t have simple permissions

3.3.139 2022-10-13

• T4312 (bug): Telegraf configuration doesn't accept IPs for URL

3.3.140 2022-10-12

• T4730 (bug): Conntrack-sync error - listen-address is not the correct type in config
as it should be

3.3. 1.3 Equuleus 178

 VyOS Documentation, Release 1.5.x (circinus)

3.3.141 2022-10-11

• T4680 (bug): Telegraf prometheus-client listen-address invalid format

3.3.142 2022-10-04

• T4702 (bug): Wireguard peers configuration is not synchronized with CLI

• T4652 (feature): Upgrade PowerDNS recursor to 4.7 series
• T4648 (default): PPPoE: Ignore default router from RA when PPPoE default-route is
set to none
• T4582 (default): Router-advert: Preferred lifetime cannot equal valid lifetime in
PIOs

3.3.143 2022-09-17

• T4666 (bug): EAP-TLS no longer allows TLSv1.0 after T4537, T4584

3.3.144 2022-09-15

• T4679 (bug): OpenVPN site-to-site incorrect check for IPv6 local and remote address
• T4630 (bug): Prevent attempts to use the same interface as a source interface for
pseudo-ethernet and MACsec at the same time

3.3.145 2022-09-12

• T4647 (feature): Add Google Virtual NIC (gVNIC) support

3.3.146 2022-09-05

• T4668 (bug): Adding/removing members from bond doesn't work/results in incorrect

interface state
• T4628 (bug): ConfigTree() throws ValueError() if tagNode contains whitespaces

3.3.147 2022-08-29

• T4653 (bug): Interface offload options are not applied correctly

• T4061 (default): Add util function to check for completion of boot config
• T4654 (bug): RPKI cache incorrect description
• T4572 (bug): Add an option to force interface MTU to the value received from DHCP

3.3. 1.3 Equuleus 179

 VyOS Documentation, Release 1.5.x (circinus)

3.3.148 2022-08-26

• T4642 (bug): proxy: hyphen not allowed in proxy URL

3.3.149 2022-08-23

• T4618 (bug): Traffic policy not set on virtual interfaces

• T4538 (bug): Macsec does not work correctly when the interface status changes.

3.3.150 2022-08-22

• T4629 (bug): Raised ConfigErrors contain dict instead of only the dict key
• T4632 (bug): VLAN-aware bridge not working

3.3.151 2022-08-19

• T4616 (bug): openconnect: KeyError: 'local_users'

• T4614 (feature): OpenConnect split-dns directive

3.3.152 2022-08-16

• T4592 (bug): macsec: can not create two interfaces using the same source-interface
• T4584 (bug): hostap: create custom package build
• T4537 (bug): MACsec not working with cipher gcm-aes-256

3.3.153 2022-08-15

• T4565 (bug): vlan aware bridge not working with - Kernel: T3318: update Linux
Kernel to v5.4.205 #249
• T4206 (bug): Policy Based Routing with DHCP Interface Issue
• T2763 (feature): New SNMP resource request - SNMP over TCP

3.3.154 2022-08-14

• T4579 (bug): bridge: can not delete member interface CLI option when VLAN is
enabled
• T4421 (default): Add support for floating point numbers in the numeric validator
• T4415 (bug): Include license/copyright files in the image but remove user
documentation from /usr/share/doc to reduce its size
• T4313 (bug): "generate public-key-command" throws unhandled exceptions when it
cannot retrieve the key
• T4082 (bug): Add op mode command to restart ldpd
• T3714 (bug): Some sysctl custom parameters disappear after reboot

3.3. 1.3 Equuleus 180

 VyOS Documentation, Release 1.5.x (circinus)

• T4260 (bug): Extend vyos.configdict.node_changed() to support recursiveness

• T3785 (default): Add unicode support to configtree backend
• T3507 (bug): Bond with mode LACP show u/u in show interfaces even if peer is not
configured

3.3.155 2022-08-11

• T4476 (default): Next steps after installation is not communicated properly to new
users

3.3.156 2022-08-02

• T4515 (default): Reduce telegraf binary size

3.3.157 2022-07-30

• T4575 (feature): vyos.utill add new wrapper "rc_cmd" to get the return code and
output
• T4532 (bug): Flow-accounting IPv6 server/receiver bug

3.3.158 2022-07-27

• T4571 (bug): Sflow with vrf configured does not use vrf to validate agent-address IP
from vrf-configured interfaces

3.3.159 2022-07-18

• T4228 (bug): bond: OS error thrown when two bonds use the same member
• T4534 (bug): bond: bridge: error out if member interface is assigned to a VRF
instance
• T4525 (bug): Delete interface from VRF and add it to bonding error
• T4522 (feature): bond: add ability to specify mii monitor interval via CLI
• T4521 (bug): bond: ARP monitor interval is not configured despite set via CLI

3.3.160 2022-07-14

• T4491 (bug): Use empty string for internal name of root node of config_tree

3.3. 1.3 Equuleus 181

 VyOS Documentation, Release 1.5.x (circinus)

3.3.161 2022-07-13

• T1375 (feature): Add clear dhcp server lease function

3.3.162 2022-07-12

• T4527 (bug): Prevent to create VRF name default

• T4084 (default): Dehardcode the default login banner
• T3864 (enhancment): Add Edgecore build to VyOS 1.3 Equuleus

3.3.163 2022-07-09

• T4507 (feature): IPoE-server add multiplier option for shaper

• T4468 (bug): web-proxy source group cannot start with a number bug
• T4373 (feature): PPPoE-server add multiplier option for shaper

3.3.164 2022-07-07

• T4456 (bug): NTP client in VRF tries to bind to interfaces outside VRF, logs many
messages
• T4509 (feature): Feature Request: DNS64

3.3.165 2022-07-06

• T4513 (bug): Webproxy monitor commands do not work

3.3.166 2022-07-05

• T4510 (bug): set system static-host-mapping doesn't allow IPv4 and IPv6 for same
name.
• T2654 (bug): Multiple names unable to be assigned to the same static mapping
• T2683 (default): no dual stack in system static-host-mapping host-name

3.3.167 2022-07-01

• T4489 (bug): MPLS sysctl not persistent for tunnel interfaces

3.3. 1.3 Equuleus 182

 VyOS Documentation, Release 1.5.x (circinus)

3.3.168 2022-06-20

• T1856 (feature): Support configuring IPSec SA bytes

3.3.169 2022-06-16

• T3866 (bug): Configs with DNS forwarding listening on OpenVPN interfaces or

interfaces without a fixed address cannot be migrated to the new syntax

3.3.170 2022-06-15

• T1890 (feature): Metatask: rewrite flow-accounting to XML and Python

3.3.171 2022-06-09

• T2580 (feature): Support for ip pools for ippoe

3.3.172 2022-06-08

• T4447 (bug): DHCPv6 prefix delegation `sla-id` limited to 128

• T4350 (bug): DMVPN opennhrp spokes dont work behind NAT

3.3.173 2022-05-30

• T4315 (feature): Telegraf - Output to prometheus

3.3.174 2022-05-27

• T4441 (bug): wwan: connection not possible after a change added after 1.3.1-S1
release

3.3.175 2022-05-26

• T4442 (feature): HTTP API add action "reset"

3.3.176 2022-05-25

• T2194 (default): "show firewall" garbled output

3.3. 1.3 Equuleus 183

 VyOS Documentation, Release 1.5.x (circinus)

3.3.177 2022-05-19

• T4430 (bug): Show firewall output with visual shift default rule

3.3.178 2022-05-16

• T4377 (default): generate tech-support archive includes previous archives

3.3.179 2022-05-12

• T4100 (feature): Firewall increase maximum number of rules

3.3.180 2022-05-11

• T4405 (bug): DHCP client sometimes ignores `no-default-route` option of an interface

3.3.181 2022-05-10

• T1972 (feature): Allow setting interface name for virtual_ipaddress in VRRP VRID

3.3.182 2022-05-07

• T4361 (bug): `vyos.config.exists()` does not work for nodes with multiple values
• T4354 (bug): Slave interfaces fall out from bonding during configuration change

3.3.183 2022-05-03

• T4395 (feature): Extend show vpn debug

3.3.184 2022-05-01

• T4369 (bug): OpenVPN: daemon not restarted on changes to "openvpn-option" CLI node
• T4363 (bug): salt-minion: default mine_interval option is not set

3.3.185 2022-04-29

• T4388 (bug): dhcp-server: missing constraint on tftp-server-name option

• T4366 (bug): geneve: interface is removed on changes to e.g. description

3.3. 1.3 Equuleus 184

 VyOS Documentation, Release 1.5.x (circinus)

3.3.186 2022-04-26

• T4235 (default): Add config tree diff algorithm

3.3.187 2022-04-19

• T4344 (bug): DHCP statistics not matching, conf-mode generates incorrect pool name
with dash
• T4268 (bug): Elevated LA while using VyOS monitoring feature

3.3.188 2022-04-08

• T4331 (bug): IPv6 link local addresses are not configured when an interface is in a
VRF
• T4339 (bug): wwan: tab-completion results in "No such file or directory" if there
is no WWAN interface
• T4338 (bug): wwan: changing interface description should not trigger reconnect
• T4324 (bug): wwan: check alive script should only be run via cron if a wwan
interface is configured at all

3.3.189 2022-04-07

• T4330 (bug): MTU settings cannot be applied when IPv6 is disabled

• T4346 (feature): Deprecate "system ipv6 disable" option to disable address family
within OS kernel
• T4337 (bug): isis: IETF SPF delay algorithm can not be configured - results in
vyos.frr.CommitError
• T4319 (bug): The command "set system ipv6 disable" doesn't work as expected.
• T4341 (feature): login: disable user-account prior to deletion and wait until
deletion is complete
• T4336 (feature): isis: add support for MD5 authentication password on a circuit

3.3.190 2022-04-06

• T4308 (feature): Op-comm "Show log frr" to view specific protocol logs

3.3. 1.3 Equuleus 185

 VyOS Documentation, Release 1.5.x (circinus)

3.3.191 2022-03-29

• T3686 (bug): Bridging OpenVPN tap with no local-address breaks

3.3.192 2022-03-24

• T4294 (bug): Adding a new openvpn-option does not restart the OpenVPN process
• T4230 (bug): OpenVPN server configuration deleted after reboot when using a VRRP
virtual-address

3.3.193 2022-03-21

• T4311 (bug): CVE-2021-4034: local privilege escalation in PolKit

• T4310 (bug): CVE-2022-0778: infinite loop in OpenSSL certificate parsing

3.3.194 2022-03-12

• T4296 (bug): Interface config injected by Cloud-Init may interfere with VyOS native
• T4002 (default): firewall group network-group long names restriction incorrect
behavior

3.3.195 2022-03-11

• T4297 (bug): Interface configuration saving fails for ice/iavf based interfaces
because they can't change speed/duplex settings

3.3.196 2022-03-05

• T4259 (bug): The conntrackd daemon can be started wrongly

3.3.197 2022-02-28

• T4273 (bug): ssh: Upgrade from 1.2.X to 1.3.0 breaks config

• T4115 (bug): reboot in <x> not working as expected

3.3.198 2022-02-24

• T4267 (bug): Error - Missing required "ip key" parameter

3.3. 1.3 Equuleus 186

 VyOS Documentation, Release 1.5.x (circinus)

3.3.199 2022-02-23

• T4264 (bug): vxlan: interface is destroyed and rebuild on description change

• T4263 (bug): vyos.util.leaf_node_changed() dos not honor valueLess nodes

3.3.200 2022-02-21

• T4120 (feature): [VXLAN] add ability to set multiple unicast-remotes

3.3.201 2022-02-20

• T4261 (feature): MACsec: add DHCP client support

• T4203 (bug): Reconfigure DHCP client interface causes brief outages

3.3.202 2022-02-19

• T4258 (bug): [DHCP-SERVER] error parameter on Failover

3.3.203 2022-02-17

• T4241 (bug): ocserv openconnect looks broken in recent bulds of 1.3 Equuleus
• T4255 (bug): Unexpected print of dict bridge on delete
• T4240 (bug): Cannot add wlan0 to bridge via configure
• T4154 (bug): Error add second gre tunnel with the same source interface

3.3.204 2022-02-16

• T4237 (bug): Conntrack-sync error - error adding listen-address command

3.3.205 2022-02-15

• T4201 (bug): Firewall - ICMPv6 matches not working as expected on 1.3.0

• T3006 (bug): Accel-PPP & vlan-mon config get invalid VLAN
• T3494 (bug): DHCPv6 leases traceback when PD using

3.3. 1.3 Equuleus 187

 VyOS Documentation, Release 1.5.x (circinus)

3.3.206 2022-02-13

• T4242 (bug): ethernet speed/duplex can never be switched back to auto/auto

• T4191 (bug): Lost access to host after VRF re-creating

3.3.207 2022-02-11

• T3872 (feature): Add configurable telegraf monitoring service

• T4234 (bug): Show firewall partly broken in 1.3.x

3.3.208 2022-02-10

• T4165 (bug): Custom conntrack rules cannot be deleted

3.3.209 2022-02-08

• T4227 (bug): Typo in help completion of hello-time option of bridge interface

3.3.210 2022-02-07

• T4233 (bug): ssh: sync regex for allow/deny usernames to "system login"
• T4087 (feature): IPsec IKE-group proposals limit of 10 pieces

3.3.211 2022-02-05

• T4226 (bug): VRRP transition-script does not work for groups name which contains
-(minus) sign

3.3.212 2022-02-04

• T4196 (bug): DHCP server client-prefix-length parameter results in non-functional

leases

3.3.213 2022-02-03

• T3643 (bug): show vpn ipsec sa doesn't show tunnels in "down" state

3.3. 1.3 Equuleus 188

 VyOS Documentation, Release 1.5.x (circinus)

3.3.214 2022-02-01

• T4198 (bug): Error shown on commit

3.3.215 2022-01-28

• T4184 (bug): NTP allow-clients address doesn't work it allows to use ntp server for
all addresses

3.3.216 2022-01-24

• T4204 (feature): Update Accel-PPP to a newer revision

3.3.217 2022-01-17

• T3164 (bug): console-server ssh does not work with RADIUS PAM auth

3.3.218 2022-01-15

• T4183 (feature): IPv6 link-local address not accepted as wireguard peer

• T4110 (feature): [IPV6-SSH/DNS} enable IPv6 link local adresses as listen-address
%eth0

3.3.219 2022-01-12

• T4168 (bug): IPsec VPN is impossible to restart when DMVPN is configured

• T4167 (bug): DMVPN apply wrong param on the first configuration
• T4152 (bug): NHRP shortcut-target holding-time does not work

3.3.220 2022-01-10

• T3299 (bug): Allow the web proxy service to listen on all IP addresses
• T3115 (feature): Add support for firewall on L3 VIF bridge interface

3.3.221 2022-01-09

• T3822 (bug): OpenVPN processes do not have permission to read key files generated
with `run generate openvpn key`
• T4142 (bug): Input ifbX interfaces not displayed in op-mode
• T3914 (bug): VRRP rfc3768-compatibility doesn't work with unicast peers

3.3. 1.3 Equuleus 189

 VyOS Documentation, Release 1.5.x (circinus)

3.3.222 2022-01-07

• T3924 (bug): VRRP stops working with VRF

3.3.223 2022-01-06

• T4141 (bug): Set high-availability vrrp sync-group without members error

3.3.224 2022-01-03

• T4065 (bug): IPSEC configuration error: connection to unix:///var/run/charon.ctl

failed: No such file or directory
• T4052 (bug): Validator return traceback on VRRP configuration with the script path
not in config dir
• T4128 (bug): keepalived: Upgrade package to add VRF support

3.3.225 2021-12-31

• T4081 (bug): VRRP health-check script stops working when setting up a sync group

3.3.226 2021-12-29

• T2922 (bug): The `vpn ipsec logging log-modes` miss the IPSec daemons state check
• T2695 (bug): Flow-accounting bug with subinterfaces
• T2400 (default): OpenVPN: dont restart server if no need
• T4086 (default): system login banner is not removed on deletion.

3.3.227 2021-12-28

• T3380 (bug): "show vpn ike sa" does not display IPv6 peers
• T2933 (feature): VRRP add option virtual_ipaddress_excluded

3.3.228 2021-12-27

• T2566 (bug): sstp not able to run tunnels ipv6 only

• T4093 (bug): SNMPv3 snmpd.conf generation bug
• T2764 (enhancment): Increase maximum number of NAT rules

3.3. 1.3 Equuleus 190

 VyOS Documentation, Release 1.5.x (circinus)

3.3.229 2021-12-26

• T4104 (bug): RAID1: "add raid md0 member sda1" does not restore boot sector

3.3.230 2021-12-25

• T4101 (bug): commit-archive: Use of uninitialized value $source_address in

concatenation
• T4055 (feature): Add VRF support for HTTP(S) API service

3.3.231 2021-12-24

• T3854 (bug): Missing op-mode commands for conntrack-sync

3.3.232 2021-12-23

• T4092 (bug): IKEv2 mobike commit failed with DMVPN nhrp

• T3354 (default): Convert strip-private script from Perl to Python

3.3.233 2021-12-22

• T3356 (feature): Script for remote file transfers

3.3.234 2021-12-21

• T4053 (bug): VRRP impossible to set scripts out of the /config directory
• T4013 (bug): Add pkg cloudwatch for AWS images
• T3913 (bug): VRF traffic fails after upgrade from 1.3.0-RC6 to 1.3.0-EPA1/2

3.3.235 2021-12-20

• T4088 (default): Fix typo in login banner

3.3.236 2021-12-19

• T3912 (default): Use a more informative default post-login banner

3.3. 1.3 Equuleus 191

 VyOS Documentation, Release 1.5.x (circinus)

3.3.237 2021-12-17

• T3176 (bug): Ordering of ports on EdgeCore SAF51015I is mixed up?

• T4059 (bug): VRRP sync-group transition script does not persist after reboot

3.3.238 2021-12-16

• T4046 (feature): Sflow - Add Source address parameter

• T2615 (default): Provide an explicit option for server fingerprint in commit
archive, and make insecure the default
• T4076 (enhancment): Allow setting CORS options in HTTP API
• T3378 (bug): commit-archive source-address broken for IPv6 addresses

3.3.239 2021-12-15

• T4077 (bug): op-mode: bfd: drop "show protocols bfd" in favour of "show bfd"
• T4073 (bug): "show protocols bfd peer <>" shows incorrect peer information.

3.3.240 2021-12-14

• T4071 (feature): Allow HTTP API to bind to unix domain socket

3.3.241 2021-12-12

• T4036 (bug): VXLAN incorrect raiseError if set multicast network instead of singe
address

3.3.242 2021-12-10

• T4068 (feature): Python: ConfigError should insert line breaks into the error
message

3.3.243 2021-12-09

• T4033 (bug): VRRP - Error security when setting scripts

• T4064 (bug): IP address for vif is not removed from the system when deleted in
configuration
• T4063 (bug): VRRP log error - /usr/libexec/vyos/vyos-vrrp-conntracksync.sh - No such
file or directory
• T4060 (enhancment): Extend configquery for use before boot configuration is complete

3.3. 1.3 Equuleus 192

 VyOS Documentation, Release 1.5.x (circinus)

3.3.244 2021-12-08

• T4024 (bug): Access-lists and prefix-lists disappear when setting ldp

hello-ipv4-interval

3.3.245 2021-12-07

• T4041 (servicerequest): "transition-script" doesn't work on "sync-group"

3.3.246 2021-12-06

• T4012 (feature): Add VRF support for TFTP

3.3.247 2021-12-05

• T4034 (bug): "make xcp-ng-iso" still includes vyos-xe-guest-utilities

• T2076 (feature): RAID install: sfdisk change-id is deprecated in favor of
--part-type
• T1126 (bug): Reusing a RAID from a BIOS install in an EFI install causes a failure
to boot

3.3.248 2021-12-04

• T4049 (feature): support command-style output with compare command

• T4047 (bug): Wrong regex validation in XML definitions
• T4045 (bug): Unable to "format disk <new> like <old>"

3.3.249 2021-12-02

• T4035 (bug): Geneve interfaces aren't displayed by operational mode commands

3.3.250 2021-12-01

• T3695 (bug): OpenConnect reports commit success when ocserv fails to start due to
SSL cert/key file issues

3.3.251 2021-11-30

• T3725 (feature): show configuration in json format

3.3. 1.3 Equuleus 193

 VyOS Documentation, Release 1.5.x (circinus)

3.3.252 2021-11-29

• T2661 (bug): SSTP wrong certificates check

• T3946 (enhancment): Automatically resize the root partition if the drive has extra
space

3.3.253 2021-11-28

• T3999 (bug): show lldp neighbor Traceback error

3.3.254 2021-11-26

• T4019 (bug): Smoketests for SSTP and openconnect fails

3.3.255 2021-11-25

• T4005 (feature): Feature Request: IPsec IKEv1 + IKEv2 for one peer

3.3.256 2021-11-24

• T4015 (feature): Update Accel-PPP to a newer revision

• T1083 (feature): Implement persistent/random address and port mapping options for
NAT rules

3.3.257 2021-11-23

• T3990 (bug): WATCHFRR: crashlog and per-thread log buffering unavailable (due to
files left behind in /var/tmp/frr/ after reboot)

3.3.258 2021-11-20

• T4004 (bug): IPsec ike-group parameters are not saved correctly (after reboot)

3.3.259 2021-11-19

• T4003 (bug): API for "show interfaces ethernet" does not include the interface
description
• T4011 (bug): ethernet: deleting interface should place interface in admin down
state

3.3. 1.3 Equuleus 194

 VyOS Documentation, Release 1.5.x (circinus)

3.3.260 2021-11-18

• T3995 (feature): OpenVPN: do not stop/start service on configuration change

• T4008 (feature): dhcp: change client retry interval form 300 -> 60 seconds
• T3795 (bug): WWAN: issues with non connected interface / no signal

3.3.261 2021-11-17

• T3350 (bug): OpenVPN config file generation broken

• T3996 (bug): SNMP service error in log

3.3.262 2021-11-15

• T3934 (bug): Openconnect VPN broken: ocserv-worker general protection fault on

client connect
• T3724 (feature): Allow setting host-name in l2tp section of accel-ppp

3.3.263 2021-11-14

• T3974 (bug): route-map commit fails if interface does not exist

3.3.264 2021-11-11

• T1349 (bug): L2TP remote-access vpn terminated and not showing as connected
• T1058 (default): hw-id is ignored when naming interfaces
• T914 (feature): Extend list_interfaces.py to support multiple interface types
• T688 (enhancment): Move component versions used for config migration purposes into
vyos-1x

3.3.265 2021-11-10

• T3982 (bug): DHCP server commit fails if static-mapping contains + or .

3.3.266 2021-11-09

• T3962 (bug): Image cannot be built without open-vm-tools

• T2088 (bug): Increased boot time from 1.2.4 -> 1.3 rolling by 100%
• T2136 (bug): XML command definition convertor doesn't disallow tag nodes with multi
flag on

3.3. 1.3 Equuleus 195

 VyOS Documentation, Release 1.5.x (circinus)

3.3.267 2021-11-07

• T2874 (feature): Add MTU and TCP-MSS discovery tool

• T3626 (bug): Configuring and disabling DHCP Server

3.3.268 2021-11-06

• T3971 (feature): Ability to build ISO images for XCP-NG hypervisor

• T3514 (bug): NIC flap at any interface change

3.3.269 2021-11-05

• T3972 (bug): Removing vif-c interface raises KeyError

3.3.270 2021-11-04

• T3964 (bug): SSTP: local-user static-ip CLI node accepts invalid IPv4 addresses

3.3.271 2021-11-03

• T3610 (bug): DHCP-Server creation for not primary IP address fails

3.3.272 2021-11-01

• T3846 (bug): dmvpn configuration not reapllied after "restart vpn"

• T3956 (bug): GRE tunnel - unable to move from source-interface to source-address,
commit error

3.3.273 2021-10-31

• T3945 (feature): Add route-map for bgp aggregate-address

• T3341 (bug): Wrong behavior of the "reset vpn ipsec-peer XXX tunnel XXX" command
• T3954 (bug): FTDI cable makes VyOS sagitta latest hang, /dev/serial unpopulated,
config system error
• T3943 (bug): "netflow source-ip" prevents image upgrades if IP address does not
exist locally

3.3. 1.3 Equuleus 196

 VyOS Documentation, Release 1.5.x (circinus)

3.3.274 2021-10-29

• T3942 (feature): Generate IPSec debug archive from op-mode

3.3.275 2021-10-28

• T3941 (bug): "show vpn ipsec sa" shows established time of parent SA not child SA's

3.3.276 2021-10-27

• T3944 (bug): VRRP fails over when adding new group to master

3.3.277 2021-10-25

• T3935 (bug): Update from rc5 to EPA2 failed

3.3.278 2021-10-22

• T3188 (bug): Tunnel local-ip to dhcp-interface Change Fails to Update

3.3.279 2021-10-21

• T3920 (bug): dhclient exit hook script 01-vyos-cleanup causes too many arguments
error
• T3926 (bug): strip-private does not sanitize "cisco-authentication" from NHRP
configuration
• T3925 (feature): Tunnel: dhcp-interface not implemented - use source-interface
instead
• T3927 (feature): Kernel: Enable kernel support for HW offload of the TLS protocol

3.3.280 2021-10-20

• T3922 (bug): NHRP: delete fails

• T3918 (bug): DHCPv6 prefix delegation incorrect verify error
• T3921 (bug): tunnel: KeyError when using dhcp-interface

3.3. 1.3 Equuleus 197

 VyOS Documentation, Release 1.5.x (circinus)

3.3.281 2021-10-19

• T3396 (bug): syslog can't be configured with an ipv6 literal destination in 1.2.x
• T690 (feature): Allow OpenVPN servers to push routes with custom metric values

3.3.282 2021-10-17

• T3786 (bug): GRE tunnel source address 0.0.0.0 error

• T3425 (bug): Scripts from the /config/scripts/ folder do not run on live system
• T3217 (default): Save FRR configuration on each commit
• T3076 (bug): Router reboot adds unwanted 'conntrack-sync mcast-group '225.0.0.50''
line to configuration
• T2800 (bug): Pseudo-Ethernet: source-interface must not be member of a bridge
• T3422 (bug): Dynamic DNS doesn't allow zone field with cloudflare protocol
• T3381 (bug): Change GRE tunnel failed
• T3254 (bug): Dynamic DNS status shows incorrect last update time
• T3253 (bug): rpki: multiple peers cannot be configured
• T3219 (default): Typo in openvpn server client config for IPv6 iroute
• T2100 (feature): BGP route adverisement wih checks rib
• T1663 (enhancment): T1656 equuleus: buster: arm64/aarch64: ipaddrcheck does not
complete testing
• T1243 (bug): BGP local-as accept wrong values
• T770 (bug): Bonded interfaces get updated with incorrect hw-id in config.
• T697 (bug): Clean up and sanitize package dependencies
• T3837 (default): OpenConnect: Fix typo in help property
• T1440 (bug): Creating two DHCPv6 shared-network-names with the same subnet is
allowed, causes dhcpd to fail to start.
• T578 (feature): Support Linux Container

3.3.283 2021-10-16

• T3879 (bug): GPG key verification fails when upgrading from a 1.3 beta version
• T3851 (bug): Missing ospf and rip options for bridge vifs

3.3. 1.3 Equuleus 198

 VyOS Documentation, Release 1.5.x (circinus)

3.3.284 2021-10-13

• T3904 (bug): NTP pool associations silently fail

• T3277 (feature): DNS Forwarding - reverse zones

3.3.285 2021-10-11

• T2607 (feature): Support for pppoe-server radius mode auth and config radius
accouting port

3.3.286 2021-10-10

• T3750 (bug): pdns-recursor 4.4 issue with dont-query and private DNS servers
• T3885 (default): dhcpv6-pd: randomly generated DUID is not persisted
• T3899 (enhancment): Add support for hd44780 LCD displays

3.3.287 2021-10-09

• T3894 (bug): Tunnel Commit Failed if system does not have `eth0`

3.3.288 2021-10-08

• T3893 (bug): MGRE Tunnel commit crash If sit tunnel available

3.3.289 2021-10-04

• T3888 (bug): Incorrect warning when poweroff command executed from configure mode.
• T3890 (feature): dhcp(v6): provide op-mode commands to retrieve both server and
client logfiles
• T3889 (feature): Migrate to journalctl when reading daemon logs

3.3.290 2021-10-03

• T3880 (bug): EFI boot shows error on display

3.3.291 2021-10-02

• T3882 (feature): Upgrade PowerDNs recursor to 4.5 series

• T3883 (bug): VRF - Delette vrf config on interface

3.3. 1.3 Equuleus 199

 VyOS Documentation, Release 1.5.x (circinus)

3.3.292 2021-10-01

• T3877 (bug): VRRP always enabled rfc3768-compatibility even when not specified

3.3.293 2021-09-30

• T3874 (bug): D-Link Ethernet Interface not working.

3.3.294 2021-09-27

• T3858 (bug): Deleting OSPFv3 process yields: Unknown command: no router-id

3.3.295 2021-09-26

• T3860 (bug): Error on pppoe, tunnel and wireguard interfaces for IPv6 EUI64
addresses
• T3857 (feature): reboot: send wall message to all users for information
• T3867 (bug): vxlan: multicast group address is not validated
• T3859 (bug): Add "log-adjacency-changes" to ospfv3 process

3.3.296 2021-09-23

• T3850 (bug): Dots are no longer allowed in SSH public key names

3.3.297 2021-09-21

• T2602 (bug): pptp/sstp/l2tp add possibility enable or disable CCP

3.3.298 2021-09-19

• T3841 (feature): dhcp-server: add ping-check option to CLI

• T2738 (bug): Modifying configuration in the "interfaces" section from VRRP
transition scripts causes configuration lockup and high CPU utilization
• T3842 (feature): Backport DHCP server improvements from VyOS 1.4 sagitta to 1.3
equuleus
• T3840 (feature): dns forwarding: Cache size should allow values > 10k
• T3672 (bug): DHCP-FO with multiple subnets results in invalid/non-functioning dhcpd.
conf configuration file output

3.3. 1.3 Equuleus 200

 VyOS Documentation, Release 1.5.x (circinus)

3.3.299 2021-09-11

• T3402 (feature): Add VyOS programming library for operational level commands

3.3.300 2021-09-10

• T3802 (bug): Commit fails if ethernet interface doesn't support flow control
• T3819 (bug): Upgrade Salt Stack 3002.3 -> 3003 release train
• T3421 (bug): MTR/Traceroute broken in 1.3-beta
• T3820 (feature): PowerDNS recursor - update from 4.3 -> 4.4 to sync with current
• T1770 (bug): webproxy breaks commit and http access on routed client
• T915 (feature): MPLS Support

3.3.301 2021-09-09

• T3816 (bug): Error after entering outbound-interface command in NAT

• T3814 (bug): wireguard: commit error showing incorrect peer name from the
configured name
• T3805 (bug): OpenVPN insufficient privileges for rtnetlink when closing TUN/TAP
interface

3.3.302 2021-09-07

• T2322 (bug): CLI [op-mode] bugs. Root task

• T1894 (bug): FRR config not loaded after daemons segfault or restart
• T3807 (bug): Op Command "show interfaces wireguard" does not show the output
• T3808 (default): ipsec is mistakenly restarted after delete

3.3.303 2021-09-06

• T3806 (bug): Don't set link local ipv6 address if MTU less then 1280
• T3803 (default): Add source-address option to the ping CLI
• T3431 (bug): Show version all bug
• T3362 (bug): 1.3 - RC1 ifb redirect failing to commit
• T3291 (bug): Fault on setting offload RPS with single-core CPU
• T2920 (bug): Commit crash when adding the second mGRE tunnel with the same key
• T2895 (bug): VPN IPsec "leftsubnet" declared 2 times
• T2019 (bug): LLDP wrong config generation for interface 'all'

3.3. 1.3 Equuleus 201

 VyOS Documentation, Release 1.5.x (circinus)

3.3.304 2021-09-05

• T3804 (feature): cli: Migrate and merge "system name-servers-dhcp" into "system
name-server"

3.3.305 2021-09-04

• T3697 (bug): Impossible to delete IPsec completely

• T3619 (bug): Performance Degradation 1.2 --> 1.3 | High ksoftirqd CPU usage
• T1785 (bug): Deleting partitions on disks (Raid1) with default value 'no'

3.3.306 2021-09-03

• T3788 (bug): Keys are not allowed with ipip and sit tunnels
• T3683 (bug): VXLAN not accept ipv6 and source-interface options and mtu bug
• T3634 (feature): Add op command option for ping for do not fragment bit to be set

3.3.307 2021-09-02

• T3792 (bug): login: A hypen present in a username from "system login user" is
replaced by an underscore
• T3790 (bug): Does not possible to configure PPTP static ip-address to users

3.3.308 2021-09-01

• T2434 (bug): Duplicate Address Detection Breaks Interfaces

3.3.309 2021-08-31

• T3789 (feature): Add custom validator for base64 encoded CLI data
• T3782 (default): Ingress Shaping with IFB No Longer Functional with 1.3

3.3.310 2021-08-30

• T3777 (bug): adding IPv6 EUI64 address fails commit in 1.3.0-rc6

• T3768 (default): Remove early syntaxVersion implementation
• T2558 (feature): Add some CPU information to `show version` + fix broken hypervisor
detection
• T2430 (default): cannot delete specific route static next-hop
• T1350 (bug): VRRP transition script will be executed once only
• T2941 (default): Using a non-ASCII character in the description field causes
UnicodeDecodeError in configsource.py
• T3787 (bug): Remove deprecated UDP fragmentation offloading option

3.3. 1.3 Equuleus 202

 VyOS Documentation, Release 1.5.x (circinus)

• T3677 (feature): "sipcalc" not included in 1.3

3.3.311 2021-08-29

• T3708 (bug): isisd and gre-bridge commit error

• T3783 (bug): "set protocols isis spf-delay-ietf" is not working
• T2750 (default): Use m4 as a template processor

3.3.312 2021-08-27

• T3182 (bug): Main blocker Task for FRR 7.4/7.5 series update
• T2108 (default): Use minisign/signify instead of GPG for release signing

3.3.313 2021-08-26

• T3781 (bug): Revert the NAT implementation in 1.3 back to iptables

• T3776 (default): Rename FRR daemon restart op-mode commands
• T3779 (feature): Backport all 1.4 IS-IS features and configuration to 1.3 except VRF

3.3.314 2021-08-25

• T3773 (bug): Delete the "show system integrity" command (to prepare for a
re-implementation)
• T1514 (default): Add ability to restart frr processes

3.3.315 2021-08-24

• T3772 (bug): VRRP virtual interfaces are not shown in show interfaces

3.3.316 2021-08-23

• T2555 (bug): XML op-mode generation scripts silently discard XML nodes

3.3.317 2021-08-21

• T3682 (bug): Remove running dhclient from ether-resume.py

3.3. 1.3 Equuleus 203

 VyOS Documentation, Release 1.5.x (circinus)

3.3.318 2021-08-20

• T1950 (default): Store VyOS configuration syntax version data in JSON file

3.3.319 2021-08-19

• T2759 (bug): validate-value prints error messages from validators that fail even if
overall validation succeeds
• T3234 (bug): multi_to_list fails in certain cases, with root cause an element
redundancy in XML interface-definitions
• T3732 (feature): override-default helper should support adding defaultValues to
default less nodes
• T1962 (default): Add syntax version to schema

3.3.320 2021-08-17

• T2525 (bug): OSPFv3 missing route map, not establishing

• T508 (bug): ISC DHCP incorrect UDP checksum generation
• T1643 (bug): Deleting all firewall zones failed and locked out box
• T1550 (bug): Add support for Large BGP Community show commands

3.3.321 2021-08-16

• T3738 (default): openvpn fails if server and authentication are configured

• T1594 (bug): l2tpv3 error on IPv6 local-ip

3.3.322 2021-08-15

• T3756 (default): VyOS generates invalid QR code for wireguard clients

3.3.323 2021-08-14

• T3745 (feature): op-mode IPSec show vpn ipse sa sorting

• T521 (bug): Network services may fail if vyatta-router.service startup takes longer
than a few seconds

3.3. 1.3 Equuleus 204

 VyOS Documentation, Release 1.5.x (circinus)

3.3.324 2021-08-13

• T3740 (bug): HTTPs API breaks when the address is IPv6

3.3.325 2021-08-12

• T3731 (bug): verify_accel_ppp_base_service return wrong config error for SSP

• T3405 (feature): PPPoE server unit-cache
• T2432 (default): dhcpd: Can't create new lease file: Permission denied
• T3746 (feature): Inform users logging into the system about a pending reboot
• T3744 (default): Dns forwarding statistics formatting missing a new line

3.3.326 2021-08-10

• T3730 (bug): op-mode conntrack-sync miss some functions

3.3.327 2021-08-09

• T1501 (bug): VPN Commit Errors

3.3.328 2021-08-08

• T2027 (bug): get_config_dict is failing when the configuration section is empty/

missing
• T169 (feature): Image install should put correct serial console device in created
GRUB menu entry

3.3.329 2021-08-07

• T548 (feature): BGP IPv6 multipath support

3.3.330 2021-08-06

• T1153 (bug): VyOS 1.2.0RC10, RAID-1, fresh install, unable to save config

3.3.331 2021-08-05

• T696 (feature): Rewrite conntrack sync to XML

3.3. 1.3 Equuleus 205

 VyOS Documentation, Release 1.5.x (circinus)

3.3.332 2021-08-04

• T3704 (feature): Add ability to interact with Areca RAID adapers

• T320 (default): OSPF does not redistribute connected routes associated with virtual
tunnel interfaces

3.3.333 2021-08-02

• T2623 (bug): Creating sit tunnel fails with “Can not set “local” for tunnel sit tun1
at tunnel creation”
• T2161 (default): snmpd cannot start if ipv6 disabled
• T3601 (default): Error in ssh keys for vmware cloud-init if ssh keys is left empty.

3.3.334 2021-08-01

• T3707 (bug): Ping incorrect ip host checks

3.3.335 2021-07-31

• T3716 (feature): Linux kernel parameters ignore_routes_with_link_down- ignore

disconnected routing connections
• T1626 (bug): BGP exchanges prefixes without specified address-family

3.3.336 2021-07-30

• T1176 (default): FRR - BGP replicating routes

• T1123 (bug): Inconsistency in community-list naming validation

3.3.337 2021-07-29

• T2931 (bug): Unicode decode error causes vyos.configd service to restart

• T2727 (bug): Add a dotted decimal value validator
• T2328 (default): dhcpv6 server not starting (disable check reversed?)
• T1758 (default): Switch vyos.config to libvyosconfig
• T954 (bug): Using the 10.255.255.0/24 subnet on other interfaces breaks L2TP/IPSec

3.3. 1.3 Equuleus 206

 VyOS Documentation, Release 1.5.x (circinus)

3.3.338 2021-07-23

• T3699 (bug): login: verify selected "system login user" name is not already used by
the base system.

3.3.339 2021-07-21

• T3689 (bug): static ipv6 route doesn't deleted in some cases

• T3685 (feature): IPv6 PBR doesn't allow setting of an egress interface

3.3.340 2021-07-20

• T3691 (bug): GRETAP: key is not applied when interface is created

3.3.341 2021-07-13

• T3679 (default): Point the unexpected exception message link to the new rolling
release location

3.3.342 2021-07-11

• T3665 (bug): Missing VRF support for VxLAN but already documented

3.3.343 2021-07-06

• T3660 (feature): Conntrack-Sync configuration command to specify destination udp

port for peer

3.3.344 2021-07-01

• T3658 (feature): Add support for dhcpdv6 fixed-prefix6

3.3.345 2021-06-29

• T3593 (bug): PPPoE server called-sid format does not work

3.3.346 2021-06-25

• T3650 (bug): OpenVPN: Upgrade package to 2.5.1 before releasing VyOS 1.3.0
• T3649 (feature): Add bonding additional hash-policy

3.3. 1.3 Equuleus 207

 VyOS Documentation, Release 1.5.x (circinus)

3.3.347 2021-06-24

• T2722 (bug): get_config_dict() and key_mangling=('-', '_') will alter CLI data for
tagNodes

3.3.348 2021-06-22

• T3629 (bug): IPoE server shifting address in the range

3.3.349 2021-06-20

• T3637 (bug): vrf: bind-to-all didn't work properly

3.3.350 2021-06-19

• T3633 (feature): Add LRO offload for interface ethernet

3.3.351 2021-06-17

• T3631 (feature): route-map: migrate "set extcommunity-rt" and "set

extcommunity-soo" to "set extcommunity rt|soo" to match FRR syntax

3.3.352 2021-06-16

• T2425 (feature): Rewrite all policy zebra filters to XML/Python style

• T3630 (feature): op-mode: add "show version kernel" command

3.3.353 2021-06-13

• T3620 (feature): Rename WWAN interface from wirelessmodem to wwan to use QMI
interface
• T3622 (feature): WWAN: add support for APN authentication
• T3621 (bug): PPPoE interface does not validate if password is supplied when username
is set

3.3.354 2021-06-10

• T3250 (bug): PPPoE server: wrong local usernames

• T3138 (bug): ddclient improperly updated when apply rfc2136 config
• T2645 (default): Editing route-map action requires adding a new rule

3.3. 1.3 Equuleus 208

 VyOS Documentation, Release 1.5.x (circinus)

3.3.355 2021-06-09

• T3602 (bug): Renaming BGP Peer Groups Leaves Router Broken

• T2916 (bug): A state of VTI interface in a configuration does not being processing
properly

3.3.356 2021-06-08

• T3605 (default): Allow to set prefer-global for ipv6-next-hop

• T3607 (feature): [route-map] set ipv6 next-hop prefer-global

3.3.357 2021-06-07

• T3581 (bug): Incomplete command `show ipv6 ospfv3 linkstate`

• T3516 (bug): FRR 7.5 adds a second route when you attempt to change a static route
distance instead of overwriting the old route
• T3461 (bug): OpenConnect Server redundancy check
• T3455 (bug): system users can not be added in "edit"

3.3.358 2021-06-04

• T3592 (feature): Set default TTL 64 for tunnels

3.3.359 2021-06-01

• T406 (bug): VPN configuration error: IPv6 over IPv4 IPsec is not supported when
using IPv6 ONLY tunnel.

3.3.360 2021-05-30

• T1866 (bug): Commit archive over SFTP doesn't work with non-standard ports
• T3589 (feature): op-mode: support clearing out logfiles from CLI
• T3508 (bug): Check if there's enough drive space for an upgrade before downloading
an image
• T1506 (enhancment): commit-archive scp/sftp public key authentication

3.3. 1.3 Equuleus 209

 VyOS Documentation, Release 1.5.x (circinus)

3.3.361 2021-05-29

• T3135 (bug): BFD configurations fail to be applied

• T3103 (default): Rewrite parts of vyos\frr.py for readability, logging and to fix
mulitiline regex "bugs"
• T2739 (default): vyos-utils is not compiled with a Jenkins pipeline.
• T2451 (bug): Cannot use !tcp or !tcp_udp while adding firewall rule
• T2436 (default): equuleus: Testing: vyos-1x: syntax checking Python scripts in PR
• T2184 (bug): OpenVPN op_mode tools broken
• T1944 (bug): FRR: Invalid route in BGP causes update storm, memory leak, and failure
of Zebra

3.3.362 2021-05-28

• T1579 (feature): Rewrite all interface types in new XML/Python style

3.3.363 2021-05-27

• T2629 (bug): VXLAN interfaces don't actually allow you to configure most settings
• T2617 (feature): Rewrite vyatta-op-quagga "show" to XML
• T2512 (feature): vyatta-op-quagga [show ip] to XML format
• T1905 (default): Update to Keepalived 2.0.19
• T2669 (bug): DHCP-server overlapping ranges.

3.3.364 2021-05-26

• T3558 (default): autocomplete options for dhcp-interface is not showing for the
static route command
• T3540 (bug): Keepalived memory utilisation issue when constantly getting its state
in JSON format
• T2807 (feature): IPv6 Link-Local Address - Automatically generation/configuration on
GRE Interfaces

3.3.365 2021-05-24

• T3575 (bug): pseudo-ethernet: must check source-interface MTU

• T3571 (bug): Broken Show Tab Complete
• T3576 (bug): ISIS does not support IPV6

3.3. 1.3 Equuleus 210

 VyOS Documentation, Release 1.5.x (circinus)

3.3.366 2021-05-23

• T3570 (default): Prevent setting of a larger MTU on child interfaces

• T3572 (feature): Basic Drive Diagnostic Tools

3.3.367 2021-05-20

• T3554 (feature): Add area-type stub for ospfv3

3.3.368 2021-05-19

• T3562 (feature): Update Accel-PPP to a newer revision

• T3559 (feature): Add restart op-command for OpenConnect Server

3.3.369 2021-05-18

• T3525 (default): VMWare resume script syntax errors

• T2462 (default): LLDP op-mode exception: IndexError: list index out of range

3.3.370 2021-05-15

• T3549 (bug): DHCPv6 "service dhcpv6-server global-parameters name-server" is not

correctly exported to dhcpdv6.conf when multiple name-server entries are present
• T3532 (bug): Not possible to change ethertype after interface creation
• T3550 (bug): Router-advert completion typo
• T3547 (feature): conntrackd: remove deprecated config options
• T3535 (feature): Rewrite vyatta-conntrack-sync in new XML and Python flavor
• T2049 (feature): Update strongSwan cipher suites list for IPSec settings

3.3.371 2021-05-14

• T3346 (bug): nat 4-to-5 migration script fails when a 'source' or 'destination' node
exists but there are no rules
• T3248 (default): Deal with VRRP mode-force command that exists in 1.2 but not in 1.3
• T3426 (default): add support for script arguments to vyos-configd

3.3. 1.3 Equuleus 211

 VyOS Documentation, Release 1.5.x (circinus)

3.3.372 2021-05-13

• T3544 (feature): DHCP server should validate configuration before applying it

• T3543 (feature): Support for setting lacp_rate on LACP bonded interfaces

3.3.373 2021-05-12

• T3302 (default): Make vyos-configd relay stdout from scripts to the user's console

3.3.374 2021-05-11

• T3526 (bug): Smoketest policy fail in CI

3.3.375 2021-05-10

• T3528 (bug): Frr 7.5.1 uses 'seq' for community-lists

3.3.376 2021-05-08

• T3517 (bug): FRR 7.5 bfd behavior for 1.3

3.3.377 2021-05-07

• T1171 (bug): 1.2.0 epa2 - IPsec VPN initiation

3.3.378 2021-05-06

• T3519 (bug): Cannot add / assign L2TPv3 to vrf

3.3.379 2021-05-01

• T3379 (feature): Add global-parameters name-server for dhcpv6-server

• T3491 (default): Change Kernel HZ to 1000

3.3.380 2021-04-30

• T3170 (default): Add a sanity check for empty node.def files

3.3. 1.3 Equuleus 212

 VyOS Documentation, Release 1.5.x (circinus)

3.3.381 2021-04-29

• T3502 (bug): "system ip multipath layer4-hashing" doesn't work

• T3029 (bug): Generated NGINX configuration is wrong for the redirection (http ->
https)
• T3156 (feature): Add op and additional conf commands for ISIS
• T2012 (feature): Global PBR
• T1314 (feature): Allow BGP on unnumbered interfaces

3.3.382 2021-04-27

• T2946 (bug): Calling 'stty_size' causes show interfaces API to fail

3.3.383 2021-04-25

• T3468 (bug): Tunnel interfaces aren't suggested as being available for bridging
(regression)
• T1802 (feature): Wireguard QR code in cli for mobile devices

3.3.384 2021-04-23

• T3290 (bug): Disabling GRE conntrack module fails

3.3.385 2021-04-18

• T3481 (default): Exclude tag node values from key mangling

• T3475 (bug): XML dictionary cache unable to process syntaxVersion elements

3.3.386 2021-04-15

• T3386 (bug): PPPoE-server don't start with local authentication

3.3.387 2021-04-14

• T3055 (bug): op-mode incorrect naming for ipsec policy-based tunnels

3.3. 1.3 Equuleus 213

 VyOS Documentation, Release 1.5.x (circinus)

3.3.388 2021-04-12

• T3454 (enhancment): dhclient reject option

3.3.389 2021-04-05

• T1612 (default): dhcp-server time-offset fails to validate

• T3438 (bug): VRF: removing vif which belongs to a vrf, will delete the entire vrf
from the operating system
• T3418 (bug): BGP: system wide known interface can not be used as neighbor

3.3.390 2021-04-04

• T3457 (feature): Output the "monitor log" command in a colorful way

3.3.391 2021-03-31

• T3445 (bug): vyos-1x build include not all nodes

3.3.392 2021-03-25

• T2639 (feature): sort output of show vpn ipsec sa

3.3.393 2021-03-22

• T3284 (bug): merge/load fail silently if unable to resolve host

3.3.394 2021-03-21

• T3416 (bug): NTP: when running inside a VRF op-mode commands do not work

3.3.395 2021-03-20

• T3392 (bug): vrrp over dhcp default route bug (unexpected vrf)
• T3373 (feature): Upgrade to SaltStack version 3002.5
• T3329 (default): "system conntrack ignore" rules can no longer be created due to an
iptables syntax change
• T3300 (feature): Add DHCP default route distance
• T3306 (feature): Extend set route-map aggregator as to 4 Bytes

3.3. 1.3 Equuleus 214

 VyOS Documentation, Release 1.5.x (circinus)

3.3.396 2021-03-18

• T3411 (default): Extend the redirect_stdout context manager in vyos-configd to

redirect stdout from subprocesses
• T3271 (bug): qemu-kvm grub issue

3.3.397 2021-03-17

• T3413 (bug): Configuring invalid IPv6 EUI64 address results in "OSError: illegal IP
address string passed to inet_pton"

3.3.398 2021-03-14

• T2271 (feature): OSPF: add per VRF instance support

• T175 (feature): Add source route option to VTI interfaces

3.3.399 2021-03-13

• T3406 (bug): tunnel: interface no longer supports specifying encaplimit none - or

migrator is missing
• T3407 (bug): console-server: do not allow to spawn a console-server session on
serial port used by "system console"

3.3.400 2021-03-11

• T3399 (bug): RPKI: dashes in hostnames are replaced with underscores when rendering
the FRR config
• T3305 (bug): Ingress qdisc does not work anymore in 1.3-rolling-202101 snapshot
• T2927 (bug): isc-dhcpd release and expiry events never execute
• T899 (bug): Tunnels cannot be moved from one bridge to another
• T786 (feature): new style xml and conf-mode scripts: posibillity to add tagNode
value as parameter to conf-script

3.3.401 2021-03-09

• T3382 (bug): Error creating Console Server

3.3. 1.3 Equuleus 215

 VyOS Documentation, Release 1.5.x (circinus)

3.3.402 2021-03-08

• T3387 (bug): Command "Monitor vpn ipsec" is not working

3.3.403 2021-03-07

• T3319 (bug): VXLAN uses ttl 1 (auto) by default

• T3391 (feature): Add CLI support for specifying maximum-paths per address family
ipv4 unicast and ipv6 unicast
• T3211 (feature): ability to redistribute ISIS into other routing protocols

3.3.404 2021-03-05

• T2659 (feature): Add fastnetmon (DDoS detection) support

3.3.405 2021-03-04

• T2861 (bug): route-map "set community additive" not working correctly

3.3.406 2021-03-03

• T2966 (feature): tunnel: add new encapsulation types ip6tnl and ip6gretap

3.3.407 2021-03-01

• T3342 (bug): On xen-netback interfaces must set "scattergather" offload before

MTU>1500

3.3.408 2021-02-28

• T3370 (bug): dhcp: Invalid domain name "private"

• T3369 (feature): VXLAN: add IPv6 underlay support

3.3.409 2021-02-27

• T2291 (bug): Bad hostnames in /etc/hosts with static-mapping in dhcp server config
• T3364 (feature): tunnel: cleanup/rename CLI nodes
• T3368 (feature): macsec: add support for gcm-aes-256 cipher
• T3366 (bug): tunnel: can not change local / remote ip address for gre-bridge tunnel
• T3173 (feature): Need 'nopmtudisc' option for tunnel interface

3.3. 1.3 Equuleus 216

 VyOS Documentation, Release 1.5.x (circinus)

3.3.410 2021-02-26

• T3357 (default): HTTP-API redirect from http correct https port

3.3.411 2021-02-24

• T3303 (feature): Change welcome message on boot

3.3.412 2021-02-21

• T3163 (feature): ethernet ring-buffer can be set with an invalid value

3.3.413 2021-02-19

• T3326 (bug): OSPFv3: Cannot add L2TPv3 interface

3.3.414 2021-02-18

• T3259 (default): many dnat rules makes the vyos http api crash, even showConfig op
timeouts

3.3.415 2021-02-17

• T3047 (bug): OSPF : virtual-link and passive-interface default parameters does not
work together
• T3312 (feature): SolarFlare NICs support

3.3.416 2021-02-16

• T3318 (feature): Update Linux Kernel to v5.4.208 / 5.10.142

3.3.417 2021-02-14

• T2152 (bug): ddclient has bug which prevents use_web from being used
• T3308 (feature): BGP: add gracefull shutdown support

3.3.418 2021-02-13

• T3028 (feature): Create a default user when metadata is not available (for
Cloud-init builds)
• T2867 (feature): Cleanup DataSourceOVF.py in the Cloud-init
• T2726 (feature): Allow to use all supported SSH key types in Cloud-init
• T2403 (feature): Full support for networking config in Cloud-init
• T2387 (feature): Create XML scheme for [conf_mode] BGP

3.3. 1.3 Equuleus 217

 VyOS Documentation, Release 1.5.x (circinus)

• T2174 (feature): Rewrite protocol BGP to new XML/Python style

• T1987 (bug): A default route can be deleted by dhclient-script in some cases
• T723 (feature): Add support for first boot or installation time saved config
modification
• T1775 (bug): Cloud-init not running userdata runcmd
• T1389 (feature): Add support for NoCloud cloud-init datasource
• T1315 (feature): Allow BGP to use address-family l2vpn evpn

3.3.419 2021-02-11

• T2638 (default): FRR: New framework for configuring FRR

3.3.420 2021-02-08

• T3295 (feature): Update Linux Kernel to v5.4.96 / 5.10.14

3.3.421 2021-02-07

• T3293 (bug): RPKI migration script errors out after CLI rewrite

3.3.422 2021-02-06

• T3285 (feature): Schedule reboots through systemd-shutdownd instead of atd

• T661 (feature): Show a warning if the router is going to reboot soon (due to
"commit-confirm" command)

3.3.423 2021-02-05

• T2450 (feature): Rewrite "protocols vrf" tree in XML and Python

• T208 (feature): Ability to ignore default-route from dhcpcd per interface

3.3.424 2021-02-03

• T3239 (default): XML: override 'defaultValue' for mtu of certain interfaces; remove
workarounds
• T2910 (feature): XML: generator should support override of variables
• T2873 (bug): "show nat destination translation address" doesn't filter at all

3.3. 1.3 Equuleus 218

 VyOS Documentation, Release 1.5.x (circinus)

3.3.425 2021-02-02

• T3018 (bug): Unclear behaviour when configuring vif and vif-s interfaces
• T3255 (default): Rewrite protocol RPKI to new XML/Python style

3.3.426 2021-02-01

• T3268 (feature): Add VRF support to VIF-S interfaces

• T3274 (default): ask_yes_no() doesn't handle EOFError

3.3.427 2021-01-31

• T3276 (feature): Update Linux Kernel to v5.4.94 / 5.10.12

3.3.428 2021-01-30

• T3269 (bug): VIF-C interfaces don't verify configuration

• T3240 (feature): Support per-interface DHCPv6 DUIDs
• T3273 (default): PPPoE static default-routes deleted on interface down when not
added by interface up

3.3.429 2021-01-29

• T3262 (bug): DHCPv6 client runs when dhcpv6-options is configured without requesting
an address or PD
• T3261 (bug): Does not possible to disable pppoe client interface.

3.3.430 2021-01-27

• T3257 (feature): tcpdump supporting complete protocol

• T3110 (bug): Broken pipe in show interfaces
• T651 (enhancment): Split CI'ed, VyOS-specific packages and other packages into
separate repos
• T597 (enhancment): Code testing on sonarcloud.com
• T516 (default): Make Python / XML code development more testable
• T625 (default): Lack of IKEv1 lifetime negotiation
• T613 (bug): Missing linux-kbuild
• T505 (bug): Hostapd cannot log

3.3. 1.3 Equuleus 219

 VyOS Documentation, Release 1.5.x (circinus)

3.3.431 2021-01-26

• T3251 (bug): PPPoE client trying to authorize with the wrong username
• T2859 (bug): show nat source translation - Errors out

3.3.432 2021-01-25

• T3249 (feature): Support operation mode forwarding table output

3.3.433 2021-01-24

• T3230 (bug): RPKI can't be deleted

• T3243 (feature): Update Linux Kernel to v5.4.92 / 5.10.10

3.3.434 2021-01-18

• T2761 (feature): Extend "show vrrp" op-mode command with router priority
• T2679 (feature): VRRP with BFD Failure Detection
• T3212 (bug): SSH: configuration directory is not always created on boot
• T3231 (bug): "system option ctrl-alt-delete" has no effect

3.3.435 2021-01-17

• T3222 (bug): Typo in BGP dampening description

• T2944 (bug): NTP by default listen on any address/interface
• T3226 (bug): Repair bridge smoke test damage
• T2442 (enhancment): Move application of STP settings for bridge members from
interfaces-bridge.py to Interface.add_to_bridge()
• T2381 (bug): OpenVPN: openvpn-option parsed/rendered improperly

3.3.436 2021-01-16

• T3215 (bug): Operational command "show ipv6 route" is broken

• T3172 (bug): Builds sometime after 2020-12-17 have broken routing after reboot
• T3157 (bug): salt-minion fails to start due to permission error accessing /root/.
salt/minion.log
• T3167 (default): Recurring bugs in Intel NIC drivers
• T3151 (default): Decide on the final list of packages for 1.3
• T3137 (feature): Let VLAN aware bridge approach the behavior of professional
equipment
• T3223 (feature): Update Linux Kernel to v5.4.89 / 5.10.7

3.3. 1.3 Equuleus 220

 VyOS Documentation, Release 1.5.x (circinus)

3.3.437 2021-01-15

• T3210 (feature): ISIS three-way-handshake

• T3184 (feature): Add correct desctiptions for BGP neighbors
• T2850 (feature): Add BGP template for FRR

3.3.438 2021-01-14

• T3218 (feature): Replace Intel out-of-tree drivers with Linux Kernel stock drivers.

3.3.439 2021-01-13

• T3186 (bug): NAT: Commit failed when applying negated(!) addresses

3.3.440 2021-01-12

• T3205 (bug): Does not possible to configure tunnel mode gre-bridge

3.3.441 2021-01-11

• T3208 (bug): Does not possible to change user password

• T3198 (bug): OSPF database filtering issue
• T3206 (bug): Unable to delete destination NAT rule
• T3193 (bug): DHCPv6 PD verification issues
• T3201 (bug): Operational command "show log all" is not working for RADIUS users

3.3.442 2021-01-10

• T3178 (feature): Migrate vyatta-op-quagga to vyos-1x

3.3.443 2021-01-09

• T2467 (bug): Restarting flow accounting fails with systemd error

• T3199 (feature): Update Linux Kernel to v5.4.88 / 5.10.6

3.3. 1.3 Equuleus 221

 VyOS Documentation, Release 1.5.x (circinus)

3.3.444 2021-01-07

• T3192 (feature): login: radius: add support for IPv6 RADIUS servers

3.3.445 2021-01-05

• T3169 (enhancment): Reimplement smoke test of span (mirror)

• T3161 (default): Consider removing ConfigLoad.pm
• T1398 (default): Remove vyatta-config-migrate package
• T805 (enhancment): Drop config compatibility with Vyatta Core older than 6.5

3.3.446 2021-01-04

• T3185 (bug): [conf-mode] Wrong CompletionHelp for Tunnel local-ip

• T2601 (bug): pppoe-server: Cannot disable CCP

3.3.447 2021-01-03

• T3180 (bug): DHCP server raises NameError

3.3.448 2021-01-02

• T2321 (feature): VRF support for SSH, NTP, SNMP service

• T3177 (bug): Rolling Release no longer reports VMware UUID

3.3.449 2021-01-01

• T3171 (feature): Add CLI option to enable RPS (Receive Packet Steering)

3.3.450 2020-12-31

• T3162 (bug): Wrong PPPoE server pado-delay parameter added to config

• T3160 (bug): PPPoE server called-sid option defined in wrong section
• T3168 (feature): Update Linux Kernel to v5.4.86

3.3. 1.3 Equuleus 222

 VyOS Documentation, Release 1.5.x (circinus)

3.3.451 2020-12-29

• T3082 (bug): multi_to_list must distinguish between values and defaults

• T1466 (feature): Add EAPOL login support

3.3.452 2020-12-28

• T1732 (feature): Removing vyatta-webproxy module

• T2666 (feature): Packet Processing with eBPF and XDP
• T2581 (default): webproxy: implement proxy chaining
• T563 (feature): webproxy: migrate 'service webproxy' to get_config_dict()

3.3.453 2020-12-27

• T3150 (bug): When configuring QoS, the setting procedure of port mirroring is wrong

3.3.454 2020-12-23

• T3143 (bug): OpenVPN server: Push route config format is wrong

• T3146 (feature): Upgrade FRR from 7.4 -> 7.5 version incl. new libyang
• T3145 (feature): Update Linux Kernel to v5.4.85
• T3147 (feature): Upgrade to SaltStack version 3002.2

3.3.455 2020-12-22

• T3142 (bug): OpenVPN op-command completion fails due to missing status file
• T2940 (feature): Update FRR to 7.4
• T2573 (bug): BFD op-mode commands are broken
• T2495 (feature): Add xml for ISIS [conf_mode]
• T1316 (feature): Support for IS-IS

3.3.456 2020-12-21

• T2619 (bug): Bug: Changes in NAT or ZONES from 1.2 to 1.3

3.3. 1.3 Equuleus 223

 VyOS Documentation, Release 1.5.x (circinus)

3.3.457 2020-12-20

• T3131 (bug): Typo in ipsec preshared-secret help

• T3134 (bug): DHCPv6 DUID configuration node missing
• T3140 (feature): Relax "ethernet offload-options" CLI definition
• T3132 (feature): Enable egress flow accounting

3.3.458 2020-12-17

• T2810 (default): Docs for vpn anyconnect-server

• T2036 (default): Open Connect VPN Server () support

3.3.459 2020-12-14

• T3128 (bug): pppoe smoke test failed

• T3129 (feature): Update Linux Kernel to v5.4.83
• T3089 (feature): Migrate port mirroring to vyos-1x and support two-way traffic
mirroring
• T3130 (feature): Replace vyos-netplug with upstream debian version

3.3.460 2020-12-13

• T3114 (bug): When the bridge member is a non-ethernet interface, setting VLAN-aware
bridge parameters fails

3.3.461 2020-12-11

• T3123 (bug): Configuration of vti interface impossible

3.3.462 2020-12-10

• T3117 (bug): OpenVPN config migration errors upgrading from 1.3-rolling-202010280217

to 1.3-rolling-202012060217

3.3.463 2020-12-09

• T3122 (feature): Update Linux Kernel to v4.19.162

• T3121 (bug): get_config_dict() and key_mangling=('-', '_') Broke PowerDNS
dns_forwarding config file

3.3. 1.3 Equuleus 224

 VyOS Documentation, Release 1.5.x (circinus)

3.3.464 2020-12-08

• T2562 (bug): VyOS can't be used as a DHCP server for a DHCP relay

3.3.465 2020-12-07

• T3120 (bug): Python error when deleting nat rule

• T3119 (feature): migrate "system ip" to get_config_dict() and provide smoketest

3.3.466 2020-12-05

• T2744 (bug): igmp-proxy issue: Address already in use

3.3.467 2020-12-04

• T3108 (bug): Section config overlapped match with FRRConfig

• T3112 (feature): PPPoE IPv6: remove "enable" node
• T3100 (feature): Migrate DHCP/DHCPv6 server to get_config_dict()

3.3.468 2020-12-03

• T3105 (bug): static-host-mapping writing in one line

• T3107 (feature): Update Linux Kernel to v4.19.161
• T3104 (bug): LLDP Traceback error

3.3.469 2020-12-01

• T3102 (bug): Destination NAT fails to commit

• T2713 (bug): VyOS must not change permissions on files in /config/auth

3.3.470 2020-11-30

• T3091 (feature): Add "tag" for static route

• T1207 (feature): DMVPN behind NAT

3.3. 1.3 Equuleus 225

 VyOS Documentation, Release 1.5.x (circinus)

3.3.471 2020-11-29

• T3095 (feature): Migrate dhcp-relay and dhcpv6-relay to get_config_dict()

3.3.472 2020-11-28

• T2890 (bug): NAT error adding translation address range

• T2868 (bug): Tcp-mss option in policy calls kernel-panic
• T3092 (feature): nat: migrate to get_config_dict()

3.3.473 2020-11-27

• T2715 (feature): Duplicate address detection option supporting ARP

• T2714 (feature): A collection of utilities supporting IPv6 or ipv4
• T3088 (feature): Migrate IGMP-Proxy over to get_config_dict() and add smoketests

3.3.474 2020-11-24

• T3087 (feature): Update Linux Kernel to v4.19.160

3.3.475 2020-11-23

• T2177 (default): Commit fails on adding disabled interface to bridge

• T3066 (bug): reboot in - Invalid time
• T2802 (bug): Tunnel interface does not apply EUI-64 IPv6 Address
• T2359 (bug): Adding IPIP6 tun interface to bridge [conf_mode] errors
• T2357 (bug): GRE-bridge conf_mode errors
• T2259 (feature): Support for bind vif-c interfaces into VRFs
• T2205 (bug): "set interface ethernet" fails on Hyper-V
• T2182 (bug): Failure to commit an IPv6 address on a tunnel interface
• T2155 (bug): Cannot set anything on Intel 82599ES 10-Gigabit SFI/SFP+
• T2153 (bug): traceroute circular reference
• T3081 (bug): get_config_dict() does not honor whitespaces in the CLI values field
• T3080 (bug): OpenVPN failing silently for a number of reasons in rolling post Nov/02
• T3074 (bug): OpenVPN site-to-site creates wrong peer address
• T2542 (bug): OpenVPN client tap interfaces not coming up
• T3084 (bug): wifi: TypeError on "show interfaces wireless info"

3.3. 1.3 Equuleus 226

 VyOS Documentation, Release 1.5.x (circinus)

3.3.476 2020-11-21

• T3079 (bug): Fix the problem that VLAN 1 will be deleted in VLAN-aware bridge
• T3060 (bug): OpenVPN virtual interface not coming up after upgrade

3.3.477 2020-11-20

• T3078 (feature): CLI cleanup: rename "system options" -> "system option"
• T2997 (feature): DHCP: disallow/do-not-request certain options when requesting IP
address from server
• T3077 (feature): WireGuard: automatically create link-local IPv6 adresses
• T2550 (default): OpenVPN: IPv4 not working in client mode
• T3072 (feature): Migrate tunnel interfaces to new get_config_dict() approach
• T3065 (feature): Add "interfaces wirelessmodem" IPv6 support
• T3048 (feature): Drop static smp-affinity for a more dynamic way using tuned

3.3.478 2020-11-19

• T3067 (bug): Wireless interface can no longer be added to the bridge after bridge
VLAN support
• T3075 (feature): Update Linux Kernel to v4.19.158

3.3.479 2020-11-16

• T3003 (enhancment): Extend smoketest framework to allow loading an arbitrary config

file

3.3.480 2020-11-15

• T3069 (bug): OpenVPN routed networks not available

• T3038 (feature): Supporting AZERTY keyboards
• T2993 (bug): op-mode: lldp: show lldp neighbors - AttributeError: 'str' object
has no attribute 'items'

3.3.481 2020-11-14

• T3041 (bug): Intel QAT: vyos-1.3-rolling-202011020217-amd64 kernel panic during

configure

3.3. 1.3 Equuleus 227

 VyOS Documentation, Release 1.5.x (circinus)

3.3.482 2020-11-13

• T3063 (feature): Add support for Huawei LTE Module ME909s-120

• T3059 (bug): L2TPv3 interface: Enforced to shutdown but no command to enable
interface permanently

3.3.483 2020-11-12

• T3064 (feature): Update Linux Kernel to v4.19.157

3.3.484 2020-11-10

• T2103 (bug): Abnormal interface names if VIF present

3.3.485 2020-11-08

• T3050 (bug): Broken address/subnet validation on NAT configuration

3.3.486 2020-11-07

• T2914 (bug): OpenVPN: Fix for IPv4 remote-host hostname in client mode:
• T2653 (feature): "set interfaces" Python handler code improvements - next iteration
• T311 (feature): DHCP: set client-hostname via CLI

3.3.487 2020-11-06

• T3051 (bug): OpenVPN: multiple client routes do not work in server mode
• T3046 (bug): openvpn directory is not auto-created
• T3052 (feature): Update Linux firmware files to 20201022 version
• T2731 (bug): "show interfaces" returns invalid state when link is down

3.3.488 2020-11-05

• T3049 (feature): Update Linux Kernel to v4.19.155

• T2994 (feature): Migrate OpenVPN interfaces to get_config_dict() syntax

3.3. 1.3 Equuleus 228

 VyOS Documentation, Release 1.5.x (circinus)

3.3.489 2020-11-03

• T3043 (feature): Wireless: Refactor CLI

• T3034 (feature): Add WiFi WPA 3 support
• T2967 (bug): Duplicate IPv6 BFD peers created
• T2483 (bug): DHCP most likely not restarting pdns_recursor

3.3.490 2020-11-02

• T3024 (bug): DHCPv6 PD configuration doesn't really render an expected behavior

3.3.491 2020-11-01

• T3036 (feature): OpenVPN remote-address does not accept IPv6 address

• T2193 (feature): Display disabled VRRP instances in a `show vrrp` output

3.3.492 2020-10-30

• T2790 (feature): Add ability to set ipv6 protocol route-map for OSPFv3
• T3033 (feature): Update Linux Kernel to v4.19.154
• T2969 (bug): OpenVPN: command_set on interface is not applied, if interface doesn't
come up in commit

3.3.493 2020-10-28

• T2631 (default): l2tp, sstp, pptp add option to disable radius accounting
• T2630 (feature): Allow Interface MTU over 9000
• T3027 (bug): Unable to update system Signature check FAILED
• T2995 (bug): Enhancements/bugfixes for vyos_dict_search()
• T2968 (feature): Add support for Intel Atom C2000 series QAT

3.3.494 2020-10-27

• T3026 (default): qemu: update script for deprecated ssh_host_port_min/max

• T2938 (feature): Adding remote Syslog RFC5424 compatibility
• T2924 (bug): Using 'set src' in a route-map invalidates it as part of a subsequent
boot-up
• T2587 (bug): Cannot enable the interface when the MTU is set to less than 1280
• T2885 (default): configd: print commit errors to config session terminal
• T2808 (default): Add smoketest to ensure script consistency with config daemon
• T2582 (default): Script daemon to offload processing during commit

3.3. 1.3 Equuleus 229

 VyOS Documentation, Release 1.5.x (circinus)

• T1721 (bug): Recursive Next Hop not updated for static routes

3.3.495 2020-10-24

• T3007 (default): HTTP-API should use config load script, not backend config load
• T3009 (bug): vpn l2tp remoteaccess require option broken
• T3010 (bug): ttl option of gre-bridge
• T3005 (bug): Intel: update out-of-tree drivers, i40e driver warning
• T3004 (feature): ConfigSession should (optionally) use config load script
• T2723 (feature): Support tcptraceroute

3.3.496 2020-10-22

• T2978 (bug): IPoE service does not work on shared mode

• T2906 (bug): OpenVPN: tls-auth missing key direction

3.3.497 2020-10-21

• T2828 (bug): BGP conf_mode error enforce-first-as

• T2749 (bug): Setting ethx configuration takes a long time
• T2138 (default): Can't load archived configs as they are gzipped

3.3.498 2020-10-20

• T2987 (bug): VxLAN not working properly after upgrading to latest October build and
with a new installation
• T2989 (default): MPLS documentation expansion

3.3.499 2020-10-19

• T1588 (bug): VRRP failed to start if any of its interaces not exist
• T1385 (feature): Allow bonding interfaces to have pseudo-ethernet interfaces
• T3000 (bug): Mismatch between "prefix-length" and "preference" in dhcp6-server
syntax
• T2992 (feature): Automatically verify sha256 checksum on ISO download
• T752 (feature): Add an option to disable IPv4 forwarding on specific interface only

3.3. 1.3 Equuleus 230

 VyOS Documentation, Release 1.5.x (circinus)

3.3.500 2020-10-18

• T2965 (feature): Brief BFD Peer Info

• T2907 (feature): OpenVPN: Option to disable encryption
• T2985 (feature): Add glue code to create bridge interface on demand

3.3.501 2020-10-17

• T2980 (bug): FRR bfdd crash due to invalid length

• T2991 (feature): Update WireGuard to 1.0.20200908
• T2990 (feature): Update Linux Kernel to v4.19.152
• T2981 (feature): MPLS LDP neighbor session clear capability
• T2792 (default): Failed to run `sudo make qemu` with vyos-build container due to the
change of packer

3.3.502 2020-10-13

• T2976 (bug): Client IP pool does not work for PPPoE local users

3.3.503 2020-10-12

• T2951 (bug): Cannot enable logging for monitor nat

• T2782 (bug): Changing timezone, does not restart rsyslog

3.3.504 2020-10-06

• T2957 (bug): show openvpn not printing anything

3.3.505 2020-10-05

• T2963 (bug): Wireless: WIFI is not password protected when security wpa mode is not
defined but passphrase is

3.3.506 2020-10-04

• T2953 (feature): Accel-PPP services CLI config cleanup (SSTP, L2TP, PPPoE, IPoE)
• T2829 (bug): PPPoE server: mppe setting is implemented as node instead of leafNode
• T2960 (feature): sstp: migrate to get_config_dict()

3.3. 1.3 Equuleus 231

 VyOS Documentation, Release 1.5.x (circinus)

3.3.507 2020-10-03

• T2956 (feature): Add support for list of defaultValues

• T2955 (feature): Update Linux Kernel to v4.19.149

3.3.508 2020-10-02

• T2952 (bug): configd: timeout breaks synchronization of messages, causing freeze

3.3.509 2020-10-01

• T2945 (bug): Interface removed from bridge on setting change

• T2948 (bug): NAT: OSError when configuring translation address range
• T2936 (feature): Migrate PPPoE server to get_config_dict() do reduce boilerplate
code

3.3.510 2020-09-30

• T2939 (bug): Wireguard Remove Peer Fails

3.3.511 2020-09-29

• T2919 (feature): PPPoE server: Called-Station-Id attribute

• T2918 (feature): Accounting interim jitter for pppoe, l2tp, pptp, ipoe
• T2917 (feature): PPPoE server: Preallocate NAS-Port-Id
• T2937 (feature): Update Linux Kernel to v4.19.148

3.3.512 2020-09-27

• T2930 (feature): Support configuration of MAC address for VXLAN and GENEVE tunnel

3.3.513 2020-09-26

• T2856 (bug): equuleus: `show version all` throws broken pipe exception on abort
• T2929 (bug): Upgrading from 1.2 (crux) to 1.3 rolling causes vyos.configtree.
ConfigTreeError for RADIUS settings
• T2928 (bug): MTU less then 1280 bytes and IPv6 will raise FileNotFoundError
• T2926 (bug): snmp.py missing an import
• T2912 (feature): When setting MTU check for hardware maximum supported MTU size

3.3. 1.3 Equuleus 232

 VyOS Documentation, Release 1.5.x (circinus)

3.3.514 2020-09-25

• T2915 (bug): Lost "proxy-arp-pvlan" option for vlan

• T2925 (feature): Update Linux Kernel to v4.19.147
• T2921 (feature): Migrate "service dns forwarding" to get_config_dict() for ease of
source maintenance

3.3.515 2020-09-24

• T2896 (bug): set ip route 0.0.0.0/0 dhcp-interface eth0

• T2923 (bug): Configuring DHCPv6-PD without a interface to delegate to raises
TypeError

3.3.516 2020-09-23

• T2846 (bug): ip route doesn't show longer-prefixes

3.3.517 2020-09-20

• T2904 (feature): 802.1ad / Q-in-Q ethertype default not utilized

• T2905 (feature): Sync CLI nodes between PPPoE and WWAN interface
• T2903 (feature): Q-in-Q (802.1.ad) ethertype should be defined explicitly and not
via its raw value

3.3.518 2020-09-19

• T2894 (bug): bond: lacp: member interfaces get removed once bond interface has
vlans configured
• T2901 (feature): Update Linux Kernel to v4.19.146
• T2900 (bug): DNS forwarding: invalid warning is shown for "system name-server" or
"system name-servers-dhcp" even if present

3.3.519 2020-09-18

• T945 (bug): Unable to change configuration after changing it from script (vbash +
script-template)

3.3. 1.3 Equuleus 233

 VyOS Documentation, Release 1.5.x (circinus)

3.3.520 2020-09-16

• T2886 (bug): RADIUS authentication broken only returns operator level

• T2887 (bug): WiFi ht40+ channel width is not set in hostaptd.conf

3.3.521 2020-09-15

• T2515 (bug): Ethernet interface is automatically disabled when removing it from bond

3.3.522 2020-09-14

• T2872 (bug): "Show log" for nat and openvpn got intermixed
• T2301 (bug): Cannot delete PBR
• T2880 (feature): Update Linux Kernel to v4.19.145
• T2879 (feature): Cleanup 4.19.144 kernel configuration

3.3.523 2020-09-13

• T2858 (feature): Rewrite dynamic dns client to get_config_dict()

• T2857 (feature): Cleanup Intel QAT configuration script
• T2877 (feature): LACP / bonding: support configuration of minimum number of links

3.3.524 2020-09-12

• T2863 (default): Wireguard IPv6 Link-Local Addresses Are Not Unique

• T2876 (feature): Update Linux Kernel to v4.19.144

3.3.525 2020-09-10

• T2870 (feature): Update Linux Kernel to v5.8.8

3.3.526 2020-09-09

• T2728 (bug): Protocol option ignored for IPSec peers in transport mode
• T1934 (default): Change default hostname when deploy from OVA without params.
• T1953 (bug): DDNS service name validation rejects valid service names

3.3. 1.3 Equuleus 234

 VyOS Documentation, Release 1.5.x (circinus)

3.3.527 2020-09-07

• T1729 (default): PIM (Protocol Independent Multicast) implementation

3.3.528 2020-09-06

• T2860 (bug): Update Accel-PPP to fix l2tp CVE

3.3.529 2020-09-02

• T2833 (bug): RIP outgoing update filter list no longer operational

• T2849 (bug): vyos.xml.defaults should return a list on multi nodes, by default

3.3.530 2020-08-31

• T2636 (bug): get_config_dict() shall always return a list on <multi/> nodes

3.3.531 2020-08-30

• T2843 (feature): Upgrade Linux Kernel to 5.8 series

• T2814 (default): kernel 5.1+ : NAT : module `nft_chain_nat_ipv4` renamed
• T2839 (feature): Upgrade WireGuard user-space tools and Kernel module
• T2842 (feature): Replace custom "wireguard, wireguard-tools" package with
debian-backports version

3.3.532 2020-08-29

• T2836 (default): show system integrity broken in 1.3

3.3.533 2020-08-28

• T2126 (bug): show vpn ipsec sa IPSec - Process NOT Running

• T2813 (bug): NAT: possible to commit illegal source nat without translation
• T1463 (bug): Missing command `show ip bgp scan` appears in command completion

3.3.534 2020-08-27

• T2832 (feature): Migrate vyos-smoketest content into vyos-1x

3.3. 1.3 Equuleus 235

 VyOS Documentation, Release 1.5.x (circinus)

3.3.535 2020-08-26

• T2830 (default): Migrate "service https" to use get_config_dict()

• T2831 (feature): Update Linux Kernel to v4.19.142

3.3.536 2020-08-25

• T2826 (bug): frr: frr python lib error in replace_section

3.3.537 2020-08-24

• T2423 (bug): Loadkey scp ssh key errors

3.3.538 2020-08-23

• T2811 (bug): Cannot delete vpn anyconnect

• T2823 (bug): VXLAN has state A/D after configuration
• T2812 (default): Add basic smoketest for anyconnect

3.3.539 2020-08-22

• T2822 (feature): Update Linux Kernel to v4.19.141

• T2821 (feature): Support DHCPv6-PD without "address dhcpv6"
• T2677 (feature): Proposal for clearer DHCPv6-PD configuration options

3.3.540 2020-08-20

• T2209 (bug): Documentation has reference to the old 'user x level admin' option
• T1665 (default): prefix-list and prefix-list6 rules incorrectly accept a host
address where prefix is required
• T2815 (default): Move certbot config directory under /config/auth

3.3.541 2020-08-19

• T2794 (bug): op-mode: lldp: "show lldp neighbors" IndexError: list index out of
range
• T2791 (feature): "monitor traceroute" has no explicit IPv4/IPv6 support
• T1515 (bug): FRR ospf6d crashes when performing: "show ipv6 ospfv3 database"

3.3. 1.3 Equuleus 236

 VyOS Documentation, Release 1.5.x (circinus)

3.3.542 2020-08-16

• T2277 (bug): dhclient-script-vyos does not support VRFs

• T2090 (default): Deleting 'service salt-minion' causes python TypeError

3.3.543 2020-08-15

• T2797 (feature): Update Linux Kernel to v4.19.139

• T2796 (bug): PPPoE-Server: listen interface is mandatory but validation check is
missing

3.3.544 2020-08-14

• T2795 (bug): console server fails to commit

3.3.545 2020-08-12

• T2786 (bug): OSPF Interface Cost

• T2325 (bug): NHRP op-mode errors with missing daemon socket
• T2227 (feature): MPLS documentation
• T2767 (bug): The interface cannot be disabled for network enabled configuration
• T2316 (bug): DHCP-server op-mode errors

3.3.546 2020-08-11

• T2779 (bug): LLDP: "show lldp neighbors interface" does not yield any result
• T2379 (bug): DHCPv6 address for interface deletion triggers a script error
• T2784 (default): Remove unused arg from host_name.py functions verify and get_config

3.3.547 2020-08-10

• T2780 (feature): Update Linux Kernel to v4.19.138

3.3.548 2020-08-08

• T2716 (bug): Shaper-HFSC shapes but does not control latency correctly
• T2497 (default): Cache config string during commit
• T2501 (bug): Cannot recover from failed boot config load
• T1974 (feature): Allow route-map to set administrative distance
• T1949 (bug): Multihop IPv6 BFD is unconfigurable

3.3. 1.3 Equuleus 237

 VyOS Documentation, Release 1.5.x (circinus)

3.3.549 2020-08-04

• T2758 (bug): router-advert: 'infinity' is not a valid integer number

• T2637 (bug): Vlan is not removed from the system
• T1287 (bug): No DHCPv6 leases reported for "show dhcpv6 client leases"

3.3.550 2020-08-03

• T2241 (default): Changing settings on an interface causes it to fall out of bridge

• T2757 (bug): "show system image version" contains additional new-line character
breaking output
• T1826 (bug): Misleading message on "reboot at" command
• T1511 (default): Rewrite ethernet setup scripts to python
• T1600 (default): Convert 'ping' operation from vyatta-op to new syntax
• T1486 (bug): Unknown LLDP version reported to peers
• T1414 (enhancment): equuleus: buster: 10-unmountfs.chroot fail under apply
• T1076 (bug): SSH: make configuration (sshd_config) volatile and store it to /run
• T2724 (feature): Support for IPv6 Toolset
• T2323 (bug): LLDP: "show lldp neighbors detail" returns warnings when service is not
configured
• T1754 (bug): DHCPv6 client is impossible to restart

3.3.551 2020-08-02

• T2756 (feature): Accel-PPP: make RADIUS accounting port configurable

3.3.552 2020-08-01

• T2752 (bug): Exception when configuring unavailable ethernet interface

• T2751 (feature): Update Linux Kernel to v4.19.136
• T2753 (feature): Rewrite "add system image" op mode commands in XML
• T2690 (feature): Add VRF support to the add system image command

3.3.553 2020-07-30

• T2746 (feature): IPv6 link-local addresses not configured

• T2678 (bug): High RAM usage on SSH logins with lots of IPv6 routes in the routing
table.
• T2701 (bug): `vpn ipsec pfs enable` doesn't work with IKE groups
• T2745 (feature): router-advert: migrate to get_config_dict()

3.3. 1.3 Equuleus 238

 VyOS Documentation, Release 1.5.x (circinus)

3.3.554 2020-07-29

• T2743 (feature): WireGuard: move key migration from config script to migration
script
• T2742 (feature): mDNS repeater: migrate to get_config_dict()

3.3.555 2020-07-28

• T1117 (feature): 'show ipv6 bgp route-map' missing

• T928 (feature): Add support for PIM (Protocol-Independent Multicast)

3.3.556 2020-07-27

• T2729 (feature): Pseudo-ethernet replace fail message

• T1249 (feature): multiple PBR rules can set to a single interface
• T1956 (feature): PPPoE server: support PADO-delay
• T1295 (feature): FRR: update documentation
• T1222 (bug): OSPF routing problem - route looping
• T1158 (bug): Route-Map configuration dropped updating rc11 to epa2
• T1130 (bug): Deleting BGP communities from prefix does not work
• T2067 (feature): pppoe-server: Add possibility set multiple service-name

3.3.557 2020-07-26

• T2734 (feature): WireGuard: fwmark CLI definition is inconsistent

• T2733 (feature): Support MTU configuration on pseudo ethernet devices
• T2644 (default): Bonding interfaces cannot be disabled
• T2476 (bug): Bond member description change leads to network outage
• T2443 (feature): NHRP: Add debugging information to syslog
• T2021 (bug): OSPFv3 doesn't support decimal area syntax
• T1901 (bug): Semicolon in values is interpreted as a part of the shell command by
validators
• T2000 (bug): strongSwan does not install routes to table 220 in certain cases
• T2091 (bug): swanctl.conf file is not generated properly if more than one IPsec
profile is used
• T1983 (feature): Expose route-map when BGP routes are programmed in to FIB
• T1973 (feature): Allow route-map to match on BGP local preference value
• T1853 (bug): wireguard - disable peer doesn't work
• T1985 (feature): pppoe: Enable ipv6 modules without configured ipv6 pools

3.3. 1.3 Equuleus 239

 VyOS Documentation, Release 1.5.x (circinus)

3.3.558 2020-07-25

• T2730 (feature): Update Linux Kernel to v4.19.134

• T2106 (bug): Wrong interface states after reboot
• T1507 (default): cli: logical redundancy with boolean type

3.3.559 2020-07-24

• T2097 (bug): Problems when using <path> as completion helper in op-mode

• T2092 (bug): dhcp-server rfc3442 static route should add default route
• T1817 (bug): BGP next-hop-self not working.
• T1462 (bug): Upgrade path errors 1.1.8 to 1.2.1-S2
• T1372 (bug): Diff functionality behaves incorrectly in some cases
• T2073 (feature): ipoe-server: reset op-mode command for sessions
• T1715 (bug): System DNS Server Order Incorrect

3.3.560 2020-07-23

• T2673 (bug): After the bridge is configured with Mac, bridge is automatically
disabled
• T2626 (bug): Changing pseudo-ethernet mode, throws CLI error
• T2608 (bug): delete pseudo-ethernet failed (another error type)
• T2527 (bug): bonding: the last slave interface is not deleted
• T2358 (bug): ip6ip6 bridge conf_mode errors
• T2346 (bug): Setting hostname yields temporary file error
• T2330 (bug): Vpn op-mode syntax
• T2188 (default): NTP op-mode commands don't work

3.3.561 2020-07-22

• T2718 (bug): ntp.conf updated incorrectly

• T2658 (bug): Interface description comment display error
• T2643 (bug): show interfaces does not scale with terminal width
• T2725 (bug): Config fails to load if user has no password
• T2707 (default): Allow alternative initialization data for Config

3.3. 1.3 Equuleus 240

 VyOS Documentation, Release 1.5.x (circinus)

3.3.562 2020-07-20

• T2709 (bug): Destination NAT translation port without address fails to commit
• T2519 (bug): Broadcast address does not add automatically

3.3.563 2020-07-19

• T2708 (bug): "show flow-accounting" should not display script's "usage" help
• T2592 (default): dhcp-relay discarding packets on valid interfaces
• T2712 (feature): udp-broadcast-relay: serivce no longer starts
• T2706 (feature): Support NDP protocol monitoring

3.3.564 2020-07-18

• T2704 (bug): connect/disconnect Missing newline in op-mode tab completion helper

• T2689 (feature): Add helper functions to query changes between session and effective
configs
• T2585 (bug): Unable to access the Internet after opening PPPoE on-demand dialing

3.3.565 2020-07-15

• T2675 (bug): DNS service failed to start

• T2596 (feature): Allow specifying source IP for 'add system image'

3.3.566 2020-07-12

• T1575 (default): `show snmp mib ifmib` crashes with IndexError

• T2696 (bug): Some bugfixes of vyatta-wanloadbalance

3.3.567 2020-07-11

• T2687 (feature): SNMP: change logic on v3 password encryption

• T2693 (bug): Dhcp6c cannot be restarted after PPPoE link is reset

3.3.568 2020-07-08

• T2692 (bug): Evaluate Setting Default Hash Policy to L3+L4

• T2646 (bug): Sysctl for IPv4 ECMP Hash Policy Not Set

3.3. 1.3 Equuleus 241

 VyOS Documentation, Release 1.5.x (circinus)

3.3.569 2020-07-07

• T2691 (bug): Upgrade from 1.2.5 to 1.3-rolling-202007040117 results in broken config

due to case mismatch
• T2389 (bug): BGP community-list unknown command
• T2686 (bug): FRR: BGP: large-community configuration is not applied properly after
upgrading FRR to 7.3.x series

3.3.570 2020-07-06

• T2680 (bug): dhcp6c service cannot recover when it fails

3.3.571 2020-07-05

• T2684 (feature): Update Linux Kernel to v4.19.131

• T2685 (feature): Update Accel-PPP to fix SSTP client issues
• T2681 (bug): PPPoE stops negotiating IPv6

3.3.572 2020-07-04

• T2682 (bug): VRF aware services - connection no longer possible after system reboot

3.3.573 2020-07-03

• T2670 (default): Remove dependency on show_config from get_config_dict

• T2676 (feature): NTP: migrate to get_config_dict() implementation

3.3.574 2020-07-02

• T2668 (default): get_config_dict: add get_first_key arg to utility function

get_sub_dict

3.3.575 2020-07-01

• T2662 (default): get_config_dict includes node name as key only for tag and leaf
nodes
• T2667 (feature): get_config_dict: Use utility function for non-empty path argument

3.3. 1.3 Equuleus 242

 VyOS Documentation, Release 1.5.x (circinus)

3.3.576 2020-06-28

• T2660 (bug): XML: Python default dictionary does not obey underscore (_) when flat
is False

3.3.577 2020-06-27

• T2656 (bug): XML: Python default dictionary returns wrong dictionary level(s)

3.3.578 2020-06-26

• T2642 (bug): sshd fails to start due to configuration error

• T2588 (default): Add support for default values to the interface-definition format
• T2622 (bug): Pseudo-ethernet interface config disappears across versions
• T2057 (feature): Generalised Interface configuration
• T2625 (feature): Provide generic Library for package builds

3.3.579 2020-06-25

• T2487 (bug): VRRP does not display info when group disabled
• T2329 (bug): Show remote config openvpn
• T2165 (bug): When trying to add route to ripng it complains that ip address should
be IPv4 format
• T2159 (default): webproxy log read from wrong file
• T2101 (feature): Fix VXLAN config option parsing
• T2062 (bug): Wrong dhcp-server static route subnet bytes
• T1986 (bug): Python configuration manipulation library leaks open files
• T1762 (bug): VLAN interface configuration fails after internal representation of
edit level was switched from a string to a list
• T1538 (bug): Update conntrack-sync packages to fix VRRP issues
• T1808 (feature): add package nftables

3.3.580 2020-06-24

• T2634 (feature): remove autogeneration of interface "ip section" from

vyatta-cfg-system
• T2633 (bug): Error with arp_accept on tun interface
• T2595 (feature): Update Linux Kernel to v4.19.128
• T1938 (bug): syslog doesn't start automatically

3.3. 1.3 Equuleus 243

 VyOS Documentation, Release 1.5.x (circinus)

3.3.581 2020-06-23

• T2632 (bug): WireGuard: Cannot use only one preshared-key for one peer
• T1829 (bug): Install Image script does not respect size of partition greater than 2G
but less than disk size
• T2635 (feature): SSH: migrate to get_config_dict()

3.3.582 2020-06-22

• T2486 (bug): DNS records set via 'system static-host-mapping' return NXDOMAIN from
'service dns forwarding' after a request to a forwarded zone
• T2463 (bug): DHCP-received nameserver not added to vyos-hostsd
• T2534 (bug): pdns-recursor override.conf error
• T2054 (bug): Changing "system name-server" doesn't update dns forwarding config,
neither does "restart dns forwarding"
• T2225 (default): PIM/IGMP documentation

3.3.583 2020-06-21

• T2624 (feature): Serial Console: fix migration script for configured powersave and
no console
• T2610 (bug): default-lifetime is not reflected in the RA message
• T2299 (feature): login radius-server priority
• T1739 (bug): Serial interface seems not to be deleted properly
• T480 (bug): Error if no serial interface is present (/dev/ttyS0: not a tty)

3.3.584 2020-06-20

• T2621 (bug): show interfaces repeats interface description if it is longer then an

arbitrary number of characters
• T2618 (default): Conversion from 1.2 to 1.3 lost RADVD prefix autonomous-flag
setting

3.3.585 2020-06-19

• T2589 (bug): delete pseudo-ethernet failed

• T2490 (feature): Add serial (rs232) to ssh bridge service

3.3. 1.3 Equuleus 244

 VyOS Documentation, Release 1.5.x (circinus)

3.3.586 2020-06-18

• T2614 (default): Add an option to mangle dict keys to vyos.config.get_config_dict()

• T2026 (default): Make cli-shell-api correctly exit with non-zero code on failures
• T1868 (default): Add opportunity to get current values from API

3.3.587 2020-06-17

• T2478 (feature): login radius: use NAS-IP-Address if defined source address

• T2141 (bug): Static ARP is not applied on boot
• T2609 (bug): router-advert: radvd does not start when lifetime is improperly
configured
• T1720 (feature): support for more 'show ip route' commands

3.3.588 2020-06-16

• T2604 (default): Remove use of is_tag in system-syslog.py

• T2605 (bug): SNMP service is not disabled by default
• T2568 (bug): Add some missing checks in config
• T2156 (default): PIM op-mode commands

3.3.589 2020-06-15

• T2600 (bug): RADIUS system login configuration rendered wrongly

• T2599 (bug): "show interfaces" does not list VIF interfaces in ascending order
• T2591 (bug): show command has wrong interfaces ordering
• T2576 (bug): "show interfaces" does not return VTI

3.3.590 2020-06-14

• T2354 (bug): Wireless conf_mode errors

• T2593 (bug): source NAT translation port can not be set when translation address is
set to masquerade
• T2594 (default): Missing firmware for iwlwifi

3.3. 1.3 Equuleus 245

 VyOS Documentation, Release 1.5.x (circinus)

3.3.591 2020-06-11

• T2578 (bug): ipaddrcheck unaware of /31 host addresses - can no longer assign /31
mask to interface addresses
• T2571 (bug): NAT destination port with ! results in error
• T2570 (feature): Drop support for "system console device <device> modem"
• T2586 (bug): WWAN default route is not installed into VRF
• T2561 (feature): Drop support for "system console netconsole"
• T2569 (feature): Migrate "set system console" to XML and Python representation

3.3.592 2020-06-10

• T2575 (bug): pppoe-server: does not possibly assign IP address

• T2565 (bug): Cannot connect to l2tp server with radius auth
• T2553 (bug): set interface ethN vif-s nnnn does not commit

3.3.593 2020-06-08

• T2559 (feature): Add operational mode command to retrieve hardware sensor data

3.3.594 2020-06-07

• T2529 (feature): WWAN: migrate from ttyUSB device to new device in /dev/serial/
by-bus
• T2560 (feature): New op-mode command to display information about USB interfaces

3.3.595 2020-06-05

• T2548 (bug): Interfaces allowing inappropriate network addresses to be assigned

• T1958 (default): Include only firmware we actually need

3.3.596 2020-06-04

• T2514 (enhancment): "mac" setting for bond members

3.3. 1.3 Equuleus 246

 VyOS Documentation, Release 1.5.x (circinus)

3.3.597 2020-06-02

• T2129 (feature): XML schema: tagNode not allowed on first level in new XML op-mode
definition
• T2545 (feature): Show physical device offloading capabilities for specified ethernet
interface
• T2544 (feature): Enable Kernel KONFIG_KALLSYMS
• T2543 (feature): Kernel: always build perf binary but ship as additional deb
package to not bloat the image
• T1096 (bug): BGP process memory leak

3.3.598 2020-06-01

• T2535 (feature): Update Intel QAT drivers to 1.7.l.4.9.0-00008

• T2537 (feature): Migrate "show log dns" from vyatta-op to vyos-1x
• T2536 (bug): "show log dns forwarding" still refers to dnsmasq
• T2538 (feature): Update Intel NIC drivers to recent release (preparation for Kernel
>=5.4)
• T2526 (feature): Wake-On-Lan CLI implementation

3.3.599 2020-05-31

• T2532 (feature): VRF aware OpenVPN

3.3.600 2020-05-30

• T2388 (feature): template rendering should create folder and set permission
• T2531 (feature): Update Linux Kernel to v4.19.125
• T2530 (bug): Error creating VRF with a name of exactly 16 characters

3.3.601 2020-05-29

• T2528 (bug): "update dns dynamic" throws FileNotFoundError excepton

3.3.602 2020-05-28

• T1291 (default): Under certain conditions the VTI will stay forever down

3.3. 1.3 Equuleus 247

 VyOS Documentation, Release 1.5.x (circinus)

3.3.603 2020-05-27

• T2395 (feature): HTTP API move to flask/flask-restx as microframework

• T1121 (bug): Can't search for prefixes by community: Community malformed: AA:NN

3.3.604 2020-05-26

• T2520 (bug): show conntrack fails with Perl error

• T2502 (bug): PPPoE default route not installed for IPv6 when "default-route auto"
• T2458 (feature): Update FRR to 7.3.1
• T2506 (feature): DHCPv6-PD add prefix hint CLI option

3.3.605 2020-05-25

• T2391 (bug): pppoe-server session-control does not work

• T2269 (feature): SSTP specify tunnels names
• T1137 (bug): 'sh ip bgp sum' being truncated

3.3.606 2020-05-22

• T2491 (feature): MACsec: create CLI for replay protection

• T2489 (feature): Add MACsec interfaces to "show interfaces" output
• T2201 (feature): Rewrite protocol BGP [op-mode] to new XML/Python style
• T2492 (feature): Do not set encrypted user password when it is not changed
• T2496 (feature): Set default to new syntax for config file component versions
• T2493 (feature): Update Linux Kernel to v4.19.124
• T2380 (bug): After PPPoE 0 is restarted, the default static route is lost

3.3.607 2020-05-21

• T1876 (bug): IPSec VTI tunnels are deleted after rekey and dangling around as A/D
• T2488 (feature): Remove logfile for dialup interfaces like pppoe and wwan
• T2475 (bug): linting
• T1820 (bug): VRRP transition scripts for sync-groups are not supported in VyOS
(anymore)
• T2364 (default): Add CLI command for mroute
• T2023 (feature): Add support for 802.1ae MACsec

3.3. 1.3 Equuleus 248

 VyOS Documentation, Release 1.5.x (circinus)

3.3.608 2020-05-20

• T2480 (bug): NAT: after rewrite commit tells that dnat IP address is not locally
connected

3.3.609 2020-05-19

• T2481 (feature): WireGuard: support tunnel via IPv6 underlay

• T421 (bug): Add Pv6 prefix delegation support
• T815 (feature): Add DHCPv6 server prefix-delegation support

3.3.610 2020-05-17

• T2471 (feature): PPPoE server: always add AdvAutonomousFlag when IPv6 is configured
• T2409 (default): At boot, effective config should not be equal to current config

3.3.611 2020-05-16

• T2466 (bug): live-build encounters apt dependency problem when building with local
packages
• T2470 (feature): Update to PowerDNS recursor 4.3
• T2469 (feature): Update Linux Kernel to v4.19.123
• T2198 (default): Rewrite NAT in new XML/Python style

3.3.612 2020-05-15

• T2449 (bug): 'ipv6 address autoconf' and 'address dhcpv6' don't work because
interfaces have accept_ra=1 (they should have accept_ra=2 when forwarding=1)

3.3.613 2020-05-14

• T2456 (bug): netflow source-ip cannot be configured

3.3.614 2020-05-13

• T2435 (bug): Pseudo-ethernet Interfaces Broken

• T2294 (bug): ipoe-server broken (jinja2 template issue)

3.3. 1.3 Equuleus 249

 VyOS Documentation, Release 1.5.x (circinus)

3.3.615 2020-05-12

• T2454 (feature): Update Linux Kernel to v4.19.122

• T2392 (bug): SSTP with ipv6

3.3.616 2020-05-10

• T2445 (bug): VRF route leaking for ipv4 not working

• T2372 (bug): VLAN: error on commit if main interface is disabled
• T2439 (bug): Configuration dependency problem, unable to load complex configuration
after reboot

3.3.617 2020-05-09

• T2427 (default): Interface addressing broken since fix for T2372 was merged
• T2438 (default): isc-dhcp-server(6).service reports startup success immediately even
if dhcpd fails to start up
• T2367 (default): Flush addresses from bridge members

3.3.618 2020-05-08

• T2441 (bug): TZ validator has a parse error

• T2429 (bug): Vyos cannot apply VLAN sub interface to bridge

3.3.619 2020-05-06

• T2402 (bug): Live ISO should warn when configuring that changes won't persist

3.3.620 2020-05-05

• T1899 (bug): Unionfs metadata folder is copied to the active configuration directory

3.3.621 2020-05-04

• T2412 (bug): ping flood does not work as unprivileged user

• T701 (bug): LTE interface dosen't come up
• T951 (bug): command 'isolate-stations true/false' does not make any changes in the
hostapd.conf

3.3. 1.3 Equuleus 250

 VyOS Documentation, Release 1.5.x (circinus)

3.3.622 2020-05-03

• T2420 (feature): Update Linux Kernel to v4.19.120

• T2406 (feature): DHCPv6 CLI improvements
• T2421 (feature): Update WireGuard to Debian release 1.0.20200429-2_bpo10+1

3.3.623 2020-05-02

• T2414 (feature): Improve runtime from Python numeric validator

• T2413 (feature): Update Linux Kernel to v4.19.119

3.3.624 2020-05-01

• T2411 (feature): op-mode: make "monitor traceroute" VRF aware

• T2347 (bug): During commit, any script output directed to stdout will contain path
• T2239 (default): build-vmware-image script ignores the predefined file path, uses
the environment variable unconditionally.

3.3.625 2020-04-29

• T2399 (bug): op-mode "dhcp client leases" does not return leases
• T2398 (bug): op-mode "dhcp client leases interface" completion helper misses
interfaces
• T2394 (feature): dhcpv6 client does not start
• T2393 (feature): dhclient: migrate from SysVinit to systemd
• T2268 (bug): DHCPv6 is broken

3.3.626 2020-04-28

• T1227 (bug): rip PW can't be set at interface config

3.3.627 2020-04-27

• T2373 (feature): Required auth options for pppoe-server

• T1381 (feature): Enable DHCP option 121 processing
• T2010 (bug): Reboot at reports wrong time or missing timezone

3.3. 1.3 Equuleus 251

 VyOS Documentation, Release 1.5.x (circinus)

3.3.628 2020-04-26

• T2386 (bug): salt: upgrade to 2019.2 packages

• T2385 (bug): salt-minion: improve completion helpers
• T2384 (bug): salt-minion: log to syslog and remove custom logging option
• T2383 (feature): Update Linux Kernel to v4.19.118
• T2382 (bug): salt-minion: Throws KeyError on commit
• T2350 (bug): Interface geneve conf-mode error

3.3.629 2020-04-25

• T2304 (feature): "system login" add RADIUS VRF support

• T1842 (bug): Equuleus: "reboot at 04:00" command not working

3.3.630 2020-04-24

• T2375 (feature): WireGuard: throw exception if address and port are not given as
both are mandatory
• T2348 (bug): On IPv6 address distribution and DHCPv6 bugs

3.3.631 2020-04-23

• T2369 (feature): VRF: can not leak interface route from default VRf to any other VRF
• T2368 (bug): VRF: missing completion helper when leaking to default table
• T2374 (bug): Tunnel interface can not be disabled
• T2362 (default): IPv6 link-local addresses missing due to EUI64 address code,
causing router-advert not to work
• T2345 (default): IPv6 router-advert not working

3.3.632 2020-04-22

• T2361 (bug): Unable to delete VLAN vif interface

• T2339 (bug): OpenVPN: IPv4 no longer working after adding IPv6 support
• T2331 (bug): VRRP op-mode errors
• T2320 (bug): Wireguard creates non-existing interfaces in [op-mode].
• T2096 (feature): Provide "generate" and "show" commands via the http API
• T2351 (feature): Cleanup PPTP server implementation and CLI commands

3.3. 1.3 Equuleus 252

 VyOS Documentation, Release 1.5.x (circinus)

3.3.633 2020-04-21

• T2341 (bug): Pseudo-ethernet Interfaces Not Loaded on Boot

• T2270 (bug): using load with scp/sftp and a username and password does not work
• T2255 (bug): DNS forwarding op-mode error
• T1907 (bug): Traceback on a non-existent interface.
• T2204 (feature): Support tunnel source-interface

3.3.634 2020-04-20

• T2335 (bug): Unable to assign IPv6 from ISP

• T2317 (bug): l2tp overwriting ipsec config files
• T2292 (bug): Ensure graceful shutdown of vyos-http-api
• T2344 (bug): PPPoE server client static IP assignment silently fails

3.3.635 2020-04-19

• T2337 (default): hw-id gone missing from interfaces after upgrade to 1.

3-rolling-202004191028
• T2340 (feature): Remove informational "sg" messages from syslog
• T2338 (bug): Can't delete static IPv6 route on vrf
• T2336 (bug): OpenVPN service fails to start
• T2308 (default): openvpn op-mode scripts broken after migrating to systemd service
• T2185 (default): Start daemons with systemd units instead of with start-stop-daemon

3.3.636 2020-04-18

• T2318 (bug): dns-forwarding migration script breaks with invalid interface name
• T2319 (feature): Update Linux Kernel to v4.19.116
• T2314 (feature): Cleanup PPPoE server implementation and CLI commands
• T2313 (bug): Accel-PPP / PPPoEserver raises "Floating point exception" when not all
limits are defined
• T2312 (feature): Use LED modules to enable more visible feedback on VyOS hardware
chassis
• T2306 (feature): Add new cipher suites to the WiFi configuration
• T2286 (default): IPoE server vulnerability
• T2224 (feature): Update Linux Kernel to v4.19.114
• T2110 (feature): RADIUS: supply include file for radius config to have a uniform CLI
• T2324 (feature): Cleanup IPoE server implementation and CLI commands

3.3. 1.3 Equuleus 253

 VyOS Documentation, Release 1.5.x (circinus)

3.3.637 2020-04-17

• T2275 (bug): flow-accounting broken in rolling

• T2256 (feature): Accel-ppp op-mode syntax

3.3.638 2020-04-16

• T2295 (bug): Passwords with Special Characters Broken

• T2305 (feature): Add release name to "show version" command
• T2235 (default): OpenVPN server client IP doesn't reserve that IP in the pool
• T149 (feature): IPv6 support in OpenVPN tunnel

3.3.639 2020-04-15

• T2293 (bug): OpenVPN: UnboundLocalError after merging server_network PullRequest

• T2298 (bug): Errors PDNS with name-server set

3.3.640 2020-04-14

• T2213 (bug): vyos-1x: WiFi mode ieee80211ac should also activate ieee80211n

3.3.641 2020-04-13

• T2283 (default): openvpn not starting: ccd path in template not moved to /run/
openvpn/ccd
• T2236 (bug): DMVPN broken after tunnel rewrite to XML/Python
• T2284 (default): Upgrade ddclient to 3.9.1 which also brings systemd files
• T2282 (feature): Clarify hw-id in ethernet and wireless interface nodes
• T611 (feature): Static route syntax should reflect `ip` command routing
capabilities, if possible.

3.3.642 2020-04-12

• T2273 (default): OpenVPN no longer starts in latest rolling, migrate to systemd

• T2263 (feature): Reset feature for SSTP sessions
• T2262 (bug): Broken reset commands for pptp and l2tp
• T2031 (bug): pseudo-ethernet link interface cannot be changed

3.3. 1.3 Equuleus 254

 VyOS Documentation, Release 1.5.x (circinus)

3.3.643 2020-04-11

• T2264 (feature): l2tp: cleanup CLI definition

• T2233 (bug): Typos in wlanX.cfg
• T2238 (bug): After re-writing list_interfaces.py to use Interfaces() pseudo-ethernet
is missing

3.3.644 2020-04-10

• T2265 (feature): DHCP to be an attribute of the class instead of a inheritance

• T2261 (bug): "client-config-dir" not being set for openvpn
• T2248 (bug): PPPoE Broken in Latest 1.3 Rolling (1.3-rolling-202004070629)
• T1629 (bug): IP addresses configured on vif-s interfaces are not added to the system
• T2266 (default): openvpn bridged client-server doesn't work (validation error)
• T2253 (default): Fix use of cmd in merge config and remote function helpers

3.3.645 2020-04-09

• T2260 (feature): vxlan, pseudo-ethernet: convert link nodes to source-interface

• T2172 (feature): Enable conf VXLAN without remote address
• T2237 (bug): l2tp, pptp, pppoe wrong chap-secrets file

3.3.646 2020-04-08

• T2244 (feature): WireGuard: cleanup Python implementation and reduce amount of

boilerplate code
• T2186 (feature): Provide more information to the user when a traceback is reported
to the user
• T2246 (bug): LLDP op-mode error
• T2240 (feature): Support for bind vif-c interfaces into VRFs
• T2160 (feature): Allow restricting HTTP API to specific virtual hosts
• T2247 (feature): WireGuard: add VRF support

3.3.647 2020-04-05

• T2212 (bug): vyos-1x: WiFi card antenna count not set accordingly
• T2230 (feature): Split out inlined Jina2 template to data/templates folder
• T2206 (feature): Split WireGuard endpoint into proper host and port nodes

3.3. 1.3 Equuleus 255

 VyOS Documentation, Release 1.5.x (circinus)

3.3.648 2020-04-04

• T2158 (bug): Commit fails if ethernet interface doesn't support flow control (pause)
• T2221 (bug): Ability to remove a VRF that has a next-hop-vrf as target
• T2211 (bug): vyos-1x: VHT channel width not set accordingly
• T2208 (bug): vyos-1x: commit on interfaces wireless wlanX capabilities vht
link-adaptation (both|unsolicited) fails
• T2183 (bug): A number of bugs with wireguard script due to interface rearrangement
• T2104 (default): ifconfig.py size
• T2028 (feature): Convert "interfaces tunnel" to new XML/Python representation
• T2219 (bug): VRF default route of PPPoE and WWAN interfaces do not get added into
proper routing table
• T2222 (default): openvpn: requires "multihome" option to listen on all addresses
with udp protocol

3.3.649 2020-04-02

• T2072 (bug): Shell autocomplete of option (config node) with quoted value doesn't
work
• T1823 (feature): l2tpv3 interface migration fails
• T2202 (feature): Update PowerDNS recursor to 4.2 series
• T2200 (feature): Add VRF support on wirelessmodem interfaces

3.3.650 2020-03-31

• T2166 (bug): Broken proxy-arp on vif

• T2180 (bug): get_config_dict should be independent of CLI edit level
• T2053 (default): Update vyos-load-config.py for version string syntax change
• T2052 (default): Update vyos-merge-config.py for version string syntax change
• T2144 (default): vyos-build: docker: selection of text in the terminal still
selects it in vim (mouse isn't completely disabled)

3.3.651 2020-03-30

• T2176 (default): 'WiFiIf' object has no attribute 'set_state'

• T2029 (feature): Switch to new syntax for config file component versions

3.3. 1.3 Equuleus 256

 VyOS Documentation, Release 1.5.x (circinus)

3.3.652 2020-03-29

• T2178 (bug): VRF interface don't get removed when VRF is deleted
• T2170 (feature): Add ability to create static route from default to VRF
• T1831 (feature): Denest IPv6 router-advert from Interfaces to general service

3.3.653 2020-03-28

• T2167 (bug): vyos.ifconfig.get_mac() broken

• T2151 (default): wireless: can't delete interface present in config but not present
in system
• T1988 (feature): Migrate wirelessmodem to new XML/Python style interface

3.3.654 2020-03-27

• T2164 (bug): Package libstrongswan-standard-plugins missing from image

• T2105 (bug): wireless: not possible to disabled wlan0
• T2169 (default): Remove redundant use of show_config in vyos-merge-config

3.3.655 2020-03-26

• T2162 (default): migration script for router-advert sets link-mtu 0 on bridge

interfaces
• T1735 (bug): Issue in "show vpn ipsec/ike sa" output with ipsec encryption algorithm
aes128gcm128/aes256gcm128/chacha etc

3.3.656 2020-03-25

• T2148 (default): openvpn: setting "server client" config without "server client ip"
results in ValueError: '' does not appear to be an IPv4 or IPv6 address
• T2146 (default): openvpn: "delete server client" doesn't delete the corresponding
ccd configs

3.3.657 2020-03-24

• T2157 (default): Organize service https listen-address/listen-port/server-name under

'virtual-host' node
• T1845 (bug): syslog host no longer accepts a port

3.3. 1.3 Equuleus 257

 VyOS Documentation, Release 1.5.x (circinus)

3.3.658 2020-03-22

• T2150 (feature): SSTP ssl certificates can only be stored in /config/user-data/sstp

• T2149 (feature): Update Linux Kernel to v4.19.112
• T476 (enhancment): Update the base system to Debian 10 (Buster)

3.3.659 2020-03-21

• T2142 (bug): vyos-build: Add required packages and step to build-GCE-image script
• T1870 (feature): Extend Pipeline scripts to support PullRequests

3.3.660 2020-03-20

• T2006 (bug): SSTP RADIUS CLI accepts invalid values

• T2140 (default): openvpn: tls file check function checkCertHeader returns True even
when no match is found
• T2007 (feature): SSTP accepts client MTU up to 16384 bytes
• T2008 (feature): Adjustment of SSTP CLI to be more consistent to the rest of VyOS

3.3.661 2020-03-19

• T2135 (bug): Login banner missing spacing now

• T2132 (feature): Document kernel boot parameter 'vyos-config-debug'
• T1744 (default): Config load fails in ConfigTree with ValueError: Failed to parse
config: lexing: empty token

3.3.662 2020-03-17

• T2134 (bug): VXLAN: `NameError: name 'config' is not defined`

3.3.663 2020-03-16

• T2131 (feature): Improve syslog remote host CLI definition

3.3.664 2020-03-15

• T2122 (feature): Update Intel out-of-tree drivers to latest version(s)

• T2121 (feature): Update Linux Kernel to v4.19.109
• T2119 (bug): Error on boot when removing ethernet interface from VM

3.3. 1.3 Equuleus 258

 VyOS Documentation, Release 1.5.x (circinus)

3.3.665 2020-03-14

• T834 (feature): New L2TP server implementation based on accel-ppp

3.3.666 2020-03-13

• T1622 (default): Add failsafe and back trace to boot config loader

3.3.667 2020-03-11

• T1961 (bug): VXLAN - fails to commit due to non-existent variable, broken MTU
• T2084 (default): conntrack-tools package build error for current/equuleus

3.3.668 2020-03-10

• T1331 (bug): DNS stops working

3.3.669 2020-03-09

• T2111 (feature): VRF add route leaking support

• T2109 (bug): Ping by name broken in VyOS 1.3-rolling-202003080217
• T2065 (bug): VyOS 1.3 Don't set daemon in openvpn-{intf}.conf file
• T31 (feature): Add VRF support

3.3.670 2020-03-08

• T1954 (bug): Having `system login radius` configured causes exponentially long boot
times
• T1760 (bug): RADIUS shared secret is not redacted from "show configuration" op mode
command

3.3.671 2020-03-07

• T2107 (bug): Wireless interfaces do not work in station mode without security

3.3.672 2020-03-05

• T2074 (bug): VyOS docker container: Cannot configure ethernet interface

3.3. 1.3 Equuleus 259

 VyOS Documentation, Release 1.5.x (circinus)

3.3.673 2020-03-04

• T2098 (bug): Wrong call to cli-shell-api in generated op-mode templates for path
completion helper

3.3.674 2020-03-03

• T2095 (bug): Copy command errors out

3.3.675 2020-03-01

• T2082 (bug): WireGuard broken after merging T2057

• T2089 (feature): RADIUS: do not query servers when commit is running started from a
non RADIUS user
• T2086 (feature): Move sudo session open/close log entries to auth.log

3.3.676 2020-02-29

• T2046 (feature): allowing sub-classes of Interface to redefine how the interface is

created

3.3.677 2020-02-28

• T2083 (default): vyos-build: build-packages fails at mdns-repeater due to wrong

branch
• T2080 (default): traffic-policy shaper error when setting bandwidth

3.3.678 2020-02-27

• T2075 (feature): Add support for OpenVPN tls-crypt file option

• T2068 (feature): Update Linux Kernel to v4.19.105
• T1703 (default): Macvlan PPPoE support
• T2078 (feature): Kernel: remove unused RAID functions 5,6,10,jbod,dm

3.3.679 2020-02-25

• T2070 (feature): Rewrite (dis-)connect op-mode commands in XML and Python

• T2071 (feature): Add possibility to temporary disable a RADIUS server used for
system login

3.3. 1.3 Equuleus 260

 VyOS Documentation, Release 1.5.x (circinus)

3.3.680 2020-02-23

• T2055 (feature): Remove IPv6 router-advert options for PPPoE

• T1318 (feature): PPPoE client CLI redesign

3.3.681 2020-02-22

• T2063 (feature): vyos-salt-minion package is missing from vyos-world

3.3.682 2020-02-20

• T1969 (default): OSPF with WireGuard cause Route Inactive

3.3.683 2020-02-18

• T2034 (default): Removal of interfaces loopback lo removed 127.0.0.1 and ::1

3.3.684 2020-02-17

• T2047 (feature): Update Linux Kernel to v4.19.104

• T2048 (bug): ISO boot fails when wireless adapter is present

3.3.685 2020-02-16

• T2043 (bug): Bond VLANs can't be extended on the fly

• T2030 (bug): Bond doesn't survive reboot
• T1992 (bug): Adding vlan on a bond resets all BGP connections on same bond
• T1908 (feature): Add zone option for Cloudflare DDNS
• T1246 (bug): VyOS 1.2.0 "openvpn-options" configuration does not allow quotes in
values

3.3.686 2020-02-15

• T2042 (bug): Error on reboot after deleting "service snmp" and not "service lldp
snmp enable"
• T2041 (bug): Adding non existent bond interface raises exception

3.3. 1.3 Equuleus 261

 VyOS Documentation, Release 1.5.x (circinus)

3.3.687 2020-02-14

• T2039 (bug): Wrong system type displayed in show version

• T2040 (bug): vyos-http-api-server should reload Config in all routes

3.3.688 2020-02-13

• T2033 (feature): Drop vyos-replace package

• T1635 (feature): Rewrite interface pseudo-ethernet in new XML/Python style

3.3.689 2020-02-10

• T2024 (feature): Migrate "system login banner" to XML/Python

3.3.690 2020-02-09

• T2022 (bug): When RADIUS config is active, local logins won't work
• T2020 (default): Unable to log in after upgrade to 1.3-rolling-202002080217
• T1931 (bug): Enabling SNMP commit error

3.3.691 2020-02-05

• T1948 (bug): RADIUS login broken in 1.3

• T1990 (feature): Migrate "system login" to XML/Python representation
• T1585 (default): Add letsencrypt/certbot support for 'service https'

3.3.692 2020-02-04

• T1965 (bug): VyOS-1.3: ping no longer supports specifying interface or source

3.3.693 2020-02-02

• T2011 (feature): Update Linux Kernel to v4.19.101

• T640 (bug): Images no longer work when built without "recommended" packages

3.3. 1.3 Equuleus 262

 VyOS Documentation, Release 1.5.x (circinus)

3.3.694 2020-02-01

• T2009 (bug): Ethernet Interface always stays down

• T1989 (bug): conf.get_config_dict() throws exception

3.3.695 2020-01-31

• T1768 (bug): PPtP - vyos.config rewrite

• T2002 (bug): VLAN interfaces try to be enabled even if parent interface is A/D

3.3.696 2020-01-30

• T1994 (default): lldpd not bound to specified interfaces - Fix jinja template
• T1896 (enhancment): Remove LLDP-MED civic_based location information
• T1724 (feature): wireguard - add endpoint check in verify()

3.3.697 2020-01-29

• T1996 (feature): Update Linux Kernel to 4.19.99

• T1862 (default): Use regex pattern \s+ to split strings on whitespace in Python 3.7
• T1755 (bug): Python KeyError exceptions raised with 'show vpn ipsec sa' command
under use of certain IPSEC cipher suites
• T1747 (bug): L2TP breaks after upgrading to VyOS 1.2-rolling-201910180117 [issue
report and proposed solution]
• T1664 (bug): Ipoe with bond per vlan don't work
• T1895 (feature): There is not restriction on selection of syslog facility
• T1670 (feature): OpenVPN option for tls-auth

3.3.698 2020-01-26

• T1937 (bug): snmpd throwing a tremendous amount of errors

• T1767 (bug): IPoE - vyos.config rewrite
• T1765 (bug): wireguard - vyos.config rewrite

3.3.699 2020-01-24

• T1975 (bug): OpenVPN tap devices won't come up automatically

3.3. 1.3 Equuleus 263

 VyOS Documentation, Release 1.5.x (circinus)

3.3.700 2020-01-23

• T1766 (bug): service-pppoe - vyos.config rewrite

3.3.701 2020-01-21

• T1784 (bug): DMVPN with IPSec does not work in HUB mode
• T1977 (bug): webproxy error on fresh install

3.3.702 2020-01-18

• T1830 (feature): 1.3-rolling boots to GRUB prompt post-install on UEFI systems

• T1940 (bug): EFI Fresh Install fails to boot, 4K Sector Drives Fail to boot EFI

3.3.703 2020-01-16

• T1880 (default): "A stop job is running for live-tools - System Support Scripts"
hangs, times out when shutting down equuleus live iso

3.3.704 2020-01-15

• T1959 (bug): Error message when adding IPSec VPN

3.3.705 2020-01-09

• T1955 (feature): snmp - cli config val_help missing

• T1813 (bug): error in generated /etc/hosts file

3.3.706 2020-01-08

• T1946 (bug): Recovery ifname for PPtP remote-access

3.3.707 2020-01-03

• T1939 (feature): Provide abstraction for interface "ip" options

3.3.708 2020-01-01

• T1779 (bug): Tunnel interfaces aren't suggested as being available for bridging

3.3. 1.3 Equuleus 264

 VyOS Documentation, Release 1.5.x (circinus)

3.3.709 2019-12-31

• T1654 (bug): sFlow: multiple "sflow server" not work, and "disable-imt" could break
configuration
• T1923 (feature): Migrate L2TPv3 interface to XML/Python

3.3.710 2019-12-30

• T1920 (bug): beep: Error: Running under sudo, which is not supported for security
reasons.
• T1918 (bug): l2tp / ipsec config broken in latest daily
• T1897 (bug): IPSec - 1.2 to 1.3 migration failed
• T1921 (bug): snmp: VyOS options no longer recognized
• T1922 (feature): Add VXLAN IPv6 support
• T1919 (feature): Migrate "system options" to XML/Python representation

3.3.711 2019-12-28

• T1916 (feature): Update Linux Kernel to v4.19.91

• T1915 (bug): Remove "system ipv6 blacklist" option
• T1912 (feature): Migrate "system (ip|ipv6)" to XML/Python representation

3.3.712 2019-12-27

• T1910 (bug): Invalid parmissions on latest 1.3 rolling ISO images

3.3.713 2019-12-26

• T1794 (bug): Interface description can't contain a colon

• T1906 (feature): Migrate "system time-zone" configuration to XML/Python

3.3.714 2019-12-23

• T1898 (enhancment): Support multiple IPv4/IPv6 LLDP management addresses

• T1878 (bug): accel-ppp: pppoe single-session option implementation

3.3. 1.3 Equuleus 265

 VyOS Documentation, Release 1.5.x (circinus)

3.3.715 2019-12-22

• T393 (enhancment): Migrate vyatta-lldpd to vyos-1x

3.3.716 2019-12-20

• T1892 (default): vyos-build: Do not install recommends in docker image

[enhancement]
• T1411 (enhancment): equuleus: buster: vyatta-ravpn: libfreeradius-client2 is
missing in buster

3.3.717 2019-12-19

• T1873 (default): DHCP server fails to start due to a change in isc-dhcp-server init
scripts

3.3.718 2019-12-18

• T1889 (bug): Error building docker build image

• T1132 (default): Build on Debian Buster

3.3.719 2019-12-17

• T1886 (feature): Update Linux Kernel to v4.19.89

• T1887 (feature): Update WireGuard to Debian release 0.0.20191212-1

3.3.720 2019-12-13

• T1861 (default): hosts lost after modified static-host-mapping

3.3.721 2019-12-10

• T1843 (feature): Add GCC preprocessor support for XML files

3.3.722 2019-12-08

• T1566 (feature): Extend L2TP/IPSec server with IPv6

3.3. 1.3 Equuleus 266

 VyOS Documentation, Release 1.5.x (circinus)

3.3.723 2019-12-07

• T1714 (bug): Disable DHCP Nameservers Not Working

3.3.724 2019-12-06

• T1860 (feature): Update WireGuard to Debian release 0.0.20191127-2

• T1859 (feature): Update Linux Kernel to v4.19.88
• T1854 (bug): Dynamic DNS configuration cannot be deleted
• T1849 (bug): DHCPv6 client does not start
• T1169 (bug): LLDP potentially broken
• T586 (bug): Cannot add ethernet vif-s vif-c interface to bridge-group

3.3.725 2019-12-05

• T1847 (bug): set_level incorrectly handles path given as empty string

3.3.726 2019-12-04

• T1787 (default): Failed config migration from V1.2.3 to 1.2-rolling-201911030217

• T1212 (bug): IPSec Tunnel to Cisco ASA drops reliably after 4.2GB transferred
• T1704 (feature): OpenVPN - Add support for ncp-ciphers

3.3.727 2019-12-03

• T1782 (bug): pppoe0: showing as "Coming up"

• T1801 (bug): Unescaped backslashes in config values cause configuration failure

3.3.728 2019-12-02

• T1840 (bug): PPPoE doesn't not rename pppX to pppoeX

3.3.729 2019-11-25

• T1824 (bug): Permission denied: '/opt/vyatta/etc/config/vyos-migrate.log'

3.3. 1.3 Equuleus 267

 VyOS Documentation, Release 1.5.x (circinus)

3.3.730 2019-11-24

• T1673 (bug): vif bridge-group not migrated to bridge member interface

• T1799 (feature): Add support for GENEVE (Generic Network Virtualization
Encapsulation)

3.3.731 2019-11-23

• T1627 (feature): Rewrite wireless interface in new style XML syntax

3.3.732 2019-11-21

• T1818 (default): Print name of migration script on failure

• T1814 (default): Add log of migration scripts run during config migration

3.3.733 2019-11-14

• T1710 (default): [equuleus] buster: add patch to fix live-build missing key error
• T1804 (default): Add python3-psutil to docker image
• T1736 (default): Decide on best practice for patching live-team packages for VyOS
build system
• T1424 (default): Rewrite the config load script

3.3.734 2019-11-11

• T1793 (feature): Editing description on an interface causes BGP sessions to reset on

commit

3.3.735 2019-11-10

• T1791 (feature): Update Linux Kernel to 4.19.82

3.3.736 2019-11-08

• T1789 (bug): ddclient not working with generated RFC2136 / nsupdate config

3.3. 1.3 Equuleus 268

 VyOS Documentation, Release 1.5.x (circinus)

3.3.737 2019-11-03

• T1777 (bug): Bonding interface MAC address mismatch after reboot

• T1752 (bug): PPPoE does not automatically start on boot

3.3.738 2019-11-02

• T1783 (bug): Interface can't unpin from bridge

3.3.739 2019-10-22

• T1756 (feature): Modify output to be more useful - Wireguard

3.3.740 2019-10-21

• T1741 (feature): Add system wide proxy setting

3.3.741 2019-10-19

• T1746 (bug): 201910180117 fails startup with 'Permission Denied' errors

• T1743 (default): equuleus: remove references to SSH key type "rsa1" deprecated in
Debian Buster

3.3.742 2019-10-18

• T1712 (default): DHCP client sometimes doesn't start

• T1604 (enhancment): equuleus: buster: vbash: tab completion breaks

3.3.743 2019-10-11

• T1723 (bug): wireguard - Interface wg01 could not be brought up in time

3.3.744 2019-10-09

• T1719 (feature): ssh deprecated options

• T1718 (bug): ISO check in /opt/vyatta/sbin/install-image faulty
• T1682 (feature): Migrate to new Jenkins Pipeline script

3.3. 1.3 Equuleus 269

 VyOS Documentation, Release 1.5.x (circinus)

3.3.745 2019-10-08

• T1717 (bug): disable multiple daemons to autostart at boot

3.3.746 2019-10-06

• T1713 (feature): Remove deprecated packages no longer required after migration to

Accel-PPP

3.3.747 2019-10-03

• T1689 (feature): "reset openvpn" op-mode command should terminate and restart
OpenVPN process

3.3.748 2019-10-01

• T1706 (bug): wireguard broken in latest rolling

3.3.749 2019-09-30

• T1688 (feature): OpenVPN - Add new cipher aes-(128|192|256)-gcm

3.3.750 2019-09-28

• T1696 (bug): NTP - Tests fail when building vyos-1x

• T1512 (bug): vyos 1.2 openvpn client names with spaces created incorrectly

3.3.751 2019-09-27

• T1681 (feature): cleanup wireguard code since tagnodes are now visible
• T1695 (bug): Syntax error in interface-dummy.py

3.3.752 2019-09-26

• T1692 (bug): ipoe-server verify function error

• T1691 (bug): OpenVPN - Commiting config when OpenVPN peer/server not available makes
commit hang
• T1690 (feature): restart op-mode commands for 'service (pppoe|ipoe)-server'

3.3. 1.3 Equuleus 270

 VyOS Documentation, Release 1.5.x (circinus)

3.3.753 2019-09-25

• T1672 (bug): Wireguard keys not automatically moved

3.3.754 2019-09-23

• T1679 (bug): during bootup: invalid literal for int() with base 10
• T1680 (feature): DHCP client does not release IP address on exit/deletion

3.3.755 2019-09-21

• T1676 (default): [equuleus] buster: update GRUB boot parameters during upgrade
• T1637 (feature): Rewrite ethernet interface in new style XML syntax
• T1675 (feature): OpenVPN - Specify minimum TLS version

3.3.756 2019-09-20

• T1602 (default): equuleus: buster: add live build apt options for choosing vyos
packages

3.3.757 2019-09-19

• T1666 (feature): Deleting a bond will place member interfaces into A/D state

3.3.758 2019-09-17

• T239 (bug): Improve documentation for the firewall all-ping setting

3.3.759 2019-09-16

• T1040 (default): rc.local is executed too early

3.3.760 2019-09-15

• T1662 (default): openvpn: 'show openvpn client' error

• T1661 (default): openvpn: wrong checking for existence cert files
• T1630 (bug): OpenVPN after changing it from root to nobody (unprivileged user) cant
add routes

3.3. 1.3 Equuleus 271

 VyOS Documentation, Release 1.5.x (circinus)

3.3.761 2019-09-13

• T1660 (bug): Bonding dont’t work on VyOS 1.2-rolling-201909120338

• T1655 (enhancment): equuleus: buster: arm: vyos-accel-ppp build failes because of
filename hardcoded as x86_64 in debian/rules

3.3.762 2019-09-12

• T1572 (feature): Wireguard keyPair per interface

• T1545 (bug): IPSEC vti issue

3.3.763 2019-09-10

• T1650 (feature): implement wireguard default key removal

• T1649 (feature): feature documentation different keypairs per interface
• T1648 (feature): add cli command 'delete wireguard named-key <key>'

3.3.764 2019-09-09

• T1639 (bug): wireguard pubkey change error

3.3.765 2019-09-07

• T1640 (feature): Update Linux Kernel to v4.19.70

3.3.766 2019-09-06

• T1624 (bug): Failed to set up config session

• T1636 (feature): Rewrite VXLAN in new style XML/Python
• T1479 (bug): libvyosconfig error reporting doesn't include line numbers
• T808 (feature): replace lighthttpd with nginx
• T1478 (bug): libvyosconfig parser does not support escaped quotes inside
single-quoted strings

3.3.767 2019-09-04

• T1632 (bug): OpenVPN 'push' options with quotes

• T1631 (bug): Multiple push-route options cause error generating openvpn
configuration
• T1557 (feature): Create generic abstraction for configuring interfaces e.g. IP
address
• T1628 (feature): Adopt WireGuard configuration script to new vyos.ifconfig class
• T1614 (feature): Rewrite bonding interface in new style XML syntax

3.3. 1.3 Equuleus 272

 VyOS Documentation, Release 1.5.x (circinus)

3.3.768 2019-09-02

• T1621 (default): Rewrite the rest of trivial vyatta-op commands to new syntax

3.3.769 2019-08-31

• T1456 (bug): Port group cannot be configured if the same port is configured as
standalone and inside a range

3.3.770 2019-08-28

• T1615 (feature): After migration to pyroute2 the address DHCP statement is no longer
covered

3.3.771 2019-08-27

• T1617 (default): OpenVPN push route failure

• T1250 (bug): FRR not setting default gateway from DHCP

3.3.772 2019-08-26

• T1591 (bug): OpenVPN "run show openvpn client status" does not work
• T1608 (feature): bridge: Bridge adding non existing interfaces is allowed but does
not work
• T1548 (feature): Rewrite OpenVPN interface/op-commands in new style XML/Python
• T1607 (default): Convert 'reset conntrack' and 'reset ip[v6] cache' operations from
vyatta-op to new syntax

3.3.773 2019-08-25

• T1611 (default): Migration to latest rolling fails with vyos.configtree.

ConfigTreeError: Path [b'interfaces bridge br0 igmp-snooping querier'] doesn't
exist

3.3.774 2019-08-23

• T1606 (bug): Rolling release no longer boots after adding hostname daemon

3.3. 1.3 Equuleus 273

 VyOS Documentation, Release 1.5.x (circinus)

3.3.775 2019-08-21

• T1601 (feature): Rewrite loopback interface type with new style XML/Python interface
• T1596 (default): Convert 'telnet' and 'traceroute' vyatta-op commands to new syntax

3.3.776 2019-08-20

• T1595 (feature): Migrate deprecated "service dns forwarding listen-on" to

listen-address

3.3.777 2019-08-19

• T1580 (feature): Rewrite dummy interface type with new style XML/Python interface
• T1590 (default): Convert 'show system' operations from vyatta-op to python/xml
syntax

3.3.778 2019-08-17

• T1592 (feature): Update Linux Kernel to v4.19.67

3.3.779 2019-08-15

• T1584 (default): equuleus: buster: add consistent grub options for predictable
interface names

3.3.780 2019-08-13

• T1556 (feature): Rewrite Bridge in new style XML syntax

3.3.781 2019-08-09

• T1569 (feature): interfaceconfig class documetation

3.3.782 2019-08-05

• T1562 (feature): Change version scheme on current branch used for rolling releases

3.3. 1.3 Equuleus 274

 VyOS Documentation, Release 1.5.x (circinus)

3.3.783 2019-08-04

• T1561 (bug): VyOS rolling ISO cluttered with vyatta-ravpn Git Repo

3.3.784 2019-08-02

• T853 (feature): Add SSTP server support

• T742 (feature): Replace poptop and xl2tpd with accel-ppp

3.3.785 2019-08-01

• T1544 (feature): L2TP documentation

3.3.786 2019-07-31

• T1552 (feature): accel-ppp: SSTP documentation

• T1553 (default): equuleus: buster: add 'noautologin' to boot parameters

3.3.787 2019-07-29

• T1532 (default): [equuleus] buster: GPG error on vyos package repository

3.3.788 2019-07-28

• T1547 (feature): accel-ppp/L2TP restructure CLI

• T1546 (bug): accel-ppp/L2TP radius-source address is not honored

3.3.789 2019-07-23

• T1533 (bug): Rolling builds broken!

• T1489 (feature): Add vlan_mon usage at Accel

3.3.790 2019-07-22

• T1435 (enhancment): Make ip-address [OPTIONAL] (in dhcp-server -> static-mapping) to

cope with "unfriendly" client-hostnames of IoT-Devices

3.3. 1.3 Equuleus 275

 VyOS Documentation, Release 1.5.x (circinus)

3.3.791 2019-07-21

• T823 (feature): Rewrite DHCP op mode in the new style

3.3.792 2019-07-18

• T1497 (bug): "set system name-server" generates invalid/incorrect resolv.conf

• T533 (feature): Support for PPPoE MTU greater than 1492

3.3.793 2019-07-08

• T1510 (feature): [IPoE] vlan-mon option implementation

• T1508 (feature): [pppoe] migration script for service pppoe-server interface
• T1494 (feature): accel-ppp: IPoE update documentation
• T989 (feature): Add support for IPoE server

3.3.794 2019-07-03

• T1502 (feature): Add build sanity checking tools to the dev builds

3.3.795 2019-07-02

• T1099 (default): Openvpn: use config files instead of one long command.
• T1495 (feature): accel-ppp: IPoE implement IPv6 PD

3.3.796 2019-07-01

• T1498 (bug): Nameservers are not propagated into resolv.conf

3.3.797 2019-06-24

• T1482 (feature): Add OpenVPN SHA384 hashing algorithm

3.3.798 2019-06-23

• T1476 (bug): Update PowerDNS recursor to 4.2 series

3.3. 1.3 Equuleus 276

 VyOS Documentation, Release 1.5.x (circinus)

3.3.799 2019-06-22

• T1313 (feature): Add support for reusable build flavours

• T1202 (bug): Add `hvinfo` to the packages directory

3.3.800 2019-06-20

• T1413 (enhancment): equuleus: buster: vyos-xe-guest-utilities is not installable

and breaks live-build
• T1412 (enhancment): equuleus: buster: vyos-netplug is not installable and breaks
live-build

3.3.801 2019-06-19

• T1334 (feature): Migration script runner rewrite

• T1327 (bug): Set the serial console speed to 115200 by default

3.3.802 2019-06-18

• T1451 (bug): Intel e1000e driver missing in lates rolling release

3.3.803 2019-06-17

• T1408 (feature): pppoe-server - implement local-ipv6 for pure IPv6 based deployments

3.3.804 2019-06-12

• T1397 (default): Rewrite the config merge script

3.3.805 2019-06-05

• T1426 (default): Update the script that checks conntrack hash-size on reboot

3.3.806 2019-06-03

• T1423 (default): When merging remote config files, create known_hosts file if not
present.

3.3. 1.3 Equuleus 277

 VyOS Documentation, Release 1.5.x (circinus)

3.3.807 2019-05-28

• T1410 (feature): Upgrade Linux Kernel to 4.19.46

3.3.808 2019-05-26

• T1404 (feature): Update iproute2 package to 4.19

3.3.809 2019-05-24

• T1407 (bug): pppoe IPv6 PD documention by practical example

3.3.810 2019-05-23

• T1402 (feature): Update Linux Kernel to 4.19.45

3.3.811 2019-05-22

• T1399 (bug): accel-ppp kernel modules missing in rolling build 20190522

• T1393 (bug): pppoe IPv6 pool doesn't work

3.3.812 2019-05-21

• T592 (bug): lldpcli: unknown command from argument 1: `#`

3.3.813 2019-05-16

• T1267 (feature): FRR: Add interface name for static routes

• T1148 (bug): epa2 BGP peers initiate before config is fully loaded, routes leak.

3.3.814 2019-05-06

• T1368 (feature): Enable MPLS support in Linux Kernel

3.3.815 2019-05-04

• T1365 (bug): Cannot configure syslog on 1.2.0-rolling+201904260337

3.3. 1.3 Equuleus 278

 VyOS Documentation, Release 1.5.x (circinus)

3.3.816 2019-04-29

• T1352 (feature): vyos-documentaion: accel-pppoe adding CIDR based IP pool option

3.3.817 2019-04-21

• T1348 (feature): Upgrade WireGuard to 0.0.20190406-1

• T1347 (feature): Upgrade Linux Kernel to 4.19.36

3.3.818 2019-04-20

• T1344 (feature): Unclutter "system login radius" configuration nodes

3.3.819 2019-04-19

• T1325 (default): GRE tunnel to Cisco router fails in 1.2.0 - works in 1.1.8

3.3.820 2019-04-16

• T1184 (feature): wireguard - extend documentation with the show interface wireguard
commands

3.3.821 2019-04-15

• T1260 (feature): VICI-based implementation of "run show vpn ipsec sa"

• T1248 (default): Add a function for copying nodes to the vyos.configtree library

3.3.822 2019-04-05

• T1324 (feature): update documtation for 'set system login user level'

3.3.823 2019-04-04

• T1323 (feature): migrate operator accounts to admin accounts and remove the option
to setup an operator account

3.3.824 2019-03-20

• T405 (feature): Add binaries for lcdproc

3.3. 1.3 Equuleus 279

 VyOS Documentation, Release 1.5.x (circinus)

3.3.825 2019-03-12

• T1284 (feature): accel-ppp: pptp implementation documention

• T833 (feature): New PPTP server implementation based on accel-ppp

3.3.826 2019-02-22

• T1257 (bug): implement 'set system static-host-mapping' in host_name.py and remove

old function calls

3.3.827 2019-02-21

• T1214 (bug): Add `ipaddrcheck` to the packages directory

3.3.828 2019-02-10

• T1154 (default): use of local cache to build iso

3.3.829 2019-02-09

• T1236 (feature): Update Linux Kernel

3.4 1.2.6-S1

1.2.6-S1 is a security release release made in September 2020.

3.4.1 Resolved issues

VyOS 1.2.6 release was found to be suspectible to CVE-2020-10995. It’s a low- impact vulnerability in the PowerDNS
recursor that allows an attacker to cause performance degradation via a specially crafted authoritative DNS server reply.
• T2899 remote syslog server migration error on update

3.5 1.2.6

1.2.6 is a maintenance release made in September 2020.

3.4. 1.2.6-S1 280

 VyOS Documentation, Release 1.5.x (circinus)

3.5.1 Resolved issues

• T103 DHCP server prepends shared network name to hostnames

• T125 Missing PPPoE interfaces in l2tp configuration
• T1194 cronjob is being setup even if not saved
• T1205 module pcspkr missing
• T1219 Redundant active-active configuration, asymmetric routing and conntrack-sync cache
• T1220 Show transceiver information from plugin modules, e.g SFP+, QSFP
• T1221 BGP - Default route injection is not processed by the specific route-map
• T1241 Remove of policy route throws CLI error
• T1291 Under certain conditions the VTI will stay forever down
• T1463 Missing command show ip bgp scan appears in command completion
• T1575 show snmp mib ifmib crashes with IndexError
• T1699 Default net.ipv6.route.max_size 32768 is too low
• T1729 PIM (Protocol Independent Multicast) implementation
• T1901 Semicolon in values is interpreted as a part of the shell command by validators
• T1934 Change default hostname when deploy from OVA without params.
• T1938 syslog doesn’t start automatically
• T1949 Multihop IPv6 BFD is unconfigurable
• T1953 DDNS service name validation rejects valid service names
• T1956 PPPoE server: support PADO-delay
• T1973 Allow route-map to match on BGP local preference value
• T1974 Allow route-map to set administrative distance
• T1982 Increase rotation for atop.acct
• T1983 Expose route-map when BGP routes are programmed in to FIB
• T1985 pppoe: Enable ipv6 modules without configured ipv6 pools
• T2000 strongSwan does not install routes to table 220 in certain cases
• T2021 OSPFv3 doesn’t support decimal area syntax
• T2062 Wrong dhcp-server static route subnet bytes
• T2091 swanctl.conf file is not generated properly is more than one IPsec profile is used
• T2131 Improve syslog remote host CLI definition
• T2224 Update Linux Kernel to v4.19.114
• T2286 IPoE server vulnerability
• T2303 Unable to delete the image version that came from OVA
• T2305 Add release name to “show version” command
• T2311 Statically configured name servers may not take precedence over ones from DHCP
• T2327 Unable to create syslog server entry with different port

3.5. 1.2.6 281

 VyOS Documentation, Release 1.5.x (circinus)

• T2332 Backport node option for a syslog server

• T2342 Bridge l2tpv3 + ethX errors
• T2344 PPPoE server client static IP assignment silently fails
• T2385 salt-minion: improve completion helpers
• T2389 BGP community-list unknown command
• T2398 op-mode “dhcp client leases interface” completion helper misses interfaces
• T2402 Live ISO should warn when configuring that changes won’t persist
• T2443 NHRP: Add debugging information to syslog
• T2448 monitor protocol bgp subcommands fail with ‘command incomplete’
• T2458 Update FRR to 7.3.1
• T2476 Bond member description change leads to network outage
• T2478 login radius: use NAS-IP-Address if defined source address
• T2482 Update PowerDNS recursor to 4.3.1 for CVE-2020-10995
• T2517 vyos-container: link_filter: No such file or directory
• T2526 Wake-On-Lan CLI implementation
• T2528 “update dns dynamic” throws FileNotFoundError excepton
• T2536 “show log dns forwarding” still refers to dnsmasq
• T2538 Update Intel NIC drivers to recent release (preparation for Kernel >=5.4)
• T2545 Show physical device offloading capabilities for specified ethernet interface
• T2563 Wrong interface binding for Dell VEP 1445
• T2605 SNMP service is not disabled by default
• T2625 Provide generic Library for package builds
• T2686 FRR: BGP: large-community configuration is not applied properly after upgrading FRR to 7.3.x series
• T2701 vpn ipsec pfs enable doesn’t work with IKE groups
• T2728 Protocol option ignored for IPSec peers in transport mode
• T2734 WireGuard: fwmark CLI definition is inconsistent
• T2757 “show system image version” contains additional new-line character breaking output
• T2797 Update Linux Kernel to v4.19.139
• T2822 Update Linux Kernel to v4.19.141
• T2829 PPPoE server: mppe setting is implemented as node instead of leafNode
• T2831 Update Linux Kernel to v4.19.142
• T2852 rename dynamic dns interface breaks ddclient.cache permissions
• T2853 Intel QAT acceleration does not work

3.5. 1.2.6 282

 VyOS Documentation, Release 1.5.x (circinus)

3.6 1.2.5

1.2.5 is a maintenance release made in April 2020.

3.6.1 Resolved issues

• T1020 OSPF Stops distributing default route after a while

• T1228 pppoe default-route force option not working (Rel 1.2.0-rc11)
• T1301 bgp peer-groups don’t work when “no-ipv4-unicast” is enabled.
• T1341 Adding rate-limiter for pppoe server users
• T1376 Incorrect DHCP lease counting
• T1392 Large firewall rulesets cause the system to lose configuration and crash at startup
• T1416 2 dhcp server run in failover mode can’t sync hostname with each other
• T1452 accel-pppoe - add vendor option to shaper
• T1490 BGP configuration (is lost|not applied) when updating 1.1.8 -> 1.2.1
• T1780 Adding ipsec ike closeaction
• T1803 Unbind NTP while it’s not requested. . .
• T1821 “authentication mode radius” has no effect for PPPoE server
• T1827 Increase default gc_thresh
• T1828 Missing completion helper for “set system syslog host 192.0.2.1 facility all protocol”
• T1832 radvd adding feature DNSSL branch.example.com example.com to existing package
• T1837 PPPoE unrecognized option ‘replacedefaultroute’
• T1851 wireguard - changing the pubkey on an existing peer seems to destroy the running config.
• T1858 l2tp: Delete depricated outside-nexthop and add gateway-address
• T1864 Lower IPSec DPD timeout lower limit from 10s -> 2s
• T1879 Extend Dynamic DNS XML definition value help strings and validators
• T1881 Execute permissions are removed from custom SNMP scripts at commit time
• T1884 Keeping VRRP transition-script native behaviour and adding stop-script
• T1891 Router announcements broken on boot
• T1900 Enable SNMP for VRRP.
• T1902 Add redistribute non main table in bgp
• T1909 Incorrect behaviour of static routes with overlapping networks
• T1913 “system ipv6 blacklist” command has no effect
• T1914 IPv6 multipath hash policy does not apply
• T1917 Update WireGuard to Debian release 0.0.20191219-1
• T1934 Change default hostname when deploy from OVA without params.
• T1935 NIC identification and usage problem in Hyper-V environments

3.6. 1.2.5 283

 VyOS Documentation, Release 1.5.x (circinus)

• T1936 pppoe-server CLI control features

• T1964 SNMP Script-extensions allows names with spaces, but commit fails
• T1967 BGP parameter “enforce-first-as” does not work anymore
• T1970 Correct adding interfaces on boot
• T1971 Missing modules in initrd.img for PXE boot
• T1998 Update FRR to 7.3
• T2001 Error when router reboot
• T2032 Monitor bandwidth bits
• T2059 Set source-validation on bond vif don’t work
• T2066 PPPoE interface can be created multiple times - last wins
• T2069 PPPoE-client does not works with service-name option
• T2077 ISO build from crux branch is failing
• T2079 Update Linux Kernel to v4.19.106
• T2087 Add maxfail 0 option to pppoe configuration.
• T2100 BGP route adverisement wih checks rib
• T2120 “reset vpn ipsec-peer” doesn’t work with named peers
• T2197 Cant add vif-s interface into a bridge
• T2228 WireGuard does not allow ports < 1024 to be used
• T2252 HTTP API add system image can return ‘504 Gateway Time-out’
• T2272 Set system flow-accounting disable-imt has syntax error
• T2276 PPPoE server vulnerability

3.7 1.2.4

1.2.4 is a maintenance release made in December 2019.

3.7.1 Resolved issues

• T258 Can not configure wan load-balancing on vyos-1.2

• T818 SNMP v3 - remove required engineid from user node
• T1030 Upgrade ddclient from 3.8.2 to 3.9. (support Cloudflare API v4)
• T1183 BFD Support via FRR
• T1299 Allow SNMPd to be extended with custom scripts
• T1351 accel-pppoe adding CIDR based IP pool option
• T1391 In route-map set community additive
• T1394 syslog systemd and host_name.py race condition
• T1401 Copying files with the FTP protocol fails if the passwor contains special characters

3.7. 1.2.4 284

 VyOS Documentation, Release 1.5.x (circinus)

• T1421 OpenVPN client push-route stopped working, needs added quotes to fix
• T1430 Add options for custom DHCP client-id and hostname
• T1447 Python subprocess called without import in host_name.py
• T1470 improve output of “show dhcpv6 server leases”
• T1485 Enable ‘AdvIntervalOpt’ option in for radvd.conf
• T1496 Separate rolling release and LTS kernel builds
• T1560 “set load-balancing wan rule 0” causes segfault and prevent load balancing from starting
• T1568 strip-private command improvement for additional masking o IPv6 and MAC address
• T1578 completion offers “show table”, but show table does not exist
• T1593 Support ip6gre
• T1597 /usr/sbin/rsyslogd after deleting “system syslog”
• T1638 vyos-hostsd not setting system domain name
• T1678 hostfile-update missing line feed
• T1694 NTPd: Do not listen on all interfaces by default
• T1701 Delete domain-name and domain-search won’t work
• T1705 High CPU usage by bgpd when snmp is active
• T1707 DHCP static mapping and exclude address not working
• T1708 Update Rolling Release Kernel to 4.19.76
• T1709 Update WireGuard to 0.0.20190913
• T1716 Update Intel NIC drivers to recent versions
• T1726 Update Linux Firmware binaries to a more recen version 2019-03-14 -> 2019-10-07
• T1728 Update Linux Kernel to 4.19.79
• T1737 SNMP tab completion missing
• T1738 Copy SNMP configuration from node to node raises exception
• T1740 Broken OSPFv2 virtual-link authentication
• T1742 NHRP unable to commit.
• T1745 dhcp-server commit fails with “DHCP range stop address must be greater or equal to the range start
address y!” when static mapping has same IP as range stop
• T1749 numeric validator doesn’t support multiple ranges
• T1769 Remove complex SNMPv3 Transport Security Model (TSM)
• T1772 <regex> constraints in XML are partially broken
• T1778 Kilobits/Megabits difference in configuration Vyos/FRR
• T1780 Adding ipsec ike closeaction
• T1786 disable-dhcp-nameservers is missed in current host_name.p implementation
• T1788 Intel QAT (QuickAssist Technology ) implementation
• T1792 Update WireGuard to Debian release 0.0.20191012-1

3.7. 1.2.4 285

 VyOS Documentation, Release 1.5.x (circinus)

• T1800 Update Linux Kernel to v4.19.84

• T1809 Wireless: SSID scan does not work in AP mode
• T1811 Upgrade from 1.1.8: Config file migratio failed: module=l2tp
• T1812 DHCP: hostnames of clients not resolving afte update v1.2.3 -> 1.2-rolling
• T1819 Reboot kills SNMPv3 configuration
• T1822 Priority inversion wireless interface dhcpv6
• T1825 Improve DHCP configuration error message
• T1836 import-conf-mode-commands in vyos-1x/scripts fails to create an xml
• T1839 LLDP shows “VyOS unknown” instead of “VyOS”
• T1841 PPP ipv6-up.d direcotry missing
• T1893 igmp-proxy: Do not allow adding unknown interface
• T1903 Implementation udev predefined interface naming
• T1904 update eth1 and eth2 link files for the vep4600

3.8 1.2.3

1.2.3 is a maintenance and feature backport release made in September 2019.

3.8.1 New features

• HTTP API
• T1524 “set service dns forwarding allow-from <IPv4 net|IPv6 net>” option for limiting queries to specific client
networks
• T1503 Functions for checking if a commit is in progress
• T1543 “set system contig-mangement commit-archive source-address” option
• T1554 Intel NIC drivers now support receive side scaling and multiqueue

3.8.2 Resolved issues

• T1209 OSPF max-metric values over 100 no longer causes commit errors
• T1333 Fixes issue with DNS forwarding not performing recursive lookups on domain specific forwarders
• T1362 Special characters in VRRP passwords are handled correctly
• T1377 BGP weight is applied properly
• T1420 Fixed permission for log files
• T1425 Wireguard interfaces now support /31 addresses
• T1428 Wireguard correctly handles firewall marks
• T1439 DHCPv6 static mappings now work correctly
• T1450 Flood ping commands now works correctly

3.8. 1.2.3 286

 VyOS Documentation, Release 1.5.x (circinus)

• T1460 Op mode “show firewall” commands now support counters longer than 8 digits (T1460)
• T1465 Fixed priority inversion in VTI commands
• T1468 Fixed remote-as check in the BGP route-reflector-client option
• T1472 It’s now possible to re-create VRRP groups with RFC compatibility mode enabled
• T1527 Fixed a typo in DHCPv6 server help strings
• T1529 Unnumbered BGP peers now support VLAN interfaces
• T1530 Fixed “set system syslog global archive file” command
• T1531 Multiple fixes in cluster configuration scripts
• T1537 Fixed missing help text for “service dns”
• T1541 Fixed input validation in DHCPv6 relay options
• T1551 It’s now possible to create a QinQ interface and a firewall assigned to it in one commit
• T1559 URL filtering now uses correct rule database path and works again
• T1579 “show log vpn ipsec” command works again
• T1576 “show arp interface <intf>” command works again
• T1605 Fixed regression in L2TP/IPsec server
• T1613 Netflow/sFlow captures IPv6 traffic correctly
• T1616 “renew dhcpv6” command now works from op mode
• T1642 BGP remove-private-as option iBGP vs eBGP check works correctly now
• T1540, T1360, T1264, T1623 Multiple improvements in name servers and hosts configuration handling

3.8.3 Internals

/etc/resolv.conf and /etc/hosts files are now managed by the vyos-hostsd service that listens on a ZMQ socket
for update messages.

3.9 1.2.2

1.2.2 is a maintenance release made in July 2019.

3.9.1 New features

• Options for per-interface MSS clamping.

• BGP extended next-hop capability
• Relaxed BGP multipath option
• Internal and external options for “remote-as” (accept any AS as long as it’s the same to this router or different,
respectively)
• “Unnumbered” (interface-based) BGP peers
• BGP no-prepend option
• Additive BGP community option

3.9. 1.2.2 287

 VyOS Documentation, Release 1.5.x (circinus)

• OSPFv3 network type option

• Custom arguments for VRRP scripts
• A script for querying values from config files

3.9.2 Resolved issues

• Linux kernel 4.19.54, including a fix for the TCP SACK vulnerability
• T1371 VRRP health-check scripts now can use arguments
• T1497 DNS server addresses coming from a DHCP server are now correctly propagated to resolv.conf
• T1469 Domain-specific name servers in DNS forwarding are now used for recursive queries
• T1433 run show dhcpv6 server leases now display leases correctly
• T1461 Deleting firewall options node no longer causes errors
• T1458 Correct hostname is sent to remote syslog again
• T1438 Board serial number from DMI is correctly displayed in show version
• T1358, T1355, T1294 Multiple corrections in remote syslog config
• T1255 Fixed missing newline in /etc/hosts
• T1174 system domain-name is correctly included in /etc/resolv.conf
• T1465 Fixed priority inversion in interfaces vti vtiX ip settings
• T1446 Fixed errors when installing with RAID1 on UEFI machines
• T1387 Fixed an error on disabling an interfaces that has no address
• T1367 Fixed deleting VLAN interface with non-default MTU
• T1505 vyos.config return_effective_values() function now correctly returns a list rather than a string

3.10 1.2.1

VyOS 1.2.1 is a maintenance release made in April 2019.

3.10.1 Resolved issues

• Package updates: kernel 4.19.32, open-vm-tools 10.3, latest Intel NIC drivers
• T1326 The kernel now includes drivers for various USB serial adapters, which allows people to add a serial
console to a machine without onboard RS232, or connect to something else from the router
• The collection of network card firmware is now much more extensive
• T1271 VRRP now correctly uses a virtual rather than physical MAC addresses in the RFC-compliant mode
• T1330 DHCP WPAD URL option works correctly again
• T1312 Many to many NAT rules now can use source/destination and translation networks of non-matching size.
If 1:1 network bits translation is desired, it’s now users responsibility to check if prefix length matches.
• T1290 IPv6 network prefix translation is fixed
• T1308 Non-alphanumeric characters such as > can now be safely used in PPPoE passwords

3.10. 1.2.1 288

 VyOS Documentation, Release 1.5.x (circinus)

• T1305 show | commands no longer fails when a config section ends with a leaf node such as timezone in show
system | commands
• T1235 show | commands correctly works in config mode now
• T1298 VTI is now compatible with the DHCP-interface IPsec option
• T1277 show dhcp server statistics command was broken in latest Crux
• T1261 An issue with TFTP server refusing to listen on addresses other than loopback was fixed
• T1224 Template issue that might cause UDP broadcast relay fail to start is fixed
• T1067 VXLAN value validation is improved
• T1211 Blank hostnames in DHCP updates no longer can crash DNS forwarding
• T1322 Correct configuration is now generated for DHCPv6 relays with more than one upstream interface
• T1234 relay-agents-packets option works correctly now
• T1231 Dynamic DNS data is now cleaned on configuration change
• T1282 Remote Syslog can now use a fully qualified domain name
• T1279 ACPI power off works again
• T1247 Negation in WAN load balancing rules works again
• T1218 FRR staticd now starts on boot correctly
• T1296 The installer now correctly detects SD card devices
• T1225 Wireguard peers can be disabled now
• T1217 The issue with Wireguard interfaces impossible to delete is fixed
• T1160 Unintended IPv6 access is fixed in SNMP configuration
• T1060 It’s now possible to exclude hosts from the transparent web proxy
• T484 An issue with rules impossible to delete from the zone-based firewall is fixed

3.10. 1.2.1 289

 CHAPTER

FOUR

INSTALLATION AND IMAGE MANAGEMENT

4.1 Installation

VyOS installation requires a downloaded VyOS .iso file. That file is a live install image that lets you boot a live VyOS.
From the live system, you can proceed to a permanent installation on a hard drive or any other type of storage.

290
 VyOS Documentation, Release 1.5.x (circinus)

Table 1: Comparison of VyOS image releases

Re- Description Re- Intended Use Access to Im- Ac-
lease lease ages cess
Type Cycle to
Source
Nightly Automatically built from the current Every Developing VyOS, testing Everyone Ev-
(Cur- branch. Always up to date with cut- night new features, experiment- ery-
rent) ting edge development but guaran- ing. one
teed to contain bugs.
Nightly Automatically built from the devel- Every Developing and testing the Everyone Ev-
(Beta) opment branch and released along- night latest major version under ery-
side snapshots. Most likely contains development. one
bugs.
Snap- A particularly stable release frozen Every Home labs and simple net- Everyone Ev-
shot from nightly each month after man- month works that call for new fea- ery-
ual testing. Still contains experimen- until tures. one
tal code. RC
comes
out
Re- Rather stable. All development fo- Irreg- Labs, small offices and Everyone Ev-
lease cuses on testing and hunting down ularly non-critical production ery-
Can- remaining bugs following the feature until systems backed by a high- one
di- freeze. EPA availability setup.
date comes
out
Early Highly stable with no known bugs. Irreg- Non-critical production en- Everyone Ev-
Pro- Needs to be tested repeatedly under ularly vironments, preparing for ery-
duc- different conditions before it can be- until the LTS release. one
tion come the final release. LTS
Ac- comes
cess out
Long- Guaranteed to be stable and carefully Every Large-scale enterprise Subscribers, Ev-
Term maintained for several years after the major networks, internet service contributors, ery-
Sup- release. No features are introduced version providers, critical produc- non-profits, emer- one
port but security updates are released in tion environments that call gency services,
a timely manner. for minimum downtime. academic institu-
tions

4.1.1 Hardware requirements

The minimum system requirements are 1024 MiB RAM and 2 GiB storage. Depending on your use, you might need
additional RAM and CPU resources e.g. when having multiple BGP full tables in your system.

4.1. Installation 291

 VyOS Documentation, Release 1.5.x (circinus)

4.1.2 Download

Registered Subscribers

Registered subscribers can log into https://support.vyos.io/ to access a variety of different downloads via the “Down-
loads” link. These downloads include LTS (Long-Term Support), the associated hot-fix releases, early public access
releases, pre-built VM images, as well as device specific installation ISOs.

Building from source

Non-subscribers can always get the LTS release by building it from source. Instructions can be found in the Build VyOS
section of this manual. VyOS source code repository is available for everyone at https://github.com/vyos/vyos-build.

Rolling Release

Everyone can download bleeding-edge VyOS rolling images from: https://downloads.vyos.io/

Note: Rolling releases contain all the latest enhancements and fixes. This means that there will be new bugs of course.
If you think you hit a bug please follow the guide at Bug Report/Issue. We depend on your feedback to improve VyOS!

The following link will always fetch the most recent VyOS build for AMD64 systems from the current branch: https:
//downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso

Download Verification

LTS images are signed by the VyOS lead package-maintainer private key. With the official public key, the authenticity
of the package can be verified. GPG (GNU Privacy Guard) is used for verification.

Note: This subsection only applies to LTS images, for Rolling images please jump to Live installation.

4.1. Installation 292

 VyOS Documentation, Release 1.5.x (circinus)

Preparing for the verification

First, install GPG or another OpenPGP implementation. On most GNU+Linux distributions it is installed by default as
package managers use it to verify package signatures. If not pre-installed, it will need to be downloaded and installed.
The official VyOS public key can be retrieved in a number of ways. Skip to GPG verification if the key is already
present.
It can be retrieved directly from a key server:
gpg --recv-keys FD220285A0FE6D7E
Or it can be accessed via a web browser:
https://pgp.mit.edu/pks/lookup?op=get&search=0xFD220285A0FE6D7E
Or from the following block:

-----BEGIN PGP PUBLIC KEY BLOCK-----

Version: GnuPG v1.4.12 (GNU/Linux)

mQINBFXKsiIBEACyid9PR/v56pSRG8VgQyRwvzoI7rLErZ8BCQA2WFxA6+zNy+6G
+0E/6XAOzE+VHli+wtJpiVJwAh+wWuqzOmv9css2fdJxpMW87pJAS2i3EVVVf6ab
wU848JYLGzc9y7gZrnT1m2fNh4MXkZBNDp780WpOZx8roZq5X+j+Y5hk5KcLiBn/
lh9Zoh8yzrWDSXQsz0BGoAbVnLUEWyo0tcRcHuC0eLx6oNG/IHvd/+kxWB1uULHU
SlB/6vcx56lLqgzywkmhP01050ZDyTqrFRIfrvw6gLQaWlgR3lB93txvF/sz87Il
VblV7e6HEyVUQxedDS8ikOyzdb5r9a6Zt/j8ZPSntFNM6OcKAI7U1nDD3FVOhlVn
7lhUiNc+/qjC+pR9CrZjr/BTWE7Zpi6/kzeH4eAkfjyALj18oC5udJDjXE5daTL3
k9difHf74VkZm29Cy9M3zPckOZpsGiBl8YQsf+RXSBMDVYRKZ1BNNLDofm4ZGijK
mriXcaY+VIeVB26J8m8y0zN4/ZdioJXRcy72c1KusRt8e/TsqtC9UFK05YpzRm5R
/nwxDFYb7EdY/vHUFOmfwXLaRvyZtRJ9LwvRUAqgRbbRZg3ET/tn6JZk8hqx3e1M
IxuskOB19t5vWyAo/TLGIFw44SErrq9jnpqgclTSRgFjcjHEm061r4vjoQARAQAB
tDZWeU9TIE1haW50YWluZXJzIChWeU9TIFJlbGVhc2UpIDxtYWludGFpbmVyc0B2
eW9zLm5ldD6JAjgEEwECACIFAlXKsiICGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4B
AheAAAoJEP0iAoWg/m1+xbgP+QEDYZi5dA4IPY+vU1L95Bavju2m2o35TSUDPg5B
jfAGuhbsNUceU+l/yUlxjpKEmvshyW3GHR5QzUaKGup/ZDBo1CBxZNhpSlFida2E
KAYTx4vHk3MRXcntiAj/hIJwRtzCUp5UQIqHoU8dmHoHOkKEP+zhJuR6E2s+WwDr
nTwE6eRa0g/AHY+chj2Je6flpPm2CKoTfUE7a2yBBU3wPq3rGtsQgVxPAxHRZz7A
w4AjH3NM1Uo3etuiDnGkJAuoKKb1J4X3w2QlbwlR4cODLKhJXHIufwaGtRwEin9S
1l2bL8V3gy2Hv3D2t9TQZuR5NUHsibJRXLSa8WnSCcc6Bij5aqfdpYB+YvKH/rIm
GvYPmLZDfKGkx0JE4/qtfFjiPJ5VE7BxNyliEw/rnQsxWAGPqLlL61SD8w5jGkw3
CinwO3sccTVcPz9b6A1RsbBVhTJJX5lcPn1lkOEVwQ7l8bRhOKCMe0P53qEDcLCd
KcXNnAFbVes9u+kfUQ4oxS0G2JS9ISVNmune+uv+JR7KqSdOuRYlyXA9uTjgWz4y
Cs7RS+CpkJFqrqOtS1rmuDW9Ea4PA8ygGlisM5d/AlVkniHz/2JYtgetiLCj9mfE
MzQpgnldNSPumKqJ3wwmCNisE+lXQ5UXCaoaeqF/qX1ykybQn41LQ+0xT5Uvy7sL
9IwGuQINBFXKsiIBEACg2mP3QYkXdgWTK5JyTGyttE6bDC9uqsK8dc1J66Tjd5Ly
Be0amO+88GHXa0o5Smwk2QNoxsRR41G/D/eAeGsuOEYnePROEr3tcLnDjo4KLgQ+
H69zRPn77sdP3A34Jgp+QIzByJWM7Cnim31quQP3qal2QdpGJcT/jDJWdticN76a
Biaz+HN13LyvZM+DWhUDttbjAJc+TEwF9YzIrU+3AzkTRDWkRh4kNIQxjlpNzvho
9V75riVqg2vtgPwttPEhOLb0oMzy4ADdfezrfVvvMb4M4kY9npu4MlSkNTM97F/I
QKy90JuSUIjE05AO+PDXJF4Fd5dcpmukLV/2nV0WM2LAERpJUuAgkZN6pNUFVISR
+nSfgR7wvqeDY9NigHrJqJbSEgaBUs6RTk5hait2wnNKLJajlu3aQ2/QfRT/kG3h
ClKUz3Ju7NCURmFE6mfsdsVrlIsEjHr/dPbXRswXgC9FLlXpWgAEDYi9Wdxxz8o9
JDWrVYdKRGG+OpLFh8AP6QL3YnZF+p1oxGUQ5ugXauAJ9YS55pbzaUFP8oOO2P1Q
BeYnKRs1GcMI8KWtE/fze9C9gZ7Dqju7ZFEyllM4v3lzjhT8muMSAhw41J22mSx6
VRkQVRIAvPDFES45IbB6EEGhDDg4pD2az8Q7i7Uc6/olEmpVONSOZEEPsQe/2wAR
(continues on next page)

4.1. Installation 293

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

AQABiQIfBBgBAgAJBQJVyrIiAhsMAAoJEP0iAoWg/m1+niUQAKTxwJ9PTAfB+XDk
3qH3n+T49O2wP3fhBI0EGhJp9Xbx29G7qfEeqcQm69/qSq2/0HQOc+w/g8yy71jA
6rPuozCraoN7Im09rQ2NqIhPK/1w5ZvgNVC0NtcMigX9MiSARePKygAHOPHtrhyO
rJQyu8E3cV3VRT4qhqIqXs8Ydc9vL3ZrJbhcHQuSLdZxM1k+DahCJgwWabDCUizm
sVP3epAP19FP8sNtHi0P1LC0kq6/0qJot+4iBiRwXMervCD5ExdOm2ugvSgghdYN
BikFHvmsCxbZAQjykQ6TMn+vkmcEz4fGAn4L7Nx4paKEtXaAFO8TJmFjOlGUthEm
CtHDKjCTh9WV4pwG2WnXuACjnJcs6LcK377EjWU25H4y1ff+NDIUg/DWfSS85iIc
UgkOlQO6HJy0O96L5uxn7VJpXNYFa20lpfTVZv7uu3BC3RW/FyOYsGtSiUKYq6cb
CMxGTfFxGeynwIlPRlH68BqH6ctR/mVdo+5UIWsChSnNd1GreIEI6p2nBk3mc7jZ
7pTEHpjarwOjs/S/lK+vLW53CSFimmW4lw3MwqiyAkxl0tHAT7QMHH9Rgw2HF/g6
XD76fpFdMT856dsuf+j2uuJFlFe5B1fERBzeU18MxML0VpDmGFEaxxypfACeI/iu
8vzPzaWHhkOkU8/J/Ci7+vNtUOZb
=Ld8S
-----END PGP PUBLIC KEY BLOCK-----

Store the key in a new text file and import it into GPG via: gpg --import file_with_the_public_key
The import can be verified with:

$ gpg --list-keys
...
pub rsa4096 2015-08-12 [SC]
0694A9230F5139BF834BA458FD220285A0FE6D7E
uid [ unknown] VyOS Maintainers (VyOS Release) <[email protected]>
sub rsa4096 2015-08-12 [E]

GPG verification

With the public key imported, the signature for the desired image needs to be downloaded.

Note: The signature can be downloaded by appending .asc to the URL of the downloaded VyOS image. That small
.asc file is the signature for the associated image.

Finally, verify the authenticity of the downloaded image:

$ gpg2 --verify vyos-1.2.1-amd64.iso.asc vyos-1.2.1-amd64.iso

gpg: Signature made So 14 Apr 12:58:07 2019 CEST
gpg: using RSA key FD220285A0FE6D7E
gpg: Good signature from "VyOS Maintainers (VyOS Release) <[email protected]>"␣
˓→[unknown]

Primary key fingerprint: 0694 A923 0F51 39BF 834B A458 FD22 0285 A0FE 6D7E

4.1. Installation 294

 VyOS Documentation, Release 1.5.x (circinus)

Minisign verification

Currently we are using GPG for release signing (pretty much like everyone else).
Popularity of GPG for release signing comes from the fact that many people already had it installed for email encryp-
tion/signing. Inside a VyOS image, signature checking is the only reason to have it installed. However, it still comes
with all the features no one needs, such as support for multiple outdated cipher suits and ability to embed a photo in
the key file. More importantly, web of trust, the basic premise of PGP, is never used in release signing context. Once
you have a knowingly authentic image, authenticity of upgrades is checked using a key that comes in the image, and to
get their first image people never rely on keyservers either.
Another point is that we are using RSA now, which requires absurdly large keys to be secure.
In 2015, OpenBSD introduced signify. An alternative implementation of the same protocol is minisign, which is also
available for Windows and macOS, and in most GNU/Linux distros it’s in the repositories now.
Its installed size (complete with libsodium) is less than that of GPG binary alone (not including libgcrypt and some
other libs, which I think we only use for GPG). Since it uses elliptic curves, it gets away with much smaller keys, and
it doesn’t include as much metadata to begin with.
Another issue of GPG is that it creates a /root/.gnupg directory just for release checking. The dir is small so the fact
that it’s never used again is an aesthetic problem, but we’ve had that process fail in the past. But, small key size of the
Ed25519 algorithm allows passing public keys in command line arguments, so verification process can be completely
stateless:
T2108 switched the validation system to prefer minisign over GPG keys.
To verify a VyOS image starting off with VyOS 1.3.0-rc6 you can run:

$ minisign -V -P RWTR1ty93Oyontk6caB9WqmiQC4fgeyd/ejgRxCRGd2MQej7nqebHneP -m vyos-1.3.0-

˓→rc6-amd64.iso vyos-1.3.0-rc6-amd64.iso.minisig

Signature and comment signature verified

Trusted comment: timestamp:1629997936 file:vyos-1.3.0-rc6-amd64.iso

During an image upgrade VyOS performas the following command:

$ minisign -V -p /usr/share/vyos/keys/vyos-release.minisign.pub -m vyos-1.3.0-rc6-amd64.

˓→iso vyos-1.3.0-rc6-amd64.iso.minisig

Signature and comment signature verified

Trusted comment: timestamp:1629997936 file:vyos-1.3.0-rc6-amd64.iso

4.1.3 Live installation

Note: A permanent VyOS installation always requires to go first through a live installation.

VyOS, as other GNU+Linux distributions, can be tested without installing it in your hard drive. With your downloaded
VyOS .iso file you can create a bootable USB drive that will let you boot into a fully functional VyOS system.
Once you have tested it, you can either decide to begin a Permanent installation in your hard drive or power your system
off, remove the USB drive, and leave everything as it was.
If you have a GNU+Linux system, you can create your VyOS bootable USB stick with with the dd command:
1. Open your terminal emulator.
2. Find out the device name of your USB drive (you can use the lsblk command)

4.1. Installation 295

 VyOS Documentation, Release 1.5.x (circinus)

3. Unmount the USB drive. Replace X in the example below with the letter of your device and keep the
asterisk (wildcard) to unmount all partitions.

$ umount /dev/sdX*

4. Write the image (your VyOS .iso file) to the USB drive. Note that here you want to use the device
name (e.g. /dev/sdb), not the partition name (e.g. /dev/sdb1).
Warning: This will destroy all data on the USB drive!

# dd if=/path/to/vyos.iso of=/dev/sdX bs=8M; sync

5. Wait until you get the outcome (bytes copied). Be patient, in some computers it might take more than
one minute.
6. Once dd has finished, pull the USB drive out and plug it into the powered-off computer where you
want to install (or test) VyOS.
7. Power the computer on, making sure it boots from the USB drive (you might need to select booting
device or change booting settings).
8. Once VyOS is completely loaded, enter the default credentials (login: vyos, password: vyos).
If you find difficulties with this method, prefer to use a GUI program, or have a different operating system, there are
other programs you can use to create a bootable USB drive, like balenaEtcher (for GNU/Linux, macOS and Windows),
Rufus (for Windows) and many others. You can follow their instructions to create a bootable USB drive from an .iso
file.

Hint: The default username and password for the live system is vyos.

4.1.4 Permanent installation

Note: Before a permanent installation, VyOS requires a Live installation.

Unlike general purpose Linux distributions, VyOS uses “image installation” that mimics the user experience of tradi-
tional hardware routers and allows keeping multiple VyOS versions installed simultaneously. This makes it possible to
switch to a previous version if something breaks or miss-behaves after an image upgrade.
Every version is contained in its own squashfs image that is mounted in a union filesystem together with a directory for
mutable data such as configurations, keys, or custom scripts.

Note: Older versions (prior to VyOS 1.1) used to support non-image installation (install system command).
Support for this has been removed from VyOS 1.2 and newer releases. Older releases can still be upgraded via the
general add system image <image_path> upgrade command (consult Image Management for further information).

In order to proceed with a permanent installation:

1. Log into the VyOS live system (use the default credentials: vyos, vyos)
2. Run the install image command and follow the wizard:

4.1. Installation 296

 VyOS Documentation, Release 1.5.x (circinus)

vyos@vyos:~$ install image

Welcome to the VyOS install program. This script
will walk you through the process of installing the
VyOS image to a local hard drive.
Would you like to continue? (Yes/No) [Yes]: Yes
Probing drives: OK
Looking for pre-existing RAID groups...none found.
The VyOS image will require a minimum 2000MB root.
Would you like me to try to partition a drive automatically
or would you rather partition it manually with parted? If
you have already setup your partitions, you may skip this step

Partition (Auto/Parted/Skip) [Auto]:

I found the following drives on your system:

sda 4294MB

Install the image on? [sda]:

This will destroy all data on /dev/sda.

Continue? (Yes/No) [No]: Yes

How big of a root partition should I create? (2000MB - 4294MB) [4294]MB:

Creating filesystem on /dev/sda1: OK

Done!
Mounting /dev/sda1...
What would you like to name this image? [1.2.0-rolling+201809210337]:
OK. This image will be named: 1.2.0-rolling+201809210337
Copying squashfs image...
Copying kernel and initrd images...
Done!
I found the following configuration files:
/opt/vyatta/etc/config.boot.default
Which one should I copy to sda? [/opt/vyatta/etc/config.boot.default]:

Copying /opt/vyatta/etc/config.boot.default to sda.

Enter password for administrator account
Enter password for user 'vyos':
Retype password for user 'vyos':
I need to install the GRUB boot loader.
I found the following drives on your system:
sda 4294MB

Which drive should GRUB modify the boot partition on? [sda]:

Setting up grub: OK
Done!

3. After the installation is completed, remove the live USB stick or CD.
4. Reboot the system.

4.1. Installation 297

 VyOS Documentation, Release 1.5.x (circinus)

vyos@vyos:~$ reboot
Proceed with reboot? (Yes/No) [No] Yes

You will boot now into a permanent VyOS system.

4.1.5 PXE Boot

VyOS can also be installed through PXE. This is a more complex installation method that allows deploying VyOS
through the network.
Requirements
• Clients (where VyOS is to be installed) with a PXE-enabled NIC
• DHCP Server
• TFTP Server
• Webserver (HTTP) - optional, but we will use it to speed up installation
• VyOS ISO image to be installed (do not use images prior to VyOS 1.2.3)
• Files pxelinux.0 and ldlinux.c32 from the Syslinux distribution

Configuration

Step 1: DHCP

Configure a DHCP server to provide the client with:

• An IP address
• The TFTP server address (DHCP option 66). Sometimes referred as boot server
• The bootfile name (DHCP option 67), which is pxelinux.0
In this example we configured an existent VyOS as the DHCP server:

vyos@vyos# show service dhcp-server

shared-network-name mydhcp {
subnet 192.168.1.0/24 {
option {
bootfile-name pxelinux.0
bootfile-server 192.168.1.50
default-router 192.168.1.50
}
range 0 {
start 192.168.1.70
stop 192.168.1.100
}
subnet-id 1
}
}

4.1. Installation 298

 VyOS Documentation, Release 1.5.x (circinus)

Step 2: TFTP

Configure a TFTP server so that it serves the following:

• The pxelinux.0 file from the Syslinux distribution
• The ldlinux.c32 file from the Syslinux distribution
• The kernel of the VyOS software you want to deploy. That is the vmlinuz file inside the /live directory of the
extracted contents from the ISO file.
• The initial ramdisk of the VyOS ISO you want to deploy. That is the initrd.img file inside the /live directory of
the extracted contents from the ISO file. Do not use an empty (0 bytes) initrd.img file you might find, the correct
file may have a longer name.
• A directory named pxelinux.cfg which must contain the configuration file. We will use the configuration file
shown below, which we named default.
In the example we configured our existent VyOS as the TFTP server too:

vyos@vyos# show service tftp-server

directory /config/tftpboot
listen-address 192.168.1.50

Example of the contents of the TFTP server:

vyos@vyos# ls -hal /config/tftpboot/

total 29M
drwxr-sr-x 3 tftp tftp 4.0K Oct 14 00:23 .
drwxrwsr-x 9 root vyattacfg 4.0K Oct 18 00:05 ..
-r--r--r-- 1 root vyattacfg 25M Oct 13 23:24 initrd.img-4.19.54-amd64-vyos
-rwxr-xr-x 1 root vyattacfg 120K Oct 13 23:44 ldlinux.c32
-rw-r--r-- 1 root vyattacfg 46K Oct 13 23:24 pxelinux.0
drwxr-xr-x 2 root vyattacfg 4.0K Oct 14 01:10 pxelinux.cfg
-r--r--r-- 1 root vyattacfg 3.7M Oct 13 23:24 vmlinuz

vyos@vyos# ls -hal /config/tftpboot/pxelinux.cfg

total 12K
drwxr-xr-x 2 root vyattacfg 4.0K Oct 14 01:10 .
drwxr-sr-x 3 tftp tftp 4.0K Oct 14 00:23 ..
-rw-r--r-- 1 root root 191 Oct 14 01:10 default

Example of simple (no menu) configuration file:

vyos@vyos# cat /config/tftpboot/pxelinux.cfg/default

DEFAULT VyOS123

LABEL VyOS123
KERNEL vmlinuz
APPEND initrd=initrd.img-4.19.54-amd64-vyos boot=live nopersistence noautologin␣
˓→nonetworking fetch=http://address:8000/filesystem.squashfs

4.1. Installation 299

 VyOS Documentation, Release 1.5.x (circinus)

Step 3: HTTP

We also need to provide the filesystem.squashfs file. That is a heavy file and TFTP is slow, so you could send it through
HTTP to speed up the transfer. That is how it is done in our example, you can find that in the configuration file above.
First run a web server - you can use a simple one like Python’s SimpleHTTPServer and start serving the filesys-
tem.squashfs file. The file can be found inside the /live directory of the extracted contents of the ISO file.
Second, edit the configuration file of the Step 2: TFTP so that it shows the correct URL at fetch=http://
<address_of_your_HTTP_server>/filesystem.squashfs.

Note: Do not change the name of the filesystem.squashfs file. If you are working with different versions, you can
create different directories instead.

And third, restart the TFTP service. If you are using VyOS as your TFTP Server, you can restart the service with sudo
service tftpd-hpa restart.

Note: Make sure the available directories and files in both TFTP and HTTP server have the right permissions to be
accessed from the booting clients.

Client Boot

Finally, turn on your PXE-enabled client or clients. They will automatically get an IP address from the DHCP server
and start booting into VyOS live from the files automatically taken from the TFTP and HTTP servers.
Once finished you will be able to proceed with the install image command as in a regular VyOS installation.

4.1.6 Known Issues

This is a list of known issues that can arise during installation.

Black screen on install

GRUB attempts to redirect all output to a serial port for ease of installation on headless hosts. This appears to cause
an hard lockup on some hardware that lacks a serial port, with the result being a black screen after selecting the Live
system option from the installation image.
The workaround is to type e when the boot menu appears and edit the GRUB boot options. Specifically, remove the:
console=ttyS0,115200
option, and type CTRL-X to boot.
Installation can then continue as outlined above.

4.1. Installation 300

 VyOS Documentation, Release 1.5.x (circinus)

4.2 Running VyOS in Virtual Environments

4.2.1 Running on Libvirt Qemu/KVM

Libvirt is an open-source API, daemon and management tool for managing platform virtualization. There are several
ways to deploy VyOS on libvirt kvm. Use Virt-manager and native CLI. In an example we will be use use 4 gigabytes
of memory, 2 cores CPU and default network virbr0.

CLI

Deploy from ISO

Create VM name vyos_r1. You must specify the path to the ISO image, the disk qcow2 will be created automatically.
The default network is the virtual network (type Virtio) created by the hypervisor with NAT.

$ virt-install -n vyos_r1 \
--ram 4096 \
--vcpus 2 \
--cdrom /var/lib/libvirt/images/vyos.iso \
--os-variant debian10 \
--network network=default \
--graphics vnc \
--hvm \
--virt-type kvm \
--disk path=/var/lib/libvirt/images/vyos_r1.qcow2,bus=virtio,size=8 \
--noautoconsole

Connect to VM with command virsh console vyos_r1

$ virsh console vyos_r1

Connected to domain vyos_r1

Escape character is ^]

vyos login: vyos

Password:

vyos@vyos:~$ install image

After installation - exit from the console using the key combination Ctrl + ] and reboot the system.

Deploy from qcow2

The convenience of using KVM (Kernel-based Virtual Machine) images is that they don’t need to be installed. Down-
load predefined VyOS.qcow2 image for KVM

curl --url link_to_vyos_kvm.qcow2 --output /var/lib/libvirt/images/vyos_kvm.qcow2

Create VM with import qcow2 disk option.

4.2. Running VyOS in Virtual Environments 301

 VyOS Documentation, Release 1.5.x (circinus)

$ virt-install -n vyos_r2 \
--ram 4096 \
--vcpus 2 \
--os-variant debian10 \
--network network=default \
--graphics vnc \
--hvm \
--virt-type kvm \
--disk path=/var/lib/libvirt/images/vyos_kvm.qcow2,bus=virtio \
--import \
--noautoconsole

Connect to VM with command virsh console vyos_r2

$ virsh console vyos_r2

Connected to domain vyos_r2

Escape character is ^]

vyos login: vyos

Password:

vyos@vyos:~$

If you can not go to this screen

vyos login: vyos

Password:

Stayed in this stage. This is because the KVM console is chosen as the default boot option.

Connected to domain vyos_r2

Escape character is ^]

Open a secondary/parallel session and use this command to reboot the VM:

$ virsh reboot vyos_r2

Then go to the first session where you opened the console. Select VyOS 1.4.x for QEMU (Serial console) and
press Enter
The system is fully operational.

Virt-manager

The virt-manager application is a desktop user interface for managing virtual machines through libvirt. On the linux
open VMM (Virtual Machine Manager).

4.2. Running VyOS in Virtual Environments 302

 VyOS Documentation, Release 1.5.x (circinus)

Deploy from ISO

1. Open VMM and Create a new VM (Virtual Machine)

2. Choose Local install media (ISO)

3. Choose path to iso vyos.iso. Operating System can be any Debian based.
4. Choose Memory and CPU
5. Disk size
6. Name of VM and network selection
7. Then you will be taken to the console.

4.2. Running VyOS in Virtual Environments 303

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 304

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 305

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 306

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 307

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 308

 VyOS Documentation, Release 1.5.x (circinus)

Deploy from qcow2

Download predefined VyOS.qcow2 image for KVM

curl --url link_to_vyos_kvm.qcow2 --output /var/lib/libvirt/images/vyos_kvm.qcow2

1. Open VMM and Create a new VM

2. Choose Import existing disk image

3. Choose the path to the image vyos_kvm.qcow2 that was previously downloaded . Operation System can be any
Debian based.
4. Choose Memory and CPU
5. Name of VM and network selection
6. Then you will be taken to the console.

4.2. Running VyOS in Virtual Environments 309

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 310

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 311

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 312

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 313

 VyOS Documentation, Release 1.5.x (circinus)

4.2.2 Running on Proxmox

Proxmox is an open-source platform for virtualization. Please visit https://vyos.io to see how to get a qcow2 image that
can be imported into Proxmox.

Deploy VyOS from CLI with qcow2 image

1. Copy the qcow2 image to a temporary directory on the Proxmox server.

2. The commands below assume that virtual machine ID 200 is unused and that the user wants the disk stored in a
storage pool called local-lvm.

$ qm create 200 --name vyos2 --memory 2048 --net0 virtio,bridge=vmbr0

$ qm importdisk 200 /path/to/image/vyos-1.2.8-proxmox-2G.qcow2 local-lvm
$ qm set 200 --virtio0 local-lvm:vm-200-disk-0
$ qm set 200 --boot order=virtio0

3. Optionally, the user can attach a CDROM with an ISO as a cloud-init data source. The below command assumes
the ISO has been uploaded to the local storage pool with the name seed.iso.

$ qm set 200 --ide2 media=cdrom,file=local:iso/seed.iso

4. Start the virtual machine in the proxmox GUI or CLI using qm start 200.

Deploy VyOS from CLI with rolling release ISO

1. Download the rolling release iso from https://vyos.net/get/nightly-builds/. Non-subscribers can always get the
LTS release by building it from source. Instructions can be found in the Build VyOS section of this manual.
VyOS source code repository is available https://github.com/vyos/vyos-build.
2. Prepare VM for installation from ISO media. The commands below assume that your iso is available in a storage
pool ‘local’, that you want it to have a VM ID ‘200’ and want to create a new disk on storage pool ‘local-lvm’ of
size 15GB.

qm create 200 --name vyos --memory 2048 --net0 virtio,bridge=vmbr0 --ide2 media=cdrom,
˓→file=local:iso/live-image-amd64.hybrid.iso --virtio0 local-lvm:15

3. Start the VM using the command qm start 200 or using the start button located in the proxmox GUI.
4. Using the proxmox webGUI, open the virtual console for your newly created vm. Login username/password is
vyos/vyos.
5. Once booted into the live system, type install image into the command line and follow the prompts to install
VyOS to the virtual drive.
6. After installation has completed, remove the installation iso using the GUI or qm set 200 --ide2 none.
7. Reboot the virtual machine using the GUI or qm reboot 200.
Visit https://www.proxmox.com/en/ for more information about the download and installation of this hypervisor.

4.2. Running VyOS in Virtual Environments 314

 VyOS Documentation, Release 1.5.x (circinus)

4.2.3 Running on VMware ESXi

ESXi 5.5 or later

.ova files are available for supporting users, and a VyOS can also be stood up using a generic Linux instance, and
attaching the bootable ISO file and installing from the ISO using the normal process around install image.

Note: There have been previous documented issues with GRE/IPSEC tunneling using the E1000 adapter on the VyOS
guest, and use of the VMXNET3 has been advised.

Memory Contention Considerations

When the underlying ESXi host is approaching ~92% memory utilisation it will start the balloon process in a ‘soft’
state to start reclaiming memory from guest operating systems. This causes an artificial pressure using the vmmemctl
driver on memory usage on the virtual guest. As VyOS by default does not have a swap file, this vmmemctl pressure is
unable to force processes to move in memory data to the paging file, and blindly consumes memory forcing the virtual
guest into a low memory state with no way to escape. The balloon can expand to 65% of guest allocated memory,
so a VyOS guest running >35% of memory usage, can encounter an out of memory situation, and trigger the kernel
oom_kill process. At this point a weighted lottery favouring memory hungry processes will be run with the unlucky
winner being terminated by the kernel.
It is advised that VyOS routers are configured in a resource group with adequate memory reservations so that ballooning
is not inflicted on virtual VyOS guests.

References

https://muralidba.blogspot.com/2018/03/how-does-linux-out-of-memory-oom-killer.html

4.2.4 Running on GNS3

Sometimes you may want to test VyOS in a lab environment. GNS3 is a network emulation software you might use for
it.
This guide will provide the necessary steps for installing and setting up VyOS on GNS3.

Requirements

The following items are required:

• A VyOS installation image (.iso file). You can find how to get it on the Installation page
• A working GNS3 installation. For further information see the GNS3 documentation.

4.2. Running VyOS in Virtual Environments 315

 VyOS Documentation, Release 1.5.x (circinus)

VM setup

First, a virtual machine (VM) for the VyOS installation must be created in GNS3.
Go to the GNS3 File menu, click New template and choose select Manually create a new Template.

Select Quemu VMs and then click on the New button.

Write a name for your VM, for instance “VyOS”, and click Next.
Select qemu-system-x86_64 as Quemu binary, then 512MB of RAM and click Next.
Select telnet as your console type and click Next.
Select New image for the base disk image of your VM and click Create.
Use the defaults in the Binary and format window and click Next.
Use the defaults in the Qcow2 options window and click Next.
Set the disk size to 2000 MiB, and click Finish to end the Quemu image creator.
Click Finish to end the New QEMU VM template wizard.
Now the VM settings have to be edited.
Being again at the Preferences window, having Qemu VMs selected and having our new VM selected, click the Edit
button.
In the General settings tab of your QEMU VM template configuration, do the following:
• Click on the Browse... button to choose the Symbol you want to have representing your VM.
• In Category select in which group you want to find your VM.
• Set the Boot priority to CD/DVD-ROM.
At the HDD tab, change the Disk interface to sata to speed up the boot process.
At the CD/DVD tab click on Browse... and locate the VyOS image you want to install.

4.2. Running VyOS in Virtual Environments 316

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 317

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 318

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 319

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 320

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 321

 VyOS Documentation, Release 1.5.x (circinus)

Note: You probably will want to accept to copy the .iso file to your default image directory when you are asked.

In the Network tab, set 0 as the number of adapters, set the Name format to eth{0} and the Type to Paravirtualized
Network I/O (virtio-net-pci).
In the Advanced tab, unmark the checkbox Use as a linked base VM and click OK, which will save and close the
QEMU VM template configuration window.
At the general Preferences window, click OK to save and close.

VyOS installation

• Create a new project.

• Drag the newly created VyOS VM into it.
• Start the VM.
• Open a console. The console should show the system booting. It will ask for the login credentials, you are at the
VyOS live system.
• Install VyOS as normal (that is, using the install image command).
• After a successful installation, shutdown the VM with the poweroff command.
• Delete the VM from the GNS3 project.
The VyOS-hda.qcow2 file now contains a working VyOS image and can be used as a template. But it still needs some
fixes before we can deploy VyOS in our labs.

4.2. Running VyOS in Virtual Environments 322

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 323

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 324

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 325

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 326

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 327

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 328

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 329

 VyOS Documentation, Release 1.5.x (circinus)

VyOS VM configuration

To turn the template into a working VyOS machine, further steps are necessary as outlined below:
General settings tab: Set the boot priority to HDD

CD/DVD tab: Unmount the installation image file by clearing the Image entry field.
Set the number of required network adapters, for example 4.
Advanced settings tab: Mark the checkbox Use as a linked base VM and click OK to save the changes.
The VyOS VM is now ready to be deployed.

4.2. Running VyOS in Virtual Environments 330

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 331

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 332

 VyOS Documentation, Release 1.5.x (circinus)

4.2. Running VyOS in Virtual Environments 333

 VyOS Documentation, Release 1.5.x (circinus)

4.2.5 EVE-NG

References

https://www.eve-ng.net/

4.2.6 Running in Docker Container

Docker is an open-source project for deploying applications as standardized units called containers. Deploying VyOS
in a container provides a simple and lightweight mechanism for both testing and packet routing for container workloads.

IPv6 Support for docker

VyOS requires an IPv6-enabled docker network. Currently linux distributions do not enable docker IPv6 support by
default. You can enable IPv6 support in two ways.

Method 1: Create a docker network with IPv6 support

Here is a example using the macvlan driver.

docker network create --ipv6 -d macvlan -o parent=eth0 --subnet 2001:db8::/64 --subnet␣

˓→192.0.2.0/24 mynet

Method 2: Add IPv6 support to the docker daemon

Edit /etc/docker/daemon.json to set the ipv6 key to true and to specify the fixed-cidr-v6 to your desired IPv6
subnet.

{
"ipv6": true,
"fixed-cidr-v6": "2001:db8::/64"
}

Reload the docker configuration.

$ sudo systemctl reload docker

Deploy container from ISO

Download the ISO on which you want to base the container. In this example, the name of the ISO is vyos-1.
4-rolling-202308240020-amd64.iso. If you created a custom IPv6-enabled network, the docker run command
below will require that this network be included as the --net parameter to docker run.

$ mkdir vyos && cd vyos

$ curl -o vyos-1.4-rolling-202308240020-amd64.iso https://github.com/vyos/vyos-rolling-
˓→nightly-builds/releases/download/1.4-rolling-202308240020/vyos-1.4-rolling-

˓→202308240020-amd64.iso

$ mkdir rootfs
(continues on next page)

4.2. Running VyOS in Virtual Environments 334

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

$ sudo mount -o loop vyos-1.4-rolling-202308240020-amd64.iso rootfs
$ sudo apt-get install -y squashfs-tools
$ mkdir unsquashfs
$ sudo unsquashfs -f -d unsquashfs/ rootfs/live/filesystem.squashfs
$ sudo tar -C unsquashfs -c . | docker import - vyos:1.4-rolling-202111281249
$ sudo umount rootfs
$ cd ..
$ sudo rm -rf vyos
$ docker run -d --rm --name vyos --privileged -v /lib/modules:/lib/modules \
> vyos:1.4-rolling-202111281249 /sbin/init
$ docker exec -ti vyos su - vyos

You can execute docker stop vyos when you are finished with the container.

4.3 Running VyOS in Cloud Environments

4.3.1 Amazon AWS

Deploy VM

Deploy VyOS on Amazon AWS (Amazon Web Services)

1. Click to Instances and Launch Instance

2. On the marketplace search “VyOS”

4.3. Running VyOS in Cloud Environments 335

 VyOS Documentation, Release 1.5.x (circinus)

3. Choose the instance type. Minimum recommendation start from m3.medium

4. Configure instance for your requirements. Select number of instances / network / subnet

5. Additional storage. You can remove additional storage /dev/sdb. First root device will be /dev/xvda. You
can skip this step.
6. Configure Security Group. It’s recommended that you configure ssh access only from certain address sources.
Or permit any (by default).
7. Select SSH key pair and click Launch Instances
8. Find out your public IP address.
9. Connect to the instance by SSH key.

ssh -i ~/.ssh/amazon.pem [email protected]

vyos@ip-192-0-2-10:~$

4.3. Running VyOS in Cloud Environments 336

 VyOS Documentation, Release 1.5.x (circinus)

4.3. Running VyOS in Cloud Environments 337

 VyOS Documentation, Release 1.5.x (circinus)

4.3. Running VyOS in Cloud Environments 338

 VyOS Documentation, Release 1.5.x (circinus)

Amazon CloudWatch Agent Usage

To use Amazon CloudWatch Agent, configure it within the Amazon SSM Parameter Store. If you don’t have a config-
uration yet, do CloudWatch SSM Configuration creation.
1. Create an IAM (Identity and Access Management) role for the EC2 (Elastic Compute Cloud) instance to access
CloudWatch service, and name it CloudWatchAgentServerRole. The role should contain two default policies:
CloudWatchAgentServerPolicy and AmazonSSMManagedInstanceCore.
2. Attach the created role to your VyOS EC2 instance.
3. Ensure that amazon-cloudwatch-agent package is installed.

$ sudo apt list --installed | grep amazon-cloudwatch-agent

Note: The amazon-cloudwatch-agent package is normally included in VyOS 1.3.3+ and 1.4+

3. Retrieve an existing CloudWatch Agent configuration from the SSM (Systems Manager) Parameter Store.

$ sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a␣

˓→fetch-config -m ec2 -s -c ssm:<your-configuration-name>

This step also enables systemd service and runs it.

Note: The VyOS platform-specific scripts feature is under development. Thus, this step should be re-
peated manually after changing system image (Update VyOS)

CloudWatch SSM Configuration creation

Creating the Amazon Cloudwatch Agent Configuration in Amazon SSM Parameter Store.
1. Create an IAM role for your EC2 instance to access the CloudWatch service. Name it CloudWatchAgentAdmin-
Role. The role should contain at two default policies: CloudWatchAgentAdminPolicy and AmazonSSMMan-
agedInstanceCore.

Note: CloudWatchAgentServerRole is too permissive and should be used for single configuration cre-
ation and deployment. That’s why after completion of step #3 highly recommended to replace instance
CloudWatchAgentAdminRole role with CloudWatchAgentServerRole.

2. Run Cloudwatch configuration wizard.

$ sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-config-
˓→wizard

3. When prompted, answer “yes” to the question “Do you want to store the config in the SSM parameter store?”.

4.3. Running VyOS in Cloud Environments 339

 VyOS Documentation, Release 1.5.x (circinus)

References

• https://console.aws.amazon.com/
• https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/create-iam-roles-for-cloudwatch-agent.
html
• https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/install-CloudWatch-Agent-on-EC2-Instance-fleet.
html

4.3.2 Azure

Deploy VM

Deploy VyOS on Azure.

1. Go to the Azure services and Click to Add new Virtual machine
2. Choose vm name, resource group, region and click Browse all public and private images

3. On the marketplace search VyOS and choose the appropriate subscription

4.3. Running VyOS in Cloud Environments 340

 VyOS Documentation, Release 1.5.x (circinus)

4. Generate new SSH key pair or use existing.

5. Define network, subnet, Public IP. Or it will be created by default.

6. Click Review + create. After a few seconds your deployment will be complete
7. Click to your new vm and find out your Public IP address.
8. Connect to the instance by SSH key.

ssh -i ~/.ssh/vyos_azure [email protected]

vyos@vyos-doc-r1:~$

Add interface

If instance was deployed with one eth0 WAN interface and want to add new one. To add new interface an example eth1
LAN you need shutdown the instance. Attach the interface in the Azure portal and then start the instance.

Note: Azure does not allow you attach interface when the instance in the Running state.

4.3. Running VyOS in Cloud Environments 341

 VyOS Documentation, Release 1.5.x (circinus)

4.3. Running VyOS in Cloud Environments 342

 VyOS Documentation, Release 1.5.x (circinus)

4.3. Running VyOS in Cloud Environments 343

 VyOS Documentation, Release 1.5.x (circinus)

Absorbing Routes

If using as a router, you will want your LAN interface to absorb some or all of the traffic from your VNET by using a
route table applied to the subnet.
1. Create a route table and browse to Configuration
2. Add one or more routes for networks you want to pass through the VyOS VM. Next hop type Virtual Appliance
with the Next Hop Address of the VyOS LAN interface.

Note: If you want to create a new default route for VMs on the subnet, use Address Prefix 0.0.0.0/0 Also note that
if you want to use this as a typical edge device, you’ll want masquerade NAT for the WAN interface.

Serial Console

Azure has a way to access the serial console of a VM, but this needs to be configured on the VyOS. It’s there by default,
but keep it in mind if you are replacing config.boot and rebooting: set system console device ttyS0 speed
'9600'

References

https://azure.microsoft.com

4.3.3 Google Cloud Platform

Deploy VM

To deploy VyOS on GCP (Google Cloud Platform)

1. Generate SSH key pair type ssh-rsa from the host that will connect to VyOS.
Example:

ssh-keygen -t rsa -f ~/.ssh/vyos_gcp -C "vyos@mypc"

Note: In name “vyos@mypc” The first value must be “vyos”. Because default user is vyos and google api uses this
option.

2. Open GCP console and navigate to the menu Metadata. Choose SSH Keys and click edit.

Click Add item and paste your public ssh key. Click Save.

4.3. Running VyOS in Cloud Environments 344

 VyOS Documentation, Release 1.5.x (circinus)

2. On marketplace search “VyOS”

3. Change Deployment name/Zone/Machine type and click Deploy

4. After few seconds click to instance

5. Find out your external IP address
6. Connect to the instance. SSH key was generated in the first step.

ssh -i ~/.ssh/vyos_gcp [email protected]

vyos@vyos-r1-vm:~$

4.3. Running VyOS in Cloud Environments 345

 VyOS Documentation, Release 1.5.x (circinus)

References

https://console.cloud.google.com/

4.3.4 Oracle

References

https://www.oracle.com/cloud/

4.4 Running on Bare Metal

4.4.1 Supermicro A2SDi (Atom C3000)

I opted to get one of the new Intel Atom C3000 CPUs to spawn VyOS on it. Running VyOS on an UEFI only device
is supported as of VyOS release 1.2.

4.4. Running on Bare Metal 346

 VyOS Documentation, Release 1.5.x (circinus)

Shopping Cart

• 1x Supermicro CSE-505-203B (19” 1U chassis, inkl. 200W PSU)

• 1x Supermicro MCP-260-00085-0B (I/O Shield for A2SDi-2C-HLN4F)
• 1x Supermicro A2SDi-2C-HLN4F (Intel Atom C3338, 2C/2T, 4MB cache, Quad LAN with Intel C3000 SoC
1GbE)
• 1x Crucial CT4G4DFS824A (4GB DDR4 RAM 2400 MT/s, PC4-19200)
• 1x SanDisk Ultra Fit 32GB (USB-A 3.0 SDCZ43-032G-G46 mass storage for OS)
• 1x Supermicro MCP-320-81302-0B (optional FAN tray)

Optional (10GE)

If you want to get additional ethernet ports or even 10GE connectivity the following optional parts will be required:
• 1x Supermicro RSC-RR1U-E8 (Riser Card)
• 1x Supermicro MCP-120-00063-0N (Riser Card Bracket)
Latest VyOS rolling releases boot without any problem on this board. You also receive a nice IPMI interface realized
with an ASPEED AST2400 BMC (no information about OpenBMC so far on this motherboard).

Pictures

4.4. Running on Bare Metal 347

 VyOS Documentation, Release 1.5.x (circinus)

4.4. Running on Bare Metal 348

 VyOS Documentation, Release 1.5.x (circinus)

4.4. Running on Bare Metal 349

 VyOS Documentation, Release 1.5.x (circinus)

4.4. Running on Bare Metal 350

 VyOS Documentation, Release 1.5.x (circinus)

4.4. Running on Bare Metal 351

 VyOS Documentation, Release 1.5.x (circinus)

4.4. Running on Bare Metal 352

 VyOS Documentation, Release 1.5.x (circinus)

4.4.2 PC Engines APU4

As this platform seems to be quite common in terms of noise, cost, power and performance it makes sense to write a
small installation manual.
This guide was developed using an APU4C4 board with the following specs:
• AMD Embedded G series GX-412TC, 1 GHz quad Jaguar core with 64 bit and AES-NI support, 32K data +
32K instruction cache per core, shared 2MB L2 cache.
• 4 GB DDR3-1333 DRAM, with optional ECC support
• About 6 to 10W of 12V DC power depending on CPU load
• 2 miniPCI express (one with SIM socket for 3G modem).
• 4 Gigabit Ethernet channels using Intel i211AT NICs
The board can be powered via 12V from the front or via a 5V onboard connector.

Shopping Cart

• 1x apu4c4 = 4 i211AT LAN / AMD GX-412TC CPU / 4 GB DRAM / dual SIM

• 1x Kingston SUV500MS/120G
• 1x VARIA Group Item 326745 19” dual rack for APU4
The 19” enclosure can accommodate up to two APU4 boards - there is a single and dual front cover.

Extension Modules

WiFi

Refer to WLAN/WIFI - Wireless LAN for additional information, below listed modules have been tested successfully
on this Hardware platform:
• Compex WLE900VX mini-PCIe WiFi module, only supported in mPCIe slot 1.
• Intel Corporation AX200 mini-PCIe WiFi module, only supported in mPCIe slot 1. (see Intel AX200)

WWAN

Refer to WWAN - Wireless Wide-Area-Network for additional information, below listed modules have been tested suc-
cessfully on this Hardware platform using VyOS 1.3 (equuleus):
• Sierra Wireless AirPrime MC7304 miniPCIe card (LTE)
• Sierra Wireless AirPrime MC7430 miniPCIe card (LTE)
• Sierra Wireless AirPrime MC7455 miniPCIe card (LTE)
• Sierra Wireless AirPrime MC7710 miniPCIe card (LTE)
• Huawei ME909u-521 miniPCIe card (LTE)

4.4. Running on Bare Metal 353

 VyOS Documentation, Release 1.5.x (circinus)

VyOS 1.2 (crux)

Depending on the VyOS versions you intend to install there is a difference in the serial port settings (T1327).
Create a bootable USB pendrive using e.g. Rufus on a Windows machine.
Connect serial port to a PC through null modem cable (RXD / TXD crossed over). Set terminal emulator to 115200
8N1.

PC Engines apu4
coreboot build 20171130
BIOS version v4.6.4
4080 MB ECC DRAM
SeaBIOS (version rel-1.11.0.1-0-g90da88d)

Press F10 key now for boot menu:

Select boot device:

1. ata0-0: KINGSTON SUV500MS120G ATA-11 Hard-Disk (111 GiBytes)

2. USB MSC Drive Generic Flash Disk 8.07
3. Payload [memtest]
4. Payload [setup]

Now boot from the USB MSC Drive Generic Flash Disk 8.07 media by pressing 2, the VyOS boot menu will
appear, just wait 10 seconds or press Enter to continue.

lqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqk
x VyOS - Boot Menu x
tqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqu
x Live (amd64-vyos) x
x Live (amd64-vyos failsafe) x
x x
mqqqqqqPress ENAutomatic boot in 10 seconds...nu entryqqqqqqqj

The image will be loaded and the last lines you will get will be:

Loading /live/vmlinuz... ok
Loading /live/initrd.img...

The Kernel will now spin up using a different console setting. Set terminal emulator to 9600 8N1 and after a while
your console will show:

Loading /live/vmlinuz... ok
Loading /live/initrd.img...
Welcome to VyOS - vyos ttyS0

vyos login:

You can now proceed with a regular image installation as described in Installation.
As the APU board itself still used a serial setting of 115200 8N1 it is strongly recommended that you change the VyOS
serial interface settings after your first successful boot.
Use the following command to adjust the Serial Console settings:

4.4. Running on Bare Metal 354

 VyOS Documentation, Release 1.5.x (circinus)

set system console device ttyS0 speed 115200

Note: Once you commit the above changes access to the serial interface is lost until you set your terminal emulator to
115200 8N1 again.

vyos@vyos# show system console

device ttyS0 {
speed 115200
}

VyOS 1.2 (rolling)

Installing the rolling release on an APU2 board does not require any change on the serial console from your host side
as T1327 was successfully implemented.
Simply proceed with a regular image installation as described in Installation.

Pictures

Note: Both device types operate without any moving parts and emit zero noise.

Rack Mount

4.4. Running on Bare Metal 355

 VyOS Documentation, Release 1.5.x (circinus)

4.4. Running on Bare Metal 356

 VyOS Documentation, Release 1.5.x (circinus)

4.4. Running on Bare Metal 357

 VyOS Documentation, Release 1.5.x (circinus)

4.4. Running on Bare Metal 358

 VyOS Documentation, Release 1.5.x (circinus)

VyOS custom print

Desktop / Bench Top

4.4.3 Qotom Q355G4

The install on this Q355G4 box is pretty much plug and play. The port numbering the OS does might differ from the
labels on the outside, but the UEFI firmware has a port blink test built in with MAC addresses so you can very quickly
identify which is which. MAC labels are on the inside as well, and this test can be done from VyOS or plain Linux too.
Default settings in the UEFI will make it boot, but depending on your installation wishes (i.e. storage type, boot type,
console type) you might want to adjust them. This Qotom company seems to be the real OEM/ODM for many other
relabelling companies like Protectli.

4.4. Running on Bare Metal 359

 VyOS Documentation, Release 1.5.x (circinus)

4.4. Running on Bare Metal 360

 VyOS Documentation, Release 1.5.x (circinus)

Hardware

There are a number of other options, but they all seem to be close to Intel reference designs, with added features like
more serial ports, more network interfaces and the likes. Because they don’t deviate too much from standard designs
all the hardware is well-supported by mainline. It accepts one LPDDR3 SO-DIMM, but chances are that if you need
more than that, you’ll also want something even beefier than an i5. There are options for antenna holes, and SIM slots,
so you could in theory add an LTE/Cell modem (not tested so far).
The chassis is a U-shaped alu extrusion with removable I/O plates and removable bottom plate. Cooling is completely
passive with a heatsink on the SoC with internal and external fins, a flat interface surface, thermal pad on top of that,
which then directly attaches to the chassis, which has fins as well. It comes with mounting hardware and rubber feet,
so you could place it like a desktop model or mount it on a VESA mount, or even wall mount it with the provided
mounting plate. The closing plate doubles as internal 2.5” mounting place for an HDD or SSD, and comes supplied
with a small SATA cable and SATA power cable.
Power supply is a 12VDC barrel jack, and included switching power supply, which is why SATA power regulation is
on-board. Internally it has a NUC-board-style on-board 12V input header as well, the molex locking style.
There are WDT options and auto-boot on power enable, which is great for remote setups. Firmware is reasonably
secure (no backdoors found, BootGuard is enabled in enforcement mode, which is good but also means no coreboot
option), yet has most options available to configure (so it’s not locked out like most firmwares are).
An external RS232 serial port is available, internally a GPIO header as well. It does have Realtek based audio on board
for some reason, but you can disable that. Booting works on both USB2 and USB3 ports. Switching between serial
BIOS mode and HDMI BIOS mode depends on what is connected at startup; it goes into serial mode if you disconnect
HDMI and plug in serial, in all other cases it’s HDMI mode.

4.4. Running on Bare Metal 361

 VyOS Documentation, Release 1.5.x (circinus)

4.4.4 Partaker i5

I believe this is actually the same hardware as the Protectli. I purchased it in June 2018. It came pre-loaded with
pfSense.
Manufacturer product page.

Installation

• Write VyOS ISO to USB drive of some sort

• Plug in VGA, power, USB keyboard, and USB drive
• Press “SW” button on the front (this is the power button; I don’t know what “SW” is supposed to mean).
• Begin rapidly pressing delete on the keyboard. The boot prompt is very quick, but with a few tries you should
be able to get into the BIOS.
• Chipset > South Bridge > USB Configuration: set XHCI to Disabled and USB 2.0 (EHCI) to Enabled. Without
doing this, the USB drive won’t boot.
• Boot to the VyOS installer and install as usual.
Warning the interface labels on my device are backwards; the left-most “LAN4” port is eth0 and the right-most “LAN1”
port is eth3.

4.4.5 Acrosser AND-J190N1

This microbox network appliance was build to create OpenVPN bridges. It can saturate a 100Mbps link. It is a small
(serial console only) PC with 6 Gb LAN
You may have to add your own RAM and HDD/SSD. There is no VGA connector. But Acrosser provides a DB25
adapter for the VGA header on the motherboard (not used).

4.4. Running on Bare Metal 362

 VyOS Documentation, Release 1.5.x (circinus)

BIOS Settings:

First thing you want to do is getting a more user friendly console to configure BIOS. Default VT100 brings a lot of
issues. Configure VT100+ instead.
For practical issues change speed from 115200 to 9600. 9600 is the default speed at which both linux kernel and VyOS
will reconfigure the serial port when loading.
Connect to serial (115200bps). Power on the appliance and press Del in the console when requested to enter BIOS
settings.
Advanced > Serial Port Console Redirection > Console Redirection Settings:
• Terminal Type : VT100+
• Bits per second : 9600
Save, reboot and change serial speed to 9600 on your client.
Some options have to be changed for VyOS to boot correctly. With XHCI enabled the installer can’t access the USB
key. Enable EHCI instead.
Reboot into BIOS, Chipset > South Bridge > USB Configuration:
• Disable XHCI
• Enable USB 2.0 (EHCI) Support

4.4. Running on Bare Metal 363

 VyOS Documentation, Release 1.5.x (circinus)

Install VyOS:

Create a VyOS bootable USB key. I used the 64-bit ISO (VyOS 1.1.7) and LinuxLive USB Creator.
I’m not sure if it helps the process but I changed default option to live-serial (line “default xxxx”) on the USB key under
syslinux/syslinux.cfg.
I connected the key to one black USB port on the back and powered on. The first VyOS screen has some readability
issues. Press Enter to continue.
Then VyOS should boot and you can perform the install image

4.5 Update VyOS

New system images can be added using the add system image command. The command will extract the chosen
image and will prompt you to use the current system configuration and SSH security keys, allowing for the new image
to boot using the current configuration.

Note: Only LTS releases are PGP-signed.

add system image <url | path> | [latest] [vrf name] [username user [password pass]]
Use this command to install a new system image. You can reach the image from the web (http://, https://)
or from your local system, e.g. /tmp/vyos-1.2.3-amd64.iso.
The add system image command also supports installing new versions of VyOS through an optional given VRF.
Also if URL in question requires authentication, you can specify an optional username and password via the
commandline which will be passed as “Basic-Auth” to the server.
If there is not enough free disk space available, the installation will be canceled. To delete images use the delete
system image command.
VyOS configuration is associated to each image, and each image has a unique copy of its configuration. This is
different than a traditional network router where the configuration is shared across all images.

Note: If you have any personal files, like some scripts you created, and you don’t want them to be lost during the
upgrade, make sure those files are stored in /config as this directory is always copied to newer installed images.

You can access files from a previous installation and copy them to your current image if they were located in the /config
directory. This can be done using the copy command. So, for instance, in order to copy /config/config.boot from
VyOS 1.2.1 image, you would use the following command:

copy file 1.2.1://config/config.boot to /tmp/config.boot.1.2.1

4.5. Update VyOS 364

 VyOS Documentation, Release 1.5.x (circinus)

4.5.1 Example

vyos@vyos:~$ add system image https://s3.amazonaws.com/s3-us.vyos.io/rolling/current/

˓→vyos-1.4-rolling-202201120317-amd64.iso

Trying to fetch ISO file from https://s3.amazonaws.com/s3-us.vyos.io/rolling/current/

˓→vyos-1.4-rolling-202201120317-amd64.iso

% Total % Received % Xferd Average Speed Time Time Time Current

Dload Upload Total Spent Left Speed
100 338M 100 338M 0 0 3837k 0 0:01:30 0:01:30 --:--:-- 3929k
ISO download succeeded.
Checking for digital signature file...
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
curl: (22) The requested URL returned error: 404 Not Found

Unable to fetch digital signature file.

Do you want to continue without signature check? (yes/no) [yes]
Checking MD5 checksums of files on the ISO image...OK.
Done!

What would you like to name this image? [vyos-1.3-rolling-201912201452]:

OK. This image will be named: vyos-1.3-rolling-201912201452

You can use latest option. It loads the latest available Rolling release.

vyos@vyos:~$ add system image latest

Note: To use the latest option the “system update-check url” must be configured.

Hint: The most up-do-date Rolling Release for AMD64 can be accessed using the following URL:
https://vyos.net/get/nightly-builds/

After reboot you might want to verify the version you are running with the show version command.

4.6 Image Management

The VyOS image-based installation is implemented by creating a directory for each image on the storage device selected
during the install process.
The directory structure of the boot device:

/
/boot
/boot/grub
/boot/1.2.0-rolling+201810021347

4.6. Image Management 365

 VyOS Documentation, Release 1.5.x (circinus)

The image directory contains the system kernel, a compressed image of the root filesystem for the OS, and a directory
for persistent storage, such as configuration. On boot, the system will extract the OS image into memory and mount
the appropriate live-rw sub-directories to provide persistent storage system configuration.
This process allows for a system to always boot to a known working state, as the OS image is fixed and non-persistent.
It also allows for multiple releases of VyOS to be installed on the same storage device. The image can be selected
manually at boot if needed, but the system will otherwise boot the image configured to be the default.
show system image
List all available system images which can be booted on the current system.

vyos@vyos:~$ show system image

The system currently has the following image(s) installed:

1: 1.2.0-rolling+201810021347 (default boot)

2: 1.2.0-rolling+201810021217
3: 1.2.0-rolling+201809252218

delete system image [image-name]

Delete no longer needed images from the system. You can specify an optional image name to delete, the image
name can be retrieved via a list of available images can be shown using the show system image.

vyos@vyos:~$ delete system image

The following image(s) can be deleted:

1: 1.3-rolling-201912181733 (default boot) (running image)

2: 1.3-rolling-201912180242
3: 1.2.2
4: 1.2.1

Select the image to delete: 2

Are you sure you want to delete the

"1.3-rolling-201912180242" image? (Yes/No) [No]: y
Deleting the "1.3-rolling-201912180242" image...
Done

show version
Show current system image version.

vyos@vyos:~$ show version

Version: VyOS 1.3-rolling-201912181733
Built by: [email protected]
Built on: Wed 18 Dec 2019 17:33 UTC
Build UUID: bccde2c3-261c-49cc-b421-9b257204e06c
Build Commit ID: f7ce0d8a692f2d

Architecture: x86_64
Boot via: installed image
System type: bare metal

Hardware vendor: VMware, Inc.

Hardware model: VMware Virtual Platform
(continues on next page)

4.6. Image Management 366

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Hardware S/N: VMware-42 1d 83 b9 fe c1 bd b2-7d 3d 49 db 94 18 f5 c9
Hardware UUID: b9831d42-c1fe-b2bd-7d3d-49db9418f5c9

Copyright: VyOS maintainers and contributors

4.6.1 System rollback

If you need to rollback to a previous image, you can easily do so. First check the available images through the show
system image command and then select your image with the following command:
set system image default-boot [image-name]
Select the default boot image which will be started on the next boot of the system.
Then reboot the system.

Note: VyOS automatically associates the configuration to the image, so you don’t need to worry about that. Each
image has a unique copy of its configuration.

If you have access to the console, there is a another way to select your booting image: reboot and use the GRUB menu
at startup.

4.7 Migrate from Vyatta Core

VyOS 1.x line aims to preserve backward compatibility and provide a safe upgrade path for existing Vyatta Core users.
You may think of VyOS 1.0.0 as VC7.0.

4.7.1 Vyatta release compatibility

Vyatta Core releases from 6.5 to 6.6 should be 100% compatible.

Vyatta Core 6.4 and earlier may have incompatibilities. In Vyatta 6.5 the “modify” firewall was removed and replaced
with the set policy route command family, old configs can not be automatically converted. You will have to adapt
it to post-6.5 Vyatta syntax manually.

Note: Also, in Vyatta Core 6.5 remote access VPN interfaces have been renamed from pppX to l2tpX and pptpX. If
you are using zone based firewalling in Vyatta Core pre-6.5 versions, make sure to change interface names in rules for
remote access VPN.

4.7. Migrate from Vyatta Core 367

 VyOS Documentation, Release 1.5.x (circinus)

4.7.2 Upgrade procedure

You just use add system image, as if it was a new VC release (see Update VyOS for additional information). The
only thing you want to do is to verify the new images digital signature. You will have to add the public key manually
once as it is not shipped the first time.

vyatta@vyatta:~$ wget http://wiki.vyos.net/so3group_maintainers.key

Connecting to vyos.net (x.x.x.x:80)
so3group_maintainers 100% |*************************| 3125 --:--:-- ETA
vyatta@vyatta:~$ sudo apt-key add so3group_maintainers.key
OK
vyatta@vyatta:~$

For completion the key below corresponds to the key listed in the URL above.
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.12 (GNU/Linux)

mQINBFIIUZwBEADGl+wkZpYytQxd6LnjDZZScziBKYJbjInetYeS0SUrgpqnPkzL
2CiGfPczLwpYY0zWxpUhTvqjFsE5yDpgs0sPXIgUTFE1qfZQE+WD1I1EUM6sp/38
2xKQ9QaNc8oHuYINLYYmNYra6ZjIGtQP9WOX//IDYB3fhdwlmiW2z0hux2OnPWdh
hPZAmSrx5AiXFEEREJ1cAQyvYk7hgIRvM/rdQMUm+u4/z+S4mxCHE10KzlqOGhRv
hA8WQxHCVusMFGwXoKHxYf9OQpV7lsfOCODfXOMP/L9kHQ5/gBsLL5hHst+o/3VG
ec0QuVrVkBBehgrqhfJW2noq+9gTooURGImQHEOyE0xpJdFrrgk5Ii9RqQwdVRzI
ZPbqbo8uuldZIRJRGnfx+vAR9812yo38NVZ/X0P/hkkrx+UeGVgpC/ao5XLRiOzL
7ZBMWLA6FVmZ7mkpqdzuMXX5548ApACm6EKErULIhTYDGDzFxA3cf6gr5VVi4usD
wglVs+FHuiLehmuuPTMoVcT2R6+Ht44hG3BmQmKzh/SSEa1g9gKgrhZrMdIyK4hu
GvMqLw9z9BgJbWB3BgXOUdlkXLDwBvVpEcWsPJgxSjAvjAbLLE4YkKAdYU8bQ0Pd
JuN485tcXxgQCadFZB0gcipQAvVf4b810HrY88g6FldfauHxiACOlXscZwARAQAB
tDBTTzMgR3JvdXAgTWFpbnRhaW5lcnMgPG1haW50YWluZXJzQHNvM2dyb3VwLm5l
dD6JAjgEEwECACIFAlIIUZwCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJ
ELdE4lqkQubp8GsQAKntoRFG6bWX/4WPw7Vo7kIF5kWcmv3lVb0AQkacscWope7T
Iq0VcgpAycJue2bSS9LAsvNtpVkQmFawbwFjqB3CC5NbPNQ4Kf+gswKa+yaHwejo
7dkslAwxgXHe5g76DG7CVLMsMg6zVDFYuzeksPywls/OJBIpkuGqeXy9tAHjQzjA
SlZV3Gsx7azESjiVQ73EUBt2OXkwN4TN9TEHAnVsrNIXHwFl1VfFsSG1Q6uZDtkk
CB4DZJKN4RzCY2QSwMAqRRC2OXdwk5IAk8wwCGoFpp0UV6CO9YCeOaqJderEcBA4
MGHqdiPDIbH5wvckjZzFznU/Paz3MwPwBdtN+WSKvwf+JItSiUqm8Dy2Pl/1cnux
1g1I4WQlXUVaS/MDusqL7tbS8k5A5a2+YVMxShWH9BhXZwNXzEihl4sm8Hrg5SvZ
givJj2y93WoL69Wq0/86wkkH2xcrz4gsiUcQf5YXU/RHXOLnPR29/pg8TS0L7sST
dv0X23C2IpfqYoqN7YZ3K0Wczhi0yLPCrc27IczuHgjt/8ICda11xhB1t/pUbvnX
oksehaLp8O3uU8GyAsTfUgpijZFc/3jIadOl0L9NGUbYYgPzFeaZTa/njeEbz3wX
PZMn278sbL9UhupI5Hx7eREbKzV4VPVKz81ndKNMXyuJHXv2R0xou3nvuo1WuQIN
BFIIUZwBEADAhoYPDCSogG41Naq+wFkG+IPszqe0dW/UWg0xrZDT0UblwDSd4OGY
7FATMIhjOUyFxk6+XKA5CDCWP8Npkl0modTL59uVWNxU1vUKincc/j4ipHQeAhE6
fvZkrprvADD8TYIGesl/3EGNc7bzc5ZqX71hKPHG+autRtgFSOR2PSXD9MlJXIBb
RzHAXxlh72zvsGadcxLJm4pSWXitkR/5Wc3e0IippKdzGwZnCDpNmcBGtSTFgixP
JqyRZFVCPWs7jr/oQeZnq65wJp1KD2HvhhKHJfsPrnNjLSm1SQVh8hXzE9odcv6N
mJB7tNXywuROBt6a01ojBa9J3zuMYQj3iQl2MhxtHylKVBjr7NjZ4evZbLsRMxY1
hYk7sl+ZxCPFeOZ9D2ppU/CUDXCS095I1x+s+VuiUNf/3yd8ahCWDXVp9nsXyYjm
2pHIxb2F6r8Vd4AjlD2MQwszECS88INF3l/9ksIHEMKuuW+JAC9FiZ7k4IGcIltv
If/V2TgE6t6qoWIlmLhMTjOyJpwnokY1nIuXHH7yp+HsuqnYnf/dgLnt4czPLeHO
+TdIDHhUym0AKlCcbdgn0C6EJVTnA8BFgFjiIOMAeT0rhATg0W/cND8KQcX4V9wM
nHSEsgSEuP9H+67xuRx5Imuh5ntecrcuCYSNuOneUXWPThDKQPO9lQARAQABiQIf
BBgBAgAJBQJSCFGcAhsMAAoJELdE4lqkQubpc+0P/0IzUx8nTpF0/ii2TA0YCOgj
(continues on next page)

4.7. Migrate from Vyatta Core 368

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

tviM6PRTVPrFcxijNeXiIMHZYrALYUvXxXGp1IZBP3IcOyuZNp2WLqF/f9a3cIr1
9b/LJPrwopGqV3K30lormk7hH0s3IXbhd0ZYWvRj+5kQ8TFRAFfPwjlItzjYJmYX
AGJmM9PxJID/4LgWSfQ/ZfNu7MJ7+2goQLu9b6x7UC1FlE4q1lcjBvHjVPM//S9G
lGAHaysyTjVu88W2wwBpBrO1MQnDvqFRddXPOIWp0jecBMUd4E0fB36yuStsXZT3
RN4V8vKRBYXuqHhiTwZeh153cHZk2EZBwz5A6DJubMaGdJTesHW5Qf2goph0pmjC
+XuXn8J6tc5nFDf8DP4AFVMtqa3Brj2fodWd0Zzxq3AVsbX144c1oqJUhO4t3+ie
8fD/6/jx4iuPCQTfyhHG+zGfyUb2LQ+OVLW1WYTxH5tzHaZUmZFdV2I1kuhuvZ1t
WRlmTnHZOnEb3+t8KCRWzRMfweTzXfRRKBC0/QpeX1r5pbaMHH8zF/J5PKmL0+jg
+DS8JSbSfv7Ke6rplf7lHYaDumAFZfxXuQkajzLZbX0E5Xu5BNz4Vq6LGBj7LDXL
gswIK8FFgZB+W8zwOqUV1vjIr9wkdLifXXezKpTeYpFDGLdfsK+uNAtGyvI61TDi
Pr6fWpIruuc7Gg9rUF0L
=VQTr
-----END PGP PUBLIC KEY BLOCK-----

Next add the VyOS image.

This example uses VyOS 1.0.0, however, it’s better to install the latest release.

vyatta@vyatta:~$ show system image

The system currently has the following image(s) installed:
1: VC6.6R1 (default boot) (running image)

vyatta@vyatta:~$ add system image https://downloads.vyos.io/release/legacy/1.0.0/vyos-1.

˓→0.0-amd64.iso

Trying to fetch ISO file from https://downloads.vyos.io/release/legacy/1.0.0/vyos-1.0.0-

˓→amd64.iso

% Total % Received % Xferd Average Speed Time Time Time Current

Dload Upload Total Spent Left Speed
100 223M 100 223M 0 0 960k 0 0:03:57 0:03:57 --:--:-- 657k
ISO download succeeded.
Checking for digital signature file...
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 836 100 836 0 0 4197 0 --:--:-- --:--:-- --:--:-- 4287
Found it. Checking digital signature...
gpg: directory `/root/.gnupg' created
gpg: new configuration file `/root/.gnupg/gpg.conf' created
gpg: WARNING: options in `/root/.gnupg/gpg.conf' are not yet active during this run
gpg: keyring `/root/.gnupg/pubring.gpg' created
gpg: Signature made Sun Dec 22 16:51:42 2013 GMT using RSA key ID A442E6E9
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: Good signature from "SO3 Group Maintainers <[email protected]>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: DD5B B405 35E7 F6E3 4278 1ABF B744 E25A A442 E6E9
Digital signature is valid.
Checking MD5 checksums of files on the ISO image...OK.
Done!

What would you like to name this image? [1.0.0]: [return]

OK. This image will be named: 1.0.0
Installing "1.0.0" image.
Copying new release files...
(continues on next page)

4.7. Migrate from Vyatta Core 369

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Would you like to save the current configuration

directory and config file? (Yes/No) [Yes]: [return]
Copying current configuration...

Would you like to save the SSH host keys from your
current configuration? (Yes/No) [Yes]: [return]
Copying SSH keys...
Setting up grub configuration...
Done.

vyatta@vyatta:~$ show system image

The system currently has the following image(s) installed:

1: 1.0.0 (default boot)

2: VC6.6R1 (running image)

Upon reboot, you should have a working installation of VyOS.

You can go back to your Vyatta install using the set system image default-boot command and selecting the your
previous Vyatta Core image.

Note: Future releases of VyOS will break the direct upgrade path from Vyatta core. Please upgrade through an
intermediate VyOS version e.g. VyOS 1.2. After this you can continue upgrading to newer releases once you bootet
into VyOS 1.2 once.

4.7. Migrate from Vyatta Core 370

 CHAPTER

FIVE

QUICK START

This chapter will guide you on how to get up to speed quickly using your new VyOS system. It will show you a very
basic configuration example that will provide a NAT gateway for a device with two network interfaces (eth0 and eth1).

5.1 Configuration Mode

By default, VyOS is in operational mode, and the command prompt displays a $. To configure VyOS, you will need to
enter configuration mode, resulting in the command prompt displaying a #, as demonstrated below:

vyos@vyos$ configure
vyos@vyos#

5.2 Commit and Save

After every configuration change, you need to apply the changes by using the following command:

commit

Once your configuration works as expected, you can save it permanently by using the following command:

save

5.3 Interface Configuration

• Your outside/WAN interface will be eth0. It will receive its interface address via DHCP.
• Your internal/LAN interface will be eth1. It will use a static IP address of 192.168.0.1/24.
After switching to Configuration Mode issue the following commands:

set interfaces ethernet eth0 address dhcp

set interfaces ethernet eth0 description 'OUTSIDE'
set interfaces ethernet eth1 address '192.168.0.1/24'
set interfaces ethernet eth1 description 'LAN'

371
 VyOS Documentation, Release 1.5.x (circinus)

5.4 SSH Management

After switching to Configuration Mode issue the following commands, and your system will listen on every interface
for incoming SSH connections. You might want to check the SSH chapter on how to listen on specific addresses only.

set service ssh port '22'

5.5 DHCP/DNS quick-start

The following settings will configure DHCP and DNS services on your internal/LAN network, where VyOS will act
as the default gateway and DNS server.
• The default gateway and DNS recursor address will be 192.168.0.1/24
• The address range 192.168.0.2/24 - 192.168.0.8/24 will be reserved for static assignments
• DHCP clients will be assigned IP addresses within the range of 192.168.0.9 - 192.168.0.254 and have a
domain name of internal-network
• DHCP leases will hold for one day (86400 seconds)
• VyOS will serve as a full DNS recursor, replacing the need to utilize Google, Cloudflare, or other public DNS
servers (which is good for privacy)
• Only hosts from your internal/LAN network can use the DNS recursor

set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 option default-

˓→router '192.168.0.1'

set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 option name-server

˓→'192.168.0.1'

set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 option domain-name

˓→'vyos.net'

set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 lease '86400'

set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 range 0 start '192.
˓→168.0.9'

set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 range 0 stop '192.
˓→168.0.254'

set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 subnet-id '1'

set service dns forwarding cache-size '0'

set service dns forwarding listen-address '192.168.0.1'
set service dns forwarding allow-from '192.168.0.0/24'

5.6 NAT

The following settings will configure SNAT rules for our internal/LAN network, allowing hosts to communicate through
the outside/WAN network via IP masquerade.

set nat source rule 100 outbound-interface name 'eth0'

set nat source rule 100 source address '192.168.0.0/24'
set nat source rule 100 translation address masquerade

5.4. SSH Management 372

 VyOS Documentation, Release 1.5.x (circinus)

5.7 Firewall

A new firewall structure—which uses the nftables backend, rather than iptables—is available on all installations
starting from VyOS 1.4-rolling-202308040557. The firewall supports creation of distinct, interlinked chains for
each Netfilter hook and allows for more granular control over the packet filtering process.
The firewall begins with the base filter tables you define for each of the forward, input, and output Netfiter
hooks. Each of these tables is populated with rules that are processed in order and can jump to other chains for more
granular filtering.

5.7.1 Configure Firewall Groups

To make firewall configuration easier, we can create groups of interfaces, networks, addresses, ports, and domains that
describe different parts of our network. We can then use them for filtering within our firewall rulesets, allowing for
more concise and readable configuration.
In this case, we will create two interface groups — a WAN group for our interfaces connected to the public internet
and a LAN group for the interfaces connected to our internal network. Additionally, we will create a network group,
NET-INSIDE-v4, that contains our internal subnet.

set firewall group interface-group WAN interface eth0

set firewall group interface-group LAN interface eth1
set firewall group network-group NET-INSIDE-v4 network '192.168.0.0/24'

5.7.2 Configure Stateful Packet Filtering

With the new firewall structure, we have have a lot of flexibility in how we group and order our rules, as shown by the
three alternative approaches below.

Option 1: Global State Policies

Using options defined in set firewall global-options state-policy, state policy rules that applies for both
IPv4 and IPv6 are created. These global state policies also applies for all traffic that passes through the router (transit)
and for traffic originated/destinated to/from the router itself, and will be evaluated before any other rule defined in the
firewall.
Most installations would choose this option, and will contain:

set firewall global-options state-policy established action accept

set firewall global-options state-policy related action accept
set firewall global-options state-policy invalid action drop

5.7. Firewall 373

 VyOS Documentation, Release 1.5.x (circinus)

Option 2: Common/Custom Chain

We can create a common chain for stateful connection filtering of multiple interfaces (or multiple netfilter hooks on
one interface). Those individual chains can then jump to the common chain for stateful connection filtering, returning
to the original chain for further rule processing if no action is taken on the packet.
The chain we will create is called CONN_FILTER and has three rules:
• A default action of return, which returns the packet back to the original chain if no action is taken.
• A rule to accept packets from established and related connections.
• A rule to drop packets from invalid connections.

set firewall ipv4 name CONN_FILTER default-action 'return'

set firewall ipv4 name CONN_FILTER rule 10 action 'accept'

set firewall ipv4 name CONN_FILTER rule 10 state established
set firewall ipv4 name CONN_FILTER rule 10 state related

set firewall ipv4 name CONN_FILTER rule 20 action 'drop'

set firewall ipv4 name CONN_FILTER rule 20 state invalid

Then, we can jump to the common chain from both the forward and input hooks as the first filtering rule in the
respective chains:

set firewall ipv4 forward filter rule 10 action 'jump'

set firewall ipv4 forward filter rule 10 jump-target CONN_FILTER

set firewall ipv4 input filter rule 10 action 'jump'

set firewall ipv4 input filter rule 10 jump-target CONN_FILTER

Option 3: Per-Hook Chain

Alternatively, you can take the more traditional stateful connection filtering approach by creating rules on each base
hook’s chain:

set firewall ipv4 forward filter rule 5 action 'accept'

set firewall ipv4 forward filter rule 5 state established
set firewall ipv4 forward filter rule 5 state related
set firewall ipv4 forward filter rule 10 action 'drop'
set firewall ipv4 forward filter rule 10 state invalid

set firewall ipv4 input filter rule 5 action 'accept'

set firewall ipv4 input filter rule 5 state established
set firewall ipv4 input filter rule 5 state related
set firewall ipv4 input filter rule 10 action 'drop'
set firewall ipv4 input filter rule 10 state invalid

5.7. Firewall 374

 VyOS Documentation, Release 1.5.x (circinus)

5.7.3 Block Incoming Traffic

Now that we have configured stateful connection filtering to allow traffic from established and related connections, we
can block all other incoming traffic addressed to our local network.
Create a new chain (OUTSIDE-IN) which will drop all traffic that is not explicitly allowed at some point in the chain.
Then, we can jump to that chain from the forward hook when traffic is coming from the WAN interface group and is
addressed to our local network.

set firewall ipv4 name OUTSIDE-IN default-action 'drop'

set firewall ipv4 forward filter rule 100 action jump

set firewall ipv4 forward filter rule 100 jump-target OUTSIDE-IN
set firewall ipv4 forward filter rule 100 inbound-interface group WAN
set firewall ipv4 forward filter rule 100 destination group network-group NET-INSIDE-v4

We should also block all traffic destinated to the router itself that isn’t explicitly allowed at some point in the chain for
the input hook. As we’ve already configured stateful packet filtering above, we only need to set the default action to
drop:

set firewall ipv4 input filter default-action 'drop'

5.7.4 Allow Management Access

We can now configure access to the router itself, allowing SSH access from the inside/LAN network and rate limiting
SSH access from the outside/WAN network.
First, create a new dedicated chain (VyOS_MANAGEMENT) for management access, which returns to the parent chain if
no action is taken. Add a rule to accept traffic from the LAN interface group:

set firewall ipv4 name VyOS_MANAGEMENT default-action 'return'

Configure a rule on the input hook filter to jump to the VyOS_MANAGEMENT chain when new connections are addressed
to port 22 (SSH) on the router itself:

set firewall ipv4 input filter rule 20 action jump

set firewall ipv4 input filter rule 20 jump-target VyOS_MANAGEMENT
set firewall ipv4 input filter rule 20 destination port 22
set firewall ipv4 input filter rule 20 protocol tcp

Finally, configure the VyOS_MANAGEMENT chain to accept connection from the LAN interface group while limiting
requests coming from the WAN interface group to 4 per minute:

set firewall ipv4 name VyOS_MANAGEMENT rule 15 action 'accept'

set firewall ipv4 name VyOS_MANAGEMENT rule 15 inbound-interface group 'LAN'

set firewall ipv4 name VyOS_MANAGEMENT rule 20 action 'drop'

set firewall ipv4 name VyOS_MANAGEMENT rule 20 recent count 4
set firewall ipv4 name VyOS_MANAGEMENT rule 20 recent time minute
set firewall ipv4 name VyOS_MANAGEMENT rule 20 state new
set firewall ipv4 name VyOS_MANAGEMENT rule 20 inbound-interface group 'WAN'

set firewall ipv4 name VyOS_MANAGEMENT rule 21 action 'accept'

(continues on next page)

5.7. Firewall 375

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set firewall ipv4 name VyOS_MANAGEMENT rule 21 state new
set firewall ipv4 name VyOS_MANAGEMENT rule 21 inbound-interface group 'WAN'

5.7.5 Allow Access to Services

Here we’re allowing the router to respond to pings. Then, we can allow access to the DNS recursor we configured
earlier, accepting traffic bound for port 53 from all hosts on the NET-INSIDE-v4 network:

set firewall ipv4 input filter rule 30 action 'accept'

set firewall ipv4 input filter rule 30 icmp type-name 'echo-request'
set firewall ipv4 input filter rule 30 protocol 'icmp'
set firewall ipv4 input filter rule 30 state new

set firewall ipv4 input filter rule 40 action 'accept'

set firewall ipv4 input filter rule 40 destination port '53'
set firewall ipv4 input filter rule 40 protocol 'tcp_udp'
set firewall ipv4 input filter rule 40 source group network-group NET-INSIDE-v4

Finally, we can now configure access to the services running on this router, allowing all connections coming from
localhost:

set firewall ipv4 input filter rule 50 action 'accept'

set firewall ipv4 input filter rule 50 source address 127.0.0.0/8

Commit changes, save the configuration, and exit configuration mode:

vyos@vyos# commit
vyos@vyos# save
Saving configuration to '/config/config.boot'...
Done
vyos@vyos# exit
vyos@vyos$

5.8 Hardening

Especially if you are allowing SSH remote access from the outside/WAN interface, there are a few additional configu-
ration steps that should be taken.
Replace the default vyos system user:

set system login user myvyosuser authentication plaintext-password mysecurepassword

Set up Key Based Authentication:

set system login user myvyosuser authentication public-keys myusername@mydesktop type␣

˓→ssh-rsa

set system login user myvyosuser authentication public-keys myusername@mydesktop key␣

˓→contents_of_id_rsa.pub

Finally, try and SSH into the VyOS install as your new user. Once you have confirmed that your new user can access
your router without a password, delete the original vyos user and completely disable password authentication for SSH:

5.8. Hardening 376

 VyOS Documentation, Release 1.5.x (circinus)

delete system login user vyos

set service ssh disable-password-authentication

As above, commit your changes, save the configuration, and exit configuration mode:

vyos@vyos# commit
vyos@vyos# save
Saving configuration to '/config/config.boot'...
Done
vyos@vyos# exit
vyos@vyos$

You now should have a simple yet secure and functioning router to experiment with further. Enjoy!

5.8. Hardening 377

 CHAPTER

SIX

COMMAND LINE INTERFACE

The VyOS CLI (Command-Line Interface) comprises an operational and a configuration mode.

6.1 Operational Mode

Operational mode allows for commands to perform operational system tasks and view system and service status, while
configuration mode allows for the modification of system configuration.
The CLI provides a built-in help system. In the CLI the ? key may be used to display available commands. The TAB
key can be used to auto-complete commands and will present the help system upon a conflict or unknown value.
For example typing sh followed by the TAB key will complete to show. Pressing TAB a second time will display the
possible sub-commands of the show command.

vyos@vyos:~$ s[tab]
set show

Example showing possible show commands:

vyos@vyos:~$ show [tab]

Possible completions:
arp Show Address Resolution Protocol (ARP) information
bridge Show bridging information
cluster Show clustering information
configuration Show running configuration
conntrack Show conntrack entries in the conntrack table
conntrack-sync
Show connection syncing information
date Show system date and time
dhcp Show Dynamic Host Configuration Protocol (DHCP) information
dhcpv6 Show status related to DHCPv6
disk Show status of disk device
dns Show Domain Name Server (DNS) information
file Show files for a particular image
firewall Show firewall information
flow-accounting
Show flow accounting statistics
hardware Show system hardware details
history show command history
host Show host information
(continues on next page)

378
 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

incoming Show ethernet input-policy information
: q

You can scroll up with the keys [Shift]+[PageUp] and scroll down with [Shift]+[PageDown].
When the output of a command results in more lines than can be displayed on the terminal screen the output is paginated
as indicated by a : prompt.
When viewing in page mode the following commands are available:
• q key can be used to cancel output
• space will scroll down one page
• b will scroll back one page
• return will scroll down one line
• up-arrow and down-arrow will scroll up or down one line at a time respectively
• left-arrow and right-arrow can be used to scroll left or right in the event that the output has lines
which exceed the terminal size.

6.2 Configuration Mode

To enter configuration mode use the configure command:

vyos@vyos:~$ configure
[edit]
vyos@vyos:~#

Note: Prompt changes from $ to #. To exit configuration mode, type exit.

vyos@vyos:~# exit
exit
vyos@vyos:~$

See the configuration section of this document for more information on configuration mode.

6.2. Configuration Mode 379

 CHAPTER

SEVEN

CONFIGURATION OVERVIEW

VyOS makes use of a unified configuration file for the entire system’s configuration: /config/config.boot. This
allows easy template creation, backup, and replication of system configuration. A system can thus also be easily cloned
by simply copying the required configuration files.

7.1 Terminology

A VyOS system has three major types of configurations:

• Active or running configuration is the system configuration that is loaded and currently active (used by VyOS).
Any change in the configuration will have to be committed to belong to the active/running configuration.
• Working configuration is the one that is currently being modified in configuration mode. Changes made to
the working configuration do not go into effect until the changes are committed with the commit command. At
which time the working configuration will become the active or running configuration.
• Saved configuration is the one saved to a file using the save command. It allows you to keep safe a configuration
for future uses. There can be multiple configuration files. The default or “boot” configuration is saved and loaded
from the file /config/config.boot.

7.1.1 Seeing and navigating the configuration

show configuration
View the current active configuration, also known as the running configuration, from the operational mode.

vyos@vyos:~$ show configuration

interfaces {
ethernet eth0 {
address dhcp
hw-id 00:53:00:00:aa:01
}
loopback lo {
}
}
service {
ssh {
port 22
}
}
system {
(continues on next page)

380
 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

config-management {
commit-revisions 20
}
console {
device ttyS0 {
speed 9600
}
}
login {
user vyos {
authentication {
encrypted-password ****************
}
level admin
}
}
ntp {
server 0.pool.ntp.org {
}
server 1.pool.ntp.org {
}
server 2.pool.ntp.org {
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
}

By default, the configuration is displayed in a hierarchy like the above example, this is only one of the possible ways to
display the configuration. When the configuration is generated and the device is configured, changes are added through
a collection of set and delete commands.
show configuration commands
Get a collection of all the set commands required which led to the running configuration.

vyos@vyos:~$ show configuration commands

set interfaces ethernet eth0 address 'dhcp'
set interfaces ethernet eth0 hw-id '00:53:dd:44:3b:0f'
set interfaces loopback 'lo'
set service ssh port '22'
set system config-management commit-revisions '20'
set system console device ttyS0 speed '9600'
set system login user vyos authentication encrypted-password '$6$Vt68...QzF0'
set system login user vyos level 'admin'
(continues on next page)

7.1. Terminology 381

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set system ntp server '0.pool.ntp.org'
set system ntp server '1.pool.ntp.org'
set system ntp server '2.pool.ntp.org'
set system syslog global facility all level 'notice'
set system syslog global facility protocols level 'debug'

Both these show commands should be executed when in operational mode, they do not work directly in configuration
mode. There is a special way on how to Access opmode from config mode.

Hint: Use the show configuration commands | strip-private command when you want to hide private data.
You may want to do so if you want to share your configuration on the forum.

show configuration json

View the current active configuration in JSON format.

{"interfaces": {"ethernet": {"eth0": {"address": ["192.0.2.11/24", "192.0.2.35/24"],

˓→ "hw-id": "52:54:00:48:a0:c6"}, "eth1": {"address": ["203.0.113.1/24"], "hw-id":

˓→"52:54:00:fc:50:0b"}}, "loopback": {"lo": {}}}, "protocols": {"static": {"route":

˓→{"0.0.0.0/0": {"next-hop": {"192.0.2.254": {}}}}}}, "service": {"ssh": {"disable-

˓→host-validation": {}}}, "system": {"config-management": {"commit-revisions": "100

˓→"}, "console": {"device": {"ttyS0": {"speed": "115200"}}}, "host-name": "r11-vyos

˓→", "login": {"user": {"vyos": {"authentication": {"encrypted-password": "$6$Vt68..

˓→.F0", "plaintext-password": "", "public-keys": {"vyos@vyos": {"key": "AAAAxxx=",

˓→"type": "ssh-rsa"}}}}}}, "name-server": ["203.0.113.254"], "ntp": {"server": {

˓→"time1.vyos.net": {}, "time2.vyos.net": {}, "time3.vyos.net": {}}}, "syslog": {

˓→"global": {"facility": {"all": {"level": "info"}, "protocols": {"level": "debug"}}

˓→}}, "time-zone": "America/New_York"}}

show configuration json pretty

View the current active configuration in readable JSON format.

{
"interfaces": {
"ethernet": {
"eth0": {
"address": [
"192.0.2.11/24",
"192.0.2.35/24"
],
"hw-id": "52:54:00:48:a0:c6"
},
"eth1": {
"address": [
"203.0.113.1/24"
],
"hw-id": "52:54:00:fc:50:0b"
}
},
"loopback": {
"lo": {}
(continues on next page)

7.1. Terminology 382

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

}
},
"protocols": {
"static": {
"route": {
"0.0.0.0/0": {
"next-hop": {
"192.0.2.254": {}
}
}
}
}
},
"service": {
"ssh": {
"disable-host-validation": {}
}
},
"system": {
"config-management": {
"commit-revisions": "100"
},
"console": {
"device": {
"ttyS0": {
"speed": "115200"
}
}
},
"host-name": "r11-vyos",
"login": {
"user": {
"vyos": {
"authentication": {
"encrypted-password": "$6$Vt68...F0",
"plaintext-password": "",
"public-keys": {
"vyos@vyos": {
"key": "AAAAxxx=",
"type": "ssh-rsa"
}
}
}
}
}
},
"name-server": [
"203.0.113.254"
],
"ntp": {
"server": {
"time1.vyos.net": {},
(continues on next page)

7.1. Terminology 383

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

"time2.vyos.net": {},
"time3.vyos.net": {}
}
},
"syslog": {
"global": {
"facility": {
"all": {
"level": "info"
},
"protocols": {
"level": "debug"
}
}
}
},
"time-zone": "America/New_York"
}
}

The config mode

When entering the configuration mode you are navigating inside a tree structure, to enter configuration mode enter the
command configure when in operational mode.

vyos@vyos$ configure
[edit]
vyos@vyos#

Note: When going into configuration mode, prompt changes from $ to #.

All commands executed here are relative to the configuration level you have entered. You can do everything from the
top level, but commands will be quite lengthy when manually typing them.
The current hierarchy level can be changed by the edit command.

[edit]
vyos@vyos# edit interfaces ethernet eth0

[edit interfaces ethernet eth0]

vyos@vyos#

You are now in a sublevel relative to interfaces ethernet eth0, all commands executed from this point on are
relative to this sublevel. Use either the top or exit command to go back to the top of the hierarchy. You can also use
the up command to move only one level up at a time.
show
The show command within configuration mode will show the working configuration indicating line changes with + for
additions, > for replacements and - for deletions.
Example:

7.1. Terminology 384

 VyOS Documentation, Release 1.5.x (circinus)

vyos@vyos:~$ configure
[edit]
vyos@vyos# show interfaces
ethernet eth0 {
description MY_OLD_DESCRIPTION
disable
hw-id 00:53:dd:44:3b:03
}
loopback lo {
}
[edit]
vyos@vyos# set interfaces ethernet eth0 address dhcp
[edit]
vyos@vyos# set interfaces ethernet eth0 description MY_NEW_DESCRIPTION
[edit]
vyos@vyos# delete interfaces ethernet eth0 disable
[edit]
vyos@vyos# show interfaces
ethernet eth0 {
+ address dhcp
> description MY_NEW_DESCRIPTION
- disable
hw-id 00:53:dd:44:3b:03
}
loopback lo {
}

It is also possible to display all set commands within configuration mode using show | commands

vyos@vyos# show interfaces ethernet eth0 | commands

set address dhcp
set hw-id 00:53:ad:44:3b:03

These commands are also relative to the level you are inside and only relevant configuration blocks will be displayed
when entering a sub-level.

[edit interfaces ethernet eth0]

vyos@vyos# show
address dhcp
hw-id 00:53:ad:44:3b:03

Exiting from the configuration mode is done via the exit command from the top level, executing exit from within a
sub-level takes you back to the top level.

[edit interfaces ethernet eth0]

vyos@vyos# exit
[edit]
vyos@vyos# exit
Warning: configuration changes have not been saved.

7.1. Terminology 385

 VyOS Documentation, Release 1.5.x (circinus)

7.1.2 Editing the configuration

The configuration can be edited by the use of set and delete commands from within configuration mode.
set
Use this command to set the value of a parameter or to create a new element.
Configuration commands are flattened from the tree into ‘one-liner’ commands shown in show configuration
commands from operation mode. Commands are relative to the level where they are executed and all redundant in-
formation from the current level is removed from the command entered.

[edit]
vyos@vyos# set interface ethernet eth0 address 192.0.2.100/24

[edit interfaces ethernet eth0]

vyos@vyos# set address 203.0.113.6/24

These two commands above are essentially the same, just executed from different levels in the hierarchy.
delete
To delete a configuration entry use the delete command, this also deletes all sub-levels under the current level
you’ve specified in the delete command. Deleting an entry will also result in the element reverting back to its
default value if one exists.

[edit interfaces ethernet eth0]

vyos@vyos# delete address 192.0.2.100/24

commit
Any change you do on the configuration, will not take effect until committed using the commit command in
configuration mode.

vyos@vyos# commit
[edit]
vyos@vyos# exit
Warning: configuration changes have not been saved.
vyos@vyos:~$

Hint: You can specify a commit message with commit comment <message>.

save
Use this command to preserve configuration changes upon reboot. By default it is stored at /config/config.boot.
In the case you want to store the configuration file somewhere else, you can add a local path, a SCP address, a
FTP address or a TFTP address.

vyos@vyos# save
Saving configuration to '/config/config.boot'...
Done

vyos@vyos# save [tab]

Possible completions:
<Enter> Save to system config file
(continues on next page)

7.1. Terminology 386

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

<file> Save to file on local machine
scp://<user>:<passwd>@<host>:/<file> Save to file on remote machine
ftp://<user>:<passwd>@<host>/<file> Save to file on remote machine
tftp://<host>/<file> Save to file on remote machine
vyos@vyos# save tftp://192.168.0.100/vyos-test.config.boot
Saving configuration to 'tftp://192.168.0.100/vyos-test.config.boot'...
######################################################################## 100.0%
Done

exit [discard]
Configuration mode can not be exited while uncommitted changes exist. To exit configuration mode without
applying changes, the exit discard command must be used.
All changes in the working config will thus be lost.

vyos@vyos# exit
Cannot exit: configuration modified.
Use 'exit discard' to discard the changes and exit.
[edit]
vyos@vyos# exit discard

commit-confirm <minutes>
Use this command to temporarily commit your changes and set the number of minutes available for validation.
confirm must be entered within those minutes, otherwise the system will reboot into the previous configuration.
The default value is 10 minutes.
What if you are doing something dangerous? Suppose you want to setup a firewall, and you are not sure
there are no mistakes that will lock you out of your system. You can use confirmed commit. If you issue the
commit-confirm command, your changes will be committed, and if you don’t issue the confirm command in
10 minutes, your system will reboot into previous config revision.

vyos@router# set firewall interface eth0 local name FromWorld

vyos@router# commit-confirm
commit confirm will be automatically reboot in 10 minutes unless confirmed
Proceed? [confirm]y
[edit]
vyos@router# confirm
[edit]

Note: A reboot because you did not enter confirm will not take you necessarily to the saved configuration,
but to the point before the unfortunate commit.

copy
Copy a configuration element.
You can copy and remove configuration subtrees. Suppose you set up a firewall ruleset FromWorld with one rule
that allows traffic from specific subnet. Now you want to setup a similar rule, but for different subnet. Change
your edit level to firewall name FromWorld and use copy rule 10 to rule 20, then modify rule 20.

vyos@router# show firewall name FromWorld

default-action drop
(continues on next page)

7.1. Terminology 387

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

rule 10 {
action accept
source {
address 203.0.113.0/24
}
}
[edit]
vyos@router# edit firewall name FromWorld
[edit firewall name FromWorld]
vyos@router# copy rule 10 to rule 20
[edit firewall name FromWorld]
vyos@router# set rule 20 source address 198.51.100.0/24
[edit firewall name FromWorld]
vyos@router# commit
[edit firewall name FromWorld]

rename
Rename a configuration element.
You can also rename config subtrees:

vyos@router# rename rule 10 to rule 5

[edit firewall name FromWorld]
vyos@router# commit
[edit firewall name FromWorld]

Note that show command respects your edit level and from this level you can view the modified firewall ruleset
with just show with no parameters.

vyos@router# show
default-action drop
rule 5 {
action accept
source {
address 203.0.113.0/24
}
}
rule 20 {
action accept
source {
address 198.51.100.0/24
}
}

comment <config node> “comment text”

Add comment as an annotation to a configuration node.
The comment command allows you to insert a comment above the <config node> configuration section. When
shown, comments are enclosed with /* and */ as open/close delimiters. Comments need to be committed, just
like other config changes.
To remove an existing comment from your current configuration, specify an empty string enclosed in double
quote marks ("") as the comment text.

7.1. Terminology 388

 VyOS Documentation, Release 1.5.x (circinus)

Example:

vyos@vyos# comment firewall all-ping "Yes I know this VyOS is cool"

vyos@vyos# commit
vyos@vyos# show
firewall {
/* Yes I know this VyOS is cool */
all-ping enable
broadcast-ping disable
...
}

Note: An important thing to note is that since the comment is added on top of the section, it will not appear
if the show <section> command is used. With the above example, the show firewall command would return
starting after the firewall { line, hiding the comment.

7.1.3 Access opmode from config mode

When inside configuration mode you are not directly able to execute operational commands.
run
Access to these commands are possible through the use of the run [command] command. From this command
you will have access to everything accessible from operational mode.
Command completion and syntax help with ? and [tab] will also work.

[edit]
vyos@vyos# run show interfaces
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
eth0 0.0.0.0/0 u/u

7.1.4 Managing configurations

VyOS comes with an integrated versioning system for the system configuration. It automatically maintains a backup
of every previous configuration which has been committed to the system. The configurations are versioned locally for
rollback but they can also be stored on a remote host for archiving/backup reasons.

Local Archive

Revisions are stored on disk. You can view, compare and rollback them to any previous revisions if something goes
wrong.
show system commit
View all existing revisions on the local system.

vyos@vyos:~$ show system commit

0 2015-03-30 08:53:03 by vyos via cli
(continues on next page)

7.1. Terminology 389

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

1 2015-03-30 08:52:20 by vyos via cli
2 2015-03-26 21:26:01 by root via boot-config-loader
3 2015-03-26 20:43:18 by root via boot-config-loader
4 2015-03-25 11:06:14 by root via boot-config-loader
5 2015-03-25 01:04:28 by root via boot-config-loader
6 2015-03-25 00:16:47 by vyos via cli
7 2015-03-24 23:43:45 by root via boot-config-loader

set system config-management commit-revisions <N>

You can specify the number of revisions stored on disk. N can be in the range of 0 - 65535. When the number
of revisions exceeds the configured value, the oldest revision is removed. The default setting for this value is to
store 100 revisions locally.

Compare configurations

VyOS lets you compare different configurations.

compare <saved | N> <M>
Use this command to spot what the differences are between different configurations.

vyos@vyos# compare [tab]

Possible completions:
<Enter> Compare working & active configurations
saved Compare working & saved configurations
<N> Compare working with revision N
<N> <M> Compare revision N with M
Revisions:
0 2013-12-17 20:01:37 root by boot-config-loader
1 2013-12-13 15:59:31 root by boot-config-loader
2 2013-12-12 21:56:22 vyos by cli
3 2013-12-12 21:55:11 vyos by cli
4 2013-12-12 21:27:54 vyos by cli
5 2013-12-12 21:23:29 vyos by cli
6 2013-12-12 21:13:59 root by boot-config-loader
7 2013-12-12 16:25:19 vyos by cli
8 2013-12-12 15:44:36 vyos by cli
9 2013-12-12 15:42:07 root by boot-config-loader
10 2013-12-12 15:42:06 root by init

The command compare allows you to compare different type of configurations. It also lets you compare different
revisions through the compare N M command, where N and M are revision numbers. The output will describe
how the configuration N is when compared to M indicating with a plus sign (+) the additional parts N has when
compared to M, and indicating with a minus sign (-) the lacking parts N misses when compared to M.

vyos@vyos# compare 0 6
[edit interfaces]
+dummy dum1 {
+ address 10.189.0.1/31
+}
[edit interfaces ethernet eth0]
+vif 99 {
(continues on next page)

7.1. Terminology 390

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

+ address 10.199.0.1/31
+}
-vif 900 {
- address 192.0.2.4/24
-}

show system commit diff <number>

Show commit revision difference.
The command above also lets you see the difference between two commits. By default the difference with the running
config is shown.

vyos@router# run show system commit diff 4

[edit system]
+ipv6 {
+ disable-forwarding
+}

This means four commits ago we did set system ipv6 disable-forwarding.

Rollback Changes

You can rollback configuration changes using the rollback command. This will apply the selected revision and trigger
a system reboot.
rollback <N>
Rollback to revision N (currently requires reboot)

vyos@vyos# compare 1
[edit system]
>host-name vyos-1
[edit]

vyos@vyos# rollback 1
Proceed with reboot? [confirm][y]
Broadcast message from root@vyos-1 (pts/0) (Tue Dec 17 21:07:45 2013):
The system is going down for reboot NOW!

Remote Archive

VyOS can upload the configuration to a remote location after each call to commit. You will have to set the commit-
archive location. TFTP, FTP, SCP and SFTP servers are supported. Every time a commit is successful the config.
boot file will be copied to the defined destination(s). The filename used on the remote host will be config.
boot-hostname.YYYYMMDD_HHMMSS.
set system config-management commit-archive location <URI>
Specify remote location of commit archive as any of the below URI (Uniform Resource Identifier)
• http://<user>:<passwd>@<host>:/<dir>
• https://<user>:<passwd>@<host>:/<dir>
• ftp://<user>:<passwd>@<host>/<dir>

7.1. Terminology 391

 VyOS Documentation, Release 1.5.x (circinus)

• sftp://<user>:<passwd>@<host>/<dir>
• scp://<user>:<passwd>@<host>:/<dir>
• tftp://<host>/<dir>
• git+https://<user>:<passwd>@<host>/<path>
Since username and password are part of the URI, they need to be properly url encoded if containing special
characters.

Note: The number of revisions don’t affect the commit-archive.

Note: When using Git as destination for the commit archive the source-address CLI option has no effect.

Note: You may find VyOS not allowing the secure connection because it cannot verify the legitimacy of the
remote server. You can use the workaround below to quickly add the remote host’s SSH fingerprint to your
~/.ssh/known_hosts file:

vyos@vyos# ssh-keyscan <host> >> ~/.ssh/known_hosts

Saving and loading manually

You can use the save and load commands if you want to manually manage specific configuration files.
When using the save command, you can add a specific location where to store your configuration file. And, when
needed it, you will be able to load it with the load command:
load <URI>
Use this command to load a configuration which will replace the running configuration. Define the
location of the configuration file to be loaded. You can use a path to a local file, an SCP address, an
SFTP address, an FTP address, an HTTP address, an HTTPS address or a TFTP address.

vyos@vyos# load
Possible completions:
<Enter> Load from system config file
<file> Load from file on local machine
scp://<user>:<passwd>@<host>:/<file> Load from file on remote machine
sftp://<user>:<passwd>@<host>/<file> Load from file on remote machine
ftp://<user>:<passwd>@<host>/<file> Load from file on remote machine
http://<host>/<file> Load from file on remote machine
https://<host>/<file> Load from file on remote machine
tftp://<host>/<file> Load from file on remote machine

7.1. Terminology 392

 VyOS Documentation, Release 1.5.x (circinus)

Restore Default

In the case you want to completely delete your configuration and restore the default one, you can enter the following
command in configuration mode:

load /opt/vyatta/etc/config.boot.default

You will be asked if you want to continue. If you accept, you will have to use commit if you want to make the changes
active.
Then you may want to save in order to delete the saved configuration too.

Note: If you are remotely connected, you will lose your connection. You may want to copy first the config, edit it to
ensure connectivity, and load the edited config.

7.1. Terminology 393

 CHAPTER

EIGHT

CONFIGURATION GUIDE

The following structure respresent the cli structure.

8.1 Container

The VyOS container implementation is based on Podman as a deamonless container engine.

8.1.1 Configuration

set container name <name> image

Sets the image name in the hub registry

set container name mysql-server image mysql:8.0

If a registry is not specified, Docker.io will be used as the container registry unless an alternative registry is
specified using set container registry <name> or the registry is included in the image name

set container name mysql-server image quay.io/mysql:8.0

set container name <name> entrypoint <entrypoint>

Override the default entrypoint from the image for a container.
set container name <name> command <command>
Override the default command from the image for a container.
set container name <name> arguments <arguments>
Set the command arguments for a container.
set container name <name> host-name <hostname>
Set the host name for a container.
set container name <name> allow-host-pid
The container and the host share the same process namespace. This means that processes running on the host
are visible inside the container, and processes inside the container are visible on the host.
The command translates to “–pid host” when the container is created.
set container name <name> allow-host-networks

394
 VyOS Documentation, Release 1.5.x (circinus)

Allow host networking in a container. The network stack of the container is not isolated from the host and will
use the host IP.
The command translates to “–net host” when the container is created.

Note: allow-host-networks cannot be used with network

set container name <name> network <networkname>

Attaches user-defined network to a container. Only one network must be specified and must already exist.
set container name <name> network <networkname> address <address>
Optionally set a specific static IPv4 or IPv6 address for the container. This address must be within the named
network prefix.

Note: The first IP in the container network is reserved by the engine and cannot be used

set container name <name> description <text>

Set a container description
set container name <name> environment <key> value <value>
Add custom environment variables. Multiple environment variables are allowed. The following commands
translate to “-e key=value” when the container is created.

set container name mysql-server environment MYSQL_DATABASE value 'zabbix'

set container name mysql-server environment MYSQL_USER value 'zabbix'
set container name mysql-server environment MYSQL_PASSWORD value 'zabbix_pwd'
set container name mysql-server environment MYSQL_ROOT_PASSWORD value 'root_pwd'

set container name <name> port <portname> source <portnumber>

set container name <name> port <portname> destination <portnumber>
set container name <name> port <portname> protocol <tcp | udp>
Publish a port for the container.

set container name zabbix-web-nginx-mysql port http source 80

set container name zabbix-web-nginx-mysql port http destination 8080
set container name zabbix-web-nginx-mysql port http protocol tcp

set container name <name> volume <volumename> source <path>

set container name <name> volume <volumename> destination <path>
Mount a volume into the container

set container name coredns volume 'corefile' source /config/coredns/Corefile

set container name coredns volume 'corefile' destination /etc/Corefile

set container name <name> volume <volumename> mode <ro | rw>

Volume is either mounted as rw (read-write - default) or ro (read-only)
set container name <name> uid <number>
set container name <name> gid <number>

8.1. Container 395

 VyOS Documentation, Release 1.5.x (circinus)

Set the User ID or Group ID of the container

set container name <name> restart [no | on-failure | always]
Set the restart behavior of the container.
• no: Do not restart containers on exit
• on-failure: Restart containers when they exit with a non-zero exit code, retrying indefinitely (default)
• always: Restart containers when they exit, regardless of status, retrying indefinitely
set container name <name> cpu-quota <num>
This specifies the number of CPU resources the container can use.
Default is 0 for unlimited. For example, 1.25 limits the container to use up to 1.25 cores worth of CPU time.
This can be a decimal number with up to three decimal places.
The command translates to “–cpus=<num>” when the container is created.
set container name <name> memory <MB>
Constrain the memory available to the container.
Default is 512 MB. Use 0 MB for unlimited memory.
set container name <name> device <devicename> source <path>
set container name <name> device <devicename> destination <path>
Add a host device to the container.
set container name <name> capability <text>
Set container capabilities or permissions.
• net-admin: Network operations (interface, firewall, routing tables)
• net-bind-service: Bind a socket to privileged ports (port numbers less than 1024)
• net-raw: Permission to create raw network sockets
• setpcap: Capability sets (from bounded or inherited set)
• sys-admin: Administration operations (quotactl, mount, sethostname, setdomainame)
• sys-time: Permission to set system clock
set container name <name> sysctl parameter <parameter> value <value>
Set container sysctl values.
The subset of possible parameters are:
• Kernel Parameters: kernel.msgmax, kernel.msgmnb, kernel.msgmni, kernel.sem, kernel.shmall, ker-
nel.shmmax, kernel.shmmni, kernel.shm_rmid_forced
• Parameters beginning with fs.mqueue.*
• Parameters beginning with net.* (only if user-defined network is used)
set container name <name> label <label> value <value>
Add metadata label for this container.
set container name <name> disable
Disable a container.

8.1. Container 396

 VyOS Documentation, Release 1.5.x (circinus)

Container Networks

set container network <name>

Creates a named container network
set container network <name> description
A brief description what this network is all about.
set container network <name> prefix <ipv4|ipv6>
Define IPv4 and/or IPv6 prefix for a given network name. Both IPv4 and IPv6 can be used in parallel.
set container network <name> vrf <nme>
Bind container network to a given VRF instance.

Container Registry

set container registry <name>

Adds registry to list of unqualified-search-registries. By default, for any image that does not include the registry
in the image name, VyOS will use docker.io and quay.io as the container registry.
set container registry <name> disable
Disable a given container registry
set container registry <name> authentication username
set container registry <name> authentication password
Some container registries require credentials to be used.
Credentials can be defined here and will only be used when adding a container image to the system.

8.1.2 Operation Commands

add container image <containername>

Pull a new image for container
show container
Show the list of all active containers.
show container image
Show the local container images.
show container log <containername>
Show logs from a given container
show container network
Show a list available container networks
restart container <containername>
Restart a given container
update container image <containername>
Update container image

8.1. Container 397

 VyOS Documentation, Release 1.5.x (circinus)

delete container image [image id|all]

Delete a particular container image based on it’s image ID. You can also delete all container images at once.

8.1.3 Example Configuration

For the sake of demonstration, example #1 in the official documentation to the declarative VyOS CLI
syntax.

set container network zabbix prefix 172.20.0.0/16

set container network zabbix description 'Network for Zabbix component␣
˓→containers'

set container name mysql-server image mysql:8.0

set container name mysql-server network zabbix

set container name mysql-server environment 'MYSQL_DATABASE' value 'zabbix'

set container name mysql-server environment 'MYSQL_USER' value 'zabbix'
set container name mysql-server environment 'MYSQL_PASSWORD' value 'zabbix_pwd'
set container name mysql-server environment 'MYSQL_ROOT_PASSWORD' value 'root_
˓→pwd'

set container name zabbix-java-gateway image zabbix/zabbix-java-gateway:alpine-

˓→5.2-latest

set container name zabbix-java-gateway network zabbix

set container name zabbix-server-mysql image zabbix/zabbix-server-mysql:alpine-

˓→5.2-latest

set container name zabbix-server-mysql network zabbix

set container name zabbix-server-mysql environment 'DB_SERVER_HOST' value

˓→'mysql-server'

set container name zabbix-server-mysql environment 'MYSQL_DATABASE' value

˓→'zabbix'

set container name zabbix-server-mysql environment 'MYSQL_USER' value 'zabbix'

set container name zabbix-server-mysql environment 'MYSQL_PASSWORD' value
˓→'zabbix_pwd'

set container name zabbix-server-mysql environment 'MYSQL_ROOT_PASSWORD' value

˓→'root_pwd'

set container name zabbix-server-mysql environment 'ZBX_JAVAGATEWAY' value

˓→'zabbix-java-gateway'

set container name zabbix-server-mysql port zabbix source 10051

set container name zabbix-server-mysql port zabbix destination 10051

set container name zabbix-web-nginx-mysql image zabbix/zabbix-web-nginx-

˓→mysql:alpine-5.2-latest

set container name zabbix-web-nginx-mysql network zabbix

set container name zabbix-web-nginx-mysql environment 'MYSQL_DATABASE' value

˓→'zabbix'

set container name zabbix-web-nginx-mysql environment 'ZBX_SERVER_HOST' value

˓→'zabbix-server-mysql'

(continues on next page)

8.1. Container 398

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set container name zabbix-web-nginx-mysql environment 'DB_SERVER_HOST' value
˓→'mysql-server'

set container name zabbix-web-nginx-mysql environment 'MYSQL_USER' value

˓→'zabbix'

set container name zabbix-web-nginx-mysql environment 'MYSQL_PASSWORD' value

˓→'zabbix_pwd'

set container name zabbix-web-nginx-mysql environment 'MYSQL_ROOT_PASSWORD'␣

˓→value 'root_pwd'

set container name zabbix-web-nginx-mysql port http source 80

set container name zabbix-web-nginx-mysql port http destination 8080

8.2 Firewall

As VyOS is based on Linux it leverages its firewall. The Netfilter project created iptables and its successor nftables for
the Linux kernel to work directly on packet data flows. This now extends the concept of zone-based security to allow
for manipulating the data at multiple stages once accepted by the network interface and the driver before being handed
off to the destination (e.g., a web server OR another device).
A simplified traffic flow diagram, based on Netfilter packet flow, is shown next, in order to have a full view and under-
standing of how packets are processed, and what possible paths traffic can take.

The main points regarding this packet flow and terminology used in VyOS firewall are covered below:
• Bridge Port?: choose appropriate path based on whether interface where the packet was received is part of a
bridge, or not.
If the interface where the packet was received isn’t part of a bridge, then packet is processed at the IP Layer:
• Prerouting: All packets that are received by the router are processed in this stage, regardless of the destination of
the packet. Starting from vyos-1.5-rolling-202406120020, a new section was added to the firewall configuration.

8.2. Firewall 399

 VyOS Documentation, Release 1.5.x (circinus)

There are several actions that can be done in this stage, and currently these actions are also defined in different
parts of the VyOS configuration. Order is important, and the relevant configuration that acts in this stage are:
– Firewall prerouting: rules defined under set firewall [ipv4 | ipv6] prerouting raw.... All
rules defined in this section are processed before connection tracking subsystem.
– Conntrack Ignore: rules defined under set system conntrack ignore [ipv4 | ipv6] ....
Starting from vyos-1.5-rolling-202406120020, configuration done in this section can be done in firewall
[ipv4 | ipv6] prerouting .... For compatibility reasons, this feature is still present, but it will be
removed in the future.
– Policy Route: rules defined under set policy [route | route6] ....
– Destination NAT: rules defined under set [nat | nat66] destination....
• Destination is the router?: choose an appropriate path based on destination IP address. Transit forward contin-
ues to forward, while traffic where the destination IP address is configured on the router continues to input.
• Input: stage where traffic destined for the router itself can be filtered and controlled. This is where all rules for
securing the router should take place. This includes ipv4 and ipv6 filtering rules, defined in:
– set firewall ipv4 input filter ....
– set firewall ipv6 input filter ....
• Forward: stage where transit traffic can be filtered and controlled. This includes ipv4 and ipv6 filtering rules,
defined in:
– set firewall ipv4 forward filter ....
– set firewall ipv6 forward filter ....
• Output: stage where traffic that originates from the router itself can be filtered and controlled. Bear in mind that
this traffic can be a new connection originated by a internal process running on the VyOS router such as NTP,
or a response to traffic received externally through input (for example response to an ssh login attempt to the
router). This includes ipv4 and ipv6 rules, and two different sections are present:
– Output Prerouting: set firewall [ipv4 | ipv6] output filter .... As described in Prerout-
ing, rules defined in this section are processed before connection tracking subsystem.
– Output Filter: set firewall [ipv4 | ipv6] output filter ....
• Postrouting: as in Prerouting, several actions defined in different parts of VyOS configuration are performed
in this stage. This includes:
– Source NAT: rules defined under set [nat | nat66] destination....
If the interface where the packet was received is part of a bridge, then the packet is processed at the Bridge Layer,
which contains a basic setup for bridge filtering:
• Forward (Bridge): stage where traffic that is trespassing through the bridge is filtered and controlled:
– set firewall bridge forward filter ....
The main structure of the VyOS firewall CLI is shown next:

- set firewall
* bridge
- forward
+ filter
* flowtable
- custom_flow_table
+ ...
(continues on next page)

8.2. Firewall 400

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

* global-options
+ all-ping
+ broadcast-ping
+ ...
* group
- address-group
- ipv6-address-group
- network-group
- ipv6-network-group
- interface-group
- mac-group
- port-group
- domain-group
* ipv4
- forward
+ filter
- input
+ filter
- output
+ filter
+ raw
- prerouting
+ raw
- name
+ custom_name
* ipv6
- forward
+ filter
- input
+ filter
- output
+ filter
+ raw
- prerouting
+ raw
- ipv6-name
+ custom_name
* zone
- custom_zone_name
+ ...

Please, refer to appropriate section for more information about firewall configuration:

8.2. Firewall 401

 VyOS Documentation, Release 1.5.x (circinus)

8.2.1 Global Options Firewall Configuration

Overview

Some firewall settings are global and have an affect on the whole system. In this section there’s useful information
about these global-options that can be configured using vyos cli.
Configuration commands covered in this section:
set firewall global-options ...

Configuration

set firewall global-options all-ping [enable | disable]

By default, when VyOS receives an ICMP echo request packet destined for itself, it will answer with an ICMP
echo reply, unless you prevent it through its firewall.
With the firewall you can set rules to accept, drop or reject ICMP in, out or local traffic. You can also use the
general firewall all-ping command. This command affects only to LOCAL (packets destined for your VyOS
system), not to IN or OUT traffic.

Note: firewall global-options all-ping affects only to LOCAL and it always behaves in the most restrictive
way

set firewall global-options all-ping enable

When the command above is set, VyOS will answer every ICMP echo request addressed to itself, but that will
only happen if no other rule is applied dropping or rejecting local echo requests. In case of conflict, VyOS will
not answer ICMP echo requests.

set firewall global-options all-ping disable

When the command above is set, VyOS will answer no ICMP echo request addressed to itself at all, no matter
where it comes from or whether more specific rules are being applied to accept them.
set firewall global-options broadcast-ping [enable | disable]
This setting enables or disables the response to icmp broadcast messages. The following system parameter will
be altered:
• net.ipv4.icmp_echo_ignore_broadcasts
set firewall global-options ip-src-route [enable | disable]
set firewall global-options ipv6-src-route [enable | disable]
This setting handles if VyOS accepts packets with a source route option. The following system parameters will
be altered:
• net.ipv4.conf.all.accept_source_route
• net.ipv6.conf.all.accept_source_route
set firewall global-options receive-redirects [enable | disable]
set firewall global-options ipv6-receive-redirects [enable | disable]

8.2. Firewall 402

 VyOS Documentation, Release 1.5.x (circinus)

Enable or disable ICMPv4 or ICMPv6 redirect messages being accepted by VyOS. The following system pa-
rameters will be altered:
• net.ipv4.conf.all.accept_redirects
• net.ipv6.conf.all.accept_redirects
set firewall global-options send-redirects [enable | disable]
Enable or disable ICMPv4 redirect messages being sent by VyOS The following system parameter will be
altered:
• net.ipv4.conf.all.send_redirects
set firewall global-options log-martians [enable | disable]
Enable or disable the logging of martian IPv4 packets. The following system parameter will be altered:
• net.ipv4.conf.all.log_martians
set firewall global-options source-validation [strict | loose | disable]
Set the IPv4 source validation mode. The following system parameter will be altered:
• net.ipv4.conf.all.rp_filter
set firewall global-options syn-cookies [enable | disable]
Enable or disable if VyOS uses IPv4 TCP SYN Cookies. The following system parameter will be altered:
• net.ipv4.tcp_syncookies
set firewall global-options twa-hazards-protection [enable | disable]
Enable or Disable VyOS to be RFC 1337 conformant. The following system parameter will be altered:
• net.ipv4.tcp_rfc1337
set firewall global-options state-policy established action [accept | drop | reject]
set firewall global-options state-policy established log
set firewall global-options state-policy established log-level [emerg | alert | crit |
err | warn | notice | info | debug]
Set the global setting for an established connection.
set firewall global-options state-policy invalid action [accept | drop | reject]
set firewall global-options state-policy invalid log
set firewall global-options state-policy invalid log-level [emerg | alert | crit | err |
warn | notice | info | debug]
Set the global setting for invalid packets.
set firewall global-options state-policy related action [accept | drop | reject]
set firewall global-options state-policy related log
set firewall global-options state-policy related log-level [emerg | alert | crit | err |
warn | notice | info | debug]
Set the global setting for related connections.
VyOS supports setting timeouts for connections according to the connection type. You can set timeout values for
generic connections, for ICMP connections, UDP connections, or for TCP connections in a number of different states.
set firewall global-options timeout icmp <1-21474836>

8.2. Firewall 403

 VyOS Documentation, Release 1.5.x (circinus)

set firewall global-options timeout other <1-21474836>

set firewall global-options timeout tcp close <1-21474836>
set firewall global-options timeout tcp close-wait <1-21474836>
set firewall global-options timeout tcp established <1-21474836>
set firewall global-options timeout tcp fin-wait <1-21474836>
set firewall global-options timeout tcp last-ack <1-21474836>
set firewall global-options timeout tcp syn-recv <1-21474836>
set firewall global-options timeout tcp syn-sent <1-21474836>
set firewall global-options timeout tcp time-wait <1-21474836>
set firewall global-options timeout udp other <1-21474836>
set firewall global-options timeout udp stream <1-21474836>
Set the timeout in seconds for a protocol or state.

8.2.2 Firewall groups

Configuration

Firewall groups represent collections of IP addresses, networks, ports, mac addresses, domains or interfaces. Once
created, a group can be referenced by firewall, nat and policy route rules as either a source or destination matcher,
and/or as inbound/outbound in the case of interface group.

Address Groups

In an address group a single IP address or IP address range is defined.

set firewall group address-group <name> address [address | address range]
set firewall group ipv6-address-group <name> address <address>
Define a IPv4 or a IPv6 address group

set firewall group address-group ADR-INSIDE-v4 address 192.168.0.1

set firewall group address-group ADR-INSIDE-v4 address 10.0.0.1-10.0.0.8
set firewall group ipv6-address-group ADR-INSIDE-v6 address 2001:db8::1

set firewall group address-group <name> description <text>

set firewall group ipv6-address-group <name> description <text>
Provide a IPv4 or IPv6 address group description

8.2. Firewall 404

 VyOS Documentation, Release 1.5.x (circinus)

Network Groups

While network groups accept IP networks in CIDR notation, specific IP addresses can be added as a 32-bit prefix. If
you foresee the need to add a mix of addresses and networks, then a network group is recommended.
set firewall group network-group <name> network <CIDR>
set firewall group ipv6-network-group <name> network <CIDR>
Define a IPv4 or IPv6 Network group.

set firewall group network-group NET-INSIDE-v4 network 192.168.0.0/24

set firewall group network-group NET-INSIDE-v4 network 192.168.1.0/24
set firewall group ipv6-network-group NET-INSIDE-v6 network 2001:db8::/64

set firewall group network-group <name> description <text>

set firewall group ipv6-network-group <name> description <text>
Provide an IPv4 or IPv6 network group description.

Interface Groups

An interface group represents a collection of interfaces.

set firewall group interface-group <name> interface <text>
Define an interface group. Wildcard are accepted too.

set firewall group interface-group LAN interface bond1001

set firewall group interface-group LAN interface eth3*

set firewall group interface-group <name> description <text>

Provide an interface group description

Port Groups

A port group represents only port numbers, not the protocol. Port groups can be referenced for either TCP or UDP.
It is recommended that TCP and UDP groups are created separately to avoid accidentally filtering unnecessary ports.
Ranges of ports can be specified by using -.
set firewall group port-group <name> port [portname | portnumber | startport-endport]
Define a port group. A port name can be any name defined in /etc/services. e.g.: http

set firewall group port-group PORT-TCP-SERVER1 port http

set firewall group port-group PORT-TCP-SERVER1 port 443
set firewall group port-group PORT-TCP-SERVER1 port 5000-5010

set firewall group port-group <name> description <text>

Provide a port group description.

8.2. Firewall 405

 VyOS Documentation, Release 1.5.x (circinus)

MAC Groups

A mac group represents a collection of mac addresses.

set firewall group mac-group <name> mac-address <mac-address>
Define a mac group.

set firewall group mac-group MAC-G01 mac-address 88:a4:c2:15:b6:4f

set firewall group mac-group MAC-G01 mac-address 4c:d5:77:c0:19:81

set firewall group mac-group <name> description <text>

Provide a mac group description.

Domain Groups

A domain group represents a collection of domains.

set firewall group domain-group <name> address <domain>
Define a domain group.

set firewall group domain-group DOM address example.com

set firewall group domain-group <name> description <text>

Provide a domain group description.

Dynamic Groups

Firewall dynamic groups are different from all the groups defined previously because, not only they can be used as
source/destination in firewall rules, but members of these groups are not defined statically using vyos configuration.
Instead, members of these groups are added dynamically using firewall rules.

Defining Dynamic Address Groups

Dynamic address group is supported by both IPv4 and IPv6 families. Commands used to define dynamic IPv4|IPv6
address groups are:
set firewall group dynamic-group address-group <name>
set firewall group dynamic-group ipv6-address-group <name>
Add description to firewall groups:
set firewall group dynamic-group address-group <name> description <text>
set firewall group dynamic-group ipv6-address-group <name> description <text>

8.2. Firewall 406

 VyOS Documentation, Release 1.5.x (circinus)

Adding elements to Dynamic Firewall Groups

Once dynamic firewall groups are defined, they should be used in firewall rules in order to dynamically add elements
to it.
Commands used for this task are:
• Add destination IP address of the connection to a dynamic address group:
set firewall ipv4 [forward | input | output] filter rule <1-999999> add-address-to-group
destination-address address-group <name>
set firewall ipv4 name <name> rule <1-999999> add-address-to-group destination-address
address-group <name>
set firewall ipv6 [forward | input | output] filter rule <1-999999> add-address-to-group
destination-address address-group <name>
set firewall ipv6 name <name> rule <1-999999> add-address-to-group destination-address
address-group <name>
• Add source IP address of the connection to a dynamic address group:
set firewall ipv4 [forward | input | output] filter rule <1-999999> add-address-to-group
source-address address-group <name>
set firewall ipv4 name <name> rule <1-999999> add-address-to-group source-address
address-group <name>
set firewall ipv6 [forward | input | output] filter rule <1-999999> add-address-to-group
source-address address-group <name>
set firewall ipv6 name <name> rule <1-999999> add-address-to-group source-address
address-group <name>
Also, specific timeouts can be defined per rule. In case rule gets a hit, a source or destinatination address will be added
to the group, and this element will remain in the group until the timeout expires. If no timeout is defined, then the
element will remain in the group until next reboot, or until a new commit that changes firewall configuration is done.
set firewall ipv4 [forward | input | output] filter rule <1-999999> add-address-to-group
[destination-address | source-address] timeout <timeout>
set firewall ipv4 name <name> rule <1-999999> add-address-to-group [destination-address |
source-address] timeout <timeout>
set firewall ipv6 [forward | input | output] filter rule <1-999999> add-address-to-group
[destination-address | source-address] timeout <timeout>
set firewall ipv6 name <name> rule <1-999999> add-address-to-group [destination-address |
source-address] timeout <timeout>
Timeout can be defined using seconds, minutes, hours or days:

set firewall ipv6 name FOO rule 10 add-address-to-group source-address timeout

Possible completions:
<number>s Timeout value in seconds
<number>m Timeout value in minutes
<number>h Timeout value in hours
<number>d Timeout value in days

8.2. Firewall 407

 VyOS Documentation, Release 1.5.x (circinus)

Using Dynamic Firewall Groups

As any other firewall group, dynamic firewall groups can be used in firewall rules as matching options. For example:

Examples

General example

As said before, once firewall groups are created, they can be referenced either in firewall, nat, nat66 and/or policy-route
rules.
Here is an example were multiple groups are created:

set firewall group address-group SERVERS address 198.51.100.101

set firewall group address-group SERVERS address 198.51.100.102
set firewall group network-group TRUSTEDv4 network 192.0.2.0/30
set firewall group network-group TRUSTEDv4 network 203.0.113.128/25
set firewall group ipv6-network-group TRUSTEDv6 network 2001:db8::/64
set firewall group interface-group LAN interface eth2.2001
set firewall group interface-group LAN interface bon0
set firewall group port-group PORT-SERVERS port http
set firewall group port-group PORT-SERVERS port 443
set firewall group port-group PORT-SERVERS port 5000-5010

And next, some configuration example where groups are used:

set firewall ipv4 output filter rule 10 action accept

set firewall ipv4 output filter rule 10 outbound-interface group !LAN
set firewall ipv4 forward filter rule 20 action accept
set firewall ipv4 forward filter rule 20 source group network-group TRUSTEDv4
set firewall ipv6 input filter rule 10 action accept
set firewall ipv6 input filter rule 10 source group network-group TRUSTEDv6
set nat destination rule 101 inbound-interface group LAN
set nat destination rule 101 destination group address-group SERVERS
set nat destination rule 101 protocol tcp
set nat destination rule 101 destination group port-group PORT-SERVERS
set nat destination rule 101 translation address 203.0.113.250
set policy route PBR rule 201 destination group port-group PORT-SERVERS
set policy route PBR rule 201 protocol tcp
set policy route PBR rule 201 set table 15

Port knocking example

Using dynamic firewall groups, we can secure access to the router, or any other device if needed, by using the technique
of port knocking.
A 4 step port knocking example is shown next:

set firewall global-options state-policy established action 'accept'

set firewall global-options state-policy invalid action 'drop'
set firewall global-options state-policy related action 'accept'
set firewall group dynamic-group address-group ALLOWED
(continues on next page)

8.2. Firewall 408

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set firewall group dynamic-group address-group PN_01
set firewall group dynamic-group address-group PN_02
set firewall ipv4 input filter default-action 'drop'
set firewall ipv4 input filter rule 5 action 'accept'
set firewall ipv4 input filter rule 5 protocol 'icmp'
set firewall ipv4 input filter rule 10 action 'drop'
set firewall ipv4 input filter rule 10 add-address-to-group source-address␣
˓→address-group 'PN_01'

set firewall ipv4 input filter rule 10 add-address-to-group source-address␣

˓→timeout '2m'

set firewall ipv4 input filter rule 10 description 'Port_nock 01'

set firewall ipv4 input filter rule 10 destination port '9990'
set firewall ipv4 input filter rule 10 protocol 'tcp'
set firewall ipv4 input filter rule 20 action 'drop'
set firewall ipv4 input filter rule 20 add-address-to-group source-address␣
˓→address-group 'PN_02'

set firewall ipv4 input filter rule 20 add-address-to-group source-address␣

˓→timeout '3m'

set firewall ipv4 input filter rule 20 description 'Port_nock 02'

set firewall ipv4 input filter rule 20 destination port '9991'
set firewall ipv4 input filter rule 20 protocol 'tcp'
set firewall ipv4 input filter rule 20 source group dynamic-address-group 'PN_
˓→01'

set firewall ipv4 input filter rule 30 action 'drop'

set firewall ipv4 input filter rule 30 add-address-to-group source-address␣
˓→address-group 'ALLOWED'

set firewall ipv4 input filter rule 30 add-address-to-group source-address␣

˓→timeout '2h'

set firewall ipv4 input filter rule 30 description 'Port_nock 03'

set firewall ipv4 input filter rule 30 destination port '9992'
set firewall ipv4 input filter rule 30 protocol 'tcp'
set firewall ipv4 input filter rule 30 source group dynamic-address-group 'PN_
˓→02'

set firewall ipv4 input filter rule 99 action 'accept'

set firewall ipv4 input filter rule 99 description 'Port_nock 04 - Allow ssh'
set firewall ipv4 input filter rule 99 destination port '22'
set firewall ipv4 input filter rule 99 protocol 'tcp'
set firewall ipv4 input filter rule 99 source group dynamic-address-group
˓→'ALLOWED'

Before testing, we can check the members of firewall groups:

vyos@vyos# run show firewall group

Firewall Groups

Name Type References Members Timeout ␣

˓→ Expires
------- ---------------------- -------------------- ------------- ---------
˓→ ---------
ALLOWED address_group(dynamic) ipv4-input-filter-30 N/D N/D ␣
˓→ N/D
PN_01 address_group(dynamic) ipv4-input-filter-10 N/D N/D ␣
(continues on next page)

8.2. Firewall 409

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

˓→ N/D
PN_02 address_group(dynamic) ipv4-input-filter-20 N/D N/D ␣
˓→ N/D
[edit]
vyos@vyos#

With this configuration, in order to get ssh access to the router, the user needs to:
1. Generate a new TCP connection with destination port 9990. As shown next, a new entry was added to dynamic
firewall group PN_01

vyos@vyos# run show firewall group

Firewall Groups

Name Type References Members Timeout ␣

˓→ Expires
------- ---------------------- -------------------- ------------- ---------
˓→ ---------
ALLOWED address_group(dynamic) ipv4-input-filter-30 N/D N/D ␣
˓→ N/D
PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.89.31 120 ␣
˓→ 119
PN_02 address_group(dynamic) ipv4-input-filter-20 N/D N/D ␣
˓→ N/D
[edit]
vyos@vyos#

2. Generate a new TCP connection with destination port 9991. As shown next, a new entry was added to dynamic
firewall group PN_02

vyos@vyos# run show firewall group

Firewall Groups

Name Type References Members Timeout ␣

˓→ Expires
------- ---------------------- -------------------- ------------- ---------
˓→ ---------
ALLOWED address_group(dynamic) ipv4-input-filter-30 N/D N/D ␣
˓→ N/D
PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.89.31 120 ␣
˓→ 106
PN_02 address_group(dynamic) ipv4-input-filter-20 192.168.89.31 180 ␣
˓→ 179
[edit]
vyos@vyos#

3. Generate a new TCP connection with destination port 9992. As shown next, a new entry was added to dynamic
firewall group ALLOWED

vyos@vyos# run show firewall group

Firewall Groups

Name Type References Members Timeout ␣

(continues on next page)

8.2. Firewall 410

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

˓→ Expires
------- ---------------------- -------------------- ------------- ---------
˓→ ---------
ALLOWED address_group(dynamic) ipv4-input-filter-30 192.168.89.31 ␣
˓→7200 7199
PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.89.31 ␣
˓→120 89
PN_02 address_group(dynamic) ipv4-input-filter-20 192.168.89.31 ␣
˓→180 170
[edit]
vyos@vyos#

4. Now the user can connect through ssh to the router (assuming ssh is configured).

Operation-mode

show firewall group

show firewall group <name>
Overview of defined groups. You see the firewall group name, type, references (where the group is used),
members, timeout and expiration (last two only present in dynamic firewall groups).
Here is an example of such command:

vyos@vyos:~$ show firewall group

Firewall Groups

Name Type References Members ␣

˓→ Timeout Expires
------------ ---------------------- ---------------------- ----------------␣
˓→ --------- ---------
SERVERS address_group nat-destination-101 198.51.100.101
198.51.100.102
ALLOWED address_group(dynamic) ipv4-input-filter-30 192.168.77.39 ␣
˓→ 7200 7174
PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.0.245 ␣
˓→ 120 112
192.168.77.39 ␣
˓→ 120 85
PN_02 address_group(dynamic) ipv4-input-filter-20 192.168.77.39 ␣
˓→ 180 151
LAN interface_group ipv4-output-filter-10 bon0
nat-destination-101 eth2.2001
TRUSTEDv6 ipv6_network_group ipv6-input-filter-10 2001:db8::/64
TRUSTEDv4 network_group ipv4-forward-filter-20 192.0.2.0/30
203.0.113.128/25
PORT-SERVERS port_group route-PBR-201 443
route-PBR-201 5000-5010
nat-destination-101 http
vyos@vyos:~$

8.2. Firewall 411

 VyOS Documentation, Release 1.5.x (circinus)

8.2.3 Bridge Firewall Configuration

Note: Documentation under development

Overview

In this section there’s useful information on all firewall configuration that can be done regarding bridges, and appropriate
op-mode commands. Configuration commands covered in this section:
set firewall bridge ...
From the main structure defined in Firewall Overview in this section you can find detailed information only for the next
part of the general structure:

- set firewall
* bridge
- forward
+ filter
- name
+ custom_name

Traffic which is received by the router on an interface which is member of a bridge is processed on the Bridge Layer.
A simplified packet flow diagram for this layer is shown next:

For traffic that needs to be forwarded internally by the bridge, base chain is is forward, and it’s base command for
filtering is set firewall bridge forward filter ..., which happens in stage 4, highlighted with red color.
Custom bridge firewall chains can be created with the command set firewall bridge name <name> .... In
order to use such custom chain, a rule with action jump, and the appropriate target should be defined in a base chain.

Note: Layer 3 bridge: When an IP address is assigned to the bridge interface, and if traffic is sent to the router to
this IP (for example using such IP as default gateway), then rules defined for bridge firewall won’t match, and firewall
analysis continues at IP layer.

8.2. Firewall 412

 VyOS Documentation, Release 1.5.x (circinus)

Bridge Rules

For firewall filtering, firewall rules need to be created. Each rule is numbered, has an action to apply if the rule is
matched, and the ability to specify multiple matching criteria. Data packets go through the rules from 1 - 999999, so
order is crucial. At the first match the action of the rule will be executed.

Actions

If a rule is defined, then an action must be defined for it. This tells the firewall what to do if all matching criterea in the
rule are met.
In firewall bridge rules, the action can be:
• accept: accept the packet.
• continue: continue parsing next rule.
• drop: drop the packet.
• jump: jump to another custom chain.
• return: Return from the current chain and continue at the next rule of the last chain.
• queue: Enqueue packet to userspace.
set firewall bridge forward filter rule <1-999999> action [accept | continue | drop |
jump | queue | return]
set firewall bridge name <name> rule <1-999999> action [accept | continue | drop | jump |
queue | return]
This required setting defines the action of the current rule. If action is set to jump, then jump-target is also
needed.
set firewall bridge forward filter rule <1-999999> jump-target <text>
set firewall bridge name <name> rule <1-999999> jump-target <text>
set firewall bridge forward filter rule <1-999999> queue <0-65535>
set firewall bridge name <name> rule <1-999999> queue <0-65535>
To be used only when action is set to queue. Use this command to specify the queue target to use. Queue range
is also supported.
set firewall bridge forward filter rule <1-999999> queue-options bypass
set firewall bridge name <name> rule <1-999999> queue-options bypass
To be used only when action is set to queue. Use this command to let packet go through firewall when no
userspace software is connected to the queue.
set firewall bridge forward filter rule <1-999999> queue-options fanout
set firewall bridge name <name> rule <1-999999> queue-options fanout
To be used only when action is set to queue. Use this command to distribute packets between several queues.
Also, default-action is an action that takes place whenever a packet does not match any rule in its’ chain. For base
chains, possible options for default-action are accept or drop.
set firewall bridge forward filter default-action [accept | drop]
set firewall bridge name <name> default-action [accept | continue | drop | jump | queue |
return]

8.2. Firewall 413

 VyOS Documentation, Release 1.5.x (circinus)

This sets the default action of the rule-set if a packet does not match any of the rules in that chain. If default-
action is set to jump, then default-jump-target is also needed. Note that for base chains, default action can
only be set to accept or drop, while on custom chains more actions are available.
set firewall bridge name <name> default-jump-target <text>
To be used only when default-action is set to jump. Use this command to specify jump target for default
rule.

Note: Important note about default-actions: If the default action for any base chain is not defined, then the default
action is set to accept for that chain. For custom chains, if the default action is not defined, then the default-action is
set to drop.

Firewall Logs

Logging can be enable for every single firewall rule. If enabled, other log options can be defined.
set firewall bridge forward filter rule <1-999999> log
set firewall bridge name <name> rule <1-999999> log
Enable logging for the matched packet. If this configuration command is not present, then the log is not enabled.
set firewall bridge forward filter default-log
set firewall bridge name <name> default-log
Use this command to enable the logging of the default action on the specified chain.
set firewall bridge forward filter rule <1-999999> log-options level [emerg | alert |
crit | err | warn | notice | info | debug]
set firewall bridge name <name> rule <1-999999> log-options level [emerg | alert | crit |
err | warn | notice | info | debug]
Define log-level. Only applicable if rule log is enabled.
set firewall bridge forward filter rule <1-999999> log-options group <0-65535>
set firewall bridge name <name> rule <1-999999> log-options group <0-65535>
Define the log group to send messages to. Only applicable if rule log is enabled.
set firewall bridge forward filter rule <1-999999> log-options snapshot-length <0-9000>
set firewall bridge name <name> rule <1-999999> log-options snapshot-length <0-9000>
Define length of packet payload to include in netlink message. Only applicable if rule log is enabled and the log
group is defined.
set firewall bridge forward filter rule <1-999999> log-options queue-threshold <0-65535>
set firewall bridge name <name> rule <1-999999> log-options queue-threshold <0-65535>
Define the number of packets to queue inside the kernel before sending them to userspace. Only applicable if
rule log is enabled and the log group is defined.

8.2. Firewall 414

 VyOS Documentation, Release 1.5.x (circinus)

Firewall Description

For reference, a description can be defined for every defined custom chain.
set firewall bridge name <name> description <text>
Provide a rule-set description to a custom firewall chain.

Rule Status

When defining a rule, it is enabled by default. In some cases, it is useful to just disable the rule, rather than removing
it.
set firewall bridge forward filter rule <1-999999> disable
set firewall bridge name <name> rule <1-999999> disable
Command for disabling a rule but keep it in the configuration.

Matching criteria

There are a lot of matching criteria against which the packet can be tested.
set firewall bridge forward filter rule <1-999999> destination mac-address <mac-address>
set firewall bridge name <name> rule <1-999999> destination mac-address <mac-address>
set firewall bridge forward filter rule <1-999999> source mac-address <mac-address>
set firewall bridge name <name> rule <1-999999> source mac-address <mac-address>
Match criteria based on source and/or destination mac-address.
set firewall bridge forward filter rule <1-999999> inbound-interface name <iface>
set firewall bridge name <name> rule <1-999999> inbound-interface name <iface>
Match based on inbound interface. Wildcard * can be used. For example: eth2*. Prepending character ! for
inverted matching criteria is also supported. For example !eth2
set firewall bridge forward filter rule <1-999999> inbound-interface group <iface_group>
set firewall bridge name <name> rule <1-999999> inbound-interface group <iface_group>
Match based on inbound interface group. Prepending character ! for inverted matching criteria is also supported.
For example !IFACE_GROUP
set firewall bridge forward filter rule <1-999999> outbound-interface name <iface>
set firewall bridge name <name> rule <1-999999> outbound-interface name <iface>
Match based on outbound interface. Wildcard * can be used. For example: eth2*. Prepending character ! for
inverted matching criteria is also supported. For example !eth2
set firewall bridge forward filter rule <1-999999> outbound-interface group <iface_group>
set firewall bridge name <name> rule <1-999999> outbound-interface group <iface_group>
Match based on outbound interface group. Prepending character ! for inverted matching criteria is also sup-
ported. For example !IFACE_GROUP
set firewall bridge forward filter rule <1-999999> vlan id <0-4096>
set firewall bridge name <name> rule <1-999999> vlan id <0-4096>

8.2. Firewall 415

 VyOS Documentation, Release 1.5.x (circinus)

Match based on vlan ID. Range is also supported.

set firewall bridge forward filter rule <1-999999> vlan priority <0-7>
set firewall bridge name <name> rule <1-999999> vlan priority <0-7>
Match based on vlan priority(pcp). Range is also supported.

Operation-mode Firewall

Rule-set overview

In this section you can find all useful firewall op-mode commands.
General commands for firewall configuration, counter and statistics:
show firewall
show firewall summary
show firewall statistics
And, to print only bridge firewall information:
show firewall bridge
show firewall bridge forward filter
show firewall bridge forward filter rule <rule>
show firewall bridge name <name>
show firewall bridge name <name> rule <rule>

Show Firewall log

show log firewall

show log firewall bridge
show log firewall bridge forward
show log firewall bridge forward filter
show log firewall bridge name <name>
show log firewall bridge forward filter rule <rule>
show log firewall bridge name <name> rule <rule>
Show the logs of all firewall; show all bridge firewall logs; show all logs for forward hook; show all logs for
forward hook and priority filter; show all logs for particular custom chain; show logs for specific Rule-Set.

8.2. Firewall 416

 VyOS Documentation, Release 1.5.x (circinus)

Example

Configuration example:

set firewall bridge forward filter default-action 'drop'

set firewall bridge forward filter default-log
set firewall bridge forward filter rule 10 action 'continue'
set firewall bridge forward filter rule 10 inbound-interface name 'eth2'
set firewall bridge forward filter rule 10 vlan id '22'
set firewall bridge forward filter rule 20 action 'drop'
set firewall bridge forward filter rule 20 inbound-interface group 'TRUNK-RIGHT'
set firewall bridge forward filter rule 20 vlan id '60'
set firewall bridge forward filter rule 30 action 'jump'
set firewall bridge forward filter rule 30 jump-target 'TEST'
set firewall bridge forward filter rule 30 outbound-interface name '!eth1'
set firewall bridge forward filter rule 35 action 'accept'
set firewall bridge forward filter rule 35 vlan id '11'
set firewall bridge forward filter rule 40 action 'continue'
set firewall bridge forward filter rule 40 destination mac-address '66:55:44:33:22:11'
set firewall bridge forward filter rule 40 source mac-address '11:22:33:44:55:66'
set firewall bridge name TEST default-action 'accept'
set firewall bridge name TEST default-log
set firewall bridge name TEST rule 10 action 'continue'
set firewall bridge name TEST rule 10 log
set firewall bridge name TEST rule 10 vlan priority '0'

And op-mode commands:

vyos@BRI:~$ show firewall bridge

Rulesets bridge Information

---------------------------------
bridge Firewall "forward filter"

Rule Action Protocol Packets Bytes Conditions

------- -------- ---------- --------- ------- --------------------------------------
˓→-------------------------------

10 continue all 0 0 iifname "eth2" vlan id 22 continue

20 drop all 0 0 iifname @I_TRUNK-RIGHT vlan id 60
30 jump all 2130 170688 oifname != "eth1" jump NAME_TEST
35 accept all 2080 168616 vlan id 11 accept
40 continue all 0 0 ether daddr 66:55:44:33:22:11 ether␣
˓→saddr 11:22:33:44:55:66 continue
default drop all 0 0

---------------------------------
bridge Firewall "name TEST"

Rule Action Protocol Packets Bytes Conditions

------- -------- ---------- --------- ------- --------------------------------------
˓→------------

10 continue all 2130 170688 vlan pcp 0 prefix "[bri-NAM-TEST-10-

˓→C]" continue
(continues on next page)

8.2. Firewall 417

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

default accept all 2130 170688

vyos@BRI:~$
vyos@BRI:~$ show firewall bridge name TEST
Ruleset Information

---------------------------------
bridge Firewall "name TEST"

Rule Action Protocol Packets Bytes Conditions

------- -------- ---------- --------- ------- --------------------------------------
˓→------------

10 continue all 2130 170688 vlan pcp 0 prefix "[bri-NAM-TEST-10-

˓→C]" continue
default accept all 2130 170688

vyos@BRI:~$

Inspect logs:

vyos@BRI:~$ show log firewall bridge

Dec 05 14:37:47 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800␣
˓→OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.

˓→11.11.102

Dec 05 14:37:48 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800␣

˓→OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.

˓→11.11.102

Dec 05 14:37:49 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800␣

˓→OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.

˓→11.11.102

...
vyos@BRI:~$ show log firewall bridge forward filter
Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1␣
˓→MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd␣

˓→SRC=0000:0000:0000:0000:0000:0000:0000:0000␣

˓→DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0␣

˓→PROTO=ICMPv6 TYPE=143 CODE=0

Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1␣

˓→MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd␣

˓→SRC=0000:0000:0000:0000:0000:0000:0000:0000␣

˓→DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0␣

˓→PROTO=ICMPv6 TYPE=143 CODE=0

8.2. Firewall 418

 VyOS Documentation, Release 1.5.x (circinus)

8.2.4 IPv4 Firewall Configuration

Overview

In this section there’s useful information on all firewall configuration that can be done regarding IPv4, and appropriate
op-mode commands. Configuration commands covered in this section:
set firewall ipv4 ...
From the main structure defined in Firewall Overview in this section you can find detailed information only for the next
part of the general structure:

- set firewall
* ipv4
- forward
+ filter
- input
+ filter
- output
+ filter
+ raw
- prerouting
+ raw
- name
+ custom_name

First, all traffic is received by the router, and it is processed in the prerouting section.
This stage includes:
• Firewall Prerouting: commands found under set firewall ipv4 prerouting raw ...
• Conntrack Ignore: set system conntrack ignore ipv4...
• Policy Route: commands found under set policy route ...
• Destination NAT : commands found under set nat destination ...
For transit traffic, which is received by the router and forwarded, the base chain is forward. A simplified packet flow
diagram for transit traffic is shown next:

The base firewall chain to configure filtering rules for transit traffic is set firewall ipv4 forward filter ...,
which happens in stage 5, highlighted in the color red.
For traffic towards the router itself, the base chain is input, while traffic originated by the router has the base chain
output. A new simplified packet flow diagram is shown next, which shows the path for traffic destined to the router

8.2. Firewall 419

 VyOS Documentation, Release 1.5.x (circinus)

itself, and traffic generated by the router (starting from circle number 6):

The base chain for traffic towards the router is set firewall ipv4 input filter ...
And the base chain for traffic generated by the router is set firewall ipv4 output ..., where two sub-chains are
available: filter and raw:
• Output Prerouting: set firewall ipv4 output raw .... As described in Prerouting, rules defined in
this section are processed before connection tracking subsystem.
• Output Filter: set firewall ipv4 output filter .... Rules defined in this section are processed after
connection tracking subsystem.

Note: Important note about default-actions: If a default action for any base chain is not defined, then the default
action is set to accept for that chain. For custom chains, if the default action is not defined, then the default-action is
set to drop

Custom firewall chains can be created, with commands set firewall ipv4 name <name> .... In order to use
such custom chain, a rule with action jump, and the appropriate target should be defined in a base chain.

Firewall - IPv4 Rules

For firewall filtering, firewall rules need to be created. Each rule is numbered, has an action to apply if the rule is
matched, and the ability to specify multiple matching criteria. Data packets go through the rules from 1 - 999999, so
order is crucial. At the first match the action of the rule will be executed.

Actions

If a rule is defined, then an action must be defined for it. This tells the firewall what to do if all of the criteria defined
for that rule match.
The action can be :
• accept: accept the packet.
• continue: continue parsing next rule.
• drop: drop the packet.

8.2. Firewall 420

 VyOS Documentation, Release 1.5.x (circinus)

• reject: reject the packet.

• jump: jump to another custom chain.
• return: Return from the current chain and continue at the next rule of the last chain.
• queue: Enqueue packet to userspace.
• synproxy: synproxy the packet.
set firewall ipv4 forward filter rule <1-999999> action [accept | continue | drop | jump
| queue | reject | return | synproxy]
set firewall ipv4 input filter rule <1-999999> action [accept | continue | drop | jump |
queue | reject | return | synproxy]
set firewall ipv4 output filter rule <1-999999> action [accept | continue | drop | jump |
queue | reject | return]
set firewall ipv4 name <name> rule <1-999999> action [accept | continue | drop | jump |
queue | reject | return]
This required setting defines the action of the current rule. If the action is set to jump, then a jump-target is also
needed.
set firewall ipv4 forward filter rule <1-999999> jump-target <text>
set firewall ipv4 input filter rule <1-999999> jump-target <text>
set firewall ipv4 output filter rule <1-999999> jump-target <text>
set firewall ipv4 name <name> rule <1-999999> jump-target <text>
To be used only when action is set to jump. Use this command to specify the jump target.
set firewall ipv4 forward filter rule <1-999999> queue <0-65535>
set firewall ipv4 input filter rule <1-999999> queue <0-65535>
set firewall ipv4 output filter rule <1-999999> queue <0-65535>
set firewall ipv4 name <name> rule <1-999999> queue <0-65535>
To be used only when action is set to queue. Use this command to specify the queue target to use. Queue range
is also supported.
set firewall ipv4 forward filter rule <1-999999> queue-options bypass
set firewall ipv4 input filter rule <1-999999> queue-options bypass
set firewall ipv4 output filter rule <1-999999> queue-options bypass
set firewall ipv4 name <name> rule <1-999999> queue-options bypass
To be used only when action is set to queue. Use this command to let the packet go through firewall when no
userspace software is connected to the queue.
set firewall ipv4 forward filter rule <1-999999> queue-options fanout
set firewall ipv4 input filter rule <1-999999> queue-options fanout
set firewall ipv4 output filter rule <1-999999> queue-options fanout
set firewall ipv4 name <name> rule <1-999999> queue-options fanout
To be used only when action is set to queue. Use this command to distribute packets between several queues.
Also, default-action is an action that takes place whenever a packet does not match any rule in it’s chain. For base
chains, possible options for default-action are accept or drop.

8.2. Firewall 421

 VyOS Documentation, Release 1.5.x (circinus)

set firewall ipv4 forward filter default-action [accept | drop]

set firewall ipv4 input filter default-action [accept | drop]
set firewall ipv4 output filter default-action [accept | drop]
set firewall ipv4 name <name> default-action [accept | drop | jump | queue | reject |
return]
This sets the default action of the rule-set if a packet does not match the criteria of any rule. If default-action is
set to jump, then default-jump-target is also needed. Note that for base chains, the default action can only
be set to accept or drop, while on custom chains, more actions are available.
set firewall ipv4 name <name> default-jump-target <text>
To be used only when default-action is set to jump. Use this command to specify the jump target for the
default rule.

Note: Important note about default-actions: If the default action for any base chain is not defined, then the default
action is set to accept for that chain. For custom chains if a default action is not defined then the default-action is set
to drop.

Firewall Logs

Logging can be enable for every single firewall rule. If enabled, other log options can be defined.
set firewall ipv4 forward filter rule <1-999999> log
set firewall ipv4 input filter rule <1-999999> log
set firewall ipv4 output filter rule <1-999999> log
set firewall ipv4 name <name> rule <1-999999> log
Enable logging for the matched packet. If this configuration command is not present, then the log is not enabled.
set firewall ipv4 forward filter default-log
set firewall ipv4 input filter default-log
set firewall ipv4 output filter default-log
set firewall ipv4 name <name> default-log
Use this command to enable the logging of the default action on the specified chain.
set firewall ipv4 forward filter rule <1-999999> log-options level [emerg | alert | crit
| err | warn | notice | info | debug]
set firewall ipv4 input filter rule <1-999999> log-options level [emerg | alert | crit |
err | warn | notice | info | debug]
set firewall ipv4 output filter rule <1-999999> log-options level [emerg | alert | crit |
err | warn | notice | info | debug]
set firewall ipv4 name <name> rule <1-999999> log-options level [emerg | alert | crit |
err | warn | notice | info | debug]
Define log-level. Only applicable if rule log is enabled.
set firewall ipv4 forward filter rule <1-999999> log-options group <0-65535>
set firewall ipv4 input filter rule <1-999999> log-options group <0-65535>

8.2. Firewall 422

 VyOS Documentation, Release 1.5.x (circinus)

set firewall ipv4 output filter rule <1-999999> log-options group <0-65535>
set firewall ipv4 name <name> rule <1-999999> log-options group <0-65535>
Define the log group to send messages to. Only applicable if rule log is enabled.
set firewall ipv4 forward filter rule <1-999999> log-options snapshot-length <0-9000>
set firewall ipv4 input filter rule <1-999999> log-options snapshot-length <0-9000>
set firewall ipv4 output filter rule <1-999999> log-options snapshot-length <0-9000>
set firewall ipv4 name <name> rule <1-999999> log-options snapshot-length <0-9000>
Define the length of packet payload to include in a netlink message. Only applicable if rule log is enabled and
log group is defined.
set firewall ipv4 forward filter rule <1-999999> log-options queue-threshold <0-65535>
set firewall ipv4 input filter rule <1-999999> log-options queue-threshold <0-65535>
set firewall ipv4 output filter rule <1-999999> log-options queue-threshold <0-65535>
set firewall ipv4 name <name> rule <1-999999> log-options queue-threshold <0-65535>
Define the number of packets to queue inside the kernel before sending them to userspace. Only applicable if
rule log is enabled and log group is defined.

Firewall Description

For reference, a description can be defined for every single rule, and for every defined custom chain.
set firewall ipv4 name <name> description <text>
Provide a rule-set description to a custom firewall chain.
set firewall ipv4 forward filter rule <1-999999> description <text>
set firewall ipv4 input filter rule <1-999999> description <text>
set firewall ipv4 output filter rule <1-999999> description <text>
set firewall ipv4 name <name> rule <1-999999> description <text>
Provide a description for each rule.

Rule Status

When defining a rule, it is enabled by default. In some cases, it is useful to just disable the rule, rather than removing
it.
set firewall ipv4 forward filter rule <1-999999> disable
set firewall ipv4 input filter rule <1-999999> disable
set firewall ipv4 output filter rule <1-999999> disable
set firewall ipv4 name <name> rule <1-999999> disable
Command for disabling a rule but keep it in the configuration.

8.2. Firewall 423

 VyOS Documentation, Release 1.5.x (circinus)

Matching criteria

There are a lot of matching criteria against which the packet can be tested.
set firewall ipv4 forward filter rule <1-999999> connection-status nat [destination |
source]
set firewall ipv4 input filter rule <1-999999> connection-status nat [destination |
source]
set firewall ipv4 output filter rule <1-999999> connection-status nat [destination |
source]
set firewall ipv4 name <name> rule <1-999999> connection-status nat [destination |
source]
Match based on nat connection status.
set firewall ipv4 forward filter rule <1-999999> connection-mark <1-2147483647>
set firewall ipv4 input filter rule <1-999999> connection-mark <1-2147483647>
set firewall ipv4 output filter rule <1-999999> connection-mark <1-2147483647>
set firewall ipv4 name <name> rule <1-999999> connection-mark <1-2147483647>
Match based on connection mark.
set firewall ipv4 forward filter rule <1-999999> conntrack-helper <module>
set firewall ipv4 input filter rule <1-999999> conntrack-helper <module>
set firewall ipv4 output filter rule <1-999999> conntrack-helper <module>
set firewall ipv4 name <name> rule <1-999999> conntrack-helper <module>
Match based on connection tracking protocol helper module to secure use of that helper module. See below for
possible completions <module>.

Possible completions:
ftp Related traffic from FTP helper
h323 Related traffic from H.323 helper
pptp Related traffic from PPTP helper
nfs Related traffic from NFS helper
sip Related traffic from SIP helper
tftp Related traffic from TFTP helper
sqlnet Related traffic from SQLNet helper

set firewall ipv4 forward filter rule <1-999999> source address [address | addressrange |
CIDR]
set firewall ipv4 input filter rule <1-999999> source address [address | addressrange |
CIDR]
set firewall ipv4 output filter rule <1-999999> source address [address | addressrange |
CIDR]
set firewall ipv4 name <name> rule <1-999999> source address [address | addressrange |
CIDR]
set firewall ipv4 forward filter rule <1-999999> destination address [address |
addressrange | CIDR]

8.2. Firewall 424

 VyOS Documentation, Release 1.5.x (circinus)

set firewall ipv4 input filter rule <1-999999> destination address [address |
addressrange | CIDR]
set firewall ipv4 output filter rule <1-999999> destination address [address |
addressrange | CIDR]
set firewall ipv4 name <name> rule <1-999999> destination address [address | addressrange
| CIDR]
Match criteria based on source and/or destination address. This is similar to the network groups part, but here
you are able to negate the matching addresses.

set firewall ipv4 name FOO rule 50 source address 192.0.2.10-192.0.2.11

# with a '!' the rule match everything except the specified subnet
set firewall ipv4 input filter FOO rule 51 source address !203.0.113.0/24

set firewall ipv4 forward filter rule <1-999999> source address-mask [address]
set firewall ipv4 input filter rule <1-999999> source address-mask [address]
set firewall ipv4 output filter rule <1-999999> source address-mask [address]
set firewall ipv4 name <name> rule <1-999999> source address-mask [address]
set firewall ipv4 forward filter rule <1-999999> destination address-mask [address]
set firewall ipv4 input filter rule <1-999999> destination address-mask [address]
set firewall ipv4 output filter rule <1-999999> destination address-mask [address]
set firewall ipv4 name <name> rule <1-999999> destination address-mask [address]
An arbitrary netmask can be applied to mask addresses to only match against a specific portion.
This functions for both individual addresses and address groups.

# Match any IPv4 address with `11` as the 2nd octet and `13` as the forth octet
set firewall ipv4 name FOO rule 100 destination address 0.11.0.13
set firewall ipv4 name FOO rule 100 destination address-mask 0.255.0.255

set firewall ipv4 forward filter rule <1-999999> source fqdn <fqdn>
set firewall ipv4 input filter rule <1-999999> source fqdn <fqdn>
set firewall ipv4 output filter rule <1-999999> source fqdn <fqdn>
set firewall ipv4 name <name> rule <1-999999> source fqdn <fqdn>
set firewall ipv4 forward filter rule <1-999999> destination fqdn <fqdn>
set firewall ipv4 input filter rule <1-999999> destination fqdn <fqdn>
set firewall ipv4 output filter rule <1-999999> destination fqdn <fqdn>
set firewall ipv4 name <name> rule <1-999999> destination fqdn <fqdn>
Specify a Fully Qualified Domain Name as source/destination to match. Ensure that the router is able to resolve
this dns query.
set firewall ipv4 forward filter rule <1-999999> source geoip country-code <country>
set firewall ipv4 input filter rule <1-999999> source geoip country-code <country>
set firewall ipv4 output filter rule <1-999999> source geoip country-code <country>
set firewall ipv4 name <name> rule <1-999999> source geoip country-code <country>

8.2. Firewall 425

 VyOS Documentation, Release 1.5.x (circinus)

set firewall ipv4 forward filter rule <1-999999> destination geoip country-code <country>
set firewall ipv4 input filter rule <1-999999> destination geoip country-code <country>
set firewall ipv4 output filter rule <1-999999> destination geoip country-code <country>
set firewall ipv4 name <name> rule <1-999999> destination geoip country-code <country>
set firewall ipv4 forward filter rule <1-999999> source geoip inverse-match
set firewall ipv4 input filter rule <1-999999> source geoip inverse-match
set firewall ipv4 output filter rule <1-999999> source geoip inverse-match
set firewall ipv4 name <name> rule <1-999999> source geoip inverse-match
set firewall ipv4 forward filter rule <1-999999> destination geoip inverse-match
set firewall ipv4 input filter rule <1-999999> destination geoip inverse-match
set firewall ipv4 output filter rule <1-999999> destination geoip inverse-match
set firewall ipv4 name <name> rule <1-999999> destination geoip inverse-match
Match IP addresses based on its geolocation. More info: geoip matching. Use inverse-match to match anything
except the given country-codes.
Data is provided by DB-IP.com under CC-BY-4.0 license. Attribution required, permits redistribution so we can include
a database in images(~3MB compressed). Includes cron script (manually callable by op-mode update geoip) to keep
database and rules updated.
set firewall ipv4 forward filter rule <1-999999> source mac-address <mac-address>
set firewall ipv4 input filter rule <1-999999> source mac-address <mac-address>
set firewall ipv4 output filter rule <1-999999> source mac-address <mac-address>
set firewall ipv4 name <name> rule <1-999999> source mac-address <mac-address>
You can only specify a source mac-address to match.

set firewall ipv4 input filter rule 100 source mac-address 00:53:00:11:22:33
set firewall ipv4 input filter rule 101 source mac-address !00:53:00:aa:12:34

set firewall ipv4 forward filter rule <1-999999> source port [1-65535 | portname |
start-end]
set firewall ipv4 input filter rule <1-999999> source port [1-65535 | portname |
start-end]
set firewall ipv4 output filter rule <1-999999> source port [1-65535 | portname |
start-end]
set firewall ipv4 name <name> rule <1-999999> source port [1-65535 | portname |
start-end]
set firewall ipv4 forward filter rule <1-999999> destination port [1-65535 | portname |
start-end]
set firewall ipv4 input filter rule <1-999999> destination port [1-65535 | portname |
start-end]
set firewall ipv4 output filter rule <1-999999> destination port [1-65535 | portname |
start-end]
set firewall ipv4 name <name> rule <1-999999> destination port [1-65535 | portname |
start-end]

8.2. Firewall 426

 VyOS Documentation, Release 1.5.x (circinus)

A port can be set by number or name as defined in /etc/services.

set firewall ipv4 forward filter rule 10 source port '22'

set firewall ipv4 forward filter rule 11 source port '!http'
set firewall ipv4 forward filter rule 12 source port 'https'

Multiple source ports can be specified as a comma-separated list. The whole list can also be “negated” using !.
For example:
set firewall ipv4 forward filter rule <1-999999> source group address-group <name | !
name>
set firewall ipv4 input filter rule <1-999999> source group address-group <name | !name>
set firewall ipv4 output filter rule <1-999999> source group address-group <name | !name>
set firewall ipv4 name <name> rule <1-999999> source group address-group <name | !name>
set firewall ipv4 forward filter rule <1-999999> destination group address-group <name |
!name>
set firewall ipv4 input filter rule <1-999999> destination group address-group <name |
!name>
set firewall ipv4 output filter rule <1-999999> destination group address-group <name |
!name>
set firewall ipv4 name <name> rule <1-999999> destination group address-group <name |
!name>
Use a specific address-group. Prepending the character ! to invert the criteria to match is also supported.
set firewall ipv4 forward filter rule <1-999999> source group dynamic-address-group <name
| !name>
set firewall ipv4 input filter rule <1-999999> source group dynamic-address-group <name |
!name>
set firewall ipv4 output filter rule <1-999999> source group dynamic-address-group <name
| !name>
set firewall ipv4 name <name> rule <1-999999> source group dynamic-address-group <name |
!name>
set firewall ipv4 forward filter rule <1-999999> destination group dynamic-address-group
<name | !name>
set firewall ipv4 input filter rule <1-999999> destination group dynamic-address-group
<name | !name>
set firewall ipv4 output filter rule <1-999999> destination group dynamic-address-group
<name | !name>
set firewall ipv4 name <name> rule <1-999999> destination group dynamic-address-group
<name | !name>
Use a specific dynamic-address-group. Prepending the character ! to invert the criteria to match is also sup-
ported.
set firewall ipv4 forward filter rule <1-999999> source group network-group <name | !
name>
set firewall ipv4 input filter rule <1-999999> source group network-group <name | !name>
set firewall ipv4 output filter rule <1-999999> source group network-group <name | !name>

8.2. Firewall 427

 VyOS Documentation, Release 1.5.x (circinus)

set firewall ipv4 name <name> rule <1-999999> source group network-group <name | !name>
set firewall ipv4 forward filter rule <1-999999> destination group network-group <name |
!name>
set firewall ipv4 input filter rule <1-999999> destination group network-group <name |
!name>
set firewall ipv4 output filter rule <1-999999> destination group network-group <name |
!name>
set firewall ipv4 name <name> rule <1-999999> destination group network-group <name |
!name>
Use a specific network-group. Prepending the character ! to invert the criteria to match is also supported.
set firewall ipv4 forward filter rule <1-999999> source group port-group <name | !name>
set firewall ipv4 input filter rule <1-999999> source group port-group <name | !name>
set firewall ipv4 output filter rule <1-999999> source group port-group <name | !name>
set firewall ipv4 name <name> rule <1-999999> source group port-group <name | !name>
set firewall ipv4 forward filter rule <1-999999> destination group port-group <name |
!name>
set firewall ipv4 input filter rule <1-999999> destination group port-group <name | !
name>
set firewall ipv4 output filter rule <1-999999> destination group port-group <name | !
name>
set firewall ipv4 name <name> rule <1-999999> destination group port-group <name | !name>
Use a specific port-group. Prepending the character ! to invert the criteria to match is also supported.
set firewall ipv4 forward filter rule <1-999999> source group domain-group <name | !name>
set firewall ipv4 input filter rule <1-999999> source group domain-group <name | !name>
set firewall ipv4 output filter rule <1-999999> source group domain-group <name | !name>
set firewall ipv4 name <name> rule <1-999999> source group domain-group <name | !name>
set firewall ipv4 forward filter rule <1-999999> destination group domain-group <name |
!name>
set firewall ipv4 input filter rule <1-999999> destination group domain-group <name |
!name>
set firewall ipv4 output filter rule <1-999999> destination group domain-group <name |
!name>
set firewall ipv4 name <name> rule <1-999999> destination group domain-group <name | !
name>
Use a specific domain-group. Prepending the character ! to invert the criteria to match is also supported.
set firewall ipv4 forward filter rule <1-999999> source group mac-group <name | !name>
set firewall ipv4 input filter rule <1-999999> source group mac-group <name | !name>
set firewall ipv4 output filter rule <1-999999> source group mac-group <name | !name>
set firewall ipv4 name <name> rule <1-999999> source group mac-group <name | !name>

8.2. Firewall 428

 VyOS Documentation, Release 1.5.x (circinus)

set firewall ipv4 forward filter rule <1-999999> destination group mac-group <name | !
name>
set firewall ipv4 input filter rule <1-999999> destination group mac-group <name | !name>
set firewall ipv4 output filter rule <1-999999> destination group mac-group <name | !
name>
set firewall ipv4 name <name> rule <1-999999> destination group mac-group <name | !name>
Use a specific mac-group. Prepending the character ! to invert the criteria to match is also supported.
set firewall ipv4 forward filter rule <1-999999> dscp [0-63 | start-end]
set firewall ipv4 input filter rule <1-999999> dscp [0-63 | start-end]
set firewall ipv4 output filter rule <1-999999> dscp [0-63 | start-end]
set firewall ipv4 name <name> rule <1-999999> dscp [0-63 | start-end]
set firewall ipv4 forward filter rule <1-999999> dscp-exclude [0-63 | start-end]
set firewall ipv4 input filter rule <1-999999> dscp-exclude [0-63 | start-end]
set firewall ipv4 output filter rule <1-999999> dscp-exclude [0-63 | start-end]
set firewall ipv4 name <name> rule <1-999999> dscp-exclude [0-63 | start-end]
Match based on dscp value.
set firewall ipv4 forward filter rule <1-999999> fragment [match-frag | match-non-frag]
set firewall ipv4 input filter rule <1-999999> fragment [match-frag | match-non-frag]
set firewall ipv4 output filter rule <1-999999> fragment [match-frag | match-non-frag]
set firewall ipv4 name <name> rule <1-999999> fragment [match-frag | match-non-frag]
Match based on fragmentation.
set firewall ipv4 forward filter rule <1-999999> icmp [code | type] <0-255>
set firewall ipv4 input filter rule <1-999999> icmp [code | type] <0-255>
set firewall ipv4 output filter rule <1-999999> icmp [code | type] <0-255>
set firewall ipv4 name <name> rule <1-999999> icmp [code | type] <0-255>
Match based on icmp code and type.
set firewall ipv4 forward filter rule <1-999999> icmp type-name <text>
set firewall ipv4 input filter rule <1-999999> icmp type-name <text>
set firewall ipv4 output filter rule <1-999999> icmp type-name <text>
set firewall ipv4 name <name> rule <1-999999> icmp type-name <text>
Match based on icmp type-name. Use tab for information about what type-name criteria are supported.
set firewall ipv4 forward filter rule <1-999999> inbound-interface name <iface>
set firewall ipv4 input filter rule <1-999999> inbound-interface name <iface>
set firewall ipv4 name <name> rule <1-999999> inbound-interface name <iface>
Match based on inbound interface. Wildcard * can be used. For example: eth2*. Prepending the character !
to invert the criteria to match is also supported. For example !eth2

8.2. Firewall 429

 VyOS Documentation, Release 1.5.x (circinus)

Note: If an interface is attached to a non-default vrf, when using inbound-interface, the vrf name must be used. For
example set firewall ipv4 forward filter rule 10 inbound-interface name MGMT

set firewall ipv4 forward filter rule <1-999999> inbound-interface group <iface_group>
set firewall ipv4 input filter rule <1-999999> inbound-interface group <iface_group>
set firewall ipv4 name <name> rule <1-999999> inbound-interface group <iface_group>
Match based on the inbound interface group. Prepending the character ! to invert the criteria to match is also
supported. For example !IFACE_GROUP
set firewall ipv4 forward filter rule <1-999999> outbound-interface name <iface>
set firewall ipv4 output filter rule <1-999999> outbound-interface name <iface>
set firewall ipv4 name <name> rule <1-999999> outbound-interface name <iface>
Match based on outbound interface. Wildcard * can be used. For example: eth2*. Prepending the character !
to invert the criteria to match is also supported. For example !eth2

Note: If an interface is attached to a non-default vrf, when using outbound-interface, the real interface name must
be used. For example set firewall ipv4 forward filter rule 10 outbound-interface name eth0

set firewall ipv4 forward filter rule <1-999999> outbound-interface group <iface_group>
set firewall ipv4 output filter rule <1-999999> outbound-interface group <iface_group>
set firewall ipv4 name <name> rule <1-999999> outbound-interface group <iface_group>
Match based on outbound interface group. Prepending the character ! to invert the criteria to match is also
supported. For example !IFACE_GROUP
set firewall ipv4 forward filter rule <1-999999> ipsec [match-ipsec | match-none]
set firewall ipv4 input filter rule <1-999999> ipsec [match-ipsec | match-none]
set firewall ipv4 output filter rule <1-999999> ipsec [match-ipsec | match-none]
set firewall ipv4 name <name> rule <1-999999> ipsec [match-ipsec | match-none]
Match based on ipsec.
set firewall ipv4 forward filter rule <1-999999> limit burst <0-4294967295>
set firewall ipv4 input filter rule <1-999999> limit burst <0-4294967295>
set firewall ipv4 output filter rule <1-999999> limit burst <0-4294967295>
set firewall ipv4 name <name> rule <1-999999> limit burst <0-4294967295>
Match based on the maximum number of packets to allow in excess of rate.
set firewall ipv4 forward filter rule <1-999999> limit rate <text>
set firewall ipv4 input filter rule <1-999999> limit rate <text>
set firewall ipv4 output filter rule <1-999999> limit rate <text>
set firewall ipv4 name <name> rule <1-999999> limit rate <text>
Match based on the maximum average rate, specified as integer/unit. For example 5/minutes
set firewall ipv4 forward filter rule <1-999999> packet-length <text>

8.2. Firewall 430

 VyOS Documentation, Release 1.5.x (circinus)

set firewall ipv4 input filter rule <1-999999> packet-length <text>

set firewall ipv4 output filter rule <1-999999> packet-length <text>
set firewall ipv4 name <name> rule <1-999999> packet-length <text>
set firewall ipv4 forward filter rule <1-999999> packet-length-exclude <text>
set firewall ipv4 input filter rule <1-999999> packet-length-exclude <text>
set firewall ipv4 output filter rule <1-999999> packet-length-exclude <text>
set firewall ipv4 name <name> rule <1-999999> packet-length-exclude <text>
Match based on the packet length. Multiple values from 1 to 65535 and ranges are supported.
set firewall ipv4 forward filter rule <1-999999> packet-type [broadcast | host |
multicast | other]
set firewall ipv4 input filter rule <1-999999> packet-type [broadcast | host | multicast
| other]
set firewall ipv4 output filter rule <1-999999> packet-type [broadcast | host | multicast
| other]
set firewall ipv4 name <name> rule <1-999999> packet-type [broadcast | host | multicast |
other]
Match based on the packet type.
set firewall ipv4 forward filter rule <1-999999> protocol [<text> | <0-255> | all |
tcp_udp]
set firewall ipv4 input filter rule <1-999999> protocol [<text> | <0-255> | all |
tcp_udp]
set firewall ipv4 output filter rule <1-999999> protocol [<text> | <0-255> | all |
tcp_udp]
set firewall ipv4 name <name> rule <1-999999> protocol [<text> | <0-255> | all | tcp_udp]
Match based on protocol number or name as defined in /etc/protocols. Special names are all for all
protocols and tcp_udp for tcp and udp based packets. The ! negates the selected protocol.

set firewall ipv4 forward fitler rule 10 protocol tcp_udp

set firewall ipv4 forward fitler rule 11 protocol !tcp_udp

set firewall ipv4 forward filter rule <1-999999> recent count <1-255>
set firewall ipv4 input filter rule <1-999999> recent count <1-255>
set firewall ipv4 output filter rule <1-999999> recent count <1-255>
set firewall ipv4 name <name> rule <1-999999> recent count <1-255>
set firewall ipv4 forward filter rule <1-999999> recent time [second | minute | hour]
set firewall ipv4 input filter rule <1-999999> recent time [second | minute | hour]
set firewall ipv4 output filter rule <1-999999> recent time [second | minute | hour]
set firewall ipv4 name <name> rule <1-999999> recent time [second | minute | hour]
Match based on recently seen sources.
set firewall ipv4 forward filter rule <1-999999> tcp flags [not] <text>
set firewall ipv4 input filter rule <1-999999> tcp flags [not] <text>

8.2. Firewall 431

 VyOS Documentation, Release 1.5.x (circinus)

set firewall ipv4 output filter rule <1-999999> tcp flags [not] <text>
set firewall ipv4 name <name> rule <1-999999> tcp flags [not] <text>
Allowed values fpr TCP flags: ack, cwr, ecn, fin, psh, rst, syn and urg. Multiple values are supported, and
for inverted selection use not, as shown in the example.

set firewall ipv4 input filter rule 10 tcp flags 'ack'

set firewall ipv4 input filter rule 12 tcp flags 'syn'
set firewall ipv4 input filter rule 13 tcp flags not 'fin'

set firewall ipv4 forward filter rule <1-999999> state [established | invalid | new |
related]
set firewall ipv4 input filter rule <1-999999> state [established | invalid | new |
related]
set firewall ipv4 output filter rule <1-999999> state [established | invalid | new |
related]
set firewall ipv4 name <name> rule <1-999999> state [established | invalid | new |
related]
Match against the state of a packet.
set firewall ipv4 forward filter rule <1-999999> time startdate <text>
set firewall ipv4 input filter rule <1-999999> time startdate <text>
set firewall ipv4 output filter rule <1-999999> time startdate <text>
set firewall ipv4 name <name> rule <1-999999> time startdate <text>
set firewall ipv4 forward filter rule <1-999999> time starttime <text>
set firewall ipv4 input filter rule <1-999999> time starttime <text>
set firewall ipv4 output filter rule <1-999999> time starttime <text>
set firewall ipv4 name <name> rule <1-999999> time starttime <text>
set firewall ipv4 forward filter rule <1-999999> time stopdate <text>
set firewall ipv4 input filter rule <1-999999> time stopdate <text>
set firewall ipv4 output filter rule <1-999999> time stopdate <text>
set firewall ipv4 name <name> rule <1-999999> time stopdate <text>
set firewall ipv4 forward filter rule <1-999999> time stoptime <text>
set firewall ipv4 input filter rule <1-999999> time stoptime <text>
set firewall ipv4 output filter rule <1-999999> time stoptime <text>
set firewall ipv4 name <name> rule <1-999999> time stoptime <text>
set firewall ipv4 forward filter rule <1-999999> time weekdays <text>
set firewall ipv4 input filter rule <1-999999> time weekdays <text>
set firewall ipv4 output filter rule <1-999999> time weekdays <text>
set firewall ipv4 name <name> rule <1-999999> time weekdays <text>
Time to match the defined rule.
set firewall ipv4 forward filter rule <1-999999> ttl <eq | gt | lt> <0-255>

8.2. Firewall 432

 VyOS Documentation, Release 1.5.x (circinus)

set firewall ipv4 input filter rule <1-999999> ttl <eq | gt | lt> <0-255>
set firewall ipv4 output filter rule <1-999999> ttl <eq | gt | lt> <0-255>
set firewall ipv4 name <name> rule <1-999999> ttl <eq | gt | lt> <0-255>
Match the time to live parameter, where ‘eq’ stands for ‘equal’; ‘gt’ stands for ‘greater than’, and ‘lt’ stands for
‘less than’.
set firewall ipv4 forward filter rule <1-999999> recent count <1-255>
set firewall ipv4 input filter rule <1-999999> recent count <1-255>
set firewall ipv4 output filter rule <1-999999> recent count <1-255>
set firewall ipv4 name <name> rule <1-999999> recent count <1-255>
set firewall ipv4 forward filter rule <1-999999> recent time <second | minute | hour>
set firewall ipv4 input filter rule <1-999999> recent time <second | minute | hour>
set firewall ipv4 output filter rule <1-999999> recent time <second | minute | hour>
set firewall ipv4 name <name> rule <1-999999> recent time <second | minute | hour>
Match when ‘count’ amount of connections are seen within ‘time’. These matching criteria can be used to block
brute-force attempts.

Synproxy

Synproxy connections
set firewall ipv4 [input | forward] filter rule <1-999999> action synproxy
set firewall ipv4 [input | forward] filter rule <1-999999> protocol tcp
set firewall ipv4 [input | forward] filter rule <1-999999> synproxy tcp mss <501-65535>
Set the TCP-MSS (maximum segment size) for the connection
set firewall ipv4 [input | forward] filter rule <1-999999> synproxy tcp window-scale
<1-14>
Set the window scale factor for TCP window scaling

Example synproxy

Requirements to enable synproxy:

• Traffic must be symmetric
• Synproxy relies on syncookies and TCP timestamps, ensure these are enabled
• Disable conntrack loose track option

set system sysctl parameter net.ipv4.tcp_timestamps value '1'

set system conntrack tcp loose disable

set system conntrack ignore ipv4 rule 10 destination port '8080'
set system conntrack ignore ipv4 rule 10 protocol 'tcp'
set system conntrack ignore ipv4 rule 10 tcp flags syn

(continues on next page)

8.2. Firewall 433

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set firewall global-options syn-cookies 'enable'
set firewall ipv4 input filter rule 10 action 'synproxy'
set firewall ipv4 input filter rule 10 destination port '8080'
set firewall ipv4 input filter rule 10 inbound-interface name 'eth1'
set firewall ipv4 input filter rule 10 protocol 'tcp'
set firewall ipv4 input filter rule 10 synproxy tcp mss '1460'
set firewall ipv4 input filter rule 10 synproxy tcp window-scale '7'
set firewall ipv4 input filter rule 1000 action 'drop'
set firewall ipv4 input filter rule 1000 state invalid

Operation-mode Firewall

Rule-set overview

show firewall
This will show you a basic firewall overview, for all rule-sets, and not only for ipv4

vyos@vyos:~$ show firewall

Rulesets Information

---------------------------------
ipv4 Firewall "forward filter"

Rule Action Protocol Packets Bytes Conditions

------- -------- ---------- --------- ------- -----------------------------
20 accept all 0 0 ip saddr @N_TRUSTEDv4 accept
21 jump all 0 0 jump NAME_AUX
default accept all 0 0

---------------------------------
ipv4 Firewall "input filter"

Rule Action Protocol Packets Bytes Conditions

------- -------- ---------- --------- ------- -------------------------
10 accept all 156 14377 iifname != @I_LAN accept
default accept all 0 0

---------------------------------
ipv4 Firewall "name AUX"

Rule Action Protocol Packets Bytes Conditions

------ -------- ---------- --------- ------- ----------------------------------
˓→----------

10 accept icmp 0 0 meta l4proto icmp accept

20 accept udp 0 0 meta l4proto udp ip saddr @A_
˓→SERVERS accept
30 drop all 0 0 ip saddr != @A_SERVERS iifname
˓→"eth2"

---------------------------------
(continues on next page)

8.2. Firewall 434

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

ipv4 Firewall "output filter"

Rule Action Protocol Packets Bytes Conditions

------- -------- ---------- --------- ------- ---------------------------------
˓→-------

10 reject all 0 0 oifname @I_LAN

20 accept icmp 2 168 meta l4proto icmp oifname "eth0"␣
˓→ accept

default accept all 72 9258

---------------------------------
ipv6 Firewall "input filter"

Rule Action Protocol Packets Bytes Conditions

------- -------- ---------- --------- ------- -------------------------------
10 accept all 0 0 ip6 saddr @N6_TRUSTEDv6 accept
default accept all 2 112

vyos@vyos:~$

show firewall summary

This will show you a summary of rule-sets and groups

vyos@vyos:~$ show firewall summary

Ruleset Summary

IPv6 Ruleset:

Ruleset Hook Ruleset Priority Description

-------------- -------------------- -------------------------
forward filter
input filter
ipv6_name IPV6-VyOS_MANAGEMENT
ipv6_name IPV6-WAN_IN PUBLIC_INTERNET

IPv4 Ruleset:

Ruleset Hook Ruleset Priority Description

-------------- ------------------ -------------------------
forward filter
input filter
name VyOS_MANAGEMENT
name WAN_IN PUBLIC_INTERNET

Firewall Groups

Name Type References Members

----------------------- ------------------ ----------------------- --------------
˓→--

PBX address_group WAN_IN-100 198.51.100.77

SERVERS address_group WAN_IN-110 192.0.2.10
WAN_IN-111 192.0.2.11
(continues on next page)

8.2. Firewall 435

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

WAN_IN-112 192.0.2.12
WAN_IN-120
WAN_IN-121
WAN_IN-122
SUPPORT address_group VyOS_MANAGEMENT-20 192.168.1.2
WAN_IN-20
PHONE_VPN_SERVERS address_group WAN_IN-160 10.6.32.2
PINGABLE_ADRESSES address_group WAN_IN-170 192.168.5.2
WAN_IN-171
PBX ipv6_address_group IPV6-WAN_IN-100 2001:db8::1
SERVERS ipv6_address_group IPV6-WAN_IN-110 2001:db8::2
IPV6-WAN_IN-111 2001:db8::3
IPV6-WAN_IN-112 2001:db8::4
IPV6-WAN_IN-120
IPV6-WAN_IN-121
IPV6-WAN_IN-122
SUPPORT ipv6_address_group IPV6-VyOS_MANAGEMENT-20 2001:db8::5
IPV6-WAN_IN-20

show firewall ipv4 [forward | input | output] filter

show firewall ipv4 name <name>
This command will give an overview of a single rule-set.

vyos@vyos:~$ show firewall ipv4 input filter

Ruleset Information

---------------------------------
IPv4 Firewall "input filter"

Rule Action Protocol Packets Bytes Conditions

------- -------- ---------- --------- ------- ---------------------------------
˓→--------

5 jump all 0 0 iifname "eth2" jump NAME_VyOS_

˓→MANAGEMENT

default accept all

show firewall ipv4 [forward | input | output] filter rule <1-999999>

show firewall ipv4 name <name> rule <1-999999>
This command will give an overview of a rule in a single rule-set, plus information for default action.

vyos@vyos:~$show firewall ipv4 output filter rule 20

Rule Information

---------------------------------
ipv4 Firewall "output filter"

Rule Action Protocol Packets Bytes Conditions

------- -------- ---------- --------- ------- --------------------------------------
˓→--

20 accept icmp 2 168 meta l4proto icmp oifname "eth0" ␣

(continues on next page)

8.2. Firewall 436

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

˓→accept
default accept all 286 47614

vyos@vyos:~$

show firewall statistics

This will show you a statistic of all rule-sets since the last boot.

Show Firewall log

show log firewall

show log firewall ipv4
show log firewall ipv4 [forward | input | output | name]
show log firewall ipv4 [forward | input | output] filter
show log firewall ipv4 name <name>
show log firewall ipv4 [forward | input | output] filter rule <rule>
show log firewall ipv4 name <name> rule <rule>
Show the logs of all firewall; show all ipv4 firewall logs; show all logs for particular hook; show all logs for
particular hook and priority; show all logs for particular custom chain; show logs for specific Rule-Set.

Example Partial Config

firewall {
group {
network-group BAD-NETWORKS {
network 198.51.100.0/24
network 203.0.113.0/24
}
network-group GOOD-NETWORKS {
network 192.0.2.0/24
}
port-group BAD-PORTS {
port 65535
}
}
ipv4 {
forward {
filter {
default-action accept
rule 5 {
action accept
source {
group {
network-group GOOD-NETWORKS
}
}
(continues on next page)

8.2. Firewall 437

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

}
rule 10 {
action drop
description "Bad Networks"
protocol all
source {
group {
network-group BAD-NETWORKS
}
}
}
}
}
}
}

Update geoip database

update geoip
Command used to update GeoIP database and firewall sets.

8.2.5 IPv6 Firewall Configuration

Overview

In this section there’s useful information on all firewall configuration that can be done regarding IPv6, and appropriate
op-mode commands. Configuration commands covered in this section:
set firewall ipv6 ...
From the main structure defined in Firewall Overview in this section you can find detailed information only for the next
part of the general structure:

- set firewall
* ipv6
- forward
+ filter
- input
+ filter
- output
+ filter
+ raw
- prerouting
+ raw
- name
+ custom_name

First, all traffic is received by the router, and it is processed in the prerouting section.
This stage includes:
• Firewall Prerouting: commands found under set firewall ipv6 prerouting raw ...

8.2. Firewall 438

 VyOS Documentation, Release 1.5.x (circinus)

• Conntrack Ignore: set system conntrack ignore ipv6...

• Policy Route: commands found under set policy route6 ...
• Destination NAT : commands found under set nat66 destination ...
For transit traffic, which is received by the router and forwarded, the base chain is forward. A simplified packet flow
diagram for transit traffic is shown next:

The base firewall chain to configure filtering rules for transit traffic is set firewall ipv6 forward filter ...,
which happens in stage 5, highlighted in the color red.
For traffic towards the router itself, the base chain is input, while traffic originated by the router has the base chain
output. A new simplified packet flow diagram is shown next, which shows the path for traffic destined to the router
itself, and traffic generated by the router (starting from circle number 6):

The base chain for traffic towards the router is set firewall ipv6 input filter ...
And the base chain for traffic generated by the router is set firewall ipv6 output ..., where two sub-chains are
available: filter and raw:
• Output Prerouting: set firewall ipv6 output raw .... As described in Prerouting, rules defined in
this section are processed before connection tracking subsystem.
• Output Filter: set firewall ipv6 output filter .... Rules defined in this section are processed after
connection tracking subsystem.

Note: Important note about default-actions: If a default action for any base chain is not defined, then the default

8.2. Firewall 439

 VyOS Documentation, Release 1.5.x (circinus)

action is set to accept for that chain. For custom chains, if the default action is not defined, then the default-action is
set to drop

Custom firewall chains can be created, with commands set firewall ipv6 name <name> .... In order to use
such custom chain, a rule with action jump, and the appropriate target should be defined in a base chain.

Firewall - IPv6 Rules

For firewall filtering, firewall rules need to be created. Each rule is numbered, has an action to apply if the rule is
matched, and the ability to specify multiple matching criteria. Data packets go through the rules from 1 - 999999, so
order is crucial. At the first match the action of the rule will be executed.

Actions

If a rule is defined, then an action must be defined for it. This tells the firewall what to do if all of the criteria defined
for that rule match.
The action can be :
• accept: accept the packet.
• continue: continue parsing next rule.
• drop: drop the packet.
• reject: reject the packet.
• jump: jump to another custom chain.
• return: Return from the current chain and continue at the next rule of the last chain.
• queue: Enqueue packet to userspace.
• synproxy: synproxy the packet.
set firewall ipv6 forward filter rule <1-999999> action [accept | continue | drop | jump
| queue | reject | return | synproxy]
set firewall ipv6 input filter rule <1-999999> action [accept | continue | drop | jump |
queue | reject | return | synproxy]
set firewall ipv6 output filter rule <1-999999> action [accept | continue | drop | jump |
queue | reject | return]
set firewall ipv6 name <name> rule <1-999999> action [accept | continue | drop | jump |
queue | reject | return]
This required setting defines the action of the current rule. If the action is set to jump, then a jump-target is also
needed.
set firewall ipv6 forward filter rule <1-999999> jump-target <text>
set firewall ipv6 input filter rule <1-999999> jump-target <text>
set firewall ipv6 output filter rule <1-999999> jump-target <text>
set firewall ipv6 name <name> rule <1-999999> jump-target <text>
To be used only when action is set to jump. Use this command to specify the jump target.
set firewall ipv6 forward filter rule <1-999999> queue <0-65535>

8.2. Firewall 440

 VyOS Documentation, Release 1.5.x (circinus)

set firewall ipv6 input filter rule <1-999999> queue <0-65535>

set firewall ipv6 output filter rule <1-999999> queue <0-65535>
set firewall ipv6 name <name> rule <1-999999> queue <0-65535>
To be used only when action is set to queue. Use this command to specify the queue target to use. Queue range
is also supported.
set firewall ipv6 forward filter rule <1-999999> queue-options bypass
set firewall ipv6 input filter rule <1-999999> queue-options bypass
set firewall ipv6 output filter rule <1-999999> queue-options bypass
set firewall ipv6 name <name> rule <1-999999> queue-options bypass
To be used only when action is set to queue. Use this command to let the packet go through firewall when no
userspace software is connected to the queue.
set firewall ipv6 forward filter rule <1-999999> queue-options fanout
set firewall ipv6 input filter rule <1-999999> queue-options fanout
set firewall ipv6 output filter rule <1-999999> queue-options fanout
set firewall ipv6 name <name> rule <1-999999> queue-options fanout
To be used only when action is set to queue. Use this command to distribute packets between several queues.
Also, default-action is an action that takes place whenever a packet does not match any rule in it’s chain. For base
chains, possible options for default-action are accept or drop.
set firewall ipv6 forward filter default-action [accept | drop]
set firewall ipv6 input filter default-action [accept | drop]
set firewall ipv6 output filter default-action [accept | drop]
set firewall ipv6 name <name> default-action [accept | drop | jump | queue | reject |
return]
This sets the default action of the rule-set if a packet does not match the criteria of any rule. If default-action is
set to jump, then default-jump-target is also needed. Note that for base chains, the default action can only
be set to accept or drop, while on custom chains, more actions are available.
set firewall ipv6 name <name> default-jump-target <text>
To be used only when default-action is set to jump. Use this command to specify the jump target for the
default rule.

Note: Important note about default-actions: If the default action for any base chain is not defined, then the default
action is set to accept for that chain. For custom chains if a default action is not defined then the default-action is set
to drop.

8.2. Firewall 441

 VyOS Documentation, Release 1.5.x (circinus)

Firewall Logs

Logging can be enable for every single firewall rule. If enabled, other log options can be defined.
set firewall ipv6 forward filter rule <1-999999> log
set firewall ipv6 input filter rule <1-999999> log
set firewall ipv6 output filter rule <1-999999> log
set firewall ipv6 name <name> rule <1-999999> log
Enable logging for the matched packet. If this configuration command is not present, then the log is not enabled.
set firewall ipv6 forward filter default-log
set firewall ipv6 input filter default-log
set firewall ipv6 output filter default-log
set firewall ipv6 name <name> default-log
Use this command to enable the logging of the default action on the specified chain.
set firewall ipv6 forward filter rule <1-999999> log-options level [emerg | alert | crit
| err | warn | notice | info | debug]
set firewall ipv6 input filter rule <1-999999> log-options level [emerg | alert | crit |
err | warn | notice | info | debug]
set firewall ipv6 output filter rule <1-999999> log-options level [emerg | alert | crit |
err | warn | notice | info | debug]
set firewall ipv6 name <name> rule <1-999999> log-options level [emerg | alert | crit |
err | warn | notice | info | debug]
Define log-level. Only applicable if rule log is enabled.
set firewall ipv6 forward filter rule <1-999999> log-options group <0-65535>
set firewall ipv6 input filter rule <1-999999> log-options group <0-65535>
set firewall ipv6 output filter rule <1-999999> log-options group <0-65535>
set firewall ipv6 name <name> rule <1-999999> log-options group <0-65535>
Define the log group to send messages to. Only applicable if rule log is enabled.
set firewall ipv6 forward filter rule <1-999999> log-options snapshot-length <0-9000>
set firewall ipv6 input filter rule <1-999999> log-options snapshot-length <0-9000>
set firewall ipv6 output filter rule <1-999999> log-options snapshot-length <0-9000>
set firewall ipv6 name <name> rule <1-999999> log-options snapshot-length <0-9000>
Define the length of packet payload to include in a netlink message. Only applicable if rule log is enabled and
log group is defined.
set firewall ipv6 forward filter rule <1-999999> log-options queue-threshold <0-65535>
set firewall ipv6 input filter rule <1-999999> log-options queue-threshold <0-65535>
set firewall ipv6 output filter rule <1-999999> log-options queue-threshold <0-65535>
set firewall ipv6 name <name> rule <1-999999> log-options queue-threshold <0-65535>
Define the number of packets to queue inside the kernel before sending them to userspace. Only applicable if
rule log is enabled and log group is defined.

8.2. Firewall 442

 VyOS Documentation, Release 1.5.x (circinus)

Firewall Description

For reference, a description can be defined for every single rule, and for every defined custom chain.
set firewall ipv6 name <name> description <text>
Provide a rule-set description to a custom firewall chain.
set firewall ipv6 forward filter rule <1-999999> description <text>
set firewall ipv6 input filter rule <1-999999> description <text>
set firewall ipv6 output filter rule <1-999999> description <text>
set firewall ipv6 name <name> rule <1-999999> description <text>
Provide a description for each rule.

Rule Status

When defining a rule, it is enabled by default. In some cases, it is useful to just disable the rule, rather than removing
it.
set firewall ipv6 forward filter rule <1-999999> disable
set firewall ipv6 input filter rule <1-999999> disable
set firewall ipv6 output filter rule <1-999999> disable
set firewall ipv6 name <name> rule <1-999999> disable
Command for disabling a rule but keep it in the configuration.

Matching criteria

There are a lot of matching criteria against which the packet can be tested.
set firewall ipv6 forward filter rule <1-999999> connection-status nat [destination |
source]
set firewall ipv6 input filter rule <1-999999> connection-status nat [destination |
source]
set firewall ipv6 output filter rule <1-999999> connection-status nat [destination |
source]
set firewall ipv6 name <name> rule <1-999999> connection-status nat [destination |
source]
Match based on nat connection status.
set firewall ipv6 forward filter rule <1-999999> connection-mark <1-2147483647>
set firewall ipv6 input filter rule <1-999999> connection-mark <1-2147483647>
set firewall ipv6 output filter rule <1-999999> connection-mark <1-2147483647>
set firewall ipv6 name <name> rule <1-999999> connection-mark <1-2147483647>
Match based on connection mark.
set firewall ipv6 forward filter rule <1-999999> source address [address | addressrange |
CIDR]

8.2. Firewall 443

 VyOS Documentation, Release 1.5.x (circinus)

set firewall ipv6 input filter rule <1-999999> source address [address | addressrange |
CIDR]
set firewall ipv6 output filter rule <1-999999> source address [address | addressrange |
CIDR]
set firewall ipv6 name <name> rule <1-999999> source address [address | addressrange |
CIDR]
set firewall ipv6 forward filter rule <1-999999> destination address [address |
addressrange | CIDR]
set firewall ipv6 input filter rule <1-999999> destination address [address |
addressrange | CIDR]
set firewall ipv6 output filter rule <1-999999> destination address [address |
addressrange | CIDR]
set firewall ipv6 name <name> rule <1-999999> destination address [address | addressrange
| CIDR]
Match based on source and/or destination address. This is similar to the network groups part, but here you are
able to negate the matching addresses.

set firewall ipv6 name FOO rule 100 source address 2001:db8::202

set firewall ipv6 forward filter rule <1-999999> source address-mask [address]
set firewall ipv6 input filter rule <1-999999> source address-mask [address]
set firewall ipv6 output filter rule <1-999999> source address-mask [address]
set firewall ipv6 name <name> rule <1-999999> source address-mask [address]
set firewall ipv6 forward filter rule <1-999999> destination address-mask [address]
set firewall ipv6 input filter rule <1-999999> destination address-mask [address]
set firewall ipv6 output filter rule <1-999999> destination address-mask [address]
set firewall ipv6 name <name> rule <1-999999> destination address-mask [address]
An arbitrary netmask can be applied to mask addresses to only match against a specific portion. This is particu-
larly useful with IPv6 as rules will remain valid if the IPv6 prefix changes and the host portion of systems IPv6
address is static (for example, with SLAAC or tokenised IPv6 addresses)
This functions for both individual addresses and address groups.

# Match any IPv6 address with the suffix ::0000:0000:0000:beef

set firewall ipv6 forward filter rule 100 destination address ::beef
set firewall ipv6 forward filter rule 100 destination address-mask␣
˓→::ffff:ffff:ffff:ffff

# Address groups
set firewall group ipv6-address-group WEBSERVERS address ::1000
set firewall group ipv6-address-group WEBSERVERS address ::2000
set firewall ipv6 forward filter rule 200 source group address-group WEBSERVERS
set firewall ipv6 forward filter rule 200 source address-mask ::ffff:ffff:ffff:ffff

set firewall ipv6 forward filter rule <1-999999> source fqdn <fqdn>
set firewall ipv6 input filter rule <1-999999> source fqdn <fqdn>
set firewall ipv6 output filter rule <1-999999> source fqdn <fqdn>

8.2. Firewall 444

 VyOS Documentation, Release 1.5.x (circinus)

set firewall ipv6 name <name> rule <1-999999> source fqdn <fqdn>
set firewall ipv6 forward filter rule <1-999999> destination fqdn <fqdn>
set firewall ipv6 input filter rule <1-999999> destination fqdn <fqdn>
set firewall ipv6 output filter rule <1-999999> destination fqdn <fqdn>
set firewall ipv6 name <name> rule <1-999999> destination fqdn <fqdn>
Specify a Fully Qualified Domain Name as source/destination to match. Ensure that the router is able to resolve
this dns query.
set firewall ipv6 forward filter rule <1-999999> source geoip country-code <country>
set firewall ipv6 input filter rule <1-999999> source geoip country-code <country>
set firewall ipv6 output filter rule <1-999999> source geoip country-code <country>
set firewall ipv6 name <name> rule <1-999999> source geoip country-code <country>
set firewall ipv6 forward filter rule <1-999999> destination geoip country-code <country>
set firewall ipv6 input filter rule <1-999999> destination geoip country-code <country>
set firewall ipv6 output filter rule <1-999999> destination geoip country-code <country>
set firewall ipv6 name <name> rule <1-999999> destination geoip country-code <country>
set firewall ipv6 forward filter rule <1-999999> source geoip inverse-match
set firewall ipv6 input filter rule <1-999999> source geoip inverse-match
set firewall ipv6 output filter rule <1-999999> source geoip inverse-match
set firewall ipv6 name <name> rule <1-999999> source geoip inverse-match
set firewall ipv6 forward filter rule <1-999999> destination geoip inverse-match
set firewall ipv6 input filter rule <1-999999> destination geoip inverse-match
set firewall ipv6 output filter rule <1-999999> destination geoip inverse-match
set firewall ipv6 name <name> rule <1-999999> destination geoip inverse-match
Match IP addresses based on its geolocation. More info: geoip matching. Use inverse-match to match anything
except the given country-codes.
Data is provided by DB-IP.com under CC-BY-4.0 license. Attribution required, permits redistribution so we can include
a database in images(~3MB compressed). Includes cron script (manually callable by op-mode update geoip) to keep
database and rules updated.
set firewall ipv6 forward filter rule <1-999999> source mac-address <mac-address>
set firewall ipv6 input filter rule <1-999999> source mac-address <mac-address>
set firewall ipv6 output filter rule <1-999999> source mac-address <mac-address>
set firewall ipv6 name <name> rule <1-999999> source mac-address <mac-address>
You can only specify a source mac-address to match.

set firewall ipv6 input filter rule 100 source mac-address 00:53:00:11:22:33
set firewall ipv6 input filter rule 101 source mac-address !00:53:00:aa:12:34

set firewall ipv6 forward filter rule <1-999999> source port [1-65535 | portname |
start-end]

8.2. Firewall 445

 VyOS Documentation, Release 1.5.x (circinus)

set firewall ipv6 input filter rule <1-999999> source port [1-65535 | portname |
start-end]
set firewall ipv6 output filter rule <1-999999> source port [1-65535 | portname |
start-end]
set firewall ipv6 name <name> rule <1-999999> source port [1-65535 | portname |
start-end]
set firewall ipv6 forward filter rule <1-999999> destination port [1-65535 | portname |
start-end]
set firewall ipv6 input filter rule <1-999999> destination port [1-65535 | portname |
start-end]
set firewall ipv6 output filter rule <1-999999> destination port [1-65535 | portname |
start-end]
set firewall ipv6 name <name> rule <1-999999> destination port [1-65535 | portname |
start-end]
A port can be set by number or name as defined in /etc/services.

set firewall ipv6 forward filter rule 10 source port '22'

set firewall ipv6 forward filter rule 11 source port '!http'
set firewall ipv6 forward filter rule 12 source port 'https'

Multiple source ports can be specified as a comma-separated list. The whole list can also be “negated” using !.
For example:

set firewall ipv6 forward filter rule 10 source port '!22,https,3333-3338'

set firewall ipv6 forward filter rule <1-999999> source group address-group <name | !
name>
set firewall ipv6 input filter rule <1-999999> source group address-group <name | !name>
set firewall ipv6 output filter rule <1-999999> source group address-group <name | !name>
set firewall ipv6 name <name> rule <1-999999> source group address-group <name | !name>
set firewall ipv6 forward filter rule <1-999999> destination group address-group <name |
!name>
set firewall ipv6 input filter rule <1-999999> destination group address-group <name |
!name>
set firewall ipv6 output filter rule <1-999999> destination group address-group <name |
!name>
set firewall ipv6 name <name> rule <1-999999> destination group address-group <name |
!name>
Use a specific address-group. Prepending the character ! to invert the criteria to match is also supported.
set firewall ipv6 forward filter rule <1-999999> source group dynamic-address-group <name
| !name>
set firewall ipv6 input filter rule <1-999999> source group dynamic-address-group <name |
!name>
set firewall ipv6 output filter rule <1-999999> source group dynamic-address-group <name
| !name>

8.2. Firewall 446

 VyOS Documentation, Release 1.5.x (circinus)

set firewall ipv6 name <name> rule <1-999999> source group dynamic-address-group <name |
!name>
set firewall ipv6 forward filter rule <1-999999> destination group dynamic-address-group
<name | !name>
set firewall ipv6 input filter rule <1-999999> destination group dynamic-address-group
<name | !name>
set firewall ipv6 output filter rule <1-999999> destination group dynamic-address-group
<name | !name>
set firewall ipv6 name <name> rule <1-999999> destination group dynamic-address-group
<name | !name>
Use a specific dynamic-address-group. Prepending the character ! to invert the criteria to match is also sup-
ported.
set firewall ipv6 forward filter rule <1-999999> source group network-group <name | !
name>
set firewall ipv6 input filter rule <1-999999> source group network-group <name | !name>
set firewall ipv6 output filter rule <1-999999> source group network-group <name | !name>
set firewall ipv6 name <name> rule <1-999999> source group network-group <name | !name>
set firewall ipv6 forward filter rule <1-999999> destination group network-group <name |
!name>
set firewall ipv6 input filter rule <1-999999> destination group network-group <name |
!name>
set firewall ipv6 output filter rule <1-999999> destination group network-group <name |
!name>
set firewall ipv6 name <name> rule <1-999999> destination group network-group <name |
!name>
Use a specific network-group. Prepending the character ! to invert the criteria to match is also supported.
set firewall ipv6 forward filter rule <1-999999> source group port-group <name | !name>
set firewall ipv6 input filter rule <1-999999> source group port-group <name | !name>
set firewall ipv6 output filter rule <1-999999> source group port-group <name | !name>
set firewall ipv6 name <name> rule <1-999999> source group port-group <name | !name>
set firewall ipv6 forward filter rule <1-999999> destination group port-group <name |
!name>
set firewall ipv6 input filter rule <1-999999> destination group port-group <name | !
name>
set firewall ipv6 output filter rule <1-999999> destination group port-group <name | !
name>
set firewall ipv6 name <name> rule <1-999999> destination group port-group <name | !name>
Use a specific port-group. Prepending the character ! to invert the criteria to match is also supported.
set firewall ipv6 forward filter rule <1-999999> source group domain-group <name | !name>
set firewall ipv6 input filter rule <1-999999> source group domain-group <name | !name>
set firewall ipv6 output filter rule <1-999999> source group domain-group <name | !name>

8.2. Firewall 447

 VyOS Documentation, Release 1.5.x (circinus)

set firewall ipv6 name <name> rule <1-999999> source group domain-group <name | !name>
set firewall ipv6 forward filter rule <1-999999> destination group domain-group <name |
!name>
set firewall ipv6 input filter rule <1-999999> destination group domain-group <name |
!name>
set firewall ipv6 output filter rule <1-999999> destination group domain-group <name |
!name>
set firewall ipv6 name <name> rule <1-999999> destination group domain-group <name | !
name>
Use a specific domain-group. Prepending the character ! to invert the criteria to match is also supported.
set firewall ipv6 forward filter rule <1-999999> source group mac-group <name | !name>
set firewall ipv6 input filter rule <1-999999> source group mac-group <name | !name>
set firewall ipv6 output filter rule <1-999999> source group mac-group <name | !name>
set firewall ipv6 name <name> rule <1-999999> source group mac-group <name | !name>
set firewall ipv6 forward filter rule <1-999999> destination group mac-group <name | !
name>
set firewall ipv6 input filter rule <1-999999> destination group mac-group <name | !name>
set firewall ipv6 output filter rule <1-999999> destination group mac-group <name | !
name>
set firewall ipv6 name <name> rule <1-999999> destination group mac-group <name | !name>
Use a specific mac-group. Prepending the character ! to invert the criteria to match is also supported.
set firewall ipv6 forward filter rule <1-999999> dscp [0-63 | start-end]
set firewall ipv6 input filter rule <1-999999> dscp [0-63 | start-end]
set firewall ipv6 output filter rule <1-999999> dscp [0-63 | start-end]
set firewall ipv6 name <name> rule <1-999999> dscp [0-63 | start-end]
set firewall ipv6 forward filter rule <1-999999> dscp-exclude [0-63 | start-end]
set firewall ipv6 input filter rule <1-999999> dscp-exclude [0-63 | start-end]
set firewall ipv6 output filter rule <1-999999> dscp-exclude [0-63 | start-end]
set firewall ipv6 name <name> rule <1-999999> dscp-exclude [0-63 | start-end]
Match based on dscp value.
set firewall ipv6 forward filter rule <1-999999> fragment [match-frag | match-non-frag]
set firewall ipv6 input filter rule <1-999999> fragment [match-frag | match-non-frag]
set firewall ipv6 output filter rule <1-999999> fragment [match-frag | match-non-frag]
set firewall ipv6 name <name> rule <1-999999> fragment [match-frag | match-non-frag]
Match based on fragmentation.
set firewall ipv6 forward filter rule <1-999999> icmpv6 [code | type] <0-255>
set firewall ipv6 input filter rule <1-999999> icmpv6 [code | type] <0-255>
set firewall ipv6 output filter rule <1-999999> icmpv6 [code | type] <0-255>

8.2. Firewall 448

 VyOS Documentation, Release 1.5.x (circinus)

set firewall ipv6 name <name> rule <1-999999> icmpv6 [code | type] <0-255>
Match based on icmp|icmpv6 code and type.
set firewall ipv6 forward filter rule <1-999999> icmpv6 type-name <text>
set firewall ipv6 input filter rule <1-999999> icmpv6 type-name <text>
set firewall ipv6 output filter rule <1-999999> icmpv6 type-name <text>
set firewall ipv6 name <name> rule <1-999999> icmpv6 type-name <text>
Match based on icmpv6 type-name. Use tab for information about what type-name criteria are supported.
set firewall ipv6 forward filter rule <1-999999> inbound-interface name <iface>
set firewall ipv6 input filter rule <1-999999> inbound-interface name <iface>
set firewall ipv6 name <name> rule <1-999999> inbound-interface name <iface>
Match based on inbound interface. Wildcard * can be used. For example: eth2*. Prepending the character !
to invert the criteria to match is also supported. For example !eth2

Note: If an interface is attached to a non-default vrf, when using inbound-interface, the vrf name must be used. For
example set firewall ipv6 forward filter rule 10 inbound-interface name MGMT

set firewall ipv6 forward filter rule <1-999999> inbound-interface group <iface_group>
set firewall ipv6 input filter rule <1-999999> inbound-interface group <iface_group>
set firewall ipv6 name <name> rule <1-999999> inbound-interface group <iface_group>
Match based on the inbound interface group. Prepending the character ! to invert the criteria to match is also
supported. For example !IFACE_GROUP
set firewall ipv6 forward filter rule <1-999999> outbound-interface name <iface>
set firewall ipv6 output filter rule <1-999999> outbound-interface name <iface>
set firewall ipv6 name <name> rule <1-999999> outbound-interface name <iface>
Match based on outbound interface. Wildcard * can be used. For example: eth2*. Prepending the character !
to invert the criteria to match is also supported. For example !eth2

Note: If an interface is attached to a non-default vrf, when using outbound-interface, the real interface name must
be used. For example set firewall ipv6 forward filter rule 10 outbound-interface name eth0

set firewall ipv6 forward filter rule <1-999999> outbound-interface group <iface_group>
set firewall ipv6 output filter rule <1-999999> outbound-interface group <iface_group>
set firewall ipv6 name <name> rule <1-999999> outbound-interface group <iface_group>
Match based on outbound interface group. Prepending the character ! to invert the criteria to match is also
supported. For example !IFACE_GROUP
set firewall ipv6 forward filter rule <1-999999> ipsec [match-ipsec | match-none]
set firewall ipv6 input filter rule <1-999999> ipsec [match-ipsec | match-none]
set firewall ipv6 output filter rule <1-999999> ipsec [match-ipsec | match-none]
set firewall ipv6 name <name> rule <1-999999> ipsec [match-ipsec | match-none]

8.2. Firewall 449

 VyOS Documentation, Release 1.5.x (circinus)

Match based on ipsec.

set firewall ipv6 forward filter rule <1-999999> limit burst <0-4294967295>
set firewall ipv6 input filter rule <1-999999> limit burst <0-4294967295>
set firewall ipv6 output filter rule <1-999999> limit burst <0-4294967295>
set firewall ipv6 name <name> rule <1-999999> limit burst <0-4294967295>
Match based on the maximum number of packets to allow in excess of rate.
set firewall ipv6 forward filter rule <1-999999> limit rate <text>
set firewall ipv6 input filter rule <1-999999> limit rate <text>
set firewall ipv6 output filter rule <1-999999> limit rate <text>
set firewall ipv6 name <name> rule <1-999999> limit rate <text>
Match based on the maximum average rate, specified as integer/unit. For example 5/minutes
set firewall ipv6 forward filter rule <1-999999> packet-length <text>
set firewall ipv6 input filter rule <1-999999> packet-length <text>
set firewall ipv6 output filter rule <1-999999> packet-length <text>
set firewall ipv6 name <name> rule <1-999999> packet-length <text>
set firewall ipv6 forward filter rule <1-999999> packet-length-exclude <text>
set firewall ipv6 input filter rule <1-999999> packet-length-exclude <text>
set firewall ipv6 output filter rule <1-999999> packet-length-exclude <text>
set firewall ipv6 name <name> rule <1-999999> packet-length-exclude <text>
Match based on the packet length. Multiple values from 1 to 65535 and ranges are supported.
set firewall ipv6 forward filter rule <1-999999> packet-type [broadcast | host |
multicast | other]
set firewall ipv6 input filter rule <1-999999> packet-type [broadcast | host | multicast
| other]
set firewall ipv6 output filter rule <1-999999> packet-type [broadcast | host | multicast
| other]
set firewall ipv6 name <name> rule <1-999999> packet-type [broadcast | host | multicast |
other]
Match based on the packet type.
set firewall ipv6 forward filter rule <1-999999> protocol [<text> | <0-255> | all |
tcp_udp]
set firewall ipv6 input filter rule <1-999999> protocol [<text> | <0-255> | all |
tcp_udp]
set firewall ipv6 output filter rule <1-999999> protocol [<text> | <0-255> | all |
tcp_udp]
set firewall ipv6 name <name> rule <1-999999> protocol [<text> | <0-255> | all | tcp_udp]
Match based on protocol number or name as defined in /etc/protocols. Special names are all for all
protocols and tcp_udp for tcp and udp based packets. The ! negates the selected protocol.

8.2. Firewall 450

 VyOS Documentation, Release 1.5.x (circinus)

set firewall ipv6 input filter rule 10 protocol tcp

set firewall ipv6 forward filter rule <1-999999> recent count <1-255>
set firewall ipv6 input filter rule <1-999999> recent count <1-255>
set firewall ipv6 output filter rule <1-999999> recent count <1-255>
set firewall ipv6 name <name> rule <1-999999> recent count <1-255>
set firewall ipv6 forward filter rule <1-999999> recent time [second | minute | hour]
set firewall ipv6 input filter rule <1-999999> recent time [second | minute | hour]
set firewall ipv6 output filter rule <1-999999> recent time [second | minute | hour]
set firewall ipv6 name <name> rule <1-999999> recent time [second | minute | hour]
Match bases on recently seen sources.
set firewall ipv6 forward filter rule <1-999999> tcp flags [not] <text>
set firewall ipv6 input filter rule <1-999999> tcp flags [not] <text>
set firewall ipv6 output filter rule <1-999999> tcp flags [not] <text>
set firewall ipv6 name <name> rule <1-999999> tcp flags [not] <text>
Allowed values fpr TCP flags: ack, cwr, ecn, fin, psh, rst, syn and urg. Multiple values are supported, and
for inverted selection use not, as shown in the example.

set firewall ipv6 input filter rule 10 tcp flags 'ack'

set firewall ipv6 input filter rule 12 tcp flags 'syn'
set firewall ipv6 input filter rule 13 tcp flags not 'fin'

set firewall ipv6 forward filter rule <1-999999> state [established | invalid | new |
related]
set firewall ipv6 input filter rule <1-999999> state [established | invalid | new |
related]
set firewall ipv6 output filter rule <1-999999> state [established | invalid | new |
related]
set firewall ipv6 name <name> rule <1-999999> state [established | invalid | new |
related]
Match against the state of a packet.
set firewall ipv6 forward filter rule <1-999999> time startdate <text>
set firewall ipv6 input filter rule <1-999999> time startdate <text>
set firewall ipv6 output filter rule <1-999999> time startdate <text>
set firewall ipv6 name <name> rule <1-999999> time startdate <text>
set firewall ipv6 forward filter rule <1-999999> time starttime <text>
set firewall ipv6 input filter rule <1-999999> time starttime <text>
set firewall ipv6 output filter rule <1-999999> time starttime <text>
set firewall ipv6 name <name> rule <1-999999> time starttime <text>
set firewall ipv6 forward filter rule <1-999999> time stopdate <text>

8.2. Firewall 451

 VyOS Documentation, Release 1.5.x (circinus)

set firewall ipv6 input filter rule <1-999999> time stopdate <text>
set firewall ipv6 output filter rule <1-999999> time stopdate <text>
set firewall ipv6 name <name> rule <1-999999> time stopdate <text>
set firewall ipv6 forward filter rule <1-999999> time stoptime <text>
set firewall ipv6 input filter rule <1-999999> time stoptime <text>
set firewall ipv6 output filter rule <1-999999> time stoptime <text>
set firewall ipv6 name <name> rule <1-999999> time stoptime <text>
set firewall ipv6 forward filter rule <1-999999> time weekdays <text>
set firewall ipv6 input filter rule <1-999999> time weekdays <text>
set firewall ipv6 output filter rule <1-999999> time weekdays <text>
set firewall ipv6 name <name> rule <1-999999> time weekdays <text>
Time to match the defined rule.
set firewall ipv6 forward filter rule <1-999999> hop-limit <eq | gt | lt> <0-255>
set firewall ipv6 input filter rule <1-999999> hop-limit <eq | gt | lt> <0-255>
set firewall ipv6 output filter rule <1-999999> hop-limit <eq | gt | lt> <0-255>
set firewall ipv6 name <name> rule <1-999999> hop-limit <eq | gt | lt> <0-255>
Match the hop-limit parameter, where ‘eq’ stands for ‘equal’; ‘gt’ stands for ‘greater than’, and ‘lt’ stands for
‘less than’.
set firewall ipv6 forward filter rule <1-999999> recent count <1-255>
set firewall ipv6 input filter rule <1-999999> recent count <1-255>
set firewall ipv6 output filter rule <1-999999> recent count <1-255>
set firewall ipv6 name <name> rule <1-999999> recent count <1-255>
set firewall ipv6 forward filter rule <1-999999> recent time <second | minute | hour>
set firewall ipv6 input filter rule <1-999999> recent time <second | minute | hour>
set firewall ipv6 output filter rule <1-999999> recent time <second | minute | hour>
set firewall ipv6 name <name> rule <1-999999> recent time <second | minute | hour>
Match when ‘count’ amount of connections are seen within ‘time’. These matching criteria can be used to block
brute-force attempts.

Synproxy

Synproxy connections
set firewall ipv6 [input | forward] filter rule <1-999999> action synproxy
set firewall ipv6 [input | forward] filter rule <1-999999> protocol tcp
set firewall ipv6 [input | forward] filter rule <1-999999> synproxy tcp mss <501-65535>
Set the TCP-MSS (maximum segment size) for the connection
set firewall ipv6 [input | forward] filter rule <1-999999> synproxy tcp window-scale
<1-14>

8.2. Firewall 452

 VyOS Documentation, Release 1.5.x (circinus)

Set the window scale factor for TCP window scaling

Example synproxy

Requirements to enable synproxy:

• Traffic must be symmetric
• Synproxy relies on syncookies and TCP timestamps, ensure these are enabled
• Disable conntrack loose track option

set system sysctl parameter net.ipv4.tcp_timestamps value '1'

set system conntrack tcp loose disable

set system conntrack ignore ipv6 rule 10 destination port '8080'
set system conntrack ignore ipv6 rule 10 protocol 'tcp'
set system conntrack ignore ipv6 rule 10 tcp flags syn

set firewall global-options syn-cookies 'enable'

set firewall ipv6 input filter rule 10 action 'synproxy'
set firewall ipv6 input filter rule 10 destination port '8080'
set firewall ipv6 input filter rule 10 inbound-interface name 'eth1'
set firewall ipv6 input filter rule 10 protocol 'tcp'
set firewall ipv6 input filter rule 10 synproxy tcp mss '1460'
set firewall ipv6 input filter rule 10 synproxy tcp window-scale '7'
set firewall ipv6 input filter rule 1000 action 'drop'
set firewall ipv6 input filter rule 1000 state invalid

Operation-mode Firewall

Rule-set overview

show firewall
This will show you a basic firewall overview, for all rule-sets, and not only for ipv6

vyos@vyos:~$ show firewall

Rulesets Information

---------------------------------
IPv4 Firewall "forward filter"

Rule Action Protocol Packets Bytes Conditions

------- -------- ---------- --------- ------- ---------------------------------
˓→--------

5 jump all 0 0 iifname "eth1" jump NAME_VyOS_

˓→MANAGEMENT

10 jump all 0 0 oifname "eth1" jump NAME_WAN_IN

15 jump all 0 0 iifname "eth3" jump NAME_WAN_IN
default accept all

---------------------------------
(continues on next page)

8.2. Firewall 453

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

IPv4 Firewall "name VyOS_MANAGEMENT"

Rule Action Protocol Packets Bytes Conditions

------- -------- ---------- --------- ------- --------------------------------
5 accept all 0 0 ct state established accept
10 drop all 0 0 ct state invalid
20 accept all 0 0 ip saddr @A_GOOD_GUYS accept
30 accept all 0 0 ip saddr @N_ENTIRE_RANGE accept
40 accept all 0 0 ip saddr @A_VyOS_SERVERS accept
50 accept icmp 0 0 meta l4proto icmp accept
default drop all 0 0

---------------------------------
IPv6 Firewall "forward filter"

Rule Action Protocol

------- -------- ----------
5 jump all
10 jump all
15 jump all
default accept all

---------------------------------
IPv6 Firewall "input filter"

Rule Action Protocol

------- -------- ----------
5 jump all
default accept all

---------------------------------
IPv6 Firewall "ipv6_name IPV6-VyOS_MANAGEMENT"

Rule Action Protocol

------- -------- ----------
5 accept all
10 drop all
20 accept all
30 accept all
40 accept all
50 accept ipv6-icmp
default drop all

show firewall summary

This will show you a summary of rule-sets and groups
vyos@vyos:~$ show firewall summary
Ruleset Summary

IPv6 Ruleset:

Ruleset Hook Ruleset Priority Description

(continues on next page)

8.2. Firewall 454

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

-------------- -------------------- -------------------------
forward filter
input filter
ipv6_name IPV6-VyOS_MANAGEMENT
ipv6_name IPV6-WAN_IN PUBLIC_INTERNET

IPv4 Ruleset:

Ruleset Hook Ruleset Priority Description

-------------- ------------------ -------------------------
forward filter
input filter
name VyOS_MANAGEMENT
name WAN_IN PUBLIC_INTERNET

Firewall Groups

Name Type References Members

----------------------- ------------------ ----------------------- --------------
˓→--

PBX address_group WAN_IN-100 198.51.100.77

SERVERS address_group WAN_IN-110 192.0.2.10
WAN_IN-111 192.0.2.11
WAN_IN-112 192.0.2.12
WAN_IN-120
WAN_IN-121
WAN_IN-122
SUPPORT address_group VyOS_MANAGEMENT-20 192.168.1.2
WAN_IN-20
PHONE_VPN_SERVERS address_group WAN_IN-160 10.6.32.2
PINGABLE_ADRESSES address_group WAN_IN-170 192.168.5.2
WAN_IN-171
PBX ipv6_address_group IPV6-WAN_IN-100 2001:db8::1
SERVERS ipv6_address_group IPV6-WAN_IN-110 2001:db8::2
IPV6-WAN_IN-111 2001:db8::3
IPV6-WAN_IN-112 2001:db8::4
IPV6-WAN_IN-120
IPV6-WAN_IN-121
IPV6-WAN_IN-122
SUPPORT ipv6_address_group IPV6-VyOS_MANAGEMENT-20 2001:db8::5
IPV6-WAN_IN-20

show firewall ipv6 [forward | input | output] filter

show firewall ipv6 ipv6-name <name>
This command will give an overview of a single rule-set.

vyos@vyos:~$ show firewall ipv6 input filter

Ruleset Information

---------------------------------
ipv6 Firewall "input filter"
(continues on next page)

8.2. Firewall 455

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Rule Action Protocol Packets Bytes Conditions

------- -------- ---------- --------- ------- ---------------------------------
˓→---------------------------------------------

10 jump all 13 1456 iifname "eth1" jump NAME6_INP-

˓→ETH1

20 accept ipv6-icmp 10 1112 meta l4proto ipv6-icmp iifname

˓→"eth0" prefix "[ipv6-INP-filter-20-A]" accept
default accept all 14 1584

vyos@vyos:~$

show firewall ipv6 [forward | input | output] filter rule <1-999999>

show firewall ipv6 name <name> rule <1-999999>
show firewall ipv6 ipv6-name <name> rule <1-999999>
This command will give an overview of a rule in a single rule-set
show firewall group <name>
Overview of defined groups. You see the type, the members, and where the group is used.

vyos@vyos:~$ show firewall group LAN

Firewall Groups

Name Type References Members

------------ ------------------ ----------------------- ----------------
LAN ipv6_network_group IPV6-VyOS_MANAGEMENT-30 2001:db8::0/64
IPV6-WAN_IN-30
LAN network_group VyOS_MANAGEMENT-30 192.168.200.0/24
WAN_IN-30

show firewall statistics

This will show you a statistic of all rule-sets since the last boot.

Show Firewall log

show log firewall

show log firewall ipv6
show log firewall ipv6 [forward | input | output | name]
show log firewall ipv6 [forward | input | output] filter
show log firewall ipv6 name <name>
show log firewall ipv6 [forward | input | output] filter rule <rule>
show log firewall ipv6 name <name> rule <rule>
Show the logs of all firewall; show all ipv6 firewall logs; show all logs for particular hook; show all logs for
particular hook and priority; show all logs for particular custom chain; show logs for specific Rule-Set.

8.2. Firewall 456

 VyOS Documentation, Release 1.5.x (circinus)

Example Partial Config

firewall {
ipv6 {
input {
filter {
rule 10 {
action jump
inbound-interface {
name eth1
}
jump-target INP-ETH1
}
rule 20 {
action accept
inbound-interface {
name eth0
}
log
protocol ipv6-icmp
}
}
}
name INP-ETH1 {
default-action drop
default-log
rule 10 {
action accept
protocol tcp_udp
}
}
}
}

Update geoip database

update geoip
Command used to update GeoIP database and firewall sets.

8.2.6 Flowtables Firewall Configuration

Note: Documentation under development

8.2. Firewall 457

 VyOS Documentation, Release 1.5.x (circinus)

Overview

In this section there’s useful information on all firewall configuration that can be done regarding flowtables.
set firewall flowtables ...
From the main structure defined in Firewall Overview in this section you can find detailed information only for the next
part of the general structure:

- set firewall
* flowtable
- custom_flow_table
+ ...

Flowtables allow you to define a fastpath through the flowtable datapath. The flowtable supports for the layer 3 IPv4
and IPv6 and the layer 4 TCP and UDP protocols.

Once the first packet of the flow successfully goes through the IP forwarding path (black circles path), from the second
packet on, you might decide to offload the flow to the flowtable through your ruleset. The flowtable infrastructure
provides a rule action that allows you to specify when to add a flow to the flowtable (On forward filtering, red circle
number 6)
A packet that finds a matching entry in the flowtable (flowtable hit) is transmitted to the output netdevice, hence, packets
bypass the classic IP forwarding path and uses the Fast Path (orange circles path). The visible effect is that you do not
see these packets from any of the Netfilter hooks coming after ingress. In case that there is no matching entry in the
flowtable (flowtable miss), the packet follows the classic IP forwarding path.

Note: Flowtable Reference: https://docs.kernel.org/networking/nf_flowtable.html

8.2. Firewall 458

 VyOS Documentation, Release 1.5.x (circinus)

Flowtable Configuration

In order to use flowtables, the minimal configuration needed includes:

• Create flowtable: create flowtable, which includes the interfaces that are going to be used by the flowtable.
• Create firewall rule: create a firewall rule, setting action to offload and using desired flowtable for
offload-target.
Creating a flow table:
set firewall flowtable <flow_table_name> interface <iface>
Define interfaces to be used in the flowtable.
set firewall flowtable <flow_table_name> description <text>
Provide a description to the flow table.
set firewall flowtable <flow_table_name> offload <hardware | software>
Define type of offload to be used by the flowtable: hardware or software. By default, software offload is
used.

Note: Hardware offload: should be supported by the NICs used.

Creating rules for using flow tables:

set firewall [ipv4 | ipv6] forward filter rule <1-999999> action offload
Create firewall rule in forward chain, and set action to offload.
set firewall [ipv4 | ipv6] forward filter rule <1-999999> offload-target <flowtable>
Create firewall rule in forward chain, and define which flowtbale should be used. Only applicable if action is
offload.

Configuration Example

Things to be considered in this setup:

• Two interfaces are going to be used in the flowtables: eth0 and eth1
• Minimum firewall ruleset is provided, which includes some filtering rules, and appropriate rules for using
flowtable offload capabilities.
As described, the first packet will be evaluated by the firewall path, so a desired connection should be explicitly accepted.
Same thing should be taken into account for traffic in reverse order. In most cases state policies are used in order to
accept a connection in the reverse path.
We will only accept traffic coming from interface eth0, protocol tcp and destination port 1122. All other traffic tres-
passing the router should be blocked.

8.2. Firewall 459

 VyOS Documentation, Release 1.5.x (circinus)

Commands

set firewall flowtable FT01 interface 'eth0'

set firewall flowtable FT01 interface 'eth1'
set firewall ipv4 forward filter default-action 'drop'
set firewall ipv4 forward filter rule 10 action 'offload'
set firewall ipv4 forward filter rule 10 offload-target 'FT01'
set firewall ipv4 forward filter rule 10 state 'established'
set firewall ipv4 forward filter rule 10 state 'related'
set firewall ipv4 forward filter rule 20 action 'accept'
set firewall ipv4 forward filter rule 20 state 'established'
set firewall ipv4 forward filter rule 20 state 'related'
set firewall ipv4 forward filter rule 110 action 'accept'
set firewall ipv4 forward filter rule 110 destination address '192.0.2.100'
set firewall ipv4 forward filter rule 110 destination port '1122'
set firewall ipv4 forward filter rule 110 inbound-interface name 'eth0'
set firewall ipv4 forward filter rule 110 protocol 'tcp'

Explanation

Analysis on what happens for desired connection:

1. Firstly, a packet is received on eth0, with destination address 192.0.2.100, protocol tcp and destination
port 1122. Assume such destination address is reachable through interface eth1.
2. Since this is the first packet, connection status of this connection, so far is new. So neither rule 10 nor
20 are valid.
3. Rule 110 is hit, so connection is accepted.
4. Once an answer from server 192.0.2.100 is seen in opposite direction, connection state will be triggered
to established, so this reply is accepted in rule 20.
5. The second packet for this connection is received by the router. Since connection state is established,
then rule 10 is hit, and a new entry in the flowtable FT01 is added for this connection.
6. All the following packets will skip the traditional path, will be offloaded and use the Fast Path.

Checks

It’s time to check the conntrack table, to see if any connections were accepted, and if it was properly offloaded

vyos@FlowTables:~$ show firewall ipv4 forward filter

Ruleset Information

---------------------------------
ipv4 Firewall "forward filter"

Rule Action Protocol Packets Bytes Conditions

------- -------- ---------- --------- ------- --------------------------------------
˓→--------------------------

10 offload all 8 468 ct state { established, related } ␣

˓→flow add @VYOS_FLOWTABLE_FT01

(continues on next page)

8.2. Firewall 460

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

20 accept all 8 468 ct state { established, related } ␣
˓→accept

110 accept tcp 2 120 ip daddr 192.0.2.100 tcp dport 1122␣

˓→iifname "eth0" accept
default drop all 7 420

vyos@FlowTables:~$ sudo conntrack -L | grep tcp

conntrack v1.4.6 (conntrack-tools): 5 flow entries have been shown.
tcp 6 src=198.51.100.100 dst=192.0.2.100 sport=41676 dport=1122 src=192.0.2.100␣
˓→dst=198.51.100.100 sport=1122 dport=41676 [OFFLOAD] mark=0 use=2

vyos@FlowTables:~$

Note: For more information of Netfilter hooks and Linux networking packet flows can be found in Netfilter-Hooks

8.2.7 Zone-based firewall

Zone Based Firewall

Overview

Note: Starting from VyOS 1.4-rolling-202308040557, a new firewall structure can be found on all VyOS installations.
The Zone based firewall was removed in that version, but re introduced in VyOS 1.4 and 1.5. All versions built after
2023-10-22 have this feature. Documentation for most of the new firewall CLI can be found in the firewall chapter. The
legacy firewall is still available for versions before 1.4-rolling-202308040557 and can be found in the legacy firewall
configuration chapter.

In this section there’s useful information on all firewall configuration that is needed for the zone-based firewall. Con-
figuration commands covered in this section:
set firewall zone ...
From the main structure defined in Firewall Overview in this section you can find detailed information only for the next
part of the general structure:

- set firewall
* zone
- custom_zone_name
+ ...

In zone-based policy, interfaces are assigned to zones, and inspection policy is applied to traffic moving between the
zones and acted on according to firewall rules. A zone is a group of interfaces that have similar functions or features. It
establishes the security borders of a network. A zone defines a boundary where traffic is subjected to policy restrictions
as it crosses to another region of a network.
Key Points:
• A zone must be configured before an interface is assigned to it and an interface can be assigned to only a single
zone.
• All traffic to and from an interface within a zone is permitted.

8.2. Firewall 461

 VyOS Documentation, Release 1.5.x (circinus)

• All traffic between zones is affected by existing policies

• Traffic cannot flow between a zone member interface and any interface that is not a zone member.
• You need 2 separate firewalls to define traffic: one for each direction.

Note: In T2199 the syntax of the zone configuration was changed. The zone configuration moved from zone-policy
zone <name> to firewall zone <name>.

Configuration

As an alternative to applying policy to an interface directly, a zone-based firewall can be created to simplify configu-
ration when multiple interfaces belong to the same security zone. Instead of applying rule-sets to interfaces, they are
applied to source zone-destination zone pairs.
A basic introduction to zone-based firewalls can be found here, and an example at Zone-Policy example.

Define a Zone

To define a zone setup either one with interfaces or a local zone.

set firewall zone <name> interface <interface>
Set interfaces to a zone. A zone can have multiple interfaces. But an interface can only be a member in one
zone.
set firewall zone <name> local-zone
Define the zone as a local zone. A local zone has no interfaces and will be applied to the router itself.
set firewall zone <name> default-action [drop | reject]
Change the default-action with this setting.
set firewall zone <name> description
Set a meaningful description.

Applying a Rule-Set to a Zone

Before you are able to apply a rule-set to a zone you have to create the zones first.
It helps to think of the syntax as: (see below). The ‘rule-set’ should be written from the perspective of: Source Zone-
to->*Destination Zone*
set firewall zone <Destination Zone> from <Source Zone> firewall name <rule-set>
set firewall zone <name> from <name> firewall name <rule-set>
set firewall zone <name> from <name> firewall ipv6-name <rule-set>
You apply a rule-set always to a zone from an other zone, it is recommended to create one rule-set for each zone
pair.

set firewall zone DMZ from LAN firewall name LANv4-to-DMZv4

set firewall zone LAN from DMZ firewall name DMZv4-to-LANv4

8.2. Firewall 462

 VyOS Documentation, Release 1.5.x (circinus)

Operation-mode

show firewall zone-policy

This will show you a basic summary of the zone configuration.

vyos@vyos:~$ show firewall zone-policy

Zone Interfaces From Zone Firewall IPv4 Firewall IPv6
------ ------------ ----------- --------------- ---------------
LAN eth1 WAN WAN_to_LAN
eth2
LOCAL LOCAL LAN LAN_to_LOCAL
WAN WAN_to_LOCAL WAN_to_LOCAL_v6
WAN eth3 LAN LAN_to_WAN
eth0 LOCAL LOCAL_to_WAN
vyos@vyos:~$

show firewall zone-policy zone <zone>

This will show you a basic summary of a particular zone.

vyos@vyos:~$ show firewall zone-policy zone WAN

Zone Interfaces From Zone Firewall IPv4 Firewall IPv6
------ ------------ ----------- --------------- ---------------
WAN eth3 LAN LAN_to_WAN
eth0 LOCAL LOCAL_to_WAN
vyos@vyos:~$ show firewall zone-policy zone LOCAL
Zone Interfaces From Zone Firewall IPv4 Firewall IPv6
------ ------------ ----------- --------------- ---------------
LOCAL LOCAL LAN LAN_to_LOCAL
WAN WAN_to_LOCAL WAN_to_LOCAL_v6
vyos@vyos:~$

With zone-based firewalls a new concept was implemented, in addition to the standard in and out traffic flows, a local
flow was added. This local flow was for traffic originating and destined to the router itself. Which means that additional
rules were required to secure the firewall itself from the network, in addition to the existing inbound and outbound rules
from the traditional concept above.
To configure VyOS with the zone-based firewall configuration
As the example image below shows, the device now needs rules to allow/block traffic to or from the services running
on the device that have open connections on that interface.

8.2. Firewall 463

 VyOS Documentation, Release 1.5.x (circinus)

8.3 High availability

VRRP (Virtual Router Redundancy Protocol) provides active/backup redundancy for routers. Every VRRP router has
a physical IP/IPv6 address, and a virtual address. On startup, routers elect the master, and the router with the highest
priority becomes the master and assigns the virtual address to its interface. All routers with lower priorities become
backup routers. The master then starts sending keepalive packets to notify other routers that it’s available. If the master
fails and stops sending keepalive packets, the router with the next highest priority becomes the new master and takes
over the virtual address.
VRRP keepalive packets use multicast, and VRRP setups are limited to a single datalink layer segment. You can setup
multiple VRRP groups (also called virtual routers). Virtual routers are identified by a VRID (Virtual Router IDentifier).
If you setup multiple groups on the same interface, their VRIDs must be unique if they use the same address family,
but it’s possible (even if not recommended for readability reasons) to use duplicate VRIDs on different interfaces.

8.3.1 Basic setup

VRRP groups are created with the set high-availability vrrp group $GROUP_NAME commands. The required
parameters are interface, vrid, and address.
minimal config

set high-availability vrrp group Foo vrid 10

set high-availability vrrp group Foo interface eth0
set high-availability vrrp group Foo address 192.0.2.1/24

You can verify your VRRP group status with the operational mode run show vrrp command:

vyos@vyos# run show vrrp

Name Interface VRID State Last Transition
---------- ----------- ------ ------- -----------------
Foo eth1 10 MASTER 2s

8.3.2 IPv6 support

The address parameter can be either an IPv4 or IPv6 address, but you can not mix IPv4 and IPv6 in the same group,
and will need to create groups with different VRIDs specially for IPv4 and IPv6. If you want to use IPv4 + IPv6 address
you can use option excluded-address

8.3.3 Address

The address can be configured either on the VRRP interface or on not VRRP interface.

set high-availability vrrp group Foo address 192.0.2.1/24

set high-availability vrrp group Foo address 203.0.113.22/24 interface eth2
set high-availability vrrp group Foo address 198.51.100.33/24 interface eth3

8.3. High availability 464

 VyOS Documentation, Release 1.5.x (circinus)

8.3.4 Disabling a VRRP group

You can disable a VRRP group with disable option:

set high-availability vrrp group Foo disable

A disabled group will be removed from the VRRP process and your router will not participate in VRRP for that VRID.
It will disappear from operational mode commands output, rather than enter the backup state.

8.3.5 Exclude address

Exclude IP addresses from VRRP packets. This option excluded-address is used when you want to set IPv4 +
IPv6 addresses on the same virtual interface or when used more than 20 IP addresses.

set high-availability vrrp group Foo excluded-address '203.0.113.254/24'

set high-availability vrrp group Foo excluded-address '2001:db8:aa::1/64'
set high-availability vrrp group Foo excluded-address '2001:db8:22::1/64'

8.3.6 Setting VRRP group priority

VRRP priority can be set with priority option:

set high-availability vrrp group Foo priority 200

The priority must be an integer number from 1 to 255. Higher priority value increases router’s precedence in the master
elections.

8.3.7 Sync groups

A sync group allows VRRP groups to transition together.

edit high-availability vrrp

set sync-group MAIN member VLAN9
set sync-group MAIN member VLAN20

In the following example, when VLAN9 transitions, VLAN20 will also transition:

vrrp {
group VLAN9 {
interface eth0.9
address 10.9.1.1/24
priority 200
vrid 9
}
group VLAN20 {
interface eth0.20
priority 200
address 10.20.20.1/24
vrid 20
}
sync-group MAIN {
(continues on next page)

8.3. High availability 465

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

member VLAN20
member VLAN9
}
}

Warning: All items in a sync group should be similarly configured. If one VRRP group is set to a different
preemption delay or priority, it would result in an endless transition loop.

8.3.8 Preemption

VRRP can use two modes: preemptive and non-preemptive. In the preemptive mode, if a router with a higher priority
fails and then comes back, routers with lower priority will give up their master status. In non-preemptive mode, the
newly elected master will keep the master status and the virtual address indefinitely.
By default VRRP uses preemption. You can disable it with the “no-preempt” option:

set high-availability vrrp group Foo no-preempt

You can also configure the time interval for preemption with the “preempt-delay” option. For example, to set the higher
priority router to take over in 180 seconds, use:

set high-availability vrrp group Foo preempt-delay 180

8.3.9 Track

Track option to track non VRRP interface states. VRRP changes status to FAULT if one of the track interfaces in state
down.

set high-availability vrrp group Foo track interface eth0

set high-availability vrrp group Foo track interface eth1

Ignore VRRP main interface faults

set high-availability vrrp group Foo track exclude-vrrp-interface

8.3.10 Unicast VRRP

By default VRRP uses multicast packets. If your network does not support multicast for whatever reason, you can make
VRRP use unicast communication instead.

set high-availability vrrp group Foo peer-address 192.0.2.10

set high-availability vrrp group Foo hello-source-address 192.0.2.15

8.3. High availability 466

 VyOS Documentation, Release 1.5.x (circinus)

8.3.11 rfc3768-compatibility

RFC 3768 defines a virtual MAC address to each VRRP virtual router. This virtual router MAC address will be used
as the source in all periodic VRRP messages sent by the active node. When the rfc3768-compatibility option is set, a
new VRRP interface is created, to which the MAC address and the virtual IP address is automatically assigned.

set high-availability vrrp group Foo rfc3768-compatibility

Verification

$show interfaces ethernet eth0v10

eth0v10@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue
state UP group default qlen 1000
link/ether 00:00:5e:00:01:0a brd ff:ff:ff:ff:ff:ff
inet 172.25.0.247/16 scope global eth0v10
valid_lft forever preferred_lft forever

Warning: RFC 3768 creates a virtual interface. If you want to apply the destination NAT rule to the traffic sent
to the virtual MAC, set the created virtual interface as inbound-interface.

8.3.12 Global options

On most scenarios, there’s no need to change specific parameters, and using default configuration is enough. But there
are cases were extra configuration is needed.
set high-availability vrrp global-parameters startup_delay <1-600>
This option specifies a delay in seconds before vrrp instances start up after keepalived starts.

8.3.13 Gratuitous ARP

These configuration is not mandatory and in most cases there’s no need to configure it. But if necessary, Gratuitous
ARP can be configured in global-parameters and/or in group section.
set high-availability vrrp global-parameters garp interval <0.000-1000>
set high-availability vrrp group <name> garp interval <0.000-1000>
Set delay between gratuitous ARP messages sent on an interface.
0 if not defined.
set high-availability vrrp global-parameters garp master-delay <1-255>
set high-availability vrrp group <name> garp master-delay <1-255>
Set delay for second set of gratuitous ARPs after transition to MASTER.
5 if not defined.
set high-availability vrrp global-parameters garp master-refresh <1-600>
set high-availability vrrp group <name> garp master-refresh <1-600>
Set minimum time interval for refreshing gratuitous ARPs while MASTER.
0 if not defined, which means no refreshing.

8.3. High availability 467

 VyOS Documentation, Release 1.5.x (circinus)

set high-availability vrrp global-parameters garp master-refresh-repeat <1-600>

set high-availability vrrp group <name> garp master-refresh-repeat <1-600>
Set number of gratuitous ARP messages to send at a time while MASTER.
1 if not defined.
set high-availability vrrp global-parameters garp master-repeat <1-600>
set high-availability vrrp group <name> garp master-repeat <1-600>
Set number of gratuitous ARP messages to send at a time after transition to MASTER.
5 if not defined.

8.3.14 Version

set high-availability vrrp global-parameters version 2|3

Set the default VRRP version to use. This defaults to 2, but IPv6 instances will always use version 3.

8.3.15 Scripting

VRRP functionality can be extended with scripts. VyOS supports two kinds of scripts: health check scripts and transi-
tion scripts. Health check scripts execute custom checks in addition to the master router reachability. Transition scripts
are executed when VRRP state changes from master to backup or fault and vice versa and can be used to enable or
disable certain services, for example.

Health check scripts

This setup will make the VRRP process execute the /config/scripts/vrrp-check.sh script every 60 seconds,
and transition the group to the fault state if it fails (i.e. exits with non-zero status) three times:

set high-availability vrrp group Foo health-check script /config/scripts/vrrp-check.sh

set high-availability vrrp group Foo health-check interval 60
set high-availability vrrp group Foo health-check failure-count 3

When the vrrp group is a member of the sync group will use only the sync group health check script. This example
shows how to configure it for the sync group:

set high-availability vrrp sync-group Bar health-check script /config/scripts/vrrp-check.

˓→sh

set high-availability vrrp sync-group Bar health-check interval 60

set high-availability vrrp sync-group Bar health-check failure-count 3

8.3. High availability 468

 VyOS Documentation, Release 1.5.x (circinus)

Transition scripts

Transition scripts can help you implement various fixups, such as starting and stopping services, or even modify-
ing the VyOS config on VRRP transition. This setup will make the VRRP process execute the /config/scripts/
vrrp-fail.sh with argument Foo when VRRP fails, and the /config/scripts/vrrp-master.sh when the router
becomes the master:

set high-availability vrrp group Foo transition-script backup "/config/scripts/vrrp-fail.

˓→sh Foo"

set high-availability vrrp group Foo transition-script fault "/config/scripts/vrrp-fail.

˓→sh Foo"

set high-availability vrrp group Foo transition-script master "/config/scripts/vrrp-

˓→master.sh Foo"

To know more about scripting, check the Command Scripting section.

8.3.16 Virtual-server

Virtual Server allows to Load-balance traffic destination virtual-address:port between several real servers.

Algorithm

Load-balancing schedule algorithm:

• round-robin
• weighted-round-robin
• least-connection
• weighted-least-connection
• source-hashing
• destination-hashing
• locality-based-least-connection

set high-availability virtual-server 203.0.113.1 algorithm 'least-connection'

Forward method

• NAT
• direct
• tunnel

set high-availability virtual-server 203.0.113.1 forward-method 'nat'

8.3. High availability 469

 VyOS Documentation, Release 1.5.x (circinus)

Health-check

Custom health-check script allows checking real-server availability

set high-availability virtual-server 203.0.113.1 real-server 192.0.2.11 health-check␣

˓→script <path-to-script>

Fwmark

Firewall mark. It possible to loadbalancing traffic based on fwmark value

set high-availability virtual-server 203.0.113.1 fwmark '111'

Real server

Real server IP address and port

set high-availability virtual-server 203.0.113.1 real-server 192.0.2.11 port '80'

Example

Virtual-server can be configured with VRRP virtual address or without VRRP.

In the next example all traffic destined to 203.0.113.1 and port 8280 protocol TCP is balanced between 2 real servers
192.0.2.11 and 192.0.2.12 to port 80
Real server is auto-excluded if port check with this server fail.

set interfaces ethernet eth0 address '203.0.113.11/24'

set interfaces ethernet eth1 address '192.0.2.1/24'
set high-availability vrrp group FOO interface 'eth0'
set high-availability vrrp group FOO no-preempt
set high-availability vrrp group FOO priority '150'
set high-availability vrrp group FOO address '203.0.113.1/24'
set high-availability vrrp group FOO vrid '10'

set high-availability virtual-server 203.0.113.1 algorithm 'source-hashing'

set high-availability virtual-server 203.0.113.1 delay-loop '10'
set high-availability virtual-server 203.0.113.1 forward-method 'nat'
set high-availability virtual-server 203.0.113.1 persistence-timeout '180'
set high-availability virtual-server 203.0.113.1 port '8280'
set high-availability virtual-server 203.0.113.1 protocol 'tcp'
set high-availability virtual-server 203.0.113.1 real-server 192.0.2.11 port '80'
set high-availability virtual-server 203.0.113.1 real-server 192.0.2.12 port '80'

A firewall mark fwmark allows using multiple ports for high-availability virtual-server. It uses fwmark value.
In this example all traffic destined to ports “80, 2222, 8888” protocol TCP marks to fwmark “111” and balanced between
2 real servers. Port “0” is required if multiple ports are used.

8.3. High availability 470

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces ethernet eth0 address 'dhcp'

set interfaces ethernet eth0 description 'WAN'
set interfaces ethernet eth1 address '192.0.2.1/24'
set interfaces ethernet eth1 description 'LAN'

set policy route PR interface 'eth0'

set policy route PR rule 10 destination port '80,2222,8888'
set policy route PR rule 10 protocol 'tcp'
set policy route PR rule 10 set mark '111'

set high-availability virtual-server vyos fwmark '111'

set high-availability virtual-server vyos protocol 'tcp'
set high-availability virtual-server vyos real-server 192.0.2.11 health-check script '/
˓→config/scripts/check-real-server-first.sh'

set high-availability virtual-server vyos real-server 192.0.2.11 port '0'

set high-availability virtual-server vyos real-server 192.0.2.12 health-check script '/
˓→config/scripts/check-real-server-second.sh'

set high-availability virtual-server vyos real-server 192.0.2.12 port '0'

set nat source rule 100 outbound-interface name 'eth0'

set nat source rule 100 source address '192.0.2.0/24'
set nat source rule 100 translation address 'masquerade'

Op-mode check virtual-server status

vyos@r14:~$ run show virtual-server

IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
FWM 111 lc persistent 300
-> 192.0.2.11:0 Masq 1 0 0
-> 192.0.2.12:0 Masq 1 1 0

8.4 Interfaces

8.4.1 Bond / Link Aggregation

The bonding interface provides a method for aggregating multiple network interfaces into a single logical “bonded”
interface, or LAG, or ether-channel, or port-channel. The behavior of the bonded interfaces depends upon the mode;
generally speaking, modes provide either hot standby or load balancing services. Additionally, link integrity monitoring
may be performed.

8.4. Interfaces 471

 VyOS Documentation, Release 1.5.x (circinus)

Configuration

Common interface configuration

set interfaces bonding <interface> address <address | dhcp | dhcpv6>

Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
• dhcp interface address is received by DHCP from a DHCP server on this segment.
• dhcpv6 interface address is received by DHCPv6 from a DHCPv6 server on this segment.

Note: When using DHCP to retrieve IPv4 address and if local customizations are needed, they should be
possible using the enter and exit hooks provided. The hook dirs are:
• /config/scripts/dhcp-client/pre-hooks.d/
• /config/scripts/dhcp-client/post-hooks.d/

Example:

set interfaces bonding bond0 address 192.0.2.1/24

set interfaces bonding bond0 address 2001:db8::1/64
set interfaces bonding bond0 address dhcp
set interfaces bonding bond0 address dhcpv6

set interfaces bonding <interface> description <description>

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces bonding bond0 description 'This is an awesome interface running on␣
˓→VyOS'

set interfaces bonding <interface> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces bonding bond0 disable

set interfaces bonding <interface> disable-flow-control

Ethernet flow control is a mechanism for temporarily stopping the transmission of data on Ethernet family com-
puter networks. The goal of this mechanism is to ensure zero packet loss in the presence of network congestion.
The first flow control mechanism, the pause frame, was defined by the IEEE 802.3x standard.
A sending station (computer or network switch) may be transmitting data faster than the other end of the link can
accept it. Using flow control, the receiving station can signal the sender requesting suspension of transmissions
until the receiver catches up.
Use this command to disable the generation of Ethernet flow control (pause frames).
Example:

8.4. Interfaces 472

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces bonding bond0 disable-flow-control

set interfaces bonding <interface> disable-link-detect

Use this command to direct an interface to not detect any physical state changes on a link, for example, when
the cable is unplugged.
Default is to detects physical link state changes.
Example:

set interfaces bonding bond0 disable-link-detect

set interfaces bonding <interface> mac <xx:xx:xx:xx:xx:xx>

Configure user defined MAC (Media Access Control) address on given <interface>.
Example:

set interfaces bonding bond0 mac '00:53:01:02:03:04'

set interfaces bonding <interface> mtu <mtu>

Configure MTU (Maximum Transmission Unit) on given <interface>. It is the size (in bytes) of the largest
ethernet frame sent on this link.
Example:

set interfaces bonding bond0 mtu 1600

set interfaces bonding <interface> ip adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces bonding <interface> ip arp-cache-timeout
Once a neighbor has been found, the entry is considered to be valid for at least for this specific time. An entry’s
validity will be extended if it receives positive feedback from higher level protocols.
This defaults to 30 seconds.
Example:

set interfaces bonding bond0 ip arp-cache-timeout 180

set interfaces bonding <interface> ip disable-arp-filter

If set the kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but
it usually makes sense, because it increases the chance of successful communication. IP addresses are owned

8.4. Interfaces 473

 VyOS Documentation, Release 1.5.x (circinus)

by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing,
does this behaviour cause problems.
If not set (default) allows you to have multiple network interfaces on the same subnet, and have the ARPs for
each interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that
interface (therefore you must use source based routing for this to work).
In other words it allows control of which cards (usually 1) will respond to an arp request.
Example:

set interfaces bonding bond0 ip disable-arp-filter

set interfaces bonding <interface> ip disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

set interfaces bonding bond0 ip disable-forwarding

set interfaces bonding <interface> ip enable-directed-broadcast

Define different modes for IP directed broadcast forwarding as described in RFC 1812 and RFC 2644.
If configured, incoming IP directed broadcast packets on this interface will be forwarded.
If this option is unset (default), incoming IP directed broadcast packets will not be forwarded.

set interfaces bonding bond0 ip enable-directed-broadcast

set interfaces bonding <interface> ip enable-arp-accept

Define behavior for gratuitous ARP frames whose IP is not already present in the ARP table. If configured
create new entries in the ARP table.
Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on.
If the ARP table already contains the IP address of the gratuitous arp frame, the arp table will be updated
regardless if this setting is on or off.

set interfaces bonding bond0 ip enable-arp-accept

set interfaces bonding <interface> ip enable-arp-announce

Define different restriction levels for announcing the local source IP address from IP packets in ARP requests
sent on interface.
Use any local address, configured on any interface if this is not set.
If configured, try to avoid local addresses that are not in the target’s subnet for this interface. This mode is
useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of
their logical network configured on the receiving interface. When we generate the request we will check all our
subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no
such subnet we select source address according to the rules for level 2.

set interfaces bonding bond0 ip enable-arp-announce

set interfaces bonding <interface> ip enable-arp-ignore

Define different modes for sending replies in response to received ARP requests that resolve local target IP
addresses:

8.4. Interfaces 474

 VyOS Documentation, Release 1.5.x (circinus)

If configured, reply only if the target IP address is local address configured on the incoming interface.
If this option is unset (default), reply for any local target IP address, configured on any interface.

set interfaces bonding bond0 ip enable-arp-ignore

set interfaces bonding <interface> ip enable-proxy-arp

Use this command to enable proxy Address Resolution Protocol (ARP) on this interface. Proxy ARP allows
an Ethernet interface to respond with its own MAC address to ARP requests for destination IP addresses on
subnets attached to other interfaces on the system. Subsequent packets sent to those destination IP addresses
are forwarded appropriately by the system.
Example:

set interfaces bonding bond0 ip enable-proxy-arp

set interfaces bonding <interface> ip proxy-arp-pvlan

Private VLAN proxy arp. Basically allow proxy arp replies back to the same interface (from which the ARP
request/solicitation was received).
This is done to support (ethernet) switch features, like RFC 3069, where the individual ports are NOT allowed
to communicate with each other, but they are allowed to talk to the upstream router. As described in RFC 3069,
it is possible to allow these hosts to communicate through the upstream router by proxy_arp’ing.

Note: Does not need to be used together with proxy_arp.

This technology is known by different names:

• In RFC 3069 it is called VLAN Aggregation
• Cisco and Allied Telesyn call it Private VLAN
• Hewlett-Packard call it Source-Port filtering or port-isolation
• Ericsson call it MAC-Forced Forwarding (RFC Draft)
set interfaces bonding <interface> ip source-validation <strict | loose | disable>
Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.
• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation
set interfaces bonding <interface> ipv6 address autoconf
SLAAC (Stateless Address Autoconfiguration) RFC 4862. IPv6 hosts can configure themselves automatically
when connected to an IPv6 network using the Neighbor Discovery Protocol via ICMPv6 (Internet Control
Message Protocol version 6) router discovery messages. When first connected to a network, a host sends a link-
local router solicitation multicast request for its configuration parameters; routers respond to such a request with
a router advertisement packet that contains Internet Layer configuration parameters.

8.4. Interfaces 475

 VyOS Documentation, Release 1.5.x (circinus)

Note: This method automatically disables IPv6 traffic forwarding on the interface in question.

Example:

set interfaces bonding bond0 ipv6 address autoconf

set interfaces bonding <interface> ipv6 address eui64 <prefix>

EUI-64 (64-Bit Extended Unique Identifier) as specified in RFC 4291 allows a host to assign iteslf a unique
64-Bit IPv6 address.
Example:

set interfaces bonding bond0 ipv6 address eui64 2001:db8:beef::/64

set interfaces bonding <interface> ipv6 address no-default-link-local

Do not assign a link-local IPv6 address to this interface.
Example:

set interfaces bonding bond0 ipv6 address no-default-link-local

set interfaces bonding <interface> ipv6 disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
Example:

set interfaces bonding bond0 ipv6 disable-forwarding

set interfaces bonding <interface> ipv6 adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss6 <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces bonding <interface> ipv6 accept-dad <1-3>
Whether to accept DAD (Duplicate Address Detection).
• 0: Disable DAD
• 1: Enable DAD (default)
• 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate link-local address has been found.
Example:

8.4. Interfaces 476

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces bonding bond0 ipv6 accept-dad 2

set interfaces bonding <interface> ipv6 dup-addr-detect-transmits <n>

The amount of Duplicate Address Detection probes to send.
Default: 1
Example:

set interfaces bonding bond0 ipv6 dup-addr-detect-transmits 5

set interfaces bonding <interface> vrf <vrf>

Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces bonding bond0 vrf red

DHCP(v6)
set interfaces bonding <interface> dhcp-options client-id <description>
RFC 2131 states: The client MAY choose to explicitly provide the identifier through the ‘client identifier’
option. If the client supplies a ‘client identifier’, the client MUST use the same ‘client identifier’ in all subsequent
messages, and the server MUST use that identifier to identify the client.
Example:

set interfaces bonding bond0 dhcp-options client-id 'foo-bar'

set interfaces bonding <interface> dhcp-options host-name <hostname>

Instead of sending the real system hostname to the DHCP server, overwrite the host-name with this given-value.
Example:

set interfaces bonding bond0 dhcp-options host-name 'VyOS'

set interfaces bonding <interface> dhcp-options vendor-class-id <vendor-id>

This option is used by some DHCP clients to identify the vendor type and possibly the configuration of a DHCP
client. The information is a string of bytes whose contents are specific to the vendor and are not specified in a
standard.
The vendor-class-id option can be used to request a specific class of vendor options from the server.
Example:

set interfaces bonding bond0 dhcp-options vendor-class-id 'VyOS'

set interfaces bonding <interface> dhcp-options no-default-route

Only request an address from the DHCP server but do not request a default gateway.
Example:

8.4. Interfaces 477

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces bonding bond0 dhcp-options no-default-route

set interfaces bonding <interface> dhcp-options default-route-distance <distance>

Set the distance for the default gateway sent by the DHCP server.
Example:

set interfaces bonding bond0 dhcp-options default-route-distance 220

set interfaces bonding <interface> dhcp-options reject <address>

Reject DHCP leases from a given address or range. This is useful when a modem gives a local IP when first
starting.
• address can be specified multiple times, e.g. 192.168.100.1 and/or 192.168.100.0/24
Example:

set interfaces bonding bond0 dhcp-options reject 192.168.100.0/24

set interfaces bonding <interface> dhcp-options user-class <string>

This option is used by some DHCP clients as a way for users to specify identifying information to the client.
This can be used in a similar way to the vendor-class-identifier option, but the value of the option is specified
by the user, not the vendor.
Example:

set interfaces bonding bond0 dhcp-options user-class VyOS

set interfaces bonding <interface> dhcpv6-options duid <duid>

The DHCP unique identifier (DUID) is used by a client to get an IP address from a DHCPv6 server. It has a
2-byte DUID type field, and a variable-length identifier field up to 128 bytes. Its actual length depends on its
type. The server compares the DUID with its database and delivers configuration data (address, lease times,
DNS servers, etc.) to the client.

set interfaces bonding bond0 duid '0e:00:00:01:00:01:27:71:db:f0:00:50:56:bf:c5:6d'

set interfaces bonding <interface> dhcpv6-options no-release

When no-release is specified, dhcp6c will send a release message on client exit to prevent losing an assigned
address or prefix.

set interfaces bonding bond0 dhcpv6-options no-release

set interfaces bonding <interface> dhcpv6-options parameters-only

This statement specifies dhcp6c to only exchange informational configuration parameters with servers. A list of
DNS server addresses is an example of such parameters. This statement is useful when the client does not need
stateful configuration parameters such as IPv6 addresses or prefixes.

set interfaces bonding bond0 dhcpv6-options parameters-only

set interfaces bonding <interface> dhcpv6-options rapid-commit

When rapid-commit is specified, dhcp6c will include a rapid-commit option in solicit messages and wait for an
immediate reply instead of advertisements.

8.4. Interfaces 478

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces bonding bond0 dhcpv6-options rapid-commit

set interfaces bonding <interface> dhcpv6-options temporary

Request only a temporary address and not form an IA_NA (Identity Association for Non-temporary Addresses)
partnership.

set interfaces bonding bond0 dhcpv6-options temporary

DHCPv6 Prefix Delegation (PD)

VyOS 1.3 (equuleus) supports DHCPv6-PD (RFC 3633). DHCPv6 Prefix Delegation is supported by most ISPs who
provide native IPv6 for consumers on fixed networks.
set interfaces bonding <interface> dhcpv6-options pd <id> length <length>
Some ISPs by default only delegate a /64 prefix. To request for a specific prefix size use this option to request
for a bigger delegation for this pd <id>. This value is in the range from 32 - 64 so you could request up to a /32
prefix (if your ISP allows this) down to a /64 delegation.
The default value corresponds to 64.
To request a /56 prefix from your ISP use:

set interfaces bonding bond0 dhcpv6-options pd 0 length 56

set interfaces bonding <interface> dhcpv6-options pd <id> interface <delegatee> address

<address>
Specify the interface address used locally on the interface where the prefix has been delegated to. ID must be a
decimal integer.
It will be combined with the delegated prefix and the sla-id to form a complete interface address. The default is
to use the EUI-64 address of the interface.
Example: Delegate a /64 prefix to interface eth8 which will use a local address on this router of
<prefix>::ffff, as the address 65534 will correspond to ffff in hexadecimal notation.

set interfaces bonding bond0 dhcpv6-options pd 0 interface eth8 address 65534

set interfaces bonding <interface> dhcpv6-options pd <id> interface <delegatee> sla-id

<id>
Specify the identifier value of the site-level aggregator (SLA) on the interface. ID must be a decimal number
greater then 0 which fits in the length of SLA IDs (see below).
Example: If ID is 1 and the client is delegated an IPv6 prefix 2001:db8:ffff::/48, dhcp6c will combine the two
values into a single IPv6 prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified interface.

set interfaces bonding bond0 dhcpv6-options pd 0 interface eth8 sla-id 1

8.4. Interfaces 479

 VyOS Documentation, Release 1.5.x (circinus)

Member Interfaces

set interfaces bonding <interface> member interface <member>

Enslave <member> interface to bond <interface>.

Bond options

set interfaces bonding <interface> mode <802.3ad | active-backup | broadcast |

round-robin | transmit-load-balance | adaptive-load-balance | xor-hash>
Specifies one of the bonding policies. The default is 802.3ad. Possible values are:
• 802.3ad - IEEE 802.3ad Dynamic link aggregation. Creates aggregation groups that share the
same speed and duplex settings. Utilizes all slaves in the active aggregator according to the 802.3ad
specification.
Slave selection for outgoing traffic is done according to the transmit hash policy, which may be
changed from the default simple XOR policy via the hash-policy option, documented below.

Note: Not all transmit policies may be 802.3ad compliant, particularly in regards to the packet
misordering requirements of section 43.2.4 of the 802.3ad standard.

• active-backup - Active-backup policy: Only one slave in the bond is active. A different slave
becomes active if, and only if, the active slave fails. The bond’s MAC address is externally visible
on only one port (network adapter) to avoid confusing the switch.
When a failover occurs in active-backup mode, bonding will issue one or more gratuitous ARPs
on the newly active slave. One gratuitous ARP is issued for the bonding master interface and
each VLAN interfaces configured above it, provided that the interface has at least one IP address
configured. Gratuitous ARPs issued for VLAN interfaces are tagged with the appropriate VLAN
id.
This mode provides fault tolerance. The primary option, documented below, affects the behavior
of this mode.
• broadcast - Broadcast policy: transmits everything on all slave interfaces.
This mode provides fault tolerance.
• round-robin - Round-robin policy: Transmit packets in sequential order from the first available
slave through the last.
This mode provides load balancing and fault tolerance.
• transmit-load-balance - Adaptive transmit load balancing: channel bonding that does not
require any special switch support.
Incoming traffic is received by the current slave. If the receiving slave fails, another slave takes
over the MAC address of the failed receiving slave.
• adaptive-load-balance - Adaptive load balancing: includes transmit-load-balance plus re-
ceive load balancing for IPV4 traffic, and does not require any special switch support. The receive
load balancing is achieved by ARP negotiation. The bonding driver intercepts the ARP Replies
sent by the local system on their way out and overwrites the source hardware address with the
unique hardware address of one of the slaves in the bond such that different peers use different
hardware addresses for the server.

8.4. Interfaces 480

 VyOS Documentation, Release 1.5.x (circinus)

Receive traffic from connections created by the server is also balanced. When the local system
sends an ARP Request the bonding driver copies and saves the peer’s IP information from the
ARP packet. When the ARP Reply arrives from the peer, its hardware address is retrieved and the
bonding driver initiates an ARP reply to this peer assigning it to one of the slaves in the bond. A
problematic outcome of using ARP negotiation for balancing is that each time that an ARP request
is broadcast it uses the hardware address of the bond. Hence, peers learn the hardware address
of the bond and the balancing of receive traffic collapses to the current slave. This is handled by
sending updates (ARP Replies) to all the peers with their individually assigned hardware address
such that the traffic is redistributed. Receive traffic is also redistributed when a new slave is added
to the bond and when an inactive slave is re-activated. The receive load is distributed sequentially
(round robin) among the group of highest speed slaves in the bond.
When a link is reconnected or a new slave joins the bond the receive traffic is redistributed among
all active slaves in the bond by initiating ARP Replies with the selected MAC address to each of
the clients. The updelay parameter (detailed below) must be set to a value equal or greater than
the switch’s forwarding delay so that the ARP Replies sent to the peers will not be blocked by the
switch.
• xor-hash - XOR policy: Transmit based on the selected transmit hash policy. The default policy
is a simple [(source MAC address XOR’d with destination MAC address XOR packet type ID)
modulo slave count]. Alternate transmit policies may be selected via the hash-policy option,
described below.
This mode provides load balancing and fault tolerance.
set interfaces bonding <interface> min-links <0-16>
Specifies the minimum number of links that must be active before asserting carrier. It is similar to the Cisco
EtherChannel min-links feature. This allows setting the minimum number of member ports that must be up
(link-up state) before marking the bond device as up (carrier on). This is useful for situations where higher
level services such as clustering want to ensure a minimum number of low bandwidth links are active before
switchover.
This option only affects 802.3ad mode.
The default value is 0. This will cause the carrier to be asserted (for 802.3ad mode) whenever there is an active
aggregator, regardless of the number of available links in that aggregator.

Note: Because an aggregator cannot be active without at least one available link, setting this option to 0 or to
1 has the exact same effect.

set interfaces bonding <interface> lacp-rate <slow|fast>

Option specifying the rate in which we’ll ask our link partner to transmit LACPDU packets in 802.3ad mode.
This option only affects 802.3ad mode.
• slow: Request partner to transmit LACPDUs every 30 seconds
• fast: Request partner to transmit LACPDUs every 1 second
The default value is slow.
set interfaces bonding <interface> system-mac <mac address>
This option allow to specifies the 802.3ad system MAC address.You can set a random mac-address that can be
used for these LACPDU exchanges.
set interfaces bonding <interface> hash-policy <policy>

8.4. Interfaces 481

 VyOS Documentation, Release 1.5.x (circinus)

• layer2 - Uses XOR of hardware MAC addresses and packet type ID field to generate the hash. The formula
is

hash = source MAC XOR destination MAC XOR packet type ID

slave number = hash modulo slave count

This algorithm will place all traffic to a particular network peer on the same slave.
This algorithm is 802.3ad compliant.
• layer2+3 - This policy uses a combination of layer2 and layer3 protocol information to generate the hash.
Uses XOR of hardware MAC addresses and IP addresses to generate the hash. The formula is:

hash = source MAC XOR destination MAC XOR packet type ID

hash = hash XOR source IP XOR destination IP
hash = hash XOR (hash RSHIFT 16)
hash = hash XOR (hash RSHIFT 8)

And then hash is reduced modulo slave count.

If the protocol is IPv6 then the source and destination addresses are first hashed using ipv6_addr_hash.
This algorithm will place all traffic to a particular network peer on the same slave. For non-IP traffic, the
formula is the same as for the layer2 transmit hash policy.
This policy is intended to provide a more balanced distribution of traffic than layer2 alone, especially in
environments where a layer3 gateway device is required to reach most destinations.
This algorithm is 802.3ad compliant.
• layer3+4 - This policy uses upper layer protocol information, when available, to generate the hash. This
allows for traffic to a particular network peer to span multiple slaves, although a single connection will not
span multiple slaves.
The formula for unfragmented TCP and UDP packets is

hash = source port, destination port (as in the header)

hash = hash XOR source IP XOR destination IP
hash = hash XOR (hash RSHIFT 16)
hash = hash XOR (hash RSHIFT 8)

And then hash is reduced modulo slave count.

If the protocol is IPv6 then the source and destination addresses are first hashed using ipv6_addr_hash.
For fragmented TCP or UDP packets and all other IPv4 and IPv6 protocol traffic, the source and destination
port information is omitted. For non-IP traffic, the formula is the same as for the layer2 transmit hash policy.
This algorithm is not fully 802.3ad compliant. A single TCP or UDP conversation containing both frag-
mented and unfragmented packets will see packets striped across two interfaces. This may result in out
of order delivery. Most traffic types will not meet these criteria, as TCP rarely fragments traffic, and most
UDP traffic is not involved in extended conversations. Other implementations of 802.3ad may or may not
tolerate this noncompliance.
set interfaces bonding <interface> primary <interface>
An <interface> specifying which slave is the primary device. The specified device will always be the active
slave while it is available. Only when the primary is off-line will alternate devices be used. This is useful when
one slave is preferred over another, e.g., when one slave has higher throughput than another.
The primary option is only valid for active-backup, transmit-load-balance, and adaptive-load-balance mode.

8.4. Interfaces 482

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces bonding <interface> arp-monitor interval <time>

Specifies the ARP link monitoring <time> in seconds.
The ARP monitor works by periodically checking the slave devices to determine whether they have sent or
received traffic recently (the precise criteria depends upon the bonding mode, and the state of the slave). Regular
traffic is generated via ARP probes issued for the addresses specified by the arp-monitor target option.
If ARP monitoring is used in an etherchannel compatible mode (modes round-robin and xor-hash), the switch
should be configured in a mode that evenly distributes packets across all links. If the switch is configured to
distribute the packets in an XOR fashion, all replies from the ARP targets will be received on the same link
which could cause the other team members to fail.
A value of 0 disables ARP monitoring. The default value is 0.
set interfaces bonding <interface> arp-monitor target <address>
Specifies the IP addresses to use as ARP monitoring peers when arp-monitor interval option is > 0. These
are the targets of the ARP request sent to determine the health of the link to the targets.
Multiple target IP addresses can be specified. At least one IP address must be given for ARP monitoring to
function.
The maximum number of targets that can be specified is 16. The default value is no IP address.

VLAN

IEEE 802.1q, often referred to as Dot1q, is the networking standard that supports virtual LANs (VLANs) on an IEEE
802.3 Ethernet network. The standard defines a system of VLAN tagging for Ethernet frames and the accompanying
procedures to be used by bridges and switches in handling such frames. The standard also contains provisions for a
quality-of-service prioritization scheme commonly known as IEEE 802.1p and defines the Generic Attribute Registra-
tion Protocol.
Portions of the network which are VLAN-aware (i.e., IEEE 802.1q conformant) can include VLAN tags. When a frame
enters the VLAN-aware portion of the network, a tag is added to represent the VLAN membership. Each frame must
be distinguishable as being within exactly one VLAN. A frame in the VLAN-aware portion of the network that does
not contain a VLAN tag is assumed to be flowing on the native VLAN.
The standard was developed by IEEE 802.1, a working group of the IEEE 802 standards committee, and continues
to be actively revised. One of the notable revisions is 802.1Q-2014 which incorporated IEEE 802.1aq (Shortest Path
Bridging) and much of the IEEE 802.1d standard.
802.1q VLAN interfaces are represented as virtual sub-interfaces in VyOS. The term used for this is vif.
set interfaces bonding <interface> vif <vlan-id>
Create a new VLAN interface on interface <interface> using the VLAN number provided via <vlan-id>.
You can create multiple VLAN interfaces on a physical interface. The VLAN ID range is from 0 to 4094.

Note: Only 802.1Q-tagged packets are accepted on Ethernet vifs.

set interfaces bonding <interface> vif <vlan-id> address <address | dhcp | dhcpv6>
Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
• dhcp interface address is received by DHCP from a DHCP server on this segment.

8.4. Interfaces 483

 VyOS Documentation, Release 1.5.x (circinus)

• dhcpv6 interface address is received by DHCPv6 from a DHCPv6 server on this segment.

Note: When using DHCP to retrieve IPv4 address and if local customizations are needed, they should be
possible using the enter and exit hooks provided. The hook dirs are:
• /config/scripts/dhcp-client/pre-hooks.d/
• /config/scripts/dhcp-client/post-hooks.d/

Example:

set interfaces bonding bond0 vif 10 address 192.0.2.1/24

set interfaces bonding bond0 vif 10 address 2001:db8::1/64
set interfaces bonding bond0 vif 10 address dhcp
set interfaces bonding bond0 vif 10 address dhcpv6

set interfaces bonding <interface> vif <vlan-id> description <description>

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces bonding bond0 vif 10 description 'This is an awesome interface␣

˓→running on VyOS'

set interfaces bonding <interface> vif <vlan-id> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces bonding bond0 vif 10 disable

set interfaces bonding <interface> vif <vlan-id> disable-link-detect

Use this command to direct an interface to not detect any physical state changes on a link, for example, when
the cable is unplugged.
Default is to detects physical link state changes.
Example:

set interfaces bonding bond0 vif 10 disable-link-detect

set interfaces bonding <interface> vif <vlan-id> mac <xx:xx:xx:xx:xx:xx>

Configure user defined MAC address on given <interface>.
Example:

set interfaces bonding bond0 vif 10 mac '00:53:01:02:03:04'

set interfaces bonding <interface> vif <vlan-id> mtu <mtu>

Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

set interfaces bonding bond0 vif 10 mtu 1600

8.4. Interfaces 484

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces bonding <interface> vif <vlan-id> ip adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces bonding <interface> vif <vlan-id> ip arp-cache-timeout
Once a neighbor has been found, the entry is considered to be valid for at least for this specific time. An entry’s
validity will be extended if it receives positive feedback from higher level protocols.
This defaults to 30 seconds.
Example:

set interfaces bonding bond0 vif 10 ip arp-cache-timeout 180

set interfaces bonding <interface> vif <vlan-id> ip disable-arp-filter

If set the kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but
it usually makes sense, because it increases the chance of successful communication. IP addresses are owned
by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing,
does this behaviour cause problems.
If not set (default) allows you to have multiple network interfaces on the same subnet, and have the ARPs for
each interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that
interface (therefore you must use source based routing for this to work).
In other words it allows control of which cards (usually 1) will respond to an arp request.
Example:

set interfaces bonding bond0 vif 10 ip disable-arp-filter

set interfaces bonding <interface> vif <vlan-id> ip disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

set interfaces bonding bond0 vif 10 ip disable-forwarding

set interfaces bonding <interface> vif <vlan-id> ip enable-directed-broadcast

Define different modes for IP directed broadcast forwarding as described in RFC 1812 and RFC 2644.
If configured, incoming IP directed broadcast packets on this interface will be forwarded.
If this option is unset (default), incoming IP directed broadcast packets will not be forwarded.

set interfaces bonding bond0 vif 10 ip enable-directed-broadcast

set interfaces bonding <interface> vif <vlan-id> ip enable-arp-accept

8.4. Interfaces 485

 VyOS Documentation, Release 1.5.x (circinus)

Define behavior for gratuitous ARP frames whose IP is not already present in the ARP table. If configured
create new entries in the ARP table.
Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on.
If the ARP table already contains the IP address of the gratuitous arp frame, the arp table will be updated
regardless if this setting is on or off.

set interfaces bonding bond0 vif 10 ip enable-arp-accept

set interfaces bonding <interface> vif <vlan-id> ip enable-arp-announce

Define different restriction levels for announcing the local source IP address from IP packets in ARP requests
sent on interface.
Use any local address, configured on any interface if this is not set.
If configured, try to avoid local addresses that are not in the target’s subnet for this interface. This mode is
useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of
their logical network configured on the receiving interface. When we generate the request we will check all our
subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no
such subnet we select source address according to the rules for level 2.

set interfaces bonding bond0 vif 10 ip enable-arp-announce

set interfaces bonding <interface> vif <vlan-id> ip enable-arp-ignore

Define different modes for sending replies in response to received ARP requests that resolve local target IP
addresses:
If configured, reply only if the target IP address is local address configured on the incoming interface.
If this option is unset (default), reply for any local target IP address, configured on any interface.

set interfaces bonding bond0 vif 10 ip enable-arp-ignore

set interfaces bonding <interface> vif <vlan-id> ip enable-proxy-arp

Use this command to enable proxy Address Resolution Protocol (ARP) on this interface. Proxy ARP allows
an Ethernet interface to respond with its own MAC address to ARP requests for destination IP addresses on
subnets attached to other interfaces on the system. Subsequent packets sent to those destination IP addresses
are forwarded appropriately by the system.
Example:

set interfaces bonding bond0 vif 10 ip enable-proxy-arp

set interfaces bonding <interface> vif <vlan-id> ip proxy-arp-pvlan

Private VLAN proxy arp. Basically allow proxy arp replies back to the same interface (from which the ARP
request/solicitation was received).
This is done to support (ethernet) switch features, like RFC 3069, where the individual ports are NOT allowed
to communicate with each other, but they are allowed to talk to the upstream router. As described in RFC 3069,
it is possible to allow these hosts to communicate through the upstream router by proxy_arp’ing.

Note: Does not need to be used together with proxy_arp.

This technology is known by different names:

8.4. Interfaces 486

 VyOS Documentation, Release 1.5.x (circinus)

• In RFC 3069 it is called VLAN Aggregation

• Cisco and Allied Telesyn call it Private VLAN
• Hewlett-Packard call it Source-Port filtering or port-isolation
• Ericsson call it MAC-Forced Forwarding (RFC Draft)
set interfaces bonding <interface> vif <vlan-id> ip source-validation <strict | loose |
disable>
Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.
• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation
set interfaces bonding <interface> vif <vlan-id> ipv6 address autoconf
SLAAC RFC 4862. IPv6 hosts can configure themselves automatically when connected to an IPv6 network us-
ing the Neighbor Discovery Protocol via ICMPv6 router discovery messages. When first connected to a network,
a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to
such a request with a router advertisement packet that contains Internet Layer configuration parameters.

Note: This method automatically disables IPv6 traffic forwarding on the interface in question.

Example:

set interfaces bonding bond0 vif 10 ipv6 address autoconf

set interfaces bonding <interface> vif <vlan-id> ipv6 address eui64 <prefix>
EUI-64 as specified in RFC 4291 allows a host to assign iteslf a unique 64-Bit IPv6 address.
Example:

set interfaces bonding bond0 vif 10 ipv6 address eui64 2001:db8:beef::/64

set interfaces bonding <interface> vif <vlan-id> ipv6 address no-default-link-local

Do not assign a link-local IPv6 address to this interface.
Example:

set interfaces bonding bond0 vif 10 ipv6 address no-default-link-local

set interfaces bonding <interface> vif <vlan-id> ipv6 disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
Example:

set interfaces bonding bond0 vif 10 ipv6 disable-forwarding

8.4. Interfaces 487

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces bonding <interface> vif <vlan-id> ipv6 adjust-mss <mss |

clamp-mss-to-pmtu>
As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss6 <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces bonding <interface> vif <vlan-id> ipv6 accept-dad <1-3>
Whether to accept DAD (Duplicate Address Detection).
• 0: Disable DAD
• 1: Enable DAD (default)
• 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate link-local address has been found.
Example:

set interfaces bonding bond0 vif 10 ipv6 accept-dad 2

set interfaces bonding <interface> vif <vlan-id> ipv6 dup-addr-detect-transmits <n>

The amount of Duplicate Address Detection probes to send.
Default: 1
Example:

set interfaces bonding bond0 vif 10 ipv6 dup-addr-detect-transmits 5

set interfaces bonding <interface> vif <vlan-id> vrf <vrf>

Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces bonding bond0 vif 10 vrf red

DHCP(v6)
set interfaces bonding <interface> vif <vlan-id> dhcp-options client-id <description>
RFC 2131 states: The client MAY choose to explicitly provide the identifier through the ‘client identifier’
option. If the client supplies a ‘client identifier’, the client MUST use the same ‘client identifier’ in all subsequent
messages, and the server MUST use that identifier to identify the client.
Example:

8.4. Interfaces 488

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces bonding bond0 vif 10 dhcp-options client-id 'foo-bar'

set interfaces bonding <interface> vif <vlan-id> dhcp-options host-name <hostname>

Instead of sending the real system hostname to the DHCP server, overwrite the host-name with this given-value.
Example:

set interfaces bonding bond0 vif 10 dhcp-options host-name 'VyOS'

set interfaces bonding <interface> vif <vlan-id> dhcp-options vendor-class-id <vendor-id>

This option is used by some DHCP clients to identify the vendor type and possibly the configuration of a DHCP
client. The information is a string of bytes whose contents are specific to the vendor and are not specified in a
standard.
The vendor-class-id option can be used to request a specific class of vendor options from the server.
Example:

set interfaces bonding bond0 vif 10 dhcp-options vendor-class-id 'VyOS'

set interfaces bonding <interface> vif <vlan-id> dhcp-options no-default-route

Only request an address from the DHCP server but do not request a default gateway.
Example:

set interfaces bonding bond0 vif 10 dhcp-options no-default-route

set interfaces bonding <interface> vif <vlan-id> dhcp-options default-route-distance

<distance>
Set the distance for the default gateway sent by the DHCP server.
Example:

set interfaces bonding bond0 vif 10 dhcp-options default-route-distance 220

set interfaces bonding <interface> vif <vlan-id> dhcp-options reject <address>

Reject DHCP leases from a given address or range. This is useful when a modem gives a local IP when first
starting.
• address can be specified multiple times, e.g. 192.168.100.1 and/or 192.168.100.0/24
Example:

set interfaces bonding bond0 vif 10 dhcp-options reject 192.168.100.0/24

set interfaces bonding <interface> vif <vlan-id> dhcp-options user-class <string>

This option is used by some DHCP clients as a way for users to specify identifying information to the client.
This can be used in a similar way to the vendor-class-identifier option, but the value of the option is specified
by the user, not the vendor.
Example:

set interfaces bonding bond0 vif 10 dhcp-options user-class VyOS

set interfaces bonding <interface> vif <vlan-id> dhcpv6-options duid <duid>

8.4. Interfaces 489

 VyOS Documentation, Release 1.5.x (circinus)

The DHCP unique identifier (DUID) is used by a client to get an IP address from a DHCPv6 server. It has a
2-byte DUID type field, and a variable-length identifier field up to 128 bytes. Its actual length depends on its
type. The server compares the DUID with its database and delivers configuration data (address, lease times,
DNS servers, etc.) to the client.

set interfaces bonding bond0 vif 10 duid

˓→'0e:00:00:01:00:01:27:71:db:f0:00:50:56:bf:c5:6d'

set interfaces bonding <interface> vif <vlan-id> dhcpv6-options no-release

When no-release is specified, dhcp6c will send a release message on client exit to prevent losing an assigned
address or prefix.

set interfaces bonding bond0 vif 10 dhcpv6-options no-release

set interfaces bonding <interface> vif <vlan-id> dhcpv6-options parameters-only

This statement specifies dhcp6c to only exchange informational configuration parameters with servers. A list of
DNS server addresses is an example of such parameters. This statement is useful when the client does not need
stateful configuration parameters such as IPv6 addresses or prefixes.

set interfaces bonding bond0 vif 10 dhcpv6-options parameters-only

set interfaces bonding <interface> vif <vlan-id> dhcpv6-options rapid-commit

When rapid-commit is specified, dhcp6c will include a rapid-commit option in solicit messages and wait for an
immediate reply instead of advertisements.

set interfaces bonding bond0 vif 10 dhcpv6-options rapid-commit

set interfaces bonding <interface> vif <vlan-id> dhcpv6-options temporary

Request only a temporary address and not form an IA_NA (Identity Association for Non-temporary Addresses)
partnership.

set interfaces bonding bond0 vif 10 dhcpv6-options temporary

DHCPv6 Prefix Delegation (PD)

VyOS 1.3 (equuleus) supports DHCPv6-PD (RFC 3633). DHCPv6 Prefix Delegation is supported by most ISPs who
provide native IPv6 for consumers on fixed networks.
set interfaces bonding <interface> vif <vlan-id> dhcpv6-options pd <id> length <length>
Some ISPs by default only delegate a /64 prefix. To request for a specific prefix size use this option to request
for a bigger delegation for this pd <id>. This value is in the range from 32 - 64 so you could request up to a /32
prefix (if your ISP allows this) down to a /64 delegation.
The default value corresponds to 64.
To request a /56 prefix from your ISP use:

set interfaces bonding bond0 vif 10 dhcpv6-options pd 0 length 56

set interfaces bonding <interface> vif <vlan-id> dhcpv6-options pd <id> interface

<delegatee> address <address>
Specify the interface address used locally on the interface where the prefix has been delegated to. ID must be a
decimal integer.

8.4. Interfaces 490

 VyOS Documentation, Release 1.5.x (circinus)

It will be combined with the delegated prefix and the sla-id to form a complete interface address. The default is
to use the EUI-64 address of the interface.
Example: Delegate a /64 prefix to interface eth8 which will use a local address on this router of
<prefix>::ffff, as the address 65534 will correspond to ffff in hexadecimal notation.

set interfaces bonding bond0 vif 10 dhcpv6-options pd 0 interface eth8 address 65534

set interfaces bonding <interface> vif <vlan-id> dhcpv6-options pd <id> interface

<delegatee> sla-id <id>
Specify the identifier value of the site-level aggregator (SLA) on the interface. ID must be a decimal number
greater then 0 which fits in the length of SLA IDs (see below).
Example: If ID is 1 and the client is delegated an IPv6 prefix 2001:db8:ffff::/48, dhcp6c will combine the two
values into a single IPv6 prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified interface.

set interfaces bonding bond0 vif 10 dhcpv6-options pd 0 interface eth8 sla-id 1

Port Mirror (SPAN)

SPAN port mirroring can copy the inbound/outbound traffic of the interface to the specified interface, usually the
interface can be connected to some special equipment, such as a behavior control system, intrusion detection system or
traffic collector, and can copy all related traffic from this port. The benefit of mirroring the traffic is that the application
is isolated from the source traffic and so application processing does not affect the traffic or the system performance.
VyOS uses the mirror option to configure port mirroring. The configuration is divided into 2 different directions.
Destination ports should be configured for different traffic directions.
set interfaces bondinging <interface> mirror ingress <monitor-interface>
Configure port mirroring for interface inbound traffic and copy the traffic to monitor-interface
Example: Mirror the inbound traffic of bond1 port to eth3

set interfaces bondinging bond1 mirror ingress eth3

set interfaces bondinging <interface> mirror egress <monitor-interface>

Configure port mirroring for interface outbound traffic and copy the traffic to monitor-interface
Example: Mirror the outbound traffic of bond1 port to eth3

set interfaces bondinging bond1 mirror egress eth3

EVPN Multihoming

All-Active Multihoming is used for redundancy and load sharing. Servers are attached to two or more PEs and the
links are bonded (link-aggregation). This group of server links is referred to as an ES (Ethernet Segment).
An Ethernet Segment can be configured by specifying a system-MAC and a local discriminator or a complete
ESINAME against the bond interface on the PE.
set interfaces bonding <interface> evpn es-id <<1-16777215|10-byte ID>
set interfaces bonding <interface> evpn es-sys-mac <xx:xx:xx:xx:xx:xx>

8.4. Interfaces 491

 VyOS Documentation, Release 1.5.x (circinus)

The sys-mac and local discriminator are used for generating a 10-byte, Type-3 Ethernet Segment ID. ESINAME
is a 10-byte, Type-0 Ethernet Segment ID - “00:AA:BB:CC:DD:EE:FF:GG:HH:II”.
Type-1 (EAD-per-ES and EAD-per-EVI) routes are used to advertise the locally attached ESs and to learn off
remote ESs in the network. Local Type-2/MAC-IP routes are also advertised with a destination ESI allowing
for MAC-IP syncing between Ethernet Segment peers. Reference: RFC 7432, RFC 8365
EVPN-MH is intended as a replacement for MLAG or Anycast VTEPs. In multihoming each PE has an unique
VTEP address which requires the introduction of a new dataplane construct, MAC-ECMP. Here a MAC/FDB
entry can point to a list of remote PEs/VTEPs.
set interfaces bonding <interface> evpn es-df-pref <1-65535>
Type-4 (ESR) routes are used for Designated Forwarder (DF) election. DFs forward BUM traffic received via
the overlay network. This implementation uses a preference based DF election specified by draft-ietf-bess-evpn-
pref-df.
The DF preference is configurable per-ES.
BUM traffic is rxed via the overlay by all PEs attached to a server but only the DF can forward the de-capsulated
traffic to the access port. To accommodate that non-DF filters are installed in the dataplane to drop the traffic.
Similarly traffic received from ES peers via the overlay cannot be forwarded to the server. This is split-horizon-
filtering with local bias.
set interfaces bonding <interface> evpn uplink
When all the underlay links go down the PE no longer has access to the VxLAN +overlay. To prevent blackholing
of traffic the server/ES links are protodowned on the PE.
A link can be setup for uplink tracking via the following example:

set interfaces bonding bond0 evpn uplink

Example

The following configuration on VyOS applies to all following 3rd party vendors. It creates a bond with two links and
VLAN 10, 100 on the bonded interfaces with a per VIF IPv4 address.

# Create bonding interface bond0 with 802.3ad LACP

set interfaces bonding bond0 hash-policy 'layer2'
set interfaces bonding bond0 mode '802.3ad'

# Add the required vlans and IPv4 addresses on them

set interfaces bonding bond0 vif 10 address 192.168.0.1/24
set interfaces bonding bond0 vif 100 address 10.10.10.1/24

# Add the member interfaces to the bonding interface

set interfaces bonding bond0 member interface eth1
set interfaces bonding bond0 member interface eth2

Note: If you happen to run this in a virtual environment like by EVE-NG you need to ensure your VyOS NIC is set to
use the e1000 driver. Using the default virtio-net-pci or the vmxnet3 driver will not work. ICMP messages will
not be properly processed. They are visible on the virtual wire but will not make it fully up the networking stack.
You can check your NIC driver by issuing show interfaces ethernet eth0 physical | grep -i driver

8.4. Interfaces 492

 VyOS Documentation, Release 1.5.x (circinus)

Cisco Catalyst

Assign member interfaces to PortChannel

interface GigabitEthernet1/0/23
description VyOS eth1
channel-group 1 mode active
!
interface GigabitEthernet1/0/24
description VyOS eth2
channel-group 1 mode active
!

A new interface becomes present Port-channel1, all configuration like allowed VLAN interfaces, STP will happen
here.

interface Port-channel1
description LACP Channel for VyOS
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,100
switchport mode trunk
spanning-tree portfast trunk
!

Juniper EX Switch

For a headstart you can use the below example on how to build a bond with two interfaces from VyOS to a Juniper EX
Switch system.

# Create aggregated ethernet device with 802.3ad LACP and port speeds of 10gbit/s
set interfaces ae0 aggregated-ether-options link-speed 10g
set interfaces ae0 aggregated-ether-options lacp active

# Create layer 2 on the aggregated ethernet device with trunking for our vlans
set interfaces ae0 unit 0 family ethernet-switching port-mode trunk

# Add the required vlans to the device

set interfaces ae0 unit 0 family ethernet-switching vlan members 10
set interfaces ae0 unit 0 family ethernet-switching vlan members 100

# Add the two interfaces to the aggregated ethernet device, in this setup both
# ports are on the same switch (switch 0, module 1, port 0 and 1)
set interfaces xe-0/1/0 ether-options 802.3ad ae0
set interfaces xe-0/1/1 ether-options 802.3ad ae0

# But this can also be done with multiple switches in a stack, a virtual
# chassis on Juniper (switch 0 and switch 1, module 1, port 0 on both switches)
set interfaces xe-0/1/0 ether-options 802.3ad ae0
set interfaces xe-1/1/0 ether-options 802.3ad ae0

8.4. Interfaces 493

 VyOS Documentation, Release 1.5.x (circinus)

Aruba/HP

For a headstart you can use the below example on how to build a bond,port-channel with two interfaces from VyOS to
a Aruba/HP 2510G switch.

# Create trunk with 2 member interfaces (interface 1 and 2) and LACP

trunk 1-2 Trk1 LACP

# Add the required vlans to the trunk

vlan 10 tagged Trk1
vlan 100 tagged Trk1

Arista EOS

When utilizing VyOS in an environment with Arista gear you can use this blue print as an initial setup to get an LACP
bond / port-channel operational between those two devices.
Lets assume the following topology:

R1

interfaces {
bonding bond10 {
hash-policy layer3+4
member {
interface eth1
interface eth2
}
(continues on next page)

8.4. Interfaces 494

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

mode 802.3ad
vif 100 {
address 192.0.2.1/30
address 2001:db8::1/64
}
}

R2

interfaces {
bonding bond10 {
hash-policy layer3+4
member {
interface eth1
interface eth2
}
mode 802.3ad
vif 100 {
address 192.0.2.2/30
address 2001:db8::2/64
}
}

SW1

!
vlan 100
name FOO
!
interface Port-Channel10
switchport trunk allowed vlan 100
switchport mode trunk
spanning-tree portfast
!
interface Port-Channel20
switchport mode trunk
no spanning-tree portfast auto
spanning-tree portfast network
!
interface Ethernet1
channel-group 10 mode active
!
interface Ethernet2
channel-group 10 mode active
!
interface Ethernet3
channel-group 20 mode active
!
interface Ethernet4
channel-group 20 mode active
!

SW2

8.4. Interfaces 495

 VyOS Documentation, Release 1.5.x (circinus)

!
vlan 100
name FOO
!
interface Port-Channel10
switchport trunk allowed vlan 100
switchport mode trunk
spanning-tree portfast
!
interface Port-Channel20
switchport mode trunk
no spanning-tree portfast auto
spanning-tree portfast network
!
interface Ethernet1
channel-group 10 mode active
!
interface Ethernet2
channel-group 10 mode active
!
interface Ethernet3
channel-group 20 mode active
!
interface Ethernet4
channel-group 20 mode active
!

Note: When using EVE-NG to lab this environment ensure you are using e1000 as the desired driver for your VyOS
network interfaces. When using the regular virtio network driver no LACP PDUs will be sent by VyOS thus the
port-channel will never become active!

Operation

show interfaces bonding

Show brief interface information.

vyos@vyos:~$ show interfaces bonding

Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
bond0 - u/u my-sw1 int 23 and 24
bond0.10 192.168.0.1/24 u/u office-net
bond0.100 10.10.10.1/24 u/u management-net

show interfaces bonding <interface>

Show detailed information on given <interface>

vyos@vyos:~$ show interfaces bonding bond5

bond5: <NO-CARRIER,BROADCAST,MULTICAST,MASTER,UP> mtu 1500 qdisc noqueue state DOWN␣
(continues on next page)

8.4. Interfaces 496

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

˓→group default qlen 1000
link/ether 00:50:56:bf:ef:aa brd ff:ff:ff:ff:ff:ff
inet6 fe80::e862:26ff:fe72:2dac/64 scope link tentative
valid_lft forever preferred_lft forever

RX: bytes packets errors dropped overrun mcast

0 0 0 0 0 0
TX: bytes packets errors dropped carrier collisions
0 0 0 0 0 0

show interfaces bonding <interface> detail

Show detailed information about the underlaying physical links on given bond <interface>.
vyos@vyos:~$ show interfaces bonding bond5 detail
Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)

Bonding Mode: IEEE 802.3ad Dynamic link aggregation

Transmit Hash Policy: layer2 (0)
MII Status: down
MII Polling Interval (ms): 100
Up Delay (ms): 0
Down Delay (ms): 0

802.3ad info
LACP rate: slow
Min links: 0
Aggregator selection policy (ad_select): stable

Slave Interface: eth1

MII Status: down
Speed: Unknown
Duplex: Unknown
Link Failure Count: 0
Permanent HW addr: 00:50:56:bf:ef:aa
Slave queue ID: 0
Aggregator ID: 1
Actor Churn State: churned
Partner Churn State: churned
Actor Churned Count: 1
Partner Churned Count: 1

Slave Interface: eth2

MII Status: down
Speed: Unknown
Duplex: Unknown
Link Failure Count: 0
Permanent HW addr: 00:50:56:bf:19:26
Slave queue ID: 0
Aggregator ID: 2
Actor Churn State: churned
Partner Churn State: churned
Actor Churned Count: 1
(continues on next page)

8.4. Interfaces 497

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Partner Churned Count: 1

8.4.2 Bridge

A Bridge is a way to connect two Ethernet segments together in a protocol independent way. Packets are forwarded
based on Ethernet address, rather than IP address (like a router). Since forwarding is done at Layer 2, all protocols can
go transparently through a bridge. The Linux bridge code implements a subset of the ANSI/IEEE 802.1d standard.

Note: Spanning Tree Protocol is not enabled by default in VyOS. STP Parameter can be easily enabled if needed.

Configuration

Common interface configuration

set interfaces bridge <interface> address <address | dhcp | dhcpv6>

Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
• dhcp interface address is received by DHCP from a DHCP server on this segment.
• dhcpv6 interface address is received by DHCPv6 from a DHCPv6 server on this segment.

Note: When using DHCP to retrieve IPv4 address and if local customizations are needed, they should be
possible using the enter and exit hooks provided. The hook dirs are:
• /config/scripts/dhcp-client/pre-hooks.d/
• /config/scripts/dhcp-client/post-hooks.d/

Example:

set interfaces bridge br0 address 192.0.2.1/24

set interfaces bridge br0 address 2001:db8::1/64
set interfaces bridge br0 address dhcp
set interfaces bridge br0 address dhcpv6

set interfaces bridge <interface> description <description>

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces bridge br0 description 'This is an awesome interface running on VyOS'

set interfaces bridge <interface> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

8.4. Interfaces 498

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces bridge br0 disable

set interfaces bridge <interface> disable-flow-control

Ethernet flow control is a mechanism for temporarily stopping the transmission of data on Ethernet family com-
puter networks. The goal of this mechanism is to ensure zero packet loss in the presence of network congestion.
The first flow control mechanism, the pause frame, was defined by the IEEE 802.3x standard.
A sending station (computer or network switch) may be transmitting data faster than the other end of the link can
accept it. Using flow control, the receiving station can signal the sender requesting suspension of transmissions
until the receiver catches up.
Use this command to disable the generation of Ethernet flow control (pause frames).
Example:

set interfaces bridge br0 disable-flow-control

set interfaces bridge <interface> disable-link-detect

Use this command to direct an interface to not detect any physical state changes on a link, for example, when
the cable is unplugged.
Default is to detects physical link state changes.
Example:

set interfaces bridge br0 disable-link-detect

set interfaces bridge <interface> mac <xx:xx:xx:xx:xx:xx>

Configure user defined MAC address on given <interface>.
Example:

set interfaces bridge br0 mac '00:53:01:02:03:04'

set interfaces bridge <interface> mtu <mtu>

Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

set interfaces bridge br0 mtu 1600

set interfaces bridge <interface> ip adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.

8.4. Interfaces 499

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces bridge <interface> ip arp-cache-timeout

Once a neighbor has been found, the entry is considered to be valid for at least for this specific time. An entry’s
validity will be extended if it receives positive feedback from higher level protocols.
This defaults to 30 seconds.
Example:

set interfaces bridge br0 ip arp-cache-timeout 180

set interfaces bridge <interface> ip disable-arp-filter

If set the kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but
it usually makes sense, because it increases the chance of successful communication. IP addresses are owned
by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing,
does this behaviour cause problems.
If not set (default) allows you to have multiple network interfaces on the same subnet, and have the ARPs for
each interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that
interface (therefore you must use source based routing for this to work).
In other words it allows control of which cards (usually 1) will respond to an arp request.
Example:

set interfaces bridge br0 ip disable-arp-filter

set interfaces bridge <interface> ip disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

set interfaces bridge br0 ip disable-forwarding

set interfaces bridge <interface> ip enable-directed-broadcast

Define different modes for IP directed broadcast forwarding as described in RFC 1812 and RFC 2644.
If configured, incoming IP directed broadcast packets on this interface will be forwarded.
If this option is unset (default), incoming IP directed broadcast packets will not be forwarded.

set interfaces bridge br0 ip enable-directed-broadcast

set interfaces bridge <interface> ip enable-arp-accept

Define behavior for gratuitous ARP frames whose IP is not already present in the ARP table. If configured
create new entries in the ARP table.
Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on.
If the ARP table already contains the IP address of the gratuitous arp frame, the arp table will be updated
regardless if this setting is on or off.

set interfaces bridge br0 ip enable-arp-accept

set interfaces bridge <interface> ip enable-arp-announce

Define different restriction levels for announcing the local source IP address from IP packets in ARP requests
sent on interface.
Use any local address, configured on any interface if this is not set.

8.4. Interfaces 500

 VyOS Documentation, Release 1.5.x (circinus)

If configured, try to avoid local addresses that are not in the target’s subnet for this interface. This mode is
useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of
their logical network configured on the receiving interface. When we generate the request we will check all our
subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no
such subnet we select source address according to the rules for level 2.

set interfaces bridge br0 ip enable-arp-announce

set interfaces bridge <interface> ip enable-arp-ignore

Define different modes for sending replies in response to received ARP requests that resolve local target IP
addresses:
If configured, reply only if the target IP address is local address configured on the incoming interface.
If this option is unset (default), reply for any local target IP address, configured on any interface.

set interfaces bridge br0 ip enable-arp-ignore

set interfaces bridge <interface> ip enable-proxy-arp

Use this command to enable proxy Address Resolution Protocol (ARP) on this interface. Proxy ARP allows
an Ethernet interface to respond with its own MAC address to ARP requests for destination IP addresses on
subnets attached to other interfaces on the system. Subsequent packets sent to those destination IP addresses
are forwarded appropriately by the system.
Example:

set interfaces bridge br0 ip enable-proxy-arp

set interfaces bridge <interface> ip proxy-arp-pvlan

Private VLAN proxy arp. Basically allow proxy arp replies back to the same interface (from which the ARP
request/solicitation was received).
This is done to support (ethernet) switch features, like RFC 3069, where the individual ports are NOT allowed
to communicate with each other, but they are allowed to talk to the upstream router. As described in RFC 3069,
it is possible to allow these hosts to communicate through the upstream router by proxy_arp’ing.

Note: Does not need to be used together with proxy_arp.

This technology is known by different names:

• In RFC 3069 it is called VLAN Aggregation
• Cisco and Allied Telesyn call it Private VLAN
• Hewlett-Packard call it Source-Port filtering or port-isolation
• Ericsson call it MAC-Forced Forwarding (RFC Draft)
set interfaces bridge <interface> ip source-validation <strict | loose | disable>
Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.

8.4. Interfaces 501

 VyOS Documentation, Release 1.5.x (circinus)

• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation
set interfaces bridge <interface> ipv6 address autoconf
SLAAC RFC 4862. IPv6 hosts can configure themselves automatically when connected to an IPv6 network us-
ing the Neighbor Discovery Protocol via ICMPv6 router discovery messages. When first connected to a network,
a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to
such a request with a router advertisement packet that contains Internet Layer configuration parameters.

Note: This method automatically disables IPv6 traffic forwarding on the interface in question.

Example:

set interfaces bridge br0 ipv6 address autoconf

set interfaces bridge <interface> ipv6 address eui64 <prefix>

EUI-64 as specified in RFC 4291 allows a host to assign iteslf a unique 64-Bit IPv6 address.
Example:

set interfaces bridge br0 ipv6 address eui64 2001:db8:beef::/64

set interfaces bridge <interface> ipv6 address no-default-link-local

Do not assign a link-local IPv6 address to this interface.
Example:

set interfaces bridge br0 ipv6 address no-default-link-local

set interfaces bridge <interface> ipv6 disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
Example:

set interfaces bridge br0 ipv6 disable-forwarding

set interfaces bridge <interface> ipv6 adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss6 <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces bridge <interface> ipv6 accept-dad <1-3>

8.4. Interfaces 502

 VyOS Documentation, Release 1.5.x (circinus)

Whether to accept DAD (Duplicate Address Detection).

• 0: Disable DAD
• 1: Enable DAD (default)
• 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate link-local address has been found.
Example:

set interfaces bridge br0 ipv6 accept-dad 2

set interfaces bridge <interface> ipv6 dup-addr-detect-transmits <n>

The amount of Duplicate Address Detection probes to send.
Default: 1
Example:

set interfaces bridge br0 ipv6 dup-addr-detect-transmits 5

set interfaces bridge <interface> vrf <vrf>

Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces bridge br0 vrf red

DHCP(v6)
set interfaces bridge <interface> dhcp-options client-id <description>
RFC 2131 states: The client MAY choose to explicitly provide the identifier through the ‘client identifier’
option. If the client supplies a ‘client identifier’, the client MUST use the same ‘client identifier’ in all subsequent
messages, and the server MUST use that identifier to identify the client.
Example:

set interfaces bridge br0 dhcp-options client-id 'foo-bar'

set interfaces bridge <interface> dhcp-options host-name <hostname>

Instead of sending the real system hostname to the DHCP server, overwrite the host-name with this given-value.
Example:

set interfaces bridge br0 dhcp-options host-name 'VyOS'

set interfaces bridge <interface> dhcp-options vendor-class-id <vendor-id>

This option is used by some DHCP clients to identify the vendor type and possibly the configuration of a DHCP
client. The information is a string of bytes whose contents are specific to the vendor and are not specified in a
standard.
The vendor-class-id option can be used to request a specific class of vendor options from the server.
Example:

8.4. Interfaces 503

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces bridge br0 dhcp-options vendor-class-id 'VyOS'

set interfaces bridge <interface> dhcp-options no-default-route

Only request an address from the DHCP server but do not request a default gateway.
Example:

set interfaces bridge br0 dhcp-options no-default-route

set interfaces bridge <interface> dhcp-options default-route-distance <distance>

Set the distance for the default gateway sent by the DHCP server.
Example:

set interfaces bridge br0 dhcp-options default-route-distance 220

set interfaces bridge <interface> dhcp-options reject <address>

Reject DHCP leases from a given address or range. This is useful when a modem gives a local IP when first
starting.
• address can be specified multiple times, e.g. 192.168.100.1 and/or 192.168.100.0/24
Example:

set interfaces bridge br0 dhcp-options reject 192.168.100.0/24

set interfaces bridge <interface> dhcp-options user-class <string>

This option is used by some DHCP clients as a way for users to specify identifying information to the client.
This can be used in a similar way to the vendor-class-identifier option, but the value of the option is specified
by the user, not the vendor.
Example:

set interfaces bridge br0 dhcp-options user-class VyOS

set interfaces bridge <interface> dhcpv6-options duid <duid>

The DHCP unique identifier (DUID) is used by a client to get an IP address from a DHCPv6 server. It has a
2-byte DUID type field, and a variable-length identifier field up to 128 bytes. Its actual length depends on its
type. The server compares the DUID with its database and delivers configuration data (address, lease times,
DNS servers, etc.) to the client.

set interfaces bridge br0 duid '0e:00:00:01:00:01:27:71:db:f0:00:50:56:bf:c5:6d'

set interfaces bridge <interface> dhcpv6-options no-release

When no-release is specified, dhcp6c will send a release message on client exit to prevent losing an assigned
address or prefix.

set interfaces bridge br0 dhcpv6-options no-release

set interfaces bridge <interface> dhcpv6-options parameters-only

This statement specifies dhcp6c to only exchange informational configuration parameters with servers. A list of
DNS server addresses is an example of such parameters. This statement is useful when the client does not need
stateful configuration parameters such as IPv6 addresses or prefixes.

8.4. Interfaces 504

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces bridge br0 dhcpv6-options parameters-only

set interfaces bridge <interface> dhcpv6-options rapid-commit

When rapid-commit is specified, dhcp6c will include a rapid-commit option in solicit messages and wait for an
immediate reply instead of advertisements.

set interfaces bridge br0 dhcpv6-options rapid-commit

set interfaces bridge <interface> dhcpv6-options temporary

Request only a temporary address and not form an IA_NA (Identity Association for Non-temporary Addresses)
partnership.

set interfaces bridge br0 dhcpv6-options temporary

DHCPv6 Prefix Delegation (PD)

VyOS 1.3 (equuleus) supports DHCPv6-PD (RFC 3633). DHCPv6 Prefix Delegation is supported by most ISPs who
provide native IPv6 for consumers on fixed networks.
set interfaces bridge <interface> dhcpv6-options pd <id> length <length>
Some ISPs by default only delegate a /64 prefix. To request for a specific prefix size use this option to request
for a bigger delegation for this pd <id>. This value is in the range from 32 - 64 so you could request up to a /32
prefix (if your ISP allows this) down to a /64 delegation.
The default value corresponds to 64.
To request a /56 prefix from your ISP use:

set interfaces bridge br0 dhcpv6-options pd 0 length 56

set interfaces bridge <interface> dhcpv6-options pd <id> interface <delegatee> address

<address>
Specify the interface address used locally on the interface where the prefix has been delegated to. ID must be a
decimal integer.
It will be combined with the delegated prefix and the sla-id to form a complete interface address. The default is
to use the EUI-64 address of the interface.
Example: Delegate a /64 prefix to interface eth8 which will use a local address on this router of
<prefix>::ffff, as the address 65534 will correspond to ffff in hexadecimal notation.

set interfaces bridge br0 dhcpv6-options pd 0 interface eth8 address 65534

set interfaces bridge <interface> dhcpv6-options pd <id> interface <delegatee> sla-id

<id>
Specify the identifier value of the site-level aggregator (SLA) on the interface. ID must be a decimal number
greater then 0 which fits in the length of SLA IDs (see below).
Example: If ID is 1 and the client is delegated an IPv6 prefix 2001:db8:ffff::/48, dhcp6c will combine the two
values into a single IPv6 prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified interface.

set interfaces bridge br0 dhcpv6-options pd 0 interface eth8 sla-id 1

8.4. Interfaces 505

 VyOS Documentation, Release 1.5.x (circinus)

Member Interfaces

set interfaces bridge <interface> member interface <member>

Assign <member> interface to bridge <interface>. A completion helper will help you with all allowed inter-
faces which can be bridged. This includes Ethernet, Bond / Link Aggregation, L2TPv3, OpenVPN, VXLAN,
WLAN/WIFI - Wireless LAN, Tunnel and GENEVE.
set interfaces bridge <interface> member interface <member> priority <priority>
Configure individual bridge port <priority>.
Each bridge has a relative priority and cost. Each interface is associated with a port (number) in the STP code.
Each has a priority and a cost, that is used to decide which is the shortest path to forward a packet. The lowest
cost path is always used unless the other path is down. If you have multiple bridges and interfaces then you may
need to adjust the priorities to achieve optimum performance.
set interfaces bridge <interface> member interface <member> cost <cost>
Path <cost> value for Spanning Tree Protocol. Each interface in a bridge could have a different speed and this
value is used when deciding which link to use. Faster interfaces should have lower costs.

Bridge Options

set interfaces bridge <interface> aging <time>

MAC address aging <time> in seconds (default: 300).
set interfaces bridge <interface> max-age <time>
Bridge maximum aging <time> in seconds (default: 20).
If an another bridge in the spanning tree does not send out a hello packet for a long period of time, it is assumed
to be dead.
set interfaces bridge <interface> igmp querier
Enable IGMP and MLD querier.
set interfaces bridge <interface> igmp snooping
Enable IGMP and MLD snooping.

STP Parameter

STP (Spanning Tree Protocol) is a network protocol that builds a loop-free logical topology for Ethernet networks. The
basic function of STP is to prevent bridge loops and the broadcast radiation that results from them. Spanning tree also
allows a network design to include backup links providing fault tolerance if an active link fails.
set interfaces bridge <interface> stp
Enable spanning tree protocol. STP is disabled by default.
set interfaces bridge <interface> forwarding-delay <delay>
Spanning Tree Protocol forwarding <delay> in seconds (default: 15).
The forwarding delay time is the time spent in each of the listening and learning states before the Forwarding
state is entered. This delay is so that when a new bridge comes onto a busy network it looks at some traffic
before participating.
set interfaces bridge <interface> hello-time <interval>

8.4. Interfaces 506

 VyOS Documentation, Release 1.5.x (circinus)

Spanning Tree Protocol hello advertisement <interval> in seconds (default: 2).

Periodically, a hello packet is sent out by the Root Bridge and the Designated Bridges. Hello packets are used
to communicate information about the topology throughout the entire Bridged Local Area Network.

VLAN

Enable VLAN-Aware Bridge

set interfaces bridge <interface> enable-vlan

To activate the VLAN aware bridge, you must activate this setting to use VLAN settings for the bridge
set interfaces bridge <interface> protocol <802.1ad|802.1q>
Define used ethertype of bridge interface.
Ethertype 0x8100 is used for 802.1q and ethertype 0x88a8 is used for 802.1ad.
The default is 802.1q.

VLAN Options

Note: It is not valid to use the vif 1 option for VLAN aware bridges because VLAN aware bridges assume that all
unlabeled packets belong to the default VLAN 1 member and that the VLAN ID of the bridge’s parent interface is
always 1

IEEE 802.1q, often referred to as Dot1q, is the networking standard that supports virtual LANs (VLANs) on an IEEE
802.3 Ethernet network. The standard defines a system of VLAN tagging for Ethernet frames and the accompanying
procedures to be used by bridges and switches in handling such frames. The standard also contains provisions for a
quality-of-service prioritization scheme commonly known as IEEE 802.1p and defines the Generic Attribute Registra-
tion Protocol.
Portions of the network which are VLAN-aware (i.e., IEEE 802.1q conformant) can include VLAN tags. When a frame
enters the VLAN-aware portion of the network, a tag is added to represent the VLAN membership. Each frame must
be distinguishable as being within exactly one VLAN. A frame in the VLAN-aware portion of the network that does
not contain a VLAN tag is assumed to be flowing on the native VLAN.
The standard was developed by IEEE 802.1, a working group of the IEEE 802 standards committee, and continues
to be actively revised. One of the notable revisions is 802.1Q-2014 which incorporated IEEE 802.1aq (Shortest Path
Bridging) and much of the IEEE 802.1d standard.
802.1q VLAN interfaces are represented as virtual sub-interfaces in VyOS. The term used for this is vif.
set interfaces bridge <interface> vif <vlan-id>
Create a new VLAN interface on interface <interface> using the VLAN number provided via <vlan-id>.
You can create multiple VLAN interfaces on a physical interface. The VLAN ID range is from 0 to 4094.

Note: Only 802.1Q-tagged packets are accepted on Ethernet vifs.

set interfaces bridge <interface> vif <vlan-id> address <address | dhcp | dhcpv6>
Configure interface <interface> with one or more interface addresses.

8.4. Interfaces 507

 VyOS Documentation, Release 1.5.x (circinus)

• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
• dhcp interface address is received by DHCP from a DHCP server on this segment.
• dhcpv6 interface address is received by DHCPv6 from a DHCPv6 server on this segment.

Note: When using DHCP to retrieve IPv4 address and if local customizations are needed, they should be
possible using the enter and exit hooks provided. The hook dirs are:
• /config/scripts/dhcp-client/pre-hooks.d/
• /config/scripts/dhcp-client/post-hooks.d/

Example:

set interfaces bridge br0 vif 10 address 192.0.2.1/24

set interfaces bridge br0 vif 10 address 2001:db8::1/64
set interfaces bridge br0 vif 10 address dhcp
set interfaces bridge br0 vif 10 address dhcpv6

set interfaces bridge <interface> vif <vlan-id> description <description>

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces bridge br0 vif 10 description 'This is an awesome interface running␣
˓→on VyOS'

set interfaces bridge <interface> vif <vlan-id> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces bridge br0 vif 10 disable

set interfaces bridge <interface> vif <vlan-id> disable-link-detect

Use this command to direct an interface to not detect any physical state changes on a link, for example, when
the cable is unplugged.
Default is to detects physical link state changes.
Example:

set interfaces bridge br0 vif 10 disable-link-detect

set interfaces bridge <interface> vif <vlan-id> mac <xx:xx:xx:xx:xx:xx>

Configure user defined MAC address on given <interface>.
Example:

set interfaces bridge br0 vif 10 mac '00:53:01:02:03:04'

set interfaces bridge <interface> vif <vlan-id> mtu <mtu>

8.4. Interfaces 508

 VyOS Documentation, Release 1.5.x (circinus)

Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

set interfaces bridge br0 vif 10 mtu 1600

set interfaces bridge <interface> vif <vlan-id> ip adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces bridge <interface> vif <vlan-id> ip arp-cache-timeout
Once a neighbor has been found, the entry is considered to be valid for at least for this specific time. An entry’s
validity will be extended if it receives positive feedback from higher level protocols.
This defaults to 30 seconds.
Example:

set interfaces bridge br0 vif 10 ip arp-cache-timeout 180

set interfaces bridge <interface> vif <vlan-id> ip disable-arp-filter

If set the kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but
it usually makes sense, because it increases the chance of successful communication. IP addresses are owned
by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing,
does this behaviour cause problems.
If not set (default) allows you to have multiple network interfaces on the same subnet, and have the ARPs for
each interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that
interface (therefore you must use source based routing for this to work).
In other words it allows control of which cards (usually 1) will respond to an arp request.
Example:

set interfaces bridge br0 vif 10 ip disable-arp-filter

set interfaces bridge <interface> vif <vlan-id> ip disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

set interfaces bridge br0 vif 10 ip disable-forwarding

set interfaces bridge <interface> vif <vlan-id> ip enable-directed-broadcast

Define different modes for IP directed broadcast forwarding as described in RFC 1812 and RFC 2644.
If configured, incoming IP directed broadcast packets on this interface will be forwarded.

8.4. Interfaces 509

 VyOS Documentation, Release 1.5.x (circinus)

If this option is unset (default), incoming IP directed broadcast packets will not be forwarded.

set interfaces bridge br0 vif 10 ip enable-directed-broadcast

set interfaces bridge <interface> vif <vlan-id> ip enable-arp-accept

Define behavior for gratuitous ARP frames whose IP is not already present in the ARP table. If configured
create new entries in the ARP table.
Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on.
If the ARP table already contains the IP address of the gratuitous arp frame, the arp table will be updated
regardless if this setting is on or off.

set interfaces bridge br0 vif 10 ip enable-arp-accept

set interfaces bridge <interface> vif <vlan-id> ip enable-arp-announce

Define different restriction levels for announcing the local source IP address from IP packets in ARP requests
sent on interface.
Use any local address, configured on any interface if this is not set.
If configured, try to avoid local addresses that are not in the target’s subnet for this interface. This mode is
useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of
their logical network configured on the receiving interface. When we generate the request we will check all our
subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no
such subnet we select source address according to the rules for level 2.

set interfaces bridge br0 vif 10 ip enable-arp-announce

set interfaces bridge <interface> vif <vlan-id> ip enable-arp-ignore

Define different modes for sending replies in response to received ARP requests that resolve local target IP
addresses:
If configured, reply only if the target IP address is local address configured on the incoming interface.
If this option is unset (default), reply for any local target IP address, configured on any interface.

set interfaces bridge br0 vif 10 ip enable-arp-ignore

set interfaces bridge <interface> vif <vlan-id> ip enable-proxy-arp

Use this command to enable proxy Address Resolution Protocol (ARP) on this interface. Proxy ARP allows
an Ethernet interface to respond with its own MAC address to ARP requests for destination IP addresses on
subnets attached to other interfaces on the system. Subsequent packets sent to those destination IP addresses
are forwarded appropriately by the system.
Example:

set interfaces bridge br0 vif 10 ip enable-proxy-arp

set interfaces bridge <interface> vif <vlan-id> ip proxy-arp-pvlan

Private VLAN proxy arp. Basically allow proxy arp replies back to the same interface (from which the ARP
request/solicitation was received).
This is done to support (ethernet) switch features, like RFC 3069, where the individual ports are NOT allowed
to communicate with each other, but they are allowed to talk to the upstream router. As described in RFC 3069,
it is possible to allow these hosts to communicate through the upstream router by proxy_arp’ing.

8.4. Interfaces 510

 VyOS Documentation, Release 1.5.x (circinus)

Note: Does not need to be used together with proxy_arp.

This technology is known by different names:

• In RFC 3069 it is called VLAN Aggregation
• Cisco and Allied Telesyn call it Private VLAN
• Hewlett-Packard call it Source-Port filtering or port-isolation
• Ericsson call it MAC-Forced Forwarding (RFC Draft)
set interfaces bridge <interface> vif <vlan-id> ip source-validation <strict | loose |
disable>
Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.
• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation
set interfaces bridge <interface> vif <vlan-id> ipv6 address autoconf
SLAAC RFC 4862. IPv6 hosts can configure themselves automatically when connected to an IPv6 network us-
ing the Neighbor Discovery Protocol via ICMPv6 router discovery messages. When first connected to a network,
a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to
such a request with a router advertisement packet that contains Internet Layer configuration parameters.

Note: This method automatically disables IPv6 traffic forwarding on the interface in question.

Example:

set interfaces bridge br0 vif 10 ipv6 address autoconf

set interfaces bridge <interface> vif <vlan-id> ipv6 address eui64 <prefix>
EUI-64 as specified in RFC 4291 allows a host to assign iteslf a unique 64-Bit IPv6 address.
Example:

set interfaces bridge br0 vif 10 ipv6 address eui64 2001:db8:beef::/64

set interfaces bridge <interface> vif <vlan-id> ipv6 address no-default-link-local

Do not assign a link-local IPv6 address to this interface.
Example:

set interfaces bridge br0 vif 10 ipv6 address no-default-link-local

set interfaces bridge <interface> vif <vlan-id> ipv6 disable-forwarding

8.4. Interfaces 511

 VyOS Documentation, Release 1.5.x (circinus)

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
Example:

set interfaces bridge br0 vif 10 ipv6 disable-forwarding

set interfaces bridge <interface> vif <vlan-id> ipv6 adjust-mss <mss | clamp-mss-to-pmtu>
As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss6 <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces bridge <interface> vif <vlan-id> ipv6 accept-dad <1-3>
Whether to accept DAD (Duplicate Address Detection).
• 0: Disable DAD
• 1: Enable DAD (default)
• 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate link-local address has been found.
Example:

set interfaces bridge br0 vif 10 ipv6 accept-dad 2

set interfaces bridge <interface> vif <vlan-id> ipv6 dup-addr-detect-transmits <n>

The amount of Duplicate Address Detection probes to send.
Default: 1
Example:

set interfaces bridge br0 vif 10 ipv6 dup-addr-detect-transmits 5

set interfaces bridge <interface> vif <vlan-id> vrf <vrf>

Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces bridge br0 vif 10 vrf red

DHCP(v6)
set interfaces bridge <interface> vif <vlan-id> dhcp-options client-id <description>

8.4. Interfaces 512

 VyOS Documentation, Release 1.5.x (circinus)

RFC 2131 states: The client MAY choose to explicitly provide the identifier through the ‘client identifier’
option. If the client supplies a ‘client identifier’, the client MUST use the same ‘client identifier’ in all subsequent
messages, and the server MUST use that identifier to identify the client.
Example:

set interfaces bridge br0 vif 10 dhcp-options client-id 'foo-bar'

set interfaces bridge <interface> vif <vlan-id> dhcp-options host-name <hostname>

Instead of sending the real system hostname to the DHCP server, overwrite the host-name with this given-value.
Example:

set interfaces bridge br0 vif 10 dhcp-options host-name 'VyOS'

set interfaces bridge <interface> vif <vlan-id> dhcp-options vendor-class-id <vendor-id>

This option is used by some DHCP clients to identify the vendor type and possibly the configuration of a DHCP
client. The information is a string of bytes whose contents are specific to the vendor and are not specified in a
standard.
The vendor-class-id option can be used to request a specific class of vendor options from the server.
Example:

set interfaces bridge br0 vif 10 dhcp-options vendor-class-id 'VyOS'

set interfaces bridge <interface> vif <vlan-id> dhcp-options no-default-route

Only request an address from the DHCP server but do not request a default gateway.
Example:

set interfaces bridge br0 vif 10 dhcp-options no-default-route

set interfaces bridge <interface> vif <vlan-id> dhcp-options default-route-distance

<distance>
Set the distance for the default gateway sent by the DHCP server.
Example:

set interfaces bridge br0 vif 10 dhcp-options default-route-distance 220

set interfaces bridge <interface> vif <vlan-id> dhcp-options reject <address>

Reject DHCP leases from a given address or range. This is useful when a modem gives a local IP when first
starting.
• address can be specified multiple times, e.g. 192.168.100.1 and/or 192.168.100.0/24
Example:

set interfaces bridge br0 vif 10 dhcp-options reject 192.168.100.0/24

set interfaces bridge <interface> vif <vlan-id> dhcp-options user-class <string>

This option is used by some DHCP clients as a way for users to specify identifying information to the client.
This can be used in a similar way to the vendor-class-identifier option, but the value of the option is specified
by the user, not the vendor.
Example:

8.4. Interfaces 513

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces bridge br0 vif 10 dhcp-options user-class VyOS

set interfaces bridge <interface> vif <vlan-id> dhcpv6-options duid <duid>

The DHCP unique identifier (DUID) is used by a client to get an IP address from a DHCPv6 server. It has a
2-byte DUID type field, and a variable-length identifier field up to 128 bytes. Its actual length depends on its
type. The server compares the DUID with its database and delivers configuration data (address, lease times,
DNS servers, etc.) to the client.

set interfaces bridge br0 vif 10 duid

˓→'0e:00:00:01:00:01:27:71:db:f0:00:50:56:bf:c5:6d'

set interfaces bridge <interface> vif <vlan-id> dhcpv6-options no-release

When no-release is specified, dhcp6c will send a release message on client exit to prevent losing an assigned
address or prefix.

set interfaces bridge br0 vif 10 dhcpv6-options no-release

set interfaces bridge <interface> vif <vlan-id> dhcpv6-options parameters-only

This statement specifies dhcp6c to only exchange informational configuration parameters with servers. A list of
DNS server addresses is an example of such parameters. This statement is useful when the client does not need
stateful configuration parameters such as IPv6 addresses or prefixes.

set interfaces bridge br0 vif 10 dhcpv6-options parameters-only

set interfaces bridge <interface> vif <vlan-id> dhcpv6-options rapid-commit

When rapid-commit is specified, dhcp6c will include a rapid-commit option in solicit messages and wait for an
immediate reply instead of advertisements.

set interfaces bridge br0 vif 10 dhcpv6-options rapid-commit

set interfaces bridge <interface> vif <vlan-id> dhcpv6-options temporary

Request only a temporary address and not form an IA_NA (Identity Association for Non-temporary Addresses)
partnership.

set interfaces bridge br0 vif 10 dhcpv6-options temporary

DHCPv6 Prefix Delegation (PD)

VyOS 1.3 (equuleus) supports DHCPv6-PD (RFC 3633). DHCPv6 Prefix Delegation is supported by most ISPs who
provide native IPv6 for consumers on fixed networks.
set interfaces bridge <interface> vif <vlan-id> dhcpv6-options pd <id> length <length>
Some ISPs by default only delegate a /64 prefix. To request for a specific prefix size use this option to request
for a bigger delegation for this pd <id>. This value is in the range from 32 - 64 so you could request up to a /32
prefix (if your ISP allows this) down to a /64 delegation.
The default value corresponds to 64.
To request a /56 prefix from your ISP use:

set interfaces bridge br0 vif 10 dhcpv6-options pd 0 length 56

set interfaces bridge <interface> vif <vlan-id> dhcpv6-options pd <id> interface

<delegatee> address <address>

8.4. Interfaces 514

 VyOS Documentation, Release 1.5.x (circinus)

Specify the interface address used locally on the interface where the prefix has been delegated to. ID must be a
decimal integer.
It will be combined with the delegated prefix and the sla-id to form a complete interface address. The default is
to use the EUI-64 address of the interface.
Example: Delegate a /64 prefix to interface eth8 which will use a local address on this router of
<prefix>::ffff, as the address 65534 will correspond to ffff in hexadecimal notation.

set interfaces bridge br0 vif 10 dhcpv6-options pd 0 interface eth8 address 65534

set interfaces bridge <interface> vif <vlan-id> dhcpv6-options pd <id> interface

<delegatee> sla-id <id>
Specify the identifier value of the site-level aggregator (SLA) on the interface. ID must be a decimal number
greater then 0 which fits in the length of SLA IDs (see below).
Example: If ID is 1 and the client is delegated an IPv6 prefix 2001:db8:ffff::/48, dhcp6c will combine the two
values into a single IPv6 prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified interface.

set interfaces bridge br0 vif 10 dhcpv6-options pd 0 interface eth8 sla-id 1

set interfaces bridge <interface> member interface <member> native-vlan <vlan-id>

Set the native VLAN ID flag of the interface. When a data packet without a VLAN tag enters the port, the data
packet will have a specific vlan id added to it. When the packet flows out, the native vlan tag will be stripped.
Example: Set eth0 member port to be native VLAN 2

set interfaces bridge br1 member interface eth0 native-vlan 2

set interfaces bridge <interface> member interface <member> allowed-vlan <vlan-id>

Allows specific VLAN IDs to pass through the bridge member interface. This can either be an individual VLAN
id or a range of VLAN ids delimited by a hyphen.
Example: Set eth0 member port to be allowed VLAN 4

set interfaces bridge br1 member interface eth0 allowed-vlan 4

Example: Set eth0 member port to be allowed VLAN 6-8

set interfaces bridge br1 member interface eth0 allowed-vlan 6-8

Port Mirror (SPAN)

SPAN port mirroring can copy the inbound/outbound traffic of the interface to the specified interface, usually the
interface can be connected to some special equipment, such as a behavior control system, intrusion detection system or
traffic collector, and can copy all related traffic from this port. The benefit of mirroring the traffic is that the application
is isolated from the source traffic and so application processing does not affect the traffic or the system performance.
VyOS uses the mirror option to configure port mirroring. The configuration is divided into 2 different directions.
Destination ports should be configured for different traffic directions.
set interfaces bridge <interface> mirror ingress <monitor-interface>
Configure port mirroring for interface inbound traffic and copy the traffic to monitor-interface
Example: Mirror the inbound traffic of br1 port to eth3

8.4. Interfaces 515

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces bridge br1 mirror ingress eth3

set interfaces bridge <interface> mirror egress <monitor-interface>

Configure port mirroring for interface outbound traffic and copy the traffic to monitor-interface
Example: Mirror the outbound traffic of br1 port to eth3

set interfaces bridge br1 mirror egress eth3

Examples

Create a basic bridge

Creating a bridge interface is very simple. In this example, we will have:

• A bridge named br100
• Member interfaces eth1 and VLAN 10 on interface eth2
• Enable STP
• Bridge answers on IP address 192.0.2.1/24 and 2001:db8::ffff/64

set interfaces bridge br100 address 192.0.2.1/24

set interfaces bridge br100 address 2001:db8::ffff/64
set interfaces bridge br100 member interface eth1
set interfaces bridge br100 member interface eth2.10
set interfaces bridge br100 stp

This results in the active configuration:

vyos@vyos# show interfaces bridge br100

address 192.0.2.1/24
address 2001:db8::ffff/64
member {
interface eth1 {
}
interface eth2.10 {
}
}
stp

Using VLAN aware Bridge

An example of creating a VLAN-aware bridge is as follows:

• A bridge named br100
• The member interface eth1 is a trunk that allows VLAN 10 to pass
• VLAN 10 on member interface eth2 (ACCESS mode)
• Enable STP
• Bridge answers on IP address 192.0.2.1/24 and 2001:db8::ffff/64

8.4. Interfaces 516

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces bridge br100 enable-vlan

set interfaces bridge br100 member interface eth1 allowed-vlan 10
set interfaces bridge br100 member interface eth2 native-vlan 10
set interfaces bridge br100 vif 10 address 192.0.2.1/24
set interfaces bridge br100 vif 10 address 2001:db8::ffff/64
set interfaces bridge br100 stp

This results in the active configuration:

vyos@vyos# show interfaces bridge br100

enable-vlan
member {
interface eth1 {
allowed-vlan 10
}
interface eth2 {
native-vlan 10
}
}
stp
vif 10 {
address 192.0.2.1/24
address 2001:db8::ffff/64
}

Using the operation mode command to view Bridge Information

show bridge
The show bridge operational command can be used to display configured bridges:

vyos@vyos:~$ show bridge

3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master br0 state forwarding
priority 32 cost 100
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master br0 state forwarding
priority 32 cost 100

show bridge <name> fdb

Show bridge <name> fdb displays the current forwarding table:

vyos@vyos:~$ show bridge br0 fdb

50:00:00:08:00:01 dev eth1 vlan 20 master br0 permanent
50:00:00:08:00:01 dev eth1 vlan 10 master br0 permanent
50:00:00:08:00:01 dev eth1 master br0 permanent
33:33:00:00:00:01 dev eth1 self permanent
33:33:00:00:00:02 dev eth1 self permanent
01:00:5e:00:00:01 dev eth1 self permanent
50:00:00:08:00:02 dev eth2 vlan 20 master br0 permanent
50:00:00:08:00:02 dev eth2 vlan 10 master br0 permanent
50:00:00:08:00:02 dev eth2 master br0 permanent
33:33:00:00:00:01 dev eth2 self permanent
33:33:00:00:00:02 dev eth2 self permanent
(continues on next page)

8.4. Interfaces 517

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

01:00:5e:00:00:01 dev eth2 self permanent
33:33:00:00:00:01 dev br0 self permanent
33:33:00:00:00:02 dev br0 self permanent
33:33:ff:08:00:01 dev br0 self permanent
01:00:5e:00:00:6a dev br0 self permanent
33:33:00:00:00:6a dev br0 self permanent
01:00:5e:00:00:01 dev br0 self permanent
33:33:ff:00:00:00 dev br0 self permanent

show bridge <name> mdb

Show bridge <name> mdb displays the current multicast group membership table.The table is populated by
IGMP and MLD snooping in the bridge driver automatically.

vyos@vyos:~$ show bridge br0 mdb

dev br0 port br0 grp ff02::1:ff00:0 temp vid 1
dev br0 port br0 grp ff02::2 temp vid 1
dev br0 port br0 grp ff02::1:ff08:1 temp vid 1
dev br0 port br0 grp ff02::6a temp vid 1

8.4.3 Dummy

The dummy interface is really a little exotic, but rather useful nevertheless. Dummy interfaces are much like the
Loopback interface, except you can have as many as you want.

Note: Dummy interfaces can be used as interfaces that always stay up (in the same fashion to loopbacks in Cisco IOS),
or for testing purposes.

Hint: On systems with multiple redundant uplinks and routes, it’s a good idea to use a dedicated address for man-
agement and dynamic routing protocols. However, assigning that address to a physical link is risky: if that link goes
down, that address will become inaccessible. A common solution is to assign the management address to a loopback
or a dummy interface and advertise that address via all physical links, so that it’s reachable through any of them. Since
in Linux-based systems, there can be only one loopback interface, it’s better to use a dummy interface for that purpose,
since they can be added, removed, and taken up and down independently.

Configuration

Common interface configuration

set interfaces dummy <interface> address <address>

Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
Example:

8.4. Interfaces 518

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces dummy dum0 address 192.0.2.1/24

set interfaces dummy dum0 address 2001:db8::1/64

set interfaces dummy <interface> description <description>

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces dummy dum0 description 'This is an awesome interface running on VyOS'

set interfaces dummy <interface> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces dummy dum0 disable

set interfaces dummy <interface> vrf <vrf>

Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces dummy dum0 vrf red

Operation

show interfaces dummy

Show brief interface information.

vyos@vyos:~$ show interfaces dummy

Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
dum0 172.18.254.201/32 u/u

show interfaces dummy <interface>

Show detailed information on given <interface>

vyos@vyos:~$ show interfaces dummy dum0

dum0: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group␣
˓→default qlen 1000

link/ether 26:7c:8e:bc:fc:f5 brd ff:ff:ff:ff:ff:ff

inet 172.18.254.201/32 scope global dum0
valid_lft forever preferred_lft forever
inet6 fe80::247c:8eff:febc:fcf5/64 scope link
valid_lft forever preferred_lft forever

(continues on next page)

8.4. Interfaces 519

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

RX: bytes packets errors dropped overrun mcast
0 0 0 0 0 0
TX: bytes packets errors dropped carrier collisions
1369707 4267 0 0 0 0

8.4.4 Ethernet

This will be the most widely used interface on a router carrying traffic to the real world.

Configuration

Common interface configuration

set interfaces ethernet <interface> address <address | dhcp | dhcpv6>

Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
• dhcp interface address is received by DHCP from a DHCP server on this segment.
• dhcpv6 interface address is received by DHCPv6 from a DHCPv6 server on this segment.

Note: When using DHCP to retrieve IPv4 address and if local customizations are needed, they should be
possible using the enter and exit hooks provided. The hook dirs are:
• /config/scripts/dhcp-client/pre-hooks.d/
• /config/scripts/dhcp-client/post-hooks.d/

Example:

set interfaces ethernet eth0 address 192.0.2.1/24

set interfaces ethernet eth0 address 2001:db8::1/64
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 address dhcpv6

set interfaces ethernet <interface> description <description>

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces ethernet eth0 description 'This is an awesome interface running on␣
˓→VyOS'

set interfaces ethernet <interface> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

8.4. Interfaces 520

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces ethernet eth0 disable

set interfaces ethernet <interface> disable-flow-control

Ethernet flow control is a mechanism for temporarily stopping the transmission of data on Ethernet family com-
puter networks. The goal of this mechanism is to ensure zero packet loss in the presence of network congestion.
The first flow control mechanism, the pause frame, was defined by the IEEE 802.3x standard.
A sending station (computer or network switch) may be transmitting data faster than the other end of the link can
accept it. Using flow control, the receiving station can signal the sender requesting suspension of transmissions
until the receiver catches up.
Use this command to disable the generation of Ethernet flow control (pause frames).
Example:

set interfaces ethernet eth0 disable-flow-control

set interfaces ethernet <interface> disable-link-detect

Use this command to direct an interface to not detect any physical state changes on a link, for example, when
the cable is unplugged.
Default is to detects physical link state changes.
Example:

set interfaces ethernet eth0 disable-link-detect

set interfaces ethernet <interface> mac <xx:xx:xx:xx:xx:xx>

Configure user defined MAC address on given <interface>.
Example:

set interfaces ethernet eth0 mac '00:53:01:02:03:04'

set interfaces ethernet <interface> mtu <mtu>

Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

set interfaces ethernet eth0 mtu 1600

set interfaces ethernet <interface> ip adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.

8.4. Interfaces 521

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces ethernet <interface> ip arp-cache-timeout

Once a neighbor has been found, the entry is considered to be valid for at least for this specific time. An entry’s
validity will be extended if it receives positive feedback from higher level protocols.
This defaults to 30 seconds.
Example:

set interfaces ethernet eth0 ip arp-cache-timeout 180

set interfaces ethernet <interface> ip disable-arp-filter

If set the kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but
it usually makes sense, because it increases the chance of successful communication. IP addresses are owned
by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing,
does this behaviour cause problems.
If not set (default) allows you to have multiple network interfaces on the same subnet, and have the ARPs for
each interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that
interface (therefore you must use source based routing for this to work).
In other words it allows control of which cards (usually 1) will respond to an arp request.
Example:

set interfaces ethernet eth0 ip disable-arp-filter

set interfaces ethernet <interface> ip disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

set interfaces ethernet eth0 ip disable-forwarding

set interfaces ethernet <interface> ip enable-directed-broadcast

Define different modes for IP directed broadcast forwarding as described in RFC 1812 and RFC 2644.
If configured, incoming IP directed broadcast packets on this interface will be forwarded.
If this option is unset (default), incoming IP directed broadcast packets will not be forwarded.

set interfaces ethernet eth0 ip enable-directed-broadcast

set interfaces ethernet <interface> ip enable-arp-accept

Define behavior for gratuitous ARP frames whose IP is not already present in the ARP table. If configured
create new entries in the ARP table.
Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on.
If the ARP table already contains the IP address of the gratuitous arp frame, the arp table will be updated
regardless if this setting is on or off.

set interfaces ethernet eth0 ip enable-arp-accept

set interfaces ethernet <interface> ip enable-arp-announce

Define different restriction levels for announcing the local source IP address from IP packets in ARP requests
sent on interface.
Use any local address, configured on any interface if this is not set.

8.4. Interfaces 522

 VyOS Documentation, Release 1.5.x (circinus)

If configured, try to avoid local addresses that are not in the target’s subnet for this interface. This mode is
useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of
their logical network configured on the receiving interface. When we generate the request we will check all our
subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no
such subnet we select source address according to the rules for level 2.

set interfaces ethernet eth0 ip enable-arp-announce

set interfaces ethernet <interface> ip enable-arp-ignore

Define different modes for sending replies in response to received ARP requests that resolve local target IP
addresses:
If configured, reply only if the target IP address is local address configured on the incoming interface.
If this option is unset (default), reply for any local target IP address, configured on any interface.

set interfaces ethernet eth0 ip enable-arp-ignore

set interfaces ethernet <interface> ip enable-proxy-arp

Use this command to enable proxy Address Resolution Protocol (ARP) on this interface. Proxy ARP allows
an Ethernet interface to respond with its own MAC address to ARP requests for destination IP addresses on
subnets attached to other interfaces on the system. Subsequent packets sent to those destination IP addresses
are forwarded appropriately by the system.
Example:

set interfaces ethernet eth0 ip enable-proxy-arp

set interfaces ethernet <interface> ip proxy-arp-pvlan

Private VLAN proxy arp. Basically allow proxy arp replies back to the same interface (from which the ARP
request/solicitation was received).
This is done to support (ethernet) switch features, like RFC 3069, where the individual ports are NOT allowed
to communicate with each other, but they are allowed to talk to the upstream router. As described in RFC 3069,
it is possible to allow these hosts to communicate through the upstream router by proxy_arp’ing.

Note: Does not need to be used together with proxy_arp.

This technology is known by different names:

• In RFC 3069 it is called VLAN Aggregation
• Cisco and Allied Telesyn call it Private VLAN
• Hewlett-Packard call it Source-Port filtering or port-isolation
• Ericsson call it MAC-Forced Forwarding (RFC Draft)
set interfaces ethernet <interface> ip source-validation <strict | loose | disable>
Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.

8.4. Interfaces 523

 VyOS Documentation, Release 1.5.x (circinus)

• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation
set interfaces ethernet <interface> ipv6 address autoconf
SLAAC RFC 4862. IPv6 hosts can configure themselves automatically when connected to an IPv6 network us-
ing the Neighbor Discovery Protocol via ICMPv6 router discovery messages. When first connected to a network,
a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to
such a request with a router advertisement packet that contains Internet Layer configuration parameters.

Note: This method automatically disables IPv6 traffic forwarding on the interface in question.

Example:

set interfaces ethernet eth0 ipv6 address autoconf

set interfaces ethernet <interface> ipv6 address eui64 <prefix>

EUI-64 as specified in RFC 4291 allows a host to assign iteslf a unique 64-Bit IPv6 address.
Example:

set interfaces ethernet eth0 ipv6 address eui64 2001:db8:beef::/64

set interfaces ethernet <interface> ipv6 address no-default-link-local

Do not assign a link-local IPv6 address to this interface.
Example:

set interfaces ethernet eth0 ipv6 address no-default-link-local

set interfaces ethernet <interface> ipv6 disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
Example:

set interfaces ethernet eth0 ipv6 disable-forwarding

set interfaces ethernet <interface> ipv6 adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss6 <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces ethernet <interface> ipv6 accept-dad <1-3>

8.4. Interfaces 524

 VyOS Documentation, Release 1.5.x (circinus)

Whether to accept DAD (Duplicate Address Detection).

• 0: Disable DAD
• 1: Enable DAD (default)
• 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate link-local address has been found.
Example:

set interfaces ethernet eth0 ipv6 accept-dad 2

set interfaces ethernet <interface> ipv6 dup-addr-detect-transmits <n>

The amount of Duplicate Address Detection probes to send.
Default: 1
Example:

set interfaces ethernet eth0 ipv6 dup-addr-detect-transmits 5

set interfaces ethernet <interface> vrf <vrf>

Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces ethernet eth0 vrf red

DHCP(v6)
set interfaces ethernet <interface> dhcp-options client-id <description>
RFC 2131 states: The client MAY choose to explicitly provide the identifier through the ‘client identifier’
option. If the client supplies a ‘client identifier’, the client MUST use the same ‘client identifier’ in all subsequent
messages, and the server MUST use that identifier to identify the client.
Example:

set interfaces ethernet eth0 dhcp-options client-id 'foo-bar'

set interfaces ethernet <interface> dhcp-options host-name <hostname>

Instead of sending the real system hostname to the DHCP server, overwrite the host-name with this given-value.
Example:

set interfaces ethernet eth0 dhcp-options host-name 'VyOS'

set interfaces ethernet <interface> dhcp-options vendor-class-id <vendor-id>

This option is used by some DHCP clients to identify the vendor type and possibly the configuration of a DHCP
client. The information is a string of bytes whose contents are specific to the vendor and are not specified in a
standard.
The vendor-class-id option can be used to request a specific class of vendor options from the server.
Example:

8.4. Interfaces 525

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces ethernet eth0 dhcp-options vendor-class-id 'VyOS'

set interfaces ethernet <interface> dhcp-options no-default-route

Only request an address from the DHCP server but do not request a default gateway.
Example:

set interfaces ethernet eth0 dhcp-options no-default-route

set interfaces ethernet <interface> dhcp-options default-route-distance <distance>

Set the distance for the default gateway sent by the DHCP server.
Example:

set interfaces ethernet eth0 dhcp-options default-route-distance 220

set interfaces ethernet <interface> dhcp-options reject <address>

Reject DHCP leases from a given address or range. This is useful when a modem gives a local IP when first
starting.
• address can be specified multiple times, e.g. 192.168.100.1 and/or 192.168.100.0/24
Example:

set interfaces ethernet eth0 dhcp-options reject 192.168.100.0/24

set interfaces ethernet <interface> dhcp-options user-class <string>

This option is used by some DHCP clients as a way for users to specify identifying information to the client.
This can be used in a similar way to the vendor-class-identifier option, but the value of the option is specified
by the user, not the vendor.
Example:

set interfaces ethernet eth0 dhcp-options user-class VyOS

set interfaces ethernet <interface> dhcpv6-options duid <duid>

The DHCP unique identifier (DUID) is used by a client to get an IP address from a DHCPv6 server. It has a
2-byte DUID type field, and a variable-length identifier field up to 128 bytes. Its actual length depends on its
type. The server compares the DUID with its database and delivers configuration data (address, lease times,
DNS servers, etc.) to the client.

set interfaces ethernet eth0 duid '0e:00:00:01:00:01:27:71:db:f0:00:50:56:bf:c5:6d'

set interfaces ethernet <interface> dhcpv6-options no-release

When no-release is specified, dhcp6c will send a release message on client exit to prevent losing an assigned
address or prefix.

set interfaces ethernet eth0 dhcpv6-options no-release

set interfaces ethernet <interface> dhcpv6-options parameters-only

This statement specifies dhcp6c to only exchange informational configuration parameters with servers. A list of
DNS server addresses is an example of such parameters. This statement is useful when the client does not need
stateful configuration parameters such as IPv6 addresses or prefixes.

8.4. Interfaces 526

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces ethernet eth0 dhcpv6-options parameters-only

set interfaces ethernet <interface> dhcpv6-options rapid-commit

When rapid-commit is specified, dhcp6c will include a rapid-commit option in solicit messages and wait for an
immediate reply instead of advertisements.

set interfaces ethernet eth0 dhcpv6-options rapid-commit

set interfaces ethernet <interface> dhcpv6-options temporary

Request only a temporary address and not form an IA_NA (Identity Association for Non-temporary Addresses)
partnership.

set interfaces ethernet eth0 dhcpv6-options temporary

DHCPv6 Prefix Delegation (PD)

VyOS 1.3 (equuleus) supports DHCPv6-PD (RFC 3633). DHCPv6 Prefix Delegation is supported by most ISPs who
provide native IPv6 for consumers on fixed networks.
set interfaces ethernet <interface> dhcpv6-options pd <id> length <length>
Some ISPs by default only delegate a /64 prefix. To request for a specific prefix size use this option to request
for a bigger delegation for this pd <id>. This value is in the range from 32 - 64 so you could request up to a /32
prefix (if your ISP allows this) down to a /64 delegation.
The default value corresponds to 64.
To request a /56 prefix from your ISP use:

set interfaces ethernet eth0 dhcpv6-options pd 0 length 56

set interfaces ethernet <interface> dhcpv6-options pd <id> interface <delegatee> address

<address>
Specify the interface address used locally on the interface where the prefix has been delegated to. ID must be a
decimal integer.
It will be combined with the delegated prefix and the sla-id to form a complete interface address. The default is
to use the EUI-64 address of the interface.
Example: Delegate a /64 prefix to interface eth8 which will use a local address on this router of
<prefix>::ffff, as the address 65534 will correspond to ffff in hexadecimal notation.

set interfaces ethernet eth0 dhcpv6-options pd 0 interface eth8 address 65534

set interfaces ethernet <interface> dhcpv6-options pd <id> interface <delegatee> sla-id

<id>
Specify the identifier value of the site-level aggregator (SLA) on the interface. ID must be a decimal number
greater then 0 which fits in the length of SLA IDs (see below).
Example: If ID is 1 and the client is delegated an IPv6 prefix 2001:db8:ffff::/48, dhcp6c will combine the two
values into a single IPv6 prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified interface.

set interfaces ethernet eth0 dhcpv6-options pd 0 interface eth8 sla-id 1

8.4. Interfaces 527

 VyOS Documentation, Release 1.5.x (circinus)

Ethernet options

set interfaces ethernet <interface> duplex <auto | full | half>

Configure physical interface duplex setting.
• auto - interface duplex setting is auto-negotiated
• full - always use full-duplex
• half - always use half-duplex
VyOS default will be auto.
set interfaces ethernet <interface> speed <auto | 10 | 100 | 1000 | 2500 | 5000 | 10000 |
25000 | 40000 | 50000 | 100000>
Configure physical interface speed setting.
• auto - interface speed is auto-negotiated
• 10 - 10 MBit/s
• 100 - 100 MBit/s
• 1000 - 1 GBit/s
• 2500 - 2.5 GBit/s
• 5000 - 5 GBit/s
• 10000 - 10 GBit/s
• 25000 - 25 GBit/s
• 40000 - 40 GBit/s
• 50000 - 50 GBit/s
• 100000 - 100 GBit/s
VyOS default will be auto.
set interface ethernet <interface> ring-buffer rx <value>
set interface ethernet <interface> ring-buffer tx <value>
Configures the ring buffer size of the interface.
The supported values for a specific interface can be obtained with: ethtool -g <interface>

Offloading

set interfaces ethernet <interface> offload <gro | gso | lro | rps | sg | tso>
Enable different types of hardware offloading on the given NIC.
LRO (Large Receive Offload) is a technique designed to boost the efficiency of how your computer’s network
interface card (NIC) processes incoming network traffic. Typically, network data arrives in smaller chunks called
packets. Processing each packet individually consumes CPU (central processing unit) resources. Lots of small
packets can lead to a performance bottleneck. Instead of handing the CPU each packet as it comes in, LRO
instructs the NIC to combine multiple incoming packets into a single, larger packet. This larger packet is then
passed to the CPU for processing.

8.4. Interfaces 528

 VyOS Documentation, Release 1.5.x (circinus)

Note: Under some circumstances, LRO is known to modify the packet headers of forwarded traffic, which
breaks the end-to-end principle of computer networking. LRO is also only able to offload TCP segments en-
capsulated in IPv4 packets. Due to these limitations, it is recommended to use GRO (Generic Receive Offload)
where possible. More information on the limitations of LRO can be found here: https://lwn.net/Articles/358910/

GSO (Generic Segmentation Offload) is a pure software offload that is meant to deal with cases where device
drivers cannot perform the offloads described above. What occurs in GSO is that a given skbuff will have its data
broken out over multiple skbuffs that have been resized to match the MSS provided via skb_shinfo()->gso_size.
Before enabling any hardware segmentation offload a corresponding software offload is required in GSO. Other-
wise it becomes possible for a frame to be re-routed between devices and end up being unable to be transmitted.
GRO (Generic receive offload) is the complement to GSO. Ideally any frame assembled by GRO should be
segmented to create an identical sequence of frames using GSO, and any sequence of frames segmented by
GSO should be able to be reassembled back to the original by GRO. The only exception to this is IPv4 ID in the
case that the DF bit is set for a given IP header. If the value of the IPv4 ID is not sequentially incrementing it
will be altered so that it is when a frame assembled via GRO is segmented via GSO.
RPS (Receive Packet Steering) is logically a software implementation of RSS (Receive Side Scaling). Being
in software, it is necessarily called later in the datapath. Whereas RSS selects the queue and hence CPU that
will run the hardware interrupt handler, RPS selects the CPU to perform protocol processing above the interrupt
handler. This is accomplished by placing the packet on the desired CPU’s backlog queue and waking up the
CPU for processing. RPS has some advantages over RSS:
• it can be used with any NIC
• software filters can easily be added to hash over new protocols
• it does not increase hardware device interrupt rate, although it does introduce inter-processor interrupts
(IPIs)

Note: In order to use TSO/LRO with VMXNET3 adapters, the SG offloading option must also be enabled.

Authentication (EAPoL)

EAP (Extensible Authentication Protocol) over LAN (EAPoL) is a network port authentication protocol used in IEEE
802.1X (Port Based Network Access Control) developed to give a generic network sign-on to access network resources.
EAPoL comes with an identify option. We automatically use the interface MAC address as identity parameter.
set interfaces ethernet <interface> eapol ca-certificate <name>
Set the name of the SSL CA (Certificate Authority) PKI entry used for authentication of the remote side. If an
intermediate CA certificate is specified, then all parent CA certificates that exist in the PKI, such as the root CA
or additional intermediate CAs, will automatically be used during certificate validation to ensure that the full
chain of trust is available.
Example:

set pki ca eapol-server-intermediate-ca <Server intermediate CA contents>

set pki ca eapol-server-root-ca <Server root CA contents>
set interfaces ethernet eth0 eapol ca-certificate eapol-server-intermediate-ca

set interfaces ethernet <interface> eapol certificate <name>

8.4. Interfaces 529

 VyOS Documentation, Release 1.5.x (circinus)

Set the name of the x509 client keypair used to authenticate against the 802.1x system. All parent CA certificates
of the client certificate, such as intermediate and root CAs, will be sent as part of the EAP-TLS handshake.
Example:

set pki ca eapol-client-intermediate-ca <Client intermediate CA contents>

set pki ca eapol-client-root-ca <Client root CA contents>
set pki certificate eapol-client certificate <Client certificate contents>
set pki certificate eapol-client private key <Client private key contents>
set interfaces ethernet eth0 eapol certificate eapol-client

EVPN Multihoming

Uplink/Core tracking.
set interfaces ethernet <interface> evpn uplink
When all the underlay links go down the PE no longer has access to the VxLAN +overlay. To prevent blackholing
of traffic the server/ES links are protodowned on the PE.
A link can be setup for uplink tracking via the following example:

set interfaces ethernet eth0 evpn uplink

VLAN

Regular VLANs (802.1q)

IEEE 802.1q, often referred to as Dot1q, is the networking standard that supports virtual LANs (VLANs) on an IEEE
802.3 Ethernet network. The standard defines a system of VLAN tagging for Ethernet frames and the accompanying
procedures to be used by bridges and switches in handling such frames. The standard also contains provisions for a
quality-of-service prioritization scheme commonly known as IEEE 802.1p and defines the Generic Attribute Registra-
tion Protocol.
Portions of the network which are VLAN-aware (i.e., IEEE 802.1q conformant) can include VLAN tags. When a frame
enters the VLAN-aware portion of the network, a tag is added to represent the VLAN membership. Each frame must
be distinguishable as being within exactly one VLAN. A frame in the VLAN-aware portion of the network that does
not contain a VLAN tag is assumed to be flowing on the native VLAN.
The standard was developed by IEEE 802.1, a working group of the IEEE 802 standards committee, and continues
to be actively revised. One of the notable revisions is 802.1Q-2014 which incorporated IEEE 802.1aq (Shortest Path
Bridging) and much of the IEEE 802.1d standard.
802.1q VLAN interfaces are represented as virtual sub-interfaces in VyOS. The term used for this is vif.
set interfaces ethernet <interface> vif <vlan-id>
Create a new VLAN interface on interface <interface> using the VLAN number provided via <vlan-id>.
You can create multiple VLAN interfaces on a physical interface. The VLAN ID range is from 0 to 4094.

Note: Only 802.1Q-tagged packets are accepted on Ethernet vifs.

set interfaces ethernet <interface> vif <vlan-id> address <address | dhcp | dhcpv6>
Configure interface <interface> with one or more interface addresses.

8.4. Interfaces 530

 VyOS Documentation, Release 1.5.x (circinus)

• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
• dhcp interface address is received by DHCP from a DHCP server on this segment.
• dhcpv6 interface address is received by DHCPv6 from a DHCPv6 server on this segment.

Note: When using DHCP to retrieve IPv4 address and if local customizations are needed, they should be
possible using the enter and exit hooks provided. The hook dirs are:
• /config/scripts/dhcp-client/pre-hooks.d/
• /config/scripts/dhcp-client/post-hooks.d/

Example:

set interfaces ethernet eth0 vif 10 address 192.0.2.1/24

set interfaces ethernet eth0 vif 10 address 2001:db8::1/64
set interfaces ethernet eth0 vif 10 address dhcp
set interfaces ethernet eth0 vif 10 address dhcpv6

set interfaces ethernet <interface> vif <vlan-id> description <description>

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces ethernet eth0 vif 10 description 'This is an awesome interface␣

˓→running on VyOS'

set interfaces ethernet <interface> vif <vlan-id> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces ethernet eth0 vif 10 disable

set interfaces ethernet <interface> vif <vlan-id> disable-link-detect

Use this command to direct an interface to not detect any physical state changes on a link, for example, when
the cable is unplugged.
Default is to detects physical link state changes.
Example:

set interfaces ethernet eth0 vif 10 disable-link-detect

set interfaces ethernet <interface> vif <vlan-id> mac <xx:xx:xx:xx:xx:xx>

Configure user defined MAC address on given <interface>.
Example:

set interfaces ethernet eth0 vif 10 mac '00:53:01:02:03:04'

set interfaces ethernet <interface> vif <vlan-id> mtu <mtu>

8.4. Interfaces 531

 VyOS Documentation, Release 1.5.x (circinus)

Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

set interfaces ethernet eth0 vif 10 mtu 1600

set interfaces ethernet <interface> vif <vlan-id> ip adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces ethernet <interface> vif <vlan-id> ip arp-cache-timeout
Once a neighbor has been found, the entry is considered to be valid for at least for this specific time. An entry’s
validity will be extended if it receives positive feedback from higher level protocols.
This defaults to 30 seconds.
Example:

set interfaces ethernet eth0 vif 10 ip arp-cache-timeout 180

set interfaces ethernet <interface> vif <vlan-id> ip disable-arp-filter

If set the kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but
it usually makes sense, because it increases the chance of successful communication. IP addresses are owned
by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing,
does this behaviour cause problems.
If not set (default) allows you to have multiple network interfaces on the same subnet, and have the ARPs for
each interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that
interface (therefore you must use source based routing for this to work).
In other words it allows control of which cards (usually 1) will respond to an arp request.
Example:

set interfaces ethernet eth0 vif 10 ip disable-arp-filter

set interfaces ethernet <interface> vif <vlan-id> ip disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

set interfaces ethernet eth0 vif 10 ip disable-forwarding

set interfaces ethernet <interface> vif <vlan-id> ip enable-directed-broadcast

Define different modes for IP directed broadcast forwarding as described in RFC 1812 and RFC 2644.
If configured, incoming IP directed broadcast packets on this interface will be forwarded.

8.4. Interfaces 532

 VyOS Documentation, Release 1.5.x (circinus)

If this option is unset (default), incoming IP directed broadcast packets will not be forwarded.

set interfaces ethernet eth0 vif 10 ip enable-directed-broadcast

set interfaces ethernet <interface> vif <vlan-id> ip enable-arp-accept

Define behavior for gratuitous ARP frames whose IP is not already present in the ARP table. If configured
create new entries in the ARP table.
Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on.
If the ARP table already contains the IP address of the gratuitous arp frame, the arp table will be updated
regardless if this setting is on or off.

set interfaces ethernet eth0 vif 10 ip enable-arp-accept

set interfaces ethernet <interface> vif <vlan-id> ip enable-arp-announce

Define different restriction levels for announcing the local source IP address from IP packets in ARP requests
sent on interface.
Use any local address, configured on any interface if this is not set.
If configured, try to avoid local addresses that are not in the target’s subnet for this interface. This mode is
useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of
their logical network configured on the receiving interface. When we generate the request we will check all our
subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no
such subnet we select source address according to the rules for level 2.

set interfaces ethernet eth0 vif 10 ip enable-arp-announce

set interfaces ethernet <interface> vif <vlan-id> ip enable-arp-ignore

Define different modes for sending replies in response to received ARP requests that resolve local target IP
addresses:
If configured, reply only if the target IP address is local address configured on the incoming interface.
If this option is unset (default), reply for any local target IP address, configured on any interface.

set interfaces ethernet eth0 vif 10 ip enable-arp-ignore

set interfaces ethernet <interface> vif <vlan-id> ip enable-proxy-arp

Use this command to enable proxy Address Resolution Protocol (ARP) on this interface. Proxy ARP allows
an Ethernet interface to respond with its own MAC address to ARP requests for destination IP addresses on
subnets attached to other interfaces on the system. Subsequent packets sent to those destination IP addresses
are forwarded appropriately by the system.
Example:

set interfaces ethernet eth0 vif 10 ip enable-proxy-arp

set interfaces ethernet <interface> vif <vlan-id> ip proxy-arp-pvlan

Private VLAN proxy arp. Basically allow proxy arp replies back to the same interface (from which the ARP
request/solicitation was received).
This is done to support (ethernet) switch features, like RFC 3069, where the individual ports are NOT allowed
to communicate with each other, but they are allowed to talk to the upstream router. As described in RFC 3069,
it is possible to allow these hosts to communicate through the upstream router by proxy_arp’ing.

8.4. Interfaces 533

 VyOS Documentation, Release 1.5.x (circinus)

Note: Does not need to be used together with proxy_arp.

This technology is known by different names:

• In RFC 3069 it is called VLAN Aggregation
• Cisco and Allied Telesyn call it Private VLAN
• Hewlett-Packard call it Source-Port filtering or port-isolation
• Ericsson call it MAC-Forced Forwarding (RFC Draft)
set interfaces ethernet <interface> vif <vlan-id> ip source-validation <strict | loose |
disable>
Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.
• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation
set interfaces ethernet <interface> vif <vlan-id> ipv6 address autoconf
SLAAC RFC 4862. IPv6 hosts can configure themselves automatically when connected to an IPv6 network us-
ing the Neighbor Discovery Protocol via ICMPv6 router discovery messages. When first connected to a network,
a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to
such a request with a router advertisement packet that contains Internet Layer configuration parameters.

Note: This method automatically disables IPv6 traffic forwarding on the interface in question.

Example:

set interfaces ethernet eth0 vif 10 ipv6 address autoconf

set interfaces ethernet <interface> vif <vlan-id> ipv6 address eui64 <prefix>
EUI-64 as specified in RFC 4291 allows a host to assign iteslf a unique 64-Bit IPv6 address.
Example:

set interfaces ethernet eth0 vif 10 ipv6 address eui64 2001:db8:beef::/64

set interfaces ethernet <interface> vif <vlan-id> ipv6 address no-default-link-local

Do not assign a link-local IPv6 address to this interface.
Example:

set interfaces ethernet eth0 vif 10 ipv6 address no-default-link-local

set interfaces ethernet <interface> vif <vlan-id> ipv6 disable-forwarding

8.4. Interfaces 534

 VyOS Documentation, Release 1.5.x (circinus)

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
Example:

set interfaces ethernet eth0 vif 10 ipv6 disable-forwarding

set interfaces ethernet <interface> vif <vlan-id> ipv6 adjust-mss <mss |

clamp-mss-to-pmtu>
As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss6 <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces ethernet <interface> vif <vlan-id> ipv6 accept-dad <1-3>
Whether to accept DAD (Duplicate Address Detection).
• 0: Disable DAD
• 1: Enable DAD (default)
• 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate link-local address has been found.
Example:

set interfaces ethernet eth0 vif 10 ipv6 accept-dad 2

set interfaces ethernet <interface> vif <vlan-id> ipv6 dup-addr-detect-transmits <n>

The amount of Duplicate Address Detection probes to send.
Default: 1
Example:

set interfaces ethernet eth0 vif 10 ipv6 dup-addr-detect-transmits 5

set interfaces ethernet <interface> vif <vlan-id> vrf <vrf>

Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces ethernet eth0 vif 10 vrf red

DHCP(v6)
set interfaces ethernet <interface> vif <vlan-id> dhcp-options client-id <description>

8.4. Interfaces 535

 VyOS Documentation, Release 1.5.x (circinus)

RFC 2131 states: The client MAY choose to explicitly provide the identifier through the ‘client identifier’
option. If the client supplies a ‘client identifier’, the client MUST use the same ‘client identifier’ in all subsequent
messages, and the server MUST use that identifier to identify the client.
Example:

set interfaces ethernet eth0 vif 10 dhcp-options client-id 'foo-bar'

set interfaces ethernet <interface> vif <vlan-id> dhcp-options host-name <hostname>

Instead of sending the real system hostname to the DHCP server, overwrite the host-name with this given-value.
Example:

set interfaces ethernet eth0 vif 10 dhcp-options host-name 'VyOS'

set interfaces ethernet <interface> vif <vlan-id> dhcp-options vendor-class-id

<vendor-id>
This option is used by some DHCP clients to identify the vendor type and possibly the configuration of a DHCP
client. The information is a string of bytes whose contents are specific to the vendor and are not specified in a
standard.
The vendor-class-id option can be used to request a specific class of vendor options from the server.
Example:

set interfaces ethernet eth0 vif 10 dhcp-options vendor-class-id 'VyOS'

set interfaces ethernet <interface> vif <vlan-id> dhcp-options no-default-route

Only request an address from the DHCP server but do not request a default gateway.
Example:

set interfaces ethernet eth0 vif 10 dhcp-options no-default-route

set interfaces ethernet <interface> vif <vlan-id> dhcp-options default-route-distance

<distance>
Set the distance for the default gateway sent by the DHCP server.
Example:

set interfaces ethernet eth0 vif 10 dhcp-options default-route-distance 220

set interfaces ethernet <interface> vif <vlan-id> dhcp-options reject <address>

Reject DHCP leases from a given address or range. This is useful when a modem gives a local IP when first
starting.
• address can be specified multiple times, e.g. 192.168.100.1 and/or 192.168.100.0/24
Example:

set interfaces ethernet eth0 vif 10 dhcp-options reject 192.168.100.0/24

set interfaces ethernet <interface> vif <vlan-id> dhcp-options user-class <string>

This option is used by some DHCP clients as a way for users to specify identifying information to the client.
This can be used in a similar way to the vendor-class-identifier option, but the value of the option is specified
by the user, not the vendor.

8.4. Interfaces 536

 VyOS Documentation, Release 1.5.x (circinus)

Example:

set interfaces ethernet eth0 vif 10 dhcp-options user-class VyOS

set interfaces ethernet <interface> vif <vlan-id> dhcpv6-options duid <duid>

The DHCP unique identifier (DUID) is used by a client to get an IP address from a DHCPv6 server. It has a
2-byte DUID type field, and a variable-length identifier field up to 128 bytes. Its actual length depends on its
type. The server compares the DUID with its database and delivers configuration data (address, lease times,
DNS servers, etc.) to the client.

set interfaces ethernet eth0 vif 10 duid

˓→'0e:00:00:01:00:01:27:71:db:f0:00:50:56:bf:c5:6d'

set interfaces ethernet <interface> vif <vlan-id> dhcpv6-options no-release

When no-release is specified, dhcp6c will send a release message on client exit to prevent losing an assigned
address or prefix.

set interfaces ethernet eth0 vif 10 dhcpv6-options no-release

set interfaces ethernet <interface> vif <vlan-id> dhcpv6-options parameters-only

This statement specifies dhcp6c to only exchange informational configuration parameters with servers. A list of
DNS server addresses is an example of such parameters. This statement is useful when the client does not need
stateful configuration parameters such as IPv6 addresses or prefixes.

set interfaces ethernet eth0 vif 10 dhcpv6-options parameters-only

set interfaces ethernet <interface> vif <vlan-id> dhcpv6-options rapid-commit

When rapid-commit is specified, dhcp6c will include a rapid-commit option in solicit messages and wait for an
immediate reply instead of advertisements.

set interfaces ethernet eth0 vif 10 dhcpv6-options rapid-commit

set interfaces ethernet <interface> vif <vlan-id> dhcpv6-options temporary

Request only a temporary address and not form an IA_NA (Identity Association for Non-temporary Addresses)
partnership.

set interfaces ethernet eth0 vif 10 dhcpv6-options temporary

DHCPv6 Prefix Delegation (PD)

VyOS 1.3 (equuleus) supports DHCPv6-PD (RFC 3633). DHCPv6 Prefix Delegation is supported by most ISPs who
provide native IPv6 for consumers on fixed networks.
set interfaces ethernet <interface> vif <vlan-id> dhcpv6-options pd <id> length <length>
Some ISPs by default only delegate a /64 prefix. To request for a specific prefix size use this option to request
for a bigger delegation for this pd <id>. This value is in the range from 32 - 64 so you could request up to a /32
prefix (if your ISP allows this) down to a /64 delegation.
The default value corresponds to 64.
To request a /56 prefix from your ISP use:

set interfaces ethernet eth0 vif 10 dhcpv6-options pd 0 length 56

8.4. Interfaces 537

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces ethernet <interface> vif <vlan-id> dhcpv6-options pd <id> interface

<delegatee> address <address>
Specify the interface address used locally on the interface where the prefix has been delegated to. ID must be a
decimal integer.
It will be combined with the delegated prefix and the sla-id to form a complete interface address. The default is
to use the EUI-64 address of the interface.
Example: Delegate a /64 prefix to interface eth8 which will use a local address on this router of
<prefix>::ffff, as the address 65534 will correspond to ffff in hexadecimal notation.

set interfaces ethernet eth0 vif 10 dhcpv6-options pd 0 interface eth8 address 65534

set interfaces ethernet <interface> vif <vlan-id> dhcpv6-options pd <id> interface

<delegatee> sla-id <id>
Specify the identifier value of the site-level aggregator (SLA) on the interface. ID must be a decimal number
greater then 0 which fits in the length of SLA IDs (see below).
Example: If ID is 1 and the client is delegated an IPv6 prefix 2001:db8:ffff::/48, dhcp6c will combine the two
values into a single IPv6 prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified interface.

set interfaces ethernet eth0 vif 10 dhcpv6-options pd 0 interface eth8 sla-id 1

QinQ (802.1ad)

IEEE 802.1ad was an Ethernet networking standard informally known as QinQ as an amendment to IEEE standard
802.1q VLAN interfaces as described above. 802.1ad was incorporated into the base 802.1q standard in 2011. The
technique is also known as provider bridging, Stacked VLANs, or simply QinQ or Q-in-Q. “Q-in-Q” can for supported
devices apply to C-tag stacking on C-tag (Ethernet Type = 0x8100).
The original 802.1q specification allows a single Virtual Local Area Network (VLAN) header to be inserted into an
Ethernet frame. QinQ allows multiple VLAN tags to be inserted into a single frame, an essential capability for im-
plementing Metro Ethernet network topologies. Just as QinQ extends 802.1Q, QinQ itself is extended by other Metro
Ethernet protocols.
In a multiple VLAN header context, out of convenience the term “VLAN tag” or just “tag” for short is often used in
place of “802.1q VLAN header”. QinQ allows multiple VLAN tags in an Ethernet frame; together these tags constitute
a tag stack. When used in the context of an Ethernet frame, a QinQ frame is a frame that has 2 VLAN 802.1q headers
(double-tagged).
In VyOS the terms vif-s and vif-c stand for the ethertype tags that are used.
The inner tag is the tag which is closest to the payload portion of the frame. It is officially called C-TAG (customer tag,
with ethertype 0x8100). The outer tag is the one closer/closest to the Ethernet header, its name is S-TAG (service tag
with Ethernet Type = 0x88a8).
set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> address <address |
dhcp | dhcpv6>
Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
• dhcp interface address is received by DHCP from a DHCP server on this segment.
• dhcpv6 interface address is received by DHCPv6 from a DHCPv6 server on this segment.

8.4. Interfaces 538

 VyOS Documentation, Release 1.5.x (circinus)

Note: When using DHCP to retrieve IPv4 address and if local customizations are needed, they should be
possible using the enter and exit hooks provided. The hook dirs are:
• /config/scripts/dhcp-client/pre-hooks.d/
• /config/scripts/dhcp-client/post-hooks.d/

Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 address 192.0.2.1/24

set interfaces ethernet eth0 vif-s 1000 vif-c 20 address 2001:db8::1/64
set interfaces ethernet eth0 vif-s 1000 vif-c 20 address dhcp
set interfaces ethernet eth0 vif-s 1000 vif-c 20 address dhcpv6

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> description

<description>
Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 description 'This is an awesome␣
˓→interface running on VyOS'

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 disable

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> disable-link-detect

Use this command to direct an interface to not detect any physical state changes on a link, for example, when
the cable is unplugged.
Default is to detects physical link state changes.
Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 disable-link-detect

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> mac

<xx:xx:xx:xx:xx:xx>
Configure user defined MAC address on given <interface>.
Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 mac '00:53:01:02:03:04'

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> mtu <mtu>
Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

8.4. Interfaces 539

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces ethernet eth0 vif-s 1000 vif-c 20 mtu 1600

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip adjust-mss <mss |
clamp-mss-to-pmtu>
As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip arp-cache-timeout
Once a neighbor has been found, the entry is considered to be valid for at least for this specific time. An entry’s
validity will be extended if it receives positive feedback from higher level protocols.
This defaults to 30 seconds.
Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 ip arp-cache-timeout 180

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip disable-arp-filter

If set the kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but
it usually makes sense, because it increases the chance of successful communication. IP addresses are owned
by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing,
does this behaviour cause problems.
If not set (default) allows you to have multiple network interfaces on the same subnet, and have the ARPs for
each interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that
interface (therefore you must use source based routing for this to work).
In other words it allows control of which cards (usually 1) will respond to an arp request.
Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 ip disable-arp-filter

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

set interfaces ethernet eth0 vif-s 1000 vif-c 20 ip disable-forwarding

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip

enable-directed-broadcast
Define different modes for IP directed broadcast forwarding as described in RFC 1812 and RFC 2644.
If configured, incoming IP directed broadcast packets on this interface will be forwarded.

8.4. Interfaces 540

 VyOS Documentation, Release 1.5.x (circinus)

If this option is unset (default), incoming IP directed broadcast packets will not be forwarded.

set interfaces ethernet eth0 vif-s 1000 vif-c 20 ip enable-directed-broadcast

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip enable-arp-accept

Define behavior for gratuitous ARP frames whose IP is not already present in the ARP table. If configured
create new entries in the ARP table.
Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on.
If the ARP table already contains the IP address of the gratuitous arp frame, the arp table will be updated
regardless if this setting is on or off.

set interfaces ethernet eth0 vif-s 1000 vif-c 20 ip enable-arp-accept

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip

enable-arp-announce
Define different restriction levels for announcing the local source IP address from IP packets in ARP requests
sent on interface.
Use any local address, configured on any interface if this is not set.
If configured, try to avoid local addresses that are not in the target’s subnet for this interface. This mode is
useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of
their logical network configured on the receiving interface. When we generate the request we will check all our
subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no
such subnet we select source address according to the rules for level 2.

set interfaces ethernet eth0 vif-s 1000 vif-c 20 ip enable-arp-announce

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip enable-arp-ignore

Define different modes for sending replies in response to received ARP requests that resolve local target IP
addresses:
If configured, reply only if the target IP address is local address configured on the incoming interface.
If this option is unset (default), reply for any local target IP address, configured on any interface.

set interfaces ethernet eth0 vif-s 1000 vif-c 20 ip enable-arp-ignore

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip enable-proxy-arp

Use this command to enable proxy Address Resolution Protocol (ARP) on this interface. Proxy ARP allows
an Ethernet interface to respond with its own MAC address to ARP requests for destination IP addresses on
subnets attached to other interfaces on the system. Subsequent packets sent to those destination IP addresses
are forwarded appropriately by the system.
Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 ip enable-proxy-arp

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip proxy-arp-pvlan

Private VLAN proxy arp. Basically allow proxy arp replies back to the same interface (from which the ARP
request/solicitation was received).
This is done to support (ethernet) switch features, like RFC 3069, where the individual ports are NOT allowed
to communicate with each other, but they are allowed to talk to the upstream router. As described in RFC 3069,
it is possible to allow these hosts to communicate through the upstream router by proxy_arp’ing.

8.4. Interfaces 541

 VyOS Documentation, Release 1.5.x (circinus)

Note: Does not need to be used together with proxy_arp.

This technology is known by different names:

• In RFC 3069 it is called VLAN Aggregation
• Cisco and Allied Telesyn call it Private VLAN
• Hewlett-Packard call it Source-Port filtering or port-isolation
• Ericsson call it MAC-Forced Forwarding (RFC Draft)
set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip source-validation
<strict | loose | disable>
Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.
• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation
set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6 address autoconf
SLAAC RFC 4862. IPv6 hosts can configure themselves automatically when connected to an IPv6 network us-
ing the Neighbor Discovery Protocol via ICMPv6 router discovery messages. When first connected to a network,
a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to
such a request with a router advertisement packet that contains Internet Layer configuration parameters.

Note: This method automatically disables IPv6 traffic forwarding on the interface in question.

Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 ipv6 address autoconf

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6 address eui64
<prefix>
EUI-64 as specified in RFC 4291 allows a host to assign iteslf a unique 64-Bit IPv6 address.
Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 ipv6 address eui64 2001:db8:beef::/
˓→64

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6 address
no-default-link-local
Do not assign a link-local IPv6 address to this interface.
Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 ipv6 address no-default-link-local

8.4. Interfaces 542

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6

disable-forwarding
Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 ipv6 disable-forwarding

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6 adjust-mss <mss
| clamp-mss-to-pmtu>
As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss6 <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6 accept-dad <1-3>
Whether to accept DAD (Duplicate Address Detection).
• 0: Disable DAD
• 1: Enable DAD (default)
• 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate link-local address has been found.
Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 ipv6 accept-dad 2

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6

dup-addr-detect-transmits <n>
The amount of Duplicate Address Detection probes to send.
Default: 1
Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 ipv6 dup-addr-detect-transmits 5

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> vrf <vrf>
Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

8.4. Interfaces 543

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces ethernet eth0 vif-s 1000 vif-c 20 vrf red

DHCP(v6)
set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options
client-id <description>
RFC 2131 states: The client MAY choose to explicitly provide the identifier through the ‘client identifier’
option. If the client supplies a ‘client identifier’, the client MUST use the same ‘client identifier’ in all subsequent
messages, and the server MUST use that identifier to identify the client.
Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 dhcp-options client-id 'foo-bar'

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options

host-name <hostname>
Instead of sending the real system hostname to the DHCP server, overwrite the host-name with this given-value.
Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 dhcp-options host-name 'VyOS'

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options

vendor-class-id <vendor-id>
This option is used by some DHCP clients to identify the vendor type and possibly the configuration of a DHCP
client. The information is a string of bytes whose contents are specific to the vendor and are not specified in a
standard.
The vendor-class-id option can be used to request a specific class of vendor options from the server.
Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 dhcp-options vendor-class-id 'VyOS'

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options

no-default-route
Only request an address from the DHCP server but do not request a default gateway.
Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 dhcp-options no-default-route

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options

default-route-distance <distance>
Set the distance for the default gateway sent by the DHCP server.
Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 dhcp-options default-route-

˓→distance 220

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options reject
<address>
Reject DHCP leases from a given address or range. This is useful when a modem gives a local IP when first
starting.

8.4. Interfaces 544

 VyOS Documentation, Release 1.5.x (circinus)

• address can be specified multiple times, e.g. 192.168.100.1 and/or 192.168.100.0/24

Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 dhcp-options reject 192.168.100.0/
˓→24

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options

user-class <string>
This option is used by some DHCP clients as a way for users to specify identifying information to the client.
This can be used in a similar way to the vendor-class-identifier option, but the value of the option is specified
by the user, not the vendor.
Example:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 dhcp-options user-class VyOS

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcpv6-options duid
<duid>
The DHCP unique identifier (DUID) is used by a client to get an IP address from a DHCPv6 server. It has a
2-byte DUID type field, and a variable-length identifier field up to 128 bytes. Its actual length depends on its
type. The server compares the DUID with its database and delivers configuration data (address, lease times,
DNS servers, etc.) to the client.

set interfaces ethernet eth0 vif-s 1000 vif-c 20 duid

˓→'0e:00:00:01:00:01:27:71:db:f0:00:50:56:bf:c5:6d'

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcpv6-options

no-release
When no-release is specified, dhcp6c will send a release message on client exit to prevent losing an assigned
address or prefix.

set interfaces ethernet eth0 vif-s 1000 vif-c 20 dhcpv6-options no-release

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcpv6-options

parameters-only
This statement specifies dhcp6c to only exchange informational configuration parameters with servers. A list of
DNS server addresses is an example of such parameters. This statement is useful when the client does not need
stateful configuration parameters such as IPv6 addresses or prefixes.

set interfaces ethernet eth0 vif-s 1000 vif-c 20 dhcpv6-options parameters-only

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcpv6-options

rapid-commit
When rapid-commit is specified, dhcp6c will include a rapid-commit option in solicit messages and wait for an
immediate reply instead of advertisements.

set interfaces ethernet eth0 vif-s 1000 vif-c 20 dhcpv6-options rapid-commit

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcpv6-options

temporary
Request only a temporary address and not form an IA_NA (Identity Association for Non-temporary Addresses)
partnership.

8.4. Interfaces 545

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces ethernet eth0 vif-s 1000 vif-c 20 dhcpv6-options temporary

DHCPv6 Prefix Delegation (PD)

VyOS 1.3 (equuleus) supports DHCPv6-PD (RFC 3633). DHCPv6 Prefix Delegation is supported by most ISPs who
provide native IPv6 for consumers on fixed networks.
set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcpv6-options pd
<id> length <length>
Some ISPs by default only delegate a /64 prefix. To request for a specific prefix size use this option to request
for a bigger delegation for this pd <id>. This value is in the range from 32 - 64 so you could request up to a /32
prefix (if your ISP allows this) down to a /64 delegation.
The default value corresponds to 64.
To request a /56 prefix from your ISP use:

set interfaces ethernet eth0 vif-s 1000 vif-c 20 dhcpv6-options pd 0 length 56

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcpv6-options pd

<id> interface <delegatee> address <address>
Specify the interface address used locally on the interface where the prefix has been delegated to. ID must be a
decimal integer.
It will be combined with the delegated prefix and the sla-id to form a complete interface address. The default is
to use the EUI-64 address of the interface.
Example: Delegate a /64 prefix to interface eth8 which will use a local address on this router of
<prefix>::ffff, as the address 65534 will correspond to ffff in hexadecimal notation.

set interfaces ethernet eth0 vif-s 1000 vif-c 20 dhcpv6-options pd 0 interface eth8␣
˓→address 65534

set interfaces ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcpv6-options pd

<id> interface <delegatee> sla-id <id>
Specify the identifier value of the site-level aggregator (SLA) on the interface. ID must be a decimal number
greater then 0 which fits in the length of SLA IDs (see below).
Example: If ID is 1 and the client is delegated an IPv6 prefix 2001:db8:ffff::/48, dhcp6c will combine the two
values into a single IPv6 prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified interface.

set interfaces ethernet eth0 vif-s 1000 vif-c 20 dhcpv6-options pd 0 interface eth8␣
˓→sla-id 1

Port Mirror (SPAN)

SPAN port mirroring can copy the inbound/outbound traffic of the interface to the specified interface, usually the
interface can be connected to some special equipment, such as a behavior control system, intrusion detection system or
traffic collector, and can copy all related traffic from this port. The benefit of mirroring the traffic is that the application
is isolated from the source traffic and so application processing does not affect the traffic or the system performance.
VyOS uses the mirror option to configure port mirroring. The configuration is divided into 2 different directions.
Destination ports should be configured for different traffic directions.
set interfaces ethernet <interface> mirror ingress <monitor-interface>

8.4. Interfaces 546

 VyOS Documentation, Release 1.5.x (circinus)

Configure port mirroring for interface inbound traffic and copy the traffic to monitor-interface
Example: Mirror the inbound traffic of eth1 port to eth3

set interfaces ethernet eth1 mirror ingress eth3

set interfaces ethernet <interface> mirror egress <monitor-interface>

Configure port mirroring for interface outbound traffic and copy the traffic to monitor-interface
Example: Mirror the outbound traffic of eth1 port to eth3

set interfaces ethernet eth1 mirror egress eth3

Operation

show interfaces ethernet

Show brief interface information.

vyos@vyos:~$ show interfaces ethernet

Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
eth0 172.18.201.10/24 u/u LAN
eth1 172.18.202.11/24 u/u WAN
eth2 - u/D

show interfaces ethernet <interface>

Show detailed information on given <interface>

vyos@vyos:~$ show interfaces ethernet eth0

eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group␣
˓→default qlen 1000

link/ether 00:50:44:00:f5:c9 brd ff:ff:ff:ff:ff:ff

inet6 fe80::250:44ff:fe00:f5c9/64 scope link
valid_lft forever preferred_lft forever

RX: bytes packets errors dropped overrun mcast

56735451 179841 0 0 0 142380
TX: bytes packets errors dropped carrier collisions
5601460 62595 0 0 0 0

show interfaces ethernet <interface> physical

Show information about physical <interface>

vyos@vyos:~$ show interfaces ethernet eth0 physical

Settings for eth0:
Supported ports: [ TP ]
Supported link modes: 1000baseT/Full
10000baseT/Full
Supported pause frame use: No
Supports auto-negotiation: No
Supported FEC modes: Not reported
(continues on next page)

8.4. Interfaces 547

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Advertised link modes: Not reported
Advertised pause frame use: No
Advertised auto-negotiation: No
Advertised FEC modes: Not reported
Speed: 10000Mb/s
Duplex: Full
Port: Twisted Pair
PHYAD: 0
Transceiver: internal
Auto-negotiation: off
MDI-X: Unknown
Supports Wake-on: uag
Wake-on: d
Link detected: yes
driver: vmxnet3
version: 1.4.16.0-k-NAPI
firmware-version:
expansion-rom-version:
bus-info: 0000:0b:00.0
supports-statistics: yes
supports-test: no
supports-eeprom-access: no
supports-register-dump: yes
supports-priv-flags: no

show interfaces ethernet <interface> physical offload

Show available offloading functions on given <interface>
vyos@vyos:~$ show interfaces ethernet eth0 physical offload
rx-checksumming on
tx-checksumming on
tx-checksum-ip-generic on
scatter-gather off
tx-scatter-gather off
tcp-segmentation-offload off
tx-tcp-segmentation off
tx-tcp-mangleid-segmentation off
tx-tcp6-segmentation off
udp-fragmentation-offload off
generic-segmentation-offload off
generic-receive-offload off
large-receive-offload off
rx-vlan-offload on
tx-vlan-offload on
ntuple-filters off
receive-hashing on
tx-gre-segmentation on
tx-gre-csum-segmentation on
tx-udp_tnl-segmentation on
tx-udp_tnl-csum-segmentation on
tx-gso-partial on
tx-nocache-copy off
(continues on next page)

8.4. Interfaces 548

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

rx-all off

show interfaces ethernet <interface> transceiver

Show transceiver information from plugin modules, e.g SFP+, QSFP

vyos@vyos:~$ show interfaces ethernet eth5 transceiver

Identifier : 0x03 (SFP)
Extended identifier : 0x04 (GBIC/SFP defined by 2-wire interface ID)
Connector : 0x07 (LC)
Transceiver codes : 0x00 0x00 0x00 0x01 0x00 0x00 0x00 0x00 0x00
Transceiver type : Ethernet: 1000BASE-SX
Encoding : 0x01 (8B/10B)
BR, Nominal : 1300MBd
Rate identifier : 0x00 (unspecified)
Length (SMF,km) : 0km
Length (SMF) : 0m
Length (50um) : 550m
Length (62.5um) : 270m
Length (Copper) : 0m
Length (OM3) : 0m
Laser wavelength : 850nm
Vendor name : CISCO-FINISAR
Vendor OUI : 00:90:65
Vendor PN : FTRJ-8519-7D-CS4
Vendor rev : A
Option values : 0x00 0x1a
Option : RX_LOS implemented
Option : TX_FAULT implemented
Option : TX_DISABLE implemented
BR margin, max : 0%
BR margin, min : 0%
Vendor SN : FNS092xxxxx
Date code : 0506xx

8.4.5 GENEVE

GENEVE (Generic Network Virtualization Encapsulation) supports all of the capabilities of VXLAN (Virtual Ex-
tensible LAN), NVGRE (Network Virtualization using Generic Routing Encapsulation), and STT (Stateless Transport
Tunneling) and was designed to overcome their perceived limitations. Many believe GENEVE could eventually replace
these earlier formats entirely.
GENEVE is designed to support network virtualization use cases, where tunnels are typically established to act as a
backplane between the virtual switches residing in hypervisors, physical switches, or middleboxes or other appliances.
An arbitrary IP network can be used as an underlay through Clos networks - A technique for composing network
fabrics larger than a single switch while maintaining non-blocking bandwidth across connection points. ECMP is used
to divide traffic across the multiple links and switches that constitute the fabric. Sometimes termed “leaf and spine” or
“fat tree” topologies.
Geneve Header:
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Ver| Opt Len |O|C| Rsvd. | Protocol Type |
(continues on next page)

8.4. Interfaces 549

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Virtual Network Identifier (VNI) | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Variable Length Options |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Configuration

Common interface configuration

set interfaces geneve <interface> address <address>

Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
Example:

set interfaces geneve gnv0 address 192.0.2.1/24

set interfaces geneve gnv0 address 2001:db8::1/64

set interfaces geneve <interface> description <description>

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces geneve gnv0 description 'This is an awesome interface running on VyOS
˓→'

set interfaces geneve <interface> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces geneve gnv0 disable

set interfaces geneve <interface> mac <xx:xx:xx:xx:xx:xx>

Configure user defined MAC address on given <interface>.
Example:

set interfaces geneve gnv0 mac '00:53:01:02:03:04'

set interfaces geneve <interface> mtu <mtu>

Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

set interfaces geneve gnv0 mtu 1600

set interfaces geneve <interface> ip adjust-mss <mss | clamp-mss-to-pmtu>

8.4. Interfaces 550

 VyOS Documentation, Release 1.5.x (circinus)

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces geneve <interface> ip arp-cache-timeout
Once a neighbor has been found, the entry is considered to be valid for at least for this specific time. An entry’s
validity will be extended if it receives positive feedback from higher level protocols.
This defaults to 30 seconds.
Example:

set interfaces geneve gnv0 ip arp-cache-timeout 180

set interfaces geneve <interface> ip disable-arp-filter

If set the kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but
it usually makes sense, because it increases the chance of successful communication. IP addresses are owned
by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing,
does this behaviour cause problems.
If not set (default) allows you to have multiple network interfaces on the same subnet, and have the ARPs for
each interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that
interface (therefore you must use source based routing for this to work).
In other words it allows control of which cards (usually 1) will respond to an arp request.
Example:

set interfaces geneve gnv0 ip disable-arp-filter

set interfaces geneve <interface> ip disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

set interfaces geneve gnv0 ip disable-forwarding

set interfaces geneve <interface> ip enable-directed-broadcast

Define different modes for IP directed broadcast forwarding as described in RFC 1812 and RFC 2644.
If configured, incoming IP directed broadcast packets on this interface will be forwarded.
If this option is unset (default), incoming IP directed broadcast packets will not be forwarded.

set interfaces geneve gnv0 ip enable-directed-broadcast

set interfaces geneve <interface> ip enable-arp-accept

8.4. Interfaces 551

 VyOS Documentation, Release 1.5.x (circinus)

Define behavior for gratuitous ARP frames whose IP is not already present in the ARP table. If configured
create new entries in the ARP table.
Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on.
If the ARP table already contains the IP address of the gratuitous arp frame, the arp table will be updated
regardless if this setting is on or off.

set interfaces geneve gnv0 ip enable-arp-accept

set interfaces geneve <interface> ip enable-arp-announce

Define different restriction levels for announcing the local source IP address from IP packets in ARP requests
sent on interface.
Use any local address, configured on any interface if this is not set.
If configured, try to avoid local addresses that are not in the target’s subnet for this interface. This mode is
useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of
their logical network configured on the receiving interface. When we generate the request we will check all our
subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no
such subnet we select source address according to the rules for level 2.

set interfaces geneve gnv0 ip enable-arp-announce

set interfaces geneve <interface> ip enable-arp-ignore

Define different modes for sending replies in response to received ARP requests that resolve local target IP
addresses:
If configured, reply only if the target IP address is local address configured on the incoming interface.
If this option is unset (default), reply for any local target IP address, configured on any interface.

set interfaces geneve gnv0 ip enable-arp-ignore

set interfaces geneve <interface> ip enable-proxy-arp

Use this command to enable proxy Address Resolution Protocol (ARP) on this interface. Proxy ARP allows
an Ethernet interface to respond with its own MAC address to ARP requests for destination IP addresses on
subnets attached to other interfaces on the system. Subsequent packets sent to those destination IP addresses
are forwarded appropriately by the system.
Example:

set interfaces geneve gnv0 ip enable-proxy-arp

set interfaces geneve <interface> ip proxy-arp-pvlan

Private VLAN proxy arp. Basically allow proxy arp replies back to the same interface (from which the ARP
request/solicitation was received).
This is done to support (ethernet) switch features, like RFC 3069, where the individual ports are NOT allowed
to communicate with each other, but they are allowed to talk to the upstream router. As described in RFC 3069,
it is possible to allow these hosts to communicate through the upstream router by proxy_arp’ing.

Note: Does not need to be used together with proxy_arp.

This technology is known by different names:

8.4. Interfaces 552

 VyOS Documentation, Release 1.5.x (circinus)

• In RFC 3069 it is called VLAN Aggregation

• Cisco and Allied Telesyn call it Private VLAN
• Hewlett-Packard call it Source-Port filtering or port-isolation
• Ericsson call it MAC-Forced Forwarding (RFC Draft)
set interfaces geneve <interface> ip source-validation <strict | loose | disable>
Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.
• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation
set interfaces geneve <interface> ipv6 address autoconf
SLAAC RFC 4862. IPv6 hosts can configure themselves automatically when connected to an IPv6 network us-
ing the Neighbor Discovery Protocol via ICMPv6 router discovery messages. When first connected to a network,
a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to
such a request with a router advertisement packet that contains Internet Layer configuration parameters.

Note: This method automatically disables IPv6 traffic forwarding on the interface in question.

Example:

set interfaces geneve gnv0 ipv6 address autoconf

set interfaces geneve <interface> ipv6 address eui64 <prefix>

EUI-64 as specified in RFC 4291 allows a host to assign iteslf a unique 64-Bit IPv6 address.
Example:

set interfaces geneve gnv0 ipv6 address eui64 2001:db8:beef::/64

set interfaces geneve <interface> ipv6 address no-default-link-local

Do not assign a link-local IPv6 address to this interface.
Example:

set interfaces geneve gnv0 ipv6 address no-default-link-local

set interfaces geneve <interface> ipv6 disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
Example:

set interfaces geneve gnv0 ipv6 disable-forwarding

set interfaces geneve <interface> ipv6 adjust-mss <mss | clamp-mss-to-pmtu>

8.4. Interfaces 553

 VyOS Documentation, Release 1.5.x (circinus)

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss6 <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces geneve <interface> ipv6 accept-dad <1-3>
Whether to accept DAD (Duplicate Address Detection).
• 0: Disable DAD
• 1: Enable DAD (default)
• 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate link-local address has been found.
Example:

set interfaces geneve gnv0 ipv6 accept-dad 2

set interfaces geneve <interface> ipv6 dup-addr-detect-transmits <n>

The amount of Duplicate Address Detection probes to send.
Default: 1
Example:

set interfaces geneve gnv0 ipv6 dup-addr-detect-transmits 5

GENEVE options

set interfaces geneve gnv0 remote <address>

Configure GENEVE tunnel far end/remote tunnel endpoint.
set interfaces geneve gnv0 vni <vni>
VNI (Virtual Network Identifier) is an identifier for a unique element of a virtual network. In many situations
this may represent an L2 segment, however, the control plane defines the forwarding semantics of decapsulated
packets. The VNI MAY be used as part of ECMP forwarding decisions or MAY be used as a mechanism
to distinguish between overlapping address spaces contained in the encapsulated packet when load balancing
across CPUs.

8.4. Interfaces 554

 VyOS Documentation, Release 1.5.x (circinus)

8.4.6 L2TPv3

Layer 2 Tunnelling Protocol Version 3 is an IETF standard related to L2TP that can be used as an alternative protocol
to MPLS for encapsulation of multiprotocol Layer 2 communications traffic over IP networks. Like L2TP, L2TPv3
provides a pseudo-wire service but is scaled to fit carrier requirements.
L2TPv3 can be regarded as being to MPLS what IP is to ATM: a simplified version of the same concept, with much
of the same benefit achieved at a fraction of the effort, at the cost of losing some technical features considered less
important in the market.
In the case of L2TPv3, the features lost are teletraffic engineering features considered important in MPLS. However,
there is no reason these features could not be re-engineered in or on top of L2TPv3 in later products.
The protocol overhead of L2TPv3 is also significantly bigger than MPLS.
L2TPv3 is described in RFC 3931.

Configuration

Common interface configuration

set interfaces l2tpv3 <interface> address <address>

Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
Example:

set interfaces l2tpv3 l2tpeth0 address 192.0.2.1/24

set interfaces l2tpv3 l2tpeth0 address 2001:db8::1/64

set interfaces l2tpv3 <interface> description <description>

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces l2tpv3 l2tpeth0 description 'This is an awesome interface running on␣
˓→VyOS'

set interfaces l2tpv3 <interface> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces l2tpv3 l2tpeth0 disable

set interfaces l2tpv3 <interface> disable-flow-control

Ethernet flow control is a mechanism for temporarily stopping the transmission of data on Ethernet family com-
puter networks. The goal of this mechanism is to ensure zero packet loss in the presence of network congestion.
The first flow control mechanism, the pause frame, was defined by the IEEE 802.3x standard.
A sending station (computer or network switch) may be transmitting data faster than the other end of the link can
accept it. Using flow control, the receiving station can signal the sender requesting suspension of transmissions
until the receiver catches up.

8.4. Interfaces 555

 VyOS Documentation, Release 1.5.x (circinus)

Use this command to disable the generation of Ethernet flow control (pause frames).
Example:

set interfaces l2tpv3 l2tpeth0 disable-flow-control

set interfaces l2tpv3 <interface> disable-link-detect

Use this command to direct an interface to not detect any physical state changes on a link, for example, when
the cable is unplugged.
Default is to detects physical link state changes.
Example:

set interfaces l2tpv3 l2tpeth0 disable-link-detect

set interfaces l2tpv3 <interface> mac <xx:xx:xx:xx:xx:xx>

Configure user defined MAC address on given <interface>.
Example:

set interfaces l2tpv3 l2tpeth0 mac '00:53:01:02:03:04'

set interfaces l2tpv3 <interface> mtu <mtu>

Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

set interfaces l2tpv3 l2tpeth0 mtu 1600

set interfaces l2tpv3 <interface> ip adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces l2tpv3 <interface> ip arp-cache-timeout
Once a neighbor has been found, the entry is considered to be valid for at least for this specific time. An entry’s
validity will be extended if it receives positive feedback from higher level protocols.
This defaults to 30 seconds.
Example:

set interfaces l2tpv3 l2tpeth0 ip arp-cache-timeout 180

set interfaces l2tpv3 <interface> ip disable-arp-filter

8.4. Interfaces 556

 VyOS Documentation, Release 1.5.x (circinus)

If set the kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but
it usually makes sense, because it increases the chance of successful communication. IP addresses are owned
by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing,
does this behaviour cause problems.
If not set (default) allows you to have multiple network interfaces on the same subnet, and have the ARPs for
each interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that
interface (therefore you must use source based routing for this to work).
In other words it allows control of which cards (usually 1) will respond to an arp request.
Example:

set interfaces l2tpv3 l2tpeth0 ip disable-arp-filter

set interfaces l2tpv3 <interface> ip disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

set interfaces l2tpv3 l2tpeth0 ip disable-forwarding

set interfaces l2tpv3 <interface> ip enable-directed-broadcast

Define different modes for IP directed broadcast forwarding as described in RFC 1812 and RFC 2644.
If configured, incoming IP directed broadcast packets on this interface will be forwarded.
If this option is unset (default), incoming IP directed broadcast packets will not be forwarded.

set interfaces l2tpv3 l2tpeth0 ip enable-directed-broadcast

set interfaces l2tpv3 <interface> ip enable-arp-accept

Define behavior for gratuitous ARP frames whose IP is not already present in the ARP table. If configured
create new entries in the ARP table.
Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on.
If the ARP table already contains the IP address of the gratuitous arp frame, the arp table will be updated
regardless if this setting is on or off.

set interfaces l2tpv3 l2tpeth0 ip enable-arp-accept

set interfaces l2tpv3 <interface> ip enable-arp-announce

Define different restriction levels for announcing the local source IP address from IP packets in ARP requests
sent on interface.
Use any local address, configured on any interface if this is not set.
If configured, try to avoid local addresses that are not in the target’s subnet for this interface. This mode is
useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of
their logical network configured on the receiving interface. When we generate the request we will check all our
subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no
such subnet we select source address according to the rules for level 2.

set interfaces l2tpv3 l2tpeth0 ip enable-arp-announce

set interfaces l2tpv3 <interface> ip enable-arp-ignore

8.4. Interfaces 557

 VyOS Documentation, Release 1.5.x (circinus)

Define different modes for sending replies in response to received ARP requests that resolve local target IP
addresses:
If configured, reply only if the target IP address is local address configured on the incoming interface.
If this option is unset (default), reply for any local target IP address, configured on any interface.

set interfaces l2tpv3 l2tpeth0 ip enable-arp-ignore

set interfaces l2tpv3 <interface> ip enable-proxy-arp

Use this command to enable proxy Address Resolution Protocol (ARP) on this interface. Proxy ARP allows
an Ethernet interface to respond with its own MAC address to ARP requests for destination IP addresses on
subnets attached to other interfaces on the system. Subsequent packets sent to those destination IP addresses
are forwarded appropriately by the system.
Example:

set interfaces l2tpv3 l2tpeth0 ip enable-proxy-arp

set interfaces l2tpv3 <interface> ip proxy-arp-pvlan

Private VLAN proxy arp. Basically allow proxy arp replies back to the same interface (from which the ARP
request/solicitation was received).
This is done to support (ethernet) switch features, like RFC 3069, where the individual ports are NOT allowed
to communicate with each other, but they are allowed to talk to the upstream router. As described in RFC 3069,
it is possible to allow these hosts to communicate through the upstream router by proxy_arp’ing.

Note: Does not need to be used together with proxy_arp.

This technology is known by different names:

• In RFC 3069 it is called VLAN Aggregation
• Cisco and Allied Telesyn call it Private VLAN
• Hewlett-Packard call it Source-Port filtering or port-isolation
• Ericsson call it MAC-Forced Forwarding (RFC Draft)
set interfaces l2tpv3 <interface> ip source-validation <strict | loose | disable>
Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.
• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation
set interfaces l2tpv3 <interface> ipv6 address autoconf
SLAAC RFC 4862. IPv6 hosts can configure themselves automatically when connected to an IPv6 network us-
ing the Neighbor Discovery Protocol via ICMPv6 router discovery messages. When first connected to a network,
a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to
such a request with a router advertisement packet that contains Internet Layer configuration parameters.

8.4. Interfaces 558

 VyOS Documentation, Release 1.5.x (circinus)

Note: This method automatically disables IPv6 traffic forwarding on the interface in question.

Example:

set interfaces l2tpv3 l2tpeth0 ipv6 address autoconf

set interfaces l2tpv3 <interface> ipv6 address eui64 <prefix>

EUI-64 as specified in RFC 4291 allows a host to assign iteslf a unique 64-Bit IPv6 address.
Example:

set interfaces l2tpv3 l2tpeth0 ipv6 address eui64 2001:db8:beef::/64

set interfaces l2tpv3 <interface> ipv6 address no-default-link-local

Do not assign a link-local IPv6 address to this interface.
Example:

set interfaces l2tpv3 l2tpeth0 ipv6 address no-default-link-local

set interfaces l2tpv3 <interface> ipv6 disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
Example:

set interfaces l2tpv3 l2tpeth0 ipv6 disable-forwarding

set interfaces l2tpv3 <interface> ipv6 adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss6 <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces l2tpv3 <interface> ipv6 accept-dad <1-3>
Whether to accept DAD (Duplicate Address Detection).
• 0: Disable DAD
• 1: Enable DAD (default)
• 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate link-local address has been found.
Example:

8.4. Interfaces 559

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces l2tpv3 l2tpeth0 ipv6 accept-dad 2

set interfaces l2tpv3 <interface> ipv6 dup-addr-detect-transmits <n>

The amount of Duplicate Address Detection probes to send.
Default: 1
Example:

set interfaces l2tpv3 l2tpeth0 ipv6 dup-addr-detect-transmits 5

set interfaces l2tpv3 <interface> vrf <vrf>

Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces l2tpv3 l2tpeth0 vrf red

L2TPv3 options

set interfaces l2tpv3 <interface> encapsulation <udp | ip>

Set the encapsulation type of the tunnel. Valid values for encapsulation are: udp, ip.
This defaults to UDP
set interfaces l2tpv3 <interface> source-address <address>
Set the IP address of the local interface to be used for the tunnel.
This address must be the address of a local interface. It may be specified as an IPv4 address or an IPv6 address.
set interfaces l2tpv3 <interface> remote <address>
Set the IP address of the remote peer. It may be specified as an IPv4 address or an IPv6 address.
set interfaces l2tpv3 <interface> session-id <id>
Set the session id, which is a 32-bit integer value. Uniquely identifies the session being created. The value used
must match the peer_session_id value being used at the peer.
set interfaces l2tpv3 <interface> peer-session-id <id>
Set the peer-session-id, which is a 32-bit integer value assigned to the session by the peer. The value used must
match the session_id value being used at the peer.
set interfaces l2tpv3 <interface> tunnel-id <id>
Set the tunnel id, which is a 32-bit integer value. Uniquely identifies the tunnel into which the session will be
created.
set interfaces l2tpv3 <interface> peer-tunnel-id <id>
Set the tunnel id, which is a 32-bit integer value. Uniquely identifies the tunnel into which the session will be
created.

8.4. Interfaces 560

 VyOS Documentation, Release 1.5.x (circinus)

Example

Over IP

# show interfaces l2tpv3

l2tpv3 l2tpeth10 {
address 192.168.37.1/27
encapsulation ip
source-address 192.0.2.1
peer-session-id 100
peer-tunnel-id 200
remote 203.0.113.24
session-id 100
tunnel-id 200
}

The inverse configuration has to be applied to the remote side.

Over UDP

UDP mode works better with NAT:

• Set source-address to your local IP (LAN).
• Add a forwarding rule matching UDP port on your internet router.

# show interfaces l2tpv3

l2tpv3 l2tpeth10 {
address 192.168.37.1/27
destination-port 9001
encapsulation udp
source-address 192.0.2.1
peer-session-id 100
peer-tunnel-id 200
remote 203.0.113.24
session-id 100
source-port 9000
tunnel-id 200
}

To create more than one tunnel, use distinct UDP ports.

Over IPSec, L2 VPN (bridge)

This is the LAN extension use case. The eth0 port of the distant VPN peers will be directly connected like if there was
a switch between them.
IPSec:

set vpn ipsec authentication psk <pre-shared-name> id '%any'

set vpn ipsec authentication psk <pre-shared-name> secret <pre-shared-key>
set vpn ipsec interface <VPN-interface>
(continues on next page)

8.4. Interfaces 561

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set vpn ipsec esp-group test-ESP-1 lifetime '3600'
set vpn ipsec esp-group test-ESP-1 mode 'transport'
set vpn ipsec esp-group test-ESP-1 pfs 'enable'
set vpn ipsec esp-group test-ESP-1 proposal 1 encryption 'aes128'
set vpn ipsec esp-group test-ESP-1 proposal 1 hash 'sha1'
set vpn ipsec ike-group test-IKE-1 key-exchange 'ikev1'
set vpn ipsec ike-group test-IKE-1 lifetime '3600'
set vpn ipsec ike-group test-IKE-1 proposal 1 dh-group '5'
set vpn ipsec ike-group test-IKE-1 proposal 1 encryption 'aes128'
set vpn ipsec ike-group test-IKE-1 proposal 1 hash 'sha1'
set vpn ipsec site-to-site peer <connection-name> authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer <connection-name> connection-type 'initiate'
set vpn ipsec site-to-site peer <connection-name> ike-group 'test-IKE-1'
set vpn ipsec site-to-site peer <connection-name> ikev2-reauth 'inherit'
set vpn ipsec site-to-site peer <connection-name> local-address <local-ip>
set vpn ipsec site-to-site peer <connection-name> tunnel 1 esp-group 'test-ESP-1'
set vpn ipsec site-to-site peer <connection-name> tunnel 1 protocol 'l2tp'

Bridge:

set interfaces bridge br0 description 'L2 VPN Bridge'

# remote side in this example:
# set interfaces bridge br0 address '172.16.30.18/30'
set interfaces bridge br0 address '172.16.30.17/30'
set interfaces bridge br0 member interface eth0
set interfaces ethernet eth0 description 'L2 VPN Physical port'

L2TPv3:

set interfaces bridge br0 member interface 'l2tpeth0'

set interfaces l2tpv3 l2tpeth0 description 'L2 VPN Tunnel'
set interfaces l2tpv3 l2tpeth0 destination-port '5000'
set interfaces l2tpv3 l2tpeth0 encapsulation 'ip'
set interfaces l2tpv3 l2tpeth0 source-address <local-ip>
set interfaces l2tpv3 l2tpeth0 mtu '1500'
set interfaces l2tpv3 l2tpeth0 peer-session-id '110'
set interfaces l2tpv3 l2tpeth0 peer-tunnel-id '10'
set interfaces l2tpv3 l2tpeth0 remote <peer-ip>
set interfaces l2tpv3 l2tpeth0 session-id '110'
set interfaces l2tpv3 l2tpeth0 source-port '5000'
set interfaces l2tpv3 l2tpeth0 tunnel-id '10'

8.4.7 Loopback

The loopback networking interface is a virtual network device implemented entirely in software. All traffic sent to it
“loops back” and just targets services on your local machine.

Note: There can only be one loopback lo interface on the system. If you need multiple interfaces, please use the
Dummy interface type.

8.4. Interfaces 562

 VyOS Documentation, Release 1.5.x (circinus)

Hint: A loopback interface is always up, thus it could be used for management traffic or as source/destination for
and IGP (Interior Gateway Protocol) like BGP so your internal BGP link is not dependent on physical link states and
multiple routes can be chosen to the destination. A Dummy Interface should always be preferred over a Loopback
interface.

Configuration

Common interface configuration

set interfaces loopback <interface> address <address>

Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
Example:

set interfaces loopback lo address 192.0.2.1/24

set interfaces loopback lo address 2001:db8::1/64

set interfaces loopback <interface> description <description>

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces loopback lo description 'This is an awesome interface running on VyOS

˓→'

Operation

show interfaces loopback

Show brief interface information.

vyos@vyos:~$ show interfaces loopback

Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
lo 127.0.0.1/8 u/u
::1/128

show interfaces loopback lo

Show detailed information on the given loopback interface lo.

vyos@vyos:~$ show interfaces loopback lo

lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen␣
˓→1000

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

inet 127.0.0.1/8 scope host lo
(continues on next page)

8.4. Interfaces 563

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever

RX: bytes packets errors dropped overrun mcast

300 6 0 0 0 0
TX: bytes packets errors dropped carrier collisions
300 6 0 0 0 0

8.4.8 MACsec

MACsec is an IEEE standard (IEEE 802.1AE) for MAC security, introduced in 2006. It defines a way to establish a
protocol independent connection between two hosts with data confidentiality, authenticity and/or integrity, using GCM-
AES-128. MACsec operates on the Ethernet layer and as such is a layer 2 protocol, which means it’s designed to secure
traffic within a layer 2 network, including DHCP or ARP requests. It does not compete with other security solutions
such as IPsec (layer 3) or TLS (layer 4), as all those solutions are used for their own specific use cases.

Configuration

Common interface configuration

set interfaces macsec <interface> address <address | dhcp | dhcpv6>

Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
• dhcp interface address is received by DHCP from a DHCP server on this segment.
• dhcpv6 interface address is received by DHCPv6 from a DHCPv6 server on this segment.

Note: When using DHCP to retrieve IPv4 address and if local customizations are needed, they should be
possible using the enter and exit hooks provided. The hook dirs are:
• /config/scripts/dhcp-client/pre-hooks.d/
• /config/scripts/dhcp-client/post-hooks.d/

Example:

set interfaces macsec macsec0 address 192.0.2.1/24

set interfaces macsec macsec0 address 2001:db8::1/64
set interfaces macsec macsec0 address dhcp
set interfaces macsec macsec0 address dhcpv6

set interfaces macsec <interface> description <description>

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

8.4. Interfaces 564

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces macsec macsec0 description 'This is an awesome interface running on␣
˓→VyOS'

set interfaces macsec <interface> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces macsec macsec0 disable

set interfaces macsec <interface> disable-flow-control

Ethernet flow control is a mechanism for temporarily stopping the transmission of data on Ethernet family com-
puter networks. The goal of this mechanism is to ensure zero packet loss in the presence of network congestion.
The first flow control mechanism, the pause frame, was defined by the IEEE 802.3x standard.
A sending station (computer or network switch) may be transmitting data faster than the other end of the link can
accept it. Using flow control, the receiving station can signal the sender requesting suspension of transmissions
until the receiver catches up.
Use this command to disable the generation of Ethernet flow control (pause frames).
Example:

set interfaces macsec macsec0 disable-flow-control

set interfaces macsec <interface> disable-link-detect

Use this command to direct an interface to not detect any physical state changes on a link, for example, when
the cable is unplugged.
Default is to detects physical link state changes.
Example:

set interfaces macsec macsec0 disable-link-detect

set interfaces macsec <interface> mac <xx:xx:xx:xx:xx:xx>

Configure user defined MAC address on given <interface>.
Example:

set interfaces macsec macsec0 mac '00:53:01:02:03:04'

set interfaces macsec <interface> mtu <mtu>

Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

set interfaces macsec macsec0 mtu 1600

set interfaces macsec <interface> ip adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

8.4. Interfaces 565

 VyOS Documentation, Release 1.5.x (circinus)

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces macsec <interface> ip arp-cache-timeout
Once a neighbor has been found, the entry is considered to be valid for at least for this specific time. An entry’s
validity will be extended if it receives positive feedback from higher level protocols.
This defaults to 30 seconds.
Example:

set interfaces macsec macsec0 ip arp-cache-timeout 180

set interfaces macsec <interface> ip disable-arp-filter

If set the kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but
it usually makes sense, because it increases the chance of successful communication. IP addresses are owned
by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing,
does this behaviour cause problems.
If not set (default) allows you to have multiple network interfaces on the same subnet, and have the ARPs for
each interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that
interface (therefore you must use source based routing for this to work).
In other words it allows control of which cards (usually 1) will respond to an arp request.
Example:

set interfaces macsec macsec0 ip disable-arp-filter

set interfaces macsec <interface> ip disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

set interfaces macsec macsec0 ip disable-forwarding

set interfaces macsec <interface> ip enable-directed-broadcast

Define different modes for IP directed broadcast forwarding as described in RFC 1812 and RFC 2644.
If configured, incoming IP directed broadcast packets on this interface will be forwarded.
If this option is unset (default), incoming IP directed broadcast packets will not be forwarded.

set interfaces macsec macsec0 ip enable-directed-broadcast

set interfaces macsec <interface> ip enable-arp-accept

Define behavior for gratuitous ARP frames whose IP is not already present in the ARP table. If configured
create new entries in the ARP table.
Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on.

8.4. Interfaces 566

 VyOS Documentation, Release 1.5.x (circinus)

If the ARP table already contains the IP address of the gratuitous arp frame, the arp table will be updated
regardless if this setting is on or off.

set interfaces macsec macsec0 ip enable-arp-accept

set interfaces macsec <interface> ip enable-arp-announce

Define different restriction levels for announcing the local source IP address from IP packets in ARP requests
sent on interface.
Use any local address, configured on any interface if this is not set.
If configured, try to avoid local addresses that are not in the target’s subnet for this interface. This mode is
useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of
their logical network configured on the receiving interface. When we generate the request we will check all our
subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no
such subnet we select source address according to the rules for level 2.

set interfaces macsec macsec0 ip enable-arp-announce

set interfaces macsec <interface> ip enable-arp-ignore

Define different modes for sending replies in response to received ARP requests that resolve local target IP
addresses:
If configured, reply only if the target IP address is local address configured on the incoming interface.
If this option is unset (default), reply for any local target IP address, configured on any interface.

set interfaces macsec macsec0 ip enable-arp-ignore

set interfaces macsec <interface> ip enable-proxy-arp

Use this command to enable proxy Address Resolution Protocol (ARP) on this interface. Proxy ARP allows
an Ethernet interface to respond with its own MAC address to ARP requests for destination IP addresses on
subnets attached to other interfaces on the system. Subsequent packets sent to those destination IP addresses
are forwarded appropriately by the system.
Example:

set interfaces macsec macsec0 ip enable-proxy-arp

set interfaces macsec <interface> ip proxy-arp-pvlan

Private VLAN proxy arp. Basically allow proxy arp replies back to the same interface (from which the ARP
request/solicitation was received).
This is done to support (ethernet) switch features, like RFC 3069, where the individual ports are NOT allowed
to communicate with each other, but they are allowed to talk to the upstream router. As described in RFC 3069,
it is possible to allow these hosts to communicate through the upstream router by proxy_arp’ing.

Note: Does not need to be used together with proxy_arp.

This technology is known by different names:

• In RFC 3069 it is called VLAN Aggregation
• Cisco and Allied Telesyn call it Private VLAN
• Hewlett-Packard call it Source-Port filtering or port-isolation

8.4. Interfaces 567

 VyOS Documentation, Release 1.5.x (circinus)

• Ericsson call it MAC-Forced Forwarding (RFC Draft)

set interfaces macsec <interface> ip source-validation <strict | loose | disable>
Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.
• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation
set interfaces macsec <interface> ipv6 address autoconf
SLAAC RFC 4862. IPv6 hosts can configure themselves automatically when connected to an IPv6 network us-
ing the Neighbor Discovery Protocol via ICMPv6 router discovery messages. When first connected to a network,
a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to
such a request with a router advertisement packet that contains Internet Layer configuration parameters.

Note: This method automatically disables IPv6 traffic forwarding on the interface in question.

Example:

set interfaces macsec macsec0 ipv6 address autoconf

set interfaces macsec <interface> ipv6 address eui64 <prefix>

EUI-64 as specified in RFC 4291 allows a host to assign iteslf a unique 64-Bit IPv6 address.
Example:

set interfaces macsec macsec0 ipv6 address eui64 2001:db8:beef::/64

set interfaces macsec <interface> ipv6 address no-default-link-local

Do not assign a link-local IPv6 address to this interface.
Example:

set interfaces macsec macsec0 ipv6 address no-default-link-local

set interfaces macsec <interface> ipv6 disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
Example:

set interfaces macsec macsec0 ipv6 disable-forwarding

set interfaces macsec <interface> ipv6 adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

8.4. Interfaces 568

 VyOS Documentation, Release 1.5.x (circinus)

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss6 <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces macsec <interface> ipv6 accept-dad <1-3>
Whether to accept DAD (Duplicate Address Detection).
• 0: Disable DAD
• 1: Enable DAD (default)
• 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate link-local address has been found.
Example:

set interfaces macsec macsec0 ipv6 accept-dad 2

set interfaces macsec <interface> ipv6 dup-addr-detect-transmits <n>

The amount of Duplicate Address Detection probes to send.
Default: 1
Example:

set interfaces macsec macsec0 ipv6 dup-addr-detect-transmits 5

set interfaces macsec <interface> vrf <vrf>

Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces macsec macsec0 vrf red

DHCP(v6)
set interfaces macsec <interface> dhcp-options client-id <description>
RFC 2131 states: The client MAY choose to explicitly provide the identifier through the ‘client identifier’
option. If the client supplies a ‘client identifier’, the client MUST use the same ‘client identifier’ in all subsequent
messages, and the server MUST use that identifier to identify the client.
Example:

set interfaces macsec macsec0 dhcp-options client-id 'foo-bar'

set interfaces macsec <interface> dhcp-options host-name <hostname>

Instead of sending the real system hostname to the DHCP server, overwrite the host-name with this given-value.
Example:

8.4. Interfaces 569

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces macsec macsec0 dhcp-options host-name 'VyOS'

set interfaces macsec <interface> dhcp-options vendor-class-id <vendor-id>

This option is used by some DHCP clients to identify the vendor type and possibly the configuration of a DHCP
client. The information is a string of bytes whose contents are specific to the vendor and are not specified in a
standard.
The vendor-class-id option can be used to request a specific class of vendor options from the server.
Example:

set interfaces macsec macsec0 dhcp-options vendor-class-id 'VyOS'

set interfaces macsec <interface> dhcp-options no-default-route

Only request an address from the DHCP server but do not request a default gateway.
Example:

set interfaces macsec macsec0 dhcp-options no-default-route

set interfaces macsec <interface> dhcp-options default-route-distance <distance>

Set the distance for the default gateway sent by the DHCP server.
Example:

set interfaces macsec macsec0 dhcp-options default-route-distance 220

set interfaces macsec <interface> dhcp-options reject <address>

Reject DHCP leases from a given address or range. This is useful when a modem gives a local IP when first
starting.
• address can be specified multiple times, e.g. 192.168.100.1 and/or 192.168.100.0/24
Example:

set interfaces macsec macsec0 dhcp-options reject 192.168.100.0/24

set interfaces macsec <interface> dhcp-options user-class <string>

This option is used by some DHCP clients as a way for users to specify identifying information to the client.
This can be used in a similar way to the vendor-class-identifier option, but the value of the option is specified
by the user, not the vendor.
Example:

set interfaces macsec macsec0 dhcp-options user-class VyOS

set interfaces macsec <interface> dhcpv6-options duid <duid>

The DHCP unique identifier (DUID) is used by a client to get an IP address from a DHCPv6 server. It has a
2-byte DUID type field, and a variable-length identifier field up to 128 bytes. Its actual length depends on its
type. The server compares the DUID with its database and delivers configuration data (address, lease times,
DNS servers, etc.) to the client.

set interfaces macsec macsec0 duid '0e:00:00:01:00:01:27:71:db:f0:00:50:56:bf:c5:6d'

set interfaces macsec <interface> dhcpv6-options no-release

8.4. Interfaces 570

 VyOS Documentation, Release 1.5.x (circinus)

When no-release is specified, dhcp6c will send a release message on client exit to prevent losing an assigned
address or prefix.

set interfaces macsec macsec0 dhcpv6-options no-release

set interfaces macsec <interface> dhcpv6-options parameters-only

This statement specifies dhcp6c to only exchange informational configuration parameters with servers. A list of
DNS server addresses is an example of such parameters. This statement is useful when the client does not need
stateful configuration parameters such as IPv6 addresses or prefixes.

set interfaces macsec macsec0 dhcpv6-options parameters-only

set interfaces macsec <interface> dhcpv6-options rapid-commit

When rapid-commit is specified, dhcp6c will include a rapid-commit option in solicit messages and wait for an
immediate reply instead of advertisements.

set interfaces macsec macsec0 dhcpv6-options rapid-commit

set interfaces macsec <interface> dhcpv6-options temporary

Request only a temporary address and not form an IA_NA (Identity Association for Non-temporary Addresses)
partnership.

set interfaces macsec macsec0 dhcpv6-options temporary

DHCPv6 Prefix Delegation (PD)

VyOS 1.3 (equuleus) supports DHCPv6-PD (RFC 3633). DHCPv6 Prefix Delegation is supported by most ISPs who
provide native IPv6 for consumers on fixed networks.
set interfaces macsec <interface> dhcpv6-options pd <id> length <length>
Some ISPs by default only delegate a /64 prefix. To request for a specific prefix size use this option to request
for a bigger delegation for this pd <id>. This value is in the range from 32 - 64 so you could request up to a /32
prefix (if your ISP allows this) down to a /64 delegation.
The default value corresponds to 64.
To request a /56 prefix from your ISP use:

set interfaces macsec macsec0 dhcpv6-options pd 0 length 56

set interfaces macsec <interface> dhcpv6-options pd <id> interface <delegatee> address

<address>
Specify the interface address used locally on the interface where the prefix has been delegated to. ID must be a
decimal integer.
It will be combined with the delegated prefix and the sla-id to form a complete interface address. The default is
to use the EUI-64 address of the interface.
Example: Delegate a /64 prefix to interface eth8 which will use a local address on this router of
<prefix>::ffff, as the address 65534 will correspond to ffff in hexadecimal notation.

set interfaces macsec macsec0 dhcpv6-options pd 0 interface eth8 address 65534

set interfaces macsec <interface> dhcpv6-options pd <id> interface <delegatee> sla-id

<id>

8.4. Interfaces 571

 VyOS Documentation, Release 1.5.x (circinus)

Specify the identifier value of the site-level aggregator (SLA) on the interface. ID must be a decimal number
greater then 0 which fits in the length of SLA IDs (see below).
Example: If ID is 1 and the client is delegated an IPv6 prefix 2001:db8:ffff::/48, dhcp6c will combine the two
values into a single IPv6 prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified interface.

set interfaces macsec macsec0 dhcpv6-options pd 0 interface eth8 sla-id 1

MACsec options

set interfaces macsec <interface> security cipher <gcm-aes-128|gcm-aes-256>

Select cipher suite used for cryptographic operations. This setting is mandatory.
set interfaces macsec <interface> security encrypt
MACsec only provides authentication by default, encryption is optional. This command will enable encryption
for all outgoing packets.
set interfaces macsec <interface> source-interface <physical-source>
A physical interface is required to connect this MACsec instance to. Traffic leaving this interface will now be
authenticated/encrypted.

Static Keys

Static SAK (Secure Authentication Key) mode can be configured manually on each device wishing to use MACsec.
Keys must be set statically on all devices for traffic to flow properly. Key rotation is dependent on the administrator
updating all keys manually across connected devices. Static SAK mode can not be used with MKA.
set interfaces macsec <interface> security static key <key>
Set the device’s transmit (TX) key. This key must be a hex string that is 16-bytes (GCM-AES-128) or 32-bytes
(GCM-AES-256).
set interfaces macsec <interface> security static peer <peer> mac <mac address>
Set the peer’s MAC address
set interfaces macsec <interface> security static peer <peer> key <key>
Set the peer’s key used to receive (RX) traffic
set interfaces macsec <interface> security static peer <peer> disable
Disable the peer configuration

Key Management

MKA (MACsec Key Agreement protocol) is used to synchronize keys between individual peers.
set interfaces macsec <interface> security mka cak <key>
IEEE 802.1X/MACsec pre-shared key mode. This allows configuring MACsec with a pre-shared key using a
CAK (MACsec connectivity association key) and CKN (MACsec connectivity association name) pair.
set interfaces macsec <interface> security mka ckn <key>
CKN key

8.4. Interfaces 572

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces macsec <interface> security mka priority <priority>

The peer with lower priority will become the key server and start distributing SAKs.

Replay protection

set interfaces macsec <interface> security replay-window <window>

IEEE 802.1X/MACsec replay protection window. This determines a window in which replay is tolerated, to
allow receipt of frames that have been misordered by the network.
• 0: No replay window, strict check
• 1-4294967295: Number of packets that could be misordered

Operation

run generate macsec mka cak <gcm-aes-128|gcm-aes-256>

Generate MKA CAK key 128 or 256 bits.

vyos@vyos:~$ generate macsec mka cak gcm-aes-128

20693b6e08bfa482703a563898c9e3ad

run generate macsec mka ckn

Generate MKA CAK key.

vyos@vyos:~$ generate macsec mka ckn

88737efef314ee319b2cbf30210a5f164957d884672c143aefdc0f5f6bc49eb2

show interfaces macsec

List all MACsec interfaces.

vyos@vyos:~$ show interfaces macsec

17: macsec1: protect on validate strict sc off sa off encrypt on send_sci on end_
˓→station off scb off replay off

cipher suite: GCM-AES-128, using ICV length 16

TXSC: 005056bfefaa0001 on SA 0
20: macsec0: protect on validate strict sc off sa off encrypt off send_sci on end_
˓→station off scb off replay off

cipher suite: GCM-AES-128, using ICV length 16

TXSC: 005056bfefaa0001 on SA 0

show interfaces macsec <interface>

Show specific MACsec interface information

vyos@vyos:~$ show interfaces macsec macsec1

17: macsec1: protect on validate strict sc off sa off encrypt on send_sci on end_
˓→station off scb off replay off

cipher suite: GCM-AES-128, using ICV length 16

TXSC: 005056bfefaa0001 on SA 0

8.4. Interfaces 573

 VyOS Documentation, Release 1.5.x (circinus)

Examples

• Two routers connected both via eth1 through an untrusted switch

• R1 has 192.0.2.1/24 & 2001:db8::1/64
• R2 has 192.0.2.2/24 & 2001:db8::2/64
R1

set interfaces macsec macsec1 address '192.0.2.1/24'

set interfaces macsec macsec1 address '2001:db8::1/64'
set interfaces macsec macsec1 security cipher 'gcm-aes-128'
set interfaces macsec macsec1 security encrypt
set interfaces macsec macsec1 security mka cak '232e44b7fda6f8e2d88a07bf78a7aff4'
set interfaces macsec macsec1 security mka ckn
˓→'40916f4b23e3d548ad27eedd2d10c6f98c2d21684699647d63d41b500dfe8836'

set interfaces macsec macsec1 source-interface 'eth1'

R2

set interfaces macsec macsec1 address '192.0.2.2/24'

set interfaces macsec macsec1 address '2001:db8::2/64'
set interfaces macsec macsec1 security cipher 'gcm-aes-128'
set interfaces macsec macsec1 security encrypt
set interfaces macsec macsec1 security mka cak '232e44b7fda6f8e2d88a07bf78a7aff4'
set interfaces macsec macsec1 security mka ckn
˓→'40916f4b23e3d548ad27eedd2d10c6f98c2d21684699647d63d41b500dfe8836'

set interfaces macsec macsec1 source-interface 'eth1'

Pinging (IPv6) the other host and intercepting the traffic in eth1 will show you the content is encrypted.

17:35:44.586668 00:50:56:bf:ef:aa > 00:50:56:b3:ad:d6, ethertype Unknown (0x88e5),␣

˓→length 150:

0x0000: 2c00 0000 000a 0050 56bf efaa 0001 d9fb ,......PV.......
0x0010: 920a 8b8d 68ed 9609 29dd e767 25a4 4466 ....h...)..g%.Df
0x0020: 5293 487b 9990 8517 3b15 22c7 ea5c ac83 R.H{....;."..\..
0x0030: 4c6e 13cf 0743 f917 2c4e 694e 87d1 0f09 Ln...C..,NiN....
0x0040: 0f77 5d53 ed75 cfe1 54df 0e5a c766 93cb .w]S.u..T..Z.f..
0x0050: c4f2 6e23 f200 6dfe 3216 c858 dcaa a73b ..n#..m.2..X...;
0x0060: 4dd1 9358 d9e4 ed0e 072f 1acc 31c4 f669 M..X...../..1..i
0x0070: e93a 9f38 8a62 17c6 2857 6ac5 ec11 8b0e .:.8.b..(Wj.....
0x0080: 6b30 92a5 7ccc 720b k0..|.r.

Disabling the encryption on the link by removing security encrypt will show the unencrypted but authenticated
content.

17:37:00.746155 00:50:56:bf:ef:aa > 00:50:56:b3:ad:d6, ethertype Unknown (0x88e5),␣

˓→length 150:

0x0000: 2000 0000 0009 0050 56bf efaa 0001 86dd .......PV.......
0x0010: 6009 86f3 0040 3a40 2001 0db8 0000 0000 `....@:@........
0x0020: 0000 0000 0000 0001 2001 0db8 0000 0000 ................
0x0030: 0000 0000 0000 0002 8100 d977 0f30 0003 ...........w.0..
0x0040: 1ca0 c65e 0000 0000 8d93 0b00 0000 0000 ...^............
0x0050: 1011 1213 1415 1617 1819 1a1b 1c1d 1e1f ................
(continues on next page)

8.4. Interfaces 574

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

0x0060: 2021 2223 2425 2627 2829 2a2b 2c2d 2e2f .!"#$%&'()*+,-./
0x0070: 3031 3233 3435 3637 87d5 eed3 3a39 d52b 01234567....:9.+
0x0080: a282 c842 5254 ef28 ...BRT.(

R1 Static Key

set interfaces macsec macsec1 address '192.0.2.1/24'

set interfaces macsec macsec1 address '2001:db8::1/64'
set interfaces macsec macsec1 security cipher 'gcm-aes-128'
set interfaces macsec macsec1 security encrypt
set interfaces macsec macsec1 security static key 'ddd6f4a7be4d8bbaf88b26f10e1c05f7'
set interfaces macsec macsec1 security static peer R2 mac 00:11:22:33:44:02
set interfaces macsec macsec1 security static peer R2 key
˓→'eadcc0aa9cf203f3ce651b332bd6e6c7'

set interfaces macsec macsec1 source-interface 'eth1'

R2 Static Key

set interfaces macsec macsec1 address '192.0.2.2/24'

set interfaces macsec macsec1 address '2001:db8::2/64'
set interfaces macsec macsec1 security cipher 'gcm-aes-128'
set interfaces macsec macsec1 security encrypt
set interfaces macsec macsec1 security static key 'eadcc0aa9cf203f3ce651b332bd6e6c7'
set interfaces macsec macsec1 security static peer R2 mac 00:11:22:33:44:01
set interfaces macsec macsec1 security static peer R2 key
˓→'ddd6f4a7be4d8bbaf88b26f10e1c05f7'

set interfaces macsec macsec1 source-interface 'eth1'

8.4.9 OpenVPN

Traditionally hardware routers implement IPsec exclusively due to relative ease of implementing it in hardware and
insufficient CPU power for doing encryption in software. Since VyOS is a software router, this is less of a concern.
OpenVPN has been widely used on the UNIX platform for a long time and is a popular option for remote access VPN,
though it’s also capable of site-to-site connections.
Advantages of OpenVPN are:
• It uses a single TCP or UDP connection and does not rely on packet source addresses, so it will work even through
a double NAT: perfect for public hotspots and such
• It’s easy to setup and offers very flexible split tunneling
• There’s a variety of client GUI frontends for any platform
Disadvantages are:
• It’s slower than IPsec due to higher protocol overhead and the fact it runs in user mode while IPsec, on Linux, is
in kernel mode
• None of the operating systems have client software installed by default
In the VyOS CLI, a key point often overlooked is that rather than being configured using the set vpn stanza, OpenVPN
is configured as a network interface using set interfaces openvpn.

8.4. Interfaces 575

 VyOS Documentation, Release 1.5.x (circinus)

Site-to-Site

OpenVPN is popular for client-server setups, but its site-to-site mode remains a relatively obscure feature, and many
router appliances still don’t support it. However, it’s very useful for quickly setting up tunnels between routers.
As of VyOS 1.4, OpenVPN site-to-site mode can use either pre-shared keys or x.509 certificates.
The pre-shared key mode is deprecated and will be removed from future OpenVPN versions, so VyOS will have to
remove support for that option as well. The reason is that using pre-shared keys is significantly less secure than using
TLS.
We’ll configure OpenVPN using self-signed certificates, and then discuss the legacy pre-shared key mode.
In both cases, we will use the following settings:
• The public IP address of the local side of the VPN will be 198.51.100.10.
• The public IP address of the remote side of the VPN will be 203.0.113.11.
• The tunnel will use 10.255.1.1 for the local IP and 10.255.1.2 for the remote.
• The local site will have a subnet of 10.0.0.0/16.
• The remote site will have a subnet of 10.1.0.0/16.
• The official port for OpenVPN is 1194, which we reserve for client VPN; we will use 1195 for site-to-site VPN.
• The persistent-tunnel directive will allow us to configure tunnel-related attributes, such as firewall policy
as we would on any normal network interface.
• If known, the IP of the remote router can be configured using the remote-host directive; if unknown, it can be
omitted. We will assume a dynamic IP for our remote router.

8.4. Interfaces 576

 VyOS Documentation, Release 1.5.x (circinus)

Setting up certificates

Setting up a full-blown PKI with a CA certificate would arguably defeat the purpose of site-to-site OpenVPN, since its
main goal is supposed to be configuration simplicity, compared to server setups that need to support multiple clients.
However, since VyOS 1.4, it is possible to verify self-signed certificates using certificate fingerprints.
On both sides, you need to generate a self-signed certificate, preferrably using the “ec” (elliptic curve) type. You can
generate them by executing command run generate pki certificate self-signed install <name> in the
configuration mode. Once the command is complete, it will add the certificate to the configuration session, to the pki
subtree. You can then review the proposed changes and commit them.

vyos@vyos# run generate pki certificate self-signed install openvpn-local

Enter private key type: [rsa, dsa, ec] (Default: rsa) ec
Enter private key bits: (Default: 256)
Enter country code: (Default: GB)
Enter state: (Default: Some-State)
Enter locality: (Default: Some-City)
Enter organization name: (Default: VyOS)
Enter common name: (Default: vyos.io)
Do you want to configure Subject Alternative Names? [y/N]
Enter how many days certificate will be valid: (Default: 365)
Enter certificate type: (client, server) (Default: server)
Note: If you plan to use the generated key on this router, do not encrypt the private␣
˓→key.

Do you want to encrypt the private key with a passphrase? [y/N]

2 value(s) installed. Use "compare" to see the pending changes, and "commit" to apply.
[edit]

vyos@vyos# compare
[pki]
+ certificate openvpn-local {
+ certificate "MIICJTCCAcugAwIBAgIUMXLfRNJ5iOjk/ ␣
˓→uAZqUe4phW8MdgwCgYIKoZIzj0EAwIwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l

˓→lw9Eq9Q89r247AJR6ec/GT26AIcVA1bsongV1YaWvRwzTPC/yi5pkzV/PcT/

˓→WU7JQIyMWo3UwczAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/

˓→wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAdBgNVHQ4EFgQUBrAxRdFppdG/

˓→UBRdo7qNyHutaTQwHwYDVR0jBBgwFoAUBrAxRdFppdG/

˓→UBRdo7qNyHutaTQwCgYIKoZIzj0EAwIDSAAwRQIhAI2+8C92z9wTcTWkQ/

˓→goRxs10EBC+h78O+vgo9k97z5iAiBSeqfaVr5taQTS31+McGTAK3cYWNTg0DlOBI8aKO2oRg=="

+ private {
+ key "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgtOeEb0dMb5P/
˓→2Exi09WWvk6Cvz0oOBoDuP68ZimS2LShRANCAASp7D0vE3SKSAWAzr/lw9Eq9Q89r247AJR6ec/

˓→GT26AIcVA1bsongV1YaWvRwzTPC/yi5pkzV/PcT/WU7JQIyMW"

+ }
+ }

[edit]

vyos@vyos# commit

You do not need to copy the certificate to the other router. Instead, you need to retrieve its SHA-256 fingerprint.
OpenVPN only supports SHA-256 fingerprints at the moment, so you need to use the following command:

8.4. Interfaces 577

 VyOS Documentation, Release 1.5.x (circinus)

vyos@vyos# run show pki certificate openvpn-local fingerprint sha256

5C:B8:09:64:8B:59:51:DC:F4:DF:2C:12:5C:B7:03:D1:68:94:D7:5B:62:C2:E1:83:79:F1:F0:68:B2:81:26:79

Note: certificate names don’t matter, we use ‘openvpn-local’ and ‘openvpn-remote’ but they can be arbitrary.
Repeat the procedure on the other router.

Setting up OpenVPN

Local Configuration:

Configure the tunnel:

set interfaces openvpn vtun1 mode site-to-site

set interfaces openvpn vtun1 protocol udp
set interfaces openvpn vtun1 persistent-tunnel
set interfaces openvpn vtun1 remote-host '203.0.113.11' # Public␣
˓→IP of the other side

set interfaces openvpn vtun1 local-port '1195'

set interfaces openvpn vtun1 remote-port '1195'
set interfaces openvpn vtun1 local-address '10.255.1.1' # Local␣
˓→IP of vtun interface

set interfaces openvpn vtun1 remote-address '10.255.1.2' # Remote␣

˓→IP of vtun interface

set interfaces openvpn vtun1 tls certificate 'openvpn-local' # The␣

˓→self-signed certificate

set interfaces openvpn vtun1 tls peer-fingerprint <remote cert fingerprint> # The␣
˓→output of 'run show pki certificate <name> fingerprint sha256

on the␣
˓→remote rout

Remote Configuration:

set interfaces openvpn vtun1 mode site-to-site

set interfaces openvpn vtun1 protocol udp
set interfaces openvpn vtun1 persistent-tunnel
set interfaces openvpn vtun1 remote-host '198.51.100.10' # Pub␣
˓→IP of other site

set interfaces openvpn vtun1 local-port '1195'

set interfaces openvpn vtun1 remote-port '1195'
set interfaces openvpn vtun1 local-address '10.255.1.2' # Local␣
˓→IP of vtun interface

set interfaces openvpn vtun1 remote-address '10.255.1.1' #␣

˓→Remote IP of vtun interface

set interfaces openvpn vtun1 tls certificate 'openvpn-remote' # The␣

˓→self-signed certificate

set interfaces openvpn vtun1 tls peer-fingerprint <local cert fingerprint> # The␣
˓→output of 'run show pki certificate <name> fingerprint sha256

on the␣
˓→local router

8.4. Interfaces 578

 VyOS Documentation, Release 1.5.x (circinus)

Pre-shared keys

Until VyOS 1.4, the only option for site-to-site OpenVPN without PKI was to use pre-shared keys. That option is still
available but it is deprecated and will be removed in the future. However, if you need to set up a tunnel to an older
VyOS version or a system with older OpenVPN, you need to still need to know how to use it.
First, you need to generate a key by running run generate pki openvpn shared-secret install <name> from
configuration mode. You can use any name, we will use s2s.

vyos@local# run generate pki openvpn shared-secret install s2s

2 value(s) installed. Use "compare" to see the pending changes, and "commit" to apply.
[edit]
vyos@local# compare
[pki openvpn shared-secret]
+ s2s {
+ key
˓→"7c73046a9da91e874d31c7ad894a32688cda054bde157c64270f28eceebc0bb2f44dbb70335fad45148b0456aaa78cb34a34c

˓→"

+ version "1"
+ }

[edit]

vyos@local# commit
[edit]

Then you need to install the key on the remote router:

vyos@remote# set pki openvpn shared-secret s2s key <generated key string>

Then you need to set the key in your OpenVPN interface settings:

set interfaces openvpn vtun1 shared-secret-key s2s

Firewall Exceptions

For the OpenVPN traffic to pass through the WAN interface, you must create a firewall exception.

set firewall name OUTSIDE_LOCAL rule 10 action accept

set firewall name OUTSIDE_LOCAL rule 10 description 'Allow established/related'
set firewall name OUTSIDE_LOCAL rule 10 state established enable
set firewall name OUTSIDE_LOCAL rule 10 state related enable
set firewall name OUTSIDE_LOCAL rule 20 action accept
set firewall name OUTSIDE_LOCAL rule 20 description OpenVPN_IN
set firewall name OUTSIDE_LOCAL rule 20 destination port 1195
set firewall name OUTSIDE_LOCAL rule 20 log enable
set firewall name OUTSIDE_LOCAL rule 20 protocol udp
set firewall name OUTSIDE_LOCAL rule 20 source

You should also ensure that the OUTISDE_LOCAL firewall group is applied to the WAN interface and a direction
(local).

set firewall interface eth0 local name 'OUTSIDE-LOCAL'

8.4. Interfaces 579

 VyOS Documentation, Release 1.5.x (circinus)

Static Routing:
Static routes can be configured referencing the tunnel interface; for example, the local router will use a network of
10.0.0.0/16, while the remote has a network of 10.1.0.0/16:
Local Configuration:

set protocols static route 10.1.0.0/16 interface vtun1

Remote Configuration:

set protocols static route 10.0.0.0/16 interface vtun1

The configurations above will default to using 256-bit AES in GCM mode for encryption (if both sides support NCP)
and SHA-1 for HMAC authentication. SHA-1 is considered weak, but other hashing algorithms are available, as are
encryption algorithms:
For Encryption:
This sets the cipher when NCP (Negotiable Crypto Parameters) is disabled or OpenVPN version < 2.4.0.

vyos@vyos# set interfaces openvpn vtun1 encryption cipher

Possible completions:
des DES algorithm
3des DES algorithm with triple encryption
bf128 Blowfish algorithm with 128-bit key
bf256 Blowfish algorithm with 256-bit key
aes128 AES algorithm with 128-bit key CBC
aes128gcm AES algorithm with 128-bit key GCM
aes192 AES algorithm with 192-bit key CBC
aes192gcm AES algorithm with 192-bit key GCM
aes256 AES algorithm with 256-bit key CBC
aes256gcm AES algorithm with 256-bit key GCM

This sets the accepted ciphers to use when version => 2.4.0 and NCP is enabled (which is the default). Default NCP
cipher for versions >= 2.4.0 is aes256gcm. The first cipher in this list is what server pushes to clients.

vyos@vyos# set int open vtun0 encryption ncp-ciphers

Possible completions:
des DES algorithm
3des DES algorithm with triple encryption
aes128 AES algorithm with 128-bit key CBC
aes128gcm AES algorithm with 128-bit key GCM
aes192 AES algorithm with 192-bit key CBC
aes192gcm AES algorithm with 192-bit key GCM
aes256 AES algorithm with 256-bit key CBC
aes256gcm AES algorithm with 256-bit key GCM

For Hashing:

vyos@vyos# set interfaces openvpn vtun1 hash

Possible completions:
md5 MD5 algorithm
sha1 SHA-1 algorithm
sha256 SHA-256 algorithm
sha512 SHA-512 algorithm

8.4. Interfaces 580

 VyOS Documentation, Release 1.5.x (circinus)

If you change the default encryption and hashing algorithms, be sure that the local and remote ends have matching
configurations, otherwise the tunnel will not come up.
Firewall policy can also be applied to the tunnel interface for local, in, and out directions and functions identically to
ethernet interfaces.
If you’re making use of multiple tunnels, OpenVPN must have a way to distinguish between different tunnels aside
from the pre-shared-key. This is done either by referencing IP addresses or port numbers. One option is to dedicate a
public IP to each tunnel. Another option is to dedicate a port number to each tunnel (e.g. 1195,1196,1197. . . ).
OpenVPN status can be verified using the show openvpn operational commands. See the built-in help for a complete
list of options.

Server

Multi-client server is the most popular OpenVPN mode on routers. It always uses x.509 authentication and therefore
requires a PKI setup. Refer this topic PKI to generate a CA certificate, a server certificate and key, a certificate revoca-
tion list, and a Diffie-Hellman key exchange parameters file. You do not need client certificates and keys for the server
setup.
In this example we will use the most complicated case: a setup where each client is a router that has its own subnet
(think HQ and branch offices), since simpler setups are subsets of it.
Suppose you want to use 10.23.1.0/24 network for client tunnel endpoints and all client subnets belong to 10.23.0.0/20.
All clients need access to the 192.168.0.0/16 network.
First we need to specify the basic settings. 1194/UDP is the default. The persistent-tunnel option is recommended,
as it prevents the TUN/TAP device from closing on connection resets or daemon reloads.

Note: Using openvpn-option -reneg-sec can be tricky. This option is used to renegotiate data channel after n seconds.
When used on both the server and client, the lower value will trigger the renegotiation. If you set it to 0 on one side of
the connection (to disable it), the chosen value on the other side will determine when the renegotiation will occur.

set interfaces openvpn vtun10 mode server

set interfaces openvpn vtun10 local-port 1194
set interfaces openvpn vtun10 persistent-tunnel
set interfaces openvpn vtun10 protocol udp

Then we need to generate, add and specify the names of the cryptographic materials. Each of the install commands
should be applied to the configuration and commited before using under the openvpn interface configuration.

run generate pki ca install ca-1 # Follow the␣

˓→instructions to generate CA cert.

Configure mode commands to install:

set pki ca ca-1 certificate 'generated_cert_string'
set pki ca ca-1 private key 'generated_private_key'

run generate pki certificate sign ca-1 install srv-1 # Follow the␣
˓→instructions to generate server cert.

Configure mode commands to install:

set pki certificate srv-1 certificate 'generated_server_cert'
set pki certificate srv-1 private key 'generated_private_key'

run generate pki dh install dh-1 # Follow the␣

(continues on next page)

8.4. Interfaces 581

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

˓→instructions to generate set of
Diffie-Hellman␣
˓→parameters.
Generating parameters...
Configure mode commands to install DH parameters:
set pki dh dh-1 parameters 'generated_dh_params_set'

set interfaces openvpn vtun10 tls ca-certificate ca-1

set interfaces openvpn vtun10 tls certificate srv-1
set interfaces openvpn vtun10 tls dh-params dh-1

Now we need to specify the server network settings. In all cases we need to specify the subnet for client tunnel endpoints.
Since we want clients to access a specific network behind our router, we will use a push-route option for installing that
route on clients.

set interfaces openvpn vtun10 server push-route 192.168.0.0/16

set interfaces openvpn vtun10 server subnet 10.23.1.0/24

Since it’s a HQ with branch offices setup, we will want all clients to have fixed addresses and we will route traffic to
specific subnets through them. We need configuration for each client to achieve this.

Note: Clients are identified by the CN field of their x.509 certificates, in this example the CN is client0:

set interfaces openvpn vtun10 server client client0 ip 10.23.1.10

set interfaces openvpn vtun10 server client client0 subnet 10.23.2.0/25

OpenVPN will not automatically create routes in the kernel for client subnets when they connect and will only use
client-subnet association internally, so we need to create a route to the 10.23.0.0/20 network ourselves:

set protocols static route 10.23.0.0/20 interface vtun10

Additionally, each client needs a copy of ca cert and its own client key and cert files. The files are plaintext so they may
be copied manually from the CLI. Client key and cert files should be signed with the proper ca cert and generated on
the server side.
HQ’s router requires the following steps to generate crypto materials for the Branch 1:

run generate pki certificate sign ca-1 install branch-1 # Follow the␣
˓→instructions to generate client

cert for Branch 1

Configure mode commands to install:

Branch 1’s router might have the following lines:

set pki ca ca-1 certificate 'generated_cert_string' # CA cert generated␣

˓→on HQ router

set pki certificate branch-1 certificate 'generated_branch_cert' # Client cert␣

˓→generated and signed on HQ router

set pki certificate branch-1 private key 'generated_private_key' # Client cert key␣
˓→generated on HQ router

(continues on next page)

8.4. Interfaces 582

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set interfaces openvpn vtun10 tls ca-cert ca-1
set interfaces openvpn vtun10 tls certificate branch-1

Client Authentication

LDAP

Enterprise installations usually ship a kind of directory service which is used to have a single password store for all
employees. VyOS and OpenVPN support using LDAP/AD as single user backend.
Authentication is done by using the openvpn-auth-ldap.so plugin which is shipped with every VyOS installation.
A dedicated configuration file is required. It is best practise to store it in /config to survive image updates

set interfaces openvpn vtun0 openvpn-option "--plugin /usr/lib/openvpn/openvpn-auth-ldap.

˓→so /config/auth/ldap-auth.config"

The required config file may look like this:

<LDAP>
# LDAP server URL
URL ldap://ldap.example.com
# Bind DN (If your LDAP server doesn't support anonymous binds)
BindDN cn=LDAPUser,dc=example,dc=com
# Bind Password password
Password S3cr3t
# Network timeout (in seconds)
Timeout 15
</LDAP>

<Authorization>
# Base DN
BaseDN "ou=people,dc=example,dc=com"
# User Search Filter
SearchFilter "(&(uid=%u)(objectClass=shadowAccount))"
# Require Group Membership - allow all users
RequireGroup false
</Authorization>

Active Directory

Despite the fact that AD is a superset of LDAP

<LDAP>
# LDAP server URL
URL ldap://dc01.example.com
# Bind DN (If your LDAP server doesn’t support anonymous binds)
BindDN CN=LDAPUser,DC=example,DC=com
# Bind Password
Password mysecretpassword
# Network timeout (in seconds)
(continues on next page)

8.4. Interfaces 583

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Timeout 15
# Enable Start TLS
TLSEnable no
# Follow LDAP Referrals (anonymously)
FollowReferrals no
</LDAP>

<Authorization>
# Base DN
BaseDN "DC=example,DC=com"
# User Search Filter, user must be a member of the VPN AD group
SearchFilter "(&(sAMAccountName=%u)(memberOf=CN=VPN,OU=Groups,DC=example,DC=com))"
# Require Group Membership
RequireGroup false # already handled by SearchFilter
<Group>
BaseDN "OU=Groups,DC=example,DC=com"
SearchFilter "(|(cn=VPN))"
MemberAttribute memberOf
</Group>
</Authorization>

If you only want to check if the user account is enabled and can authenticate (against the primary group) the following
snipped is sufficient:

<LDAP>
URL ldap://dc01.example.com
BindDN CN=SA_OPENVPN,OU=ServiceAccounts,DC=example,DC=com
Password ThisIsTopSecret
Timeout 15
TLSEnable no
FollowReferrals no
</LDAP>

<Authorization>
BaseDN "DC=example,DC=com"
SearchFilter "sAMAccountName=%u"
RequireGroup false
</Authorization>

A complete LDAP auth OpenVPN configuration could look like the following example:

vyos@vyos# show interfaces openvpn

openvpn vtun0 {
mode server
openvpn-option "--tun-mtu 1500 --fragment 1300 --mssfix"
openvpn-option "--plugin /usr/lib/openvpn/openvpn-auth-ldap.so /config/auth/ldap-
˓→auth.config"

openvpn-option "--push redirect-gateway"

openvpn-option --duplicate-cn
openvpn-option "--verify-client-cert none"
openvpn-option --comp-lzo
openvpn-option --persist-key
(continues on next page)

8.4. Interfaces 584

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

openvpn-option --persist-tun
server {
domain-name example.com
max-connections 5
name-server 203.0.113.0.10
name-server 198.51.100.3
subnet 172.18.100.128/29
}
tls {
ca-certificate ca.crt
certificate server.crt
dh-params dh1024.pem
}
}

Client

VyOS can not only act as an OpenVPN site-to-site or server for multiple clients but you can also configure any VyOS
OpenVPN interface as an OpenVPN client that connects to a VyOS OpenVPN server or any other OpenVPN server.
Given the following example we have one VyOS router acting as an OpenVPN server and another VyOS router acting
as an OpenVPN client. The server also pushes a static client IP address to the OpenVPN client. Remember, clients are
identified using their CN attribute in the SSL certificate.

Configuration

Server Side

set interfaces openvpn vtun10 encryption cipher 'aes256'

set interfaces openvpn vtun10 hash 'sha512'
set interfaces openvpn vtun10 local-host '172.18.201.10'
set interfaces openvpn vtun10 local-port '1194'
set interfaces openvpn vtun10 mode 'server'
set interfaces openvpn vtun10 persistent-tunnel
set interfaces openvpn vtun10 protocol 'udp'
set interfaces openvpn vtun10 server client client1 ip '10.10.0.10'
set interfaces openvpn vtun10 server domain-name 'vyos.net'
set interfaces openvpn vtun10 server max-connections '250'
set interfaces openvpn vtun10 server name-server '172.16.254.30'
set interfaces openvpn vtun10 server subnet '10.10.0.0/24'
set interfaces openvpn vtun10 server topology 'subnet'
set interfaces openvpn vtun10 tls ca-cert ca-1
set interfaces openvpn vtun10 tls certificate srv-1
set interfaces openvpn vtun10 tls crypt-key srv-1
set interfaces openvpn vtun10 tls dh-params dh-1
set interfaces openvpn vtun10 use-lzo-compression

8.4. Interfaces 585

 VyOS Documentation, Release 1.5.x (circinus)

Client Side

set interfaces openvpn vtun10 encryption cipher 'aes256'

set interfaces openvpn vtun10 hash 'sha512'
set interfaces openvpn vtun10 mode 'client'
set interfaces openvpn vtun10 persistent-tunnel
set interfaces openvpn vtun10 protocol 'udp'
set interfaces openvpn vtun10 remote-host '172.18.201.10'
set interfaces openvpn vtun10 remote-port '1194'
set interfaces openvpn vtun10 tls ca-cert ca-1
set interfaces openvpn vtun10 tls certificate client-1
set interfaces openvpn vtun10 tls crypt-key client-1
set interfaces openvpn vtun10 use-lzo-compression

Options

We do not have CLI nodes for every single OpenVPN option. If an option is missing, a feature request should be opened
at Phabricator so all users can benefit from it (see Issues/Feature requests).
If you are a hacker or want to try on your own we support passing raw OpenVPN options to OpenVPN.
set interfaces openvpn vtun10 openvpn-option ‘persist-key’
Will add persist-key to the generated OpenVPN configuration. Please use this only as last resort - things might
break and OpenVPN won’t start if you pass invalid options/syntax.
set interfaces openvpn vtun10 openvpn-option ‘push keepalive 10 60’
Will add push "keepalive 1 10" to the generated OpenVPN config file.
set interfaces openvpn vtun10 openvpn-option ‘route-up &quot;/config/auth/tun_up.sh
arg1&quot;’
Will add route-up "/config/auth/tun_up.sh arg1" to the generated OpenVPN config file. The path and argu-
ments need to be single- or double-quoted.

Note: Sometimes option lines in the generated OpenVPN configuration require quotes. This is done through a hack
on our config generator. You can pass quotes using the &quot; statement.

Multi-factor Authentication

VyOS supports multi-factor authentication (MFA) or two-factor authentication using Time-based One-Time Password
(TOTP). Compatible with Google Authenticator software token, other software tokens.

8.4. Interfaces 586

 VyOS Documentation, Release 1.5.x (circinus)

MFA TOTP options

set interfaces openvpn <interface> server mfa totp challenge <enable | disable>
If set to enable, openvpn-otp will expect password as result of challenge/ response protocol.
set interfaces openvpn <interface> server mfa totp digits <1-65535>
Configure number of digits to use for totp hash (default: 6)
set interfaces openvpn <interface> server mfa totp drift <1-65535>
Configure time drift in seconds (default: 0)
set interfaces openvpn <interface> server mfa totp slop <1-65535>
Configure maximum allowed clock slop in seconds (default: 180)
set interfaces openvpn <interface> server mfa totp step <1-65535>
Configure step value for totp in seconds (default: 30)

Example

set interfaces openvpn vtun20 encryption cipher 'aes256'

set interfaces openvpn vtun20 hash 'sha512'
set interfaces openvpn vtun20 mode 'server'
set interfaces openvpn vtun20 persistent-tunnel
set interfaces openvpn vtun20 server client user1
set interfaces openvpn vtun20 server mfa totp challenge 'disable'
set interfaces openvpn vtun20 server subnet '10.10.2.0/24'
set interfaces openvpn vtun20 server topology 'subnet'
set interfaces openvpn vtun20 tls ca-certificate 'openvpn_vtun20'
set interfaces openvpn vtun20 tls certificate 'openvpn_vtun20'
set interfaces openvpn vtun20 tls dh-params 'dh-pem'

For every client in the openvpn server configuration a totp secret is created. To display the authentication information,
use the command:
show interfaces openvpn <interface> user <username> mfa <qrcode|secret|uri>
An example:

vyos@vyos:~$ sh interfaces openvpn vtun20 user user1 mfa qrcode

(continues on next page)

8.4. Interfaces 587

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Use the QR code to add the user account in Google authenticator application and on client side, use the OTP number
as password.

OpenVPN Data Channel Offload (DCO)

OpenVPN Data Channel Offload (DCO) enables significant performance enhancement in encrypted OpenVPN data
processing. By minimizing context switching for each packet, DCO effectively reduces overhead. This optimization is
achieved by keeping most data handling tasks within the kernel, avoiding frequent switches between kernel and user
space for encryption and packet handling.
As a result, the processing of each packet becomes more efficient, potentially leveraging hardware encryption offloading
support available in the kernel.

Note: OpenVPN DCO is not a fully supported OpenVPN feature, and is currently considered experimental. Further-
more, there are certain OpenVPN features and use cases that remain incompatible with DCO. To get a comprehensive
understanding of the limitations associated with DCO, refer to the list of known limitations in the documentation.
https://community.openvpn.net/openvpn/wiki/DataChannelOffload/Features

Enabling OpenVPN DCO

DCO support is a per-tunnel option and it is not automatically enabled by default for new or upgraded tunnels. Existing
tunnels will continue to function as they have in the past.
DCO can be enabled for both new and existing tunnels. VyOS adds an option in each tunnel configuration where we can
enable this function. The current best practice is to create a new tunnel with DCO to minimize the chance of problems
with existing clients.
set interfaces openvpn <name> offload dco
Enable OpenVPN Data Channel Offload feature by loading the appropriate kernel module.
Disabled by default - no kernel module loaded.

Note: Enable this feature causes an interface reset.

8.4. Interfaces 588

 VyOS Documentation, Release 1.5.x (circinus)

Troubleshooting

VyOS provides some operational commands on OpenVPN.

Check status

The following commands let you check tunnel status.

show openvpn client
Use this command to check the tunnel status for OpenVPN client interfaces.
show openvpn server
Use this command to check the tunnel status for OpenVPN server interfaces.
show openvpn site-to-site
Use this command to check the tunnel status for OpenVPN site-to-site interfaces.

Reset OpenVPN

The following commands let you reset OpenVPN.

reset openvpn client <text>
Use this command to reset the specified OpenVPN client.
reset openvpn interface <interface>
Use this command to reset the OpenVPN process on a specific interface.

8.4.10 WireGuard

WireGuard is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. See https:
//www.wireguard.com for more information.

Site to Site VPN

This diagram corresponds with the example site to site configuration below.

Keypairs

WireGuard requires the generation of a keypair, which includes a private key to decrypt incoming traffic, and a public
key for peer(s) to encrypt traffic.

8.4. Interfaces 589

 VyOS Documentation, Release 1.5.x (circinus)

Generate Keypair

generate pki wireguard key-pair

Generates the keypair, which includes the public and private parts. The key is not stored on the system - only a
keypair is generated.

vyos@vyos:~$ generate pki wireguard key-pair

Private key: iJJyEARGK52Ls1GYRCcFvPuTj7WyWYDo//BknoDU0XY=
Public key: EKY0dxRrSD98QHjfHOK13mZ5PJ7hnddRZt5woB3szyw=

generate pki wireguard key-pair install interface <interface>

Generates a keypair, which includes the public and private parts, and builds a configuration command to install
this key to interface.

vyos@vyos:~$ generate pki wireguard key-pair install interface wg10

"generate" CLI command executed from operational level.
Generated private-key is not stored to CLI, use configure mode commands to install␣
˓→key:

set interfaces wireguard wg10 private-key

˓→'4Krkv8h6NkAYMMaBWI957yYDJDMvj9URTHstdlOcDU0='

Corresponding public-key to use on peer system is:

˓→'UxDsYT6EnpTIOKUzvMlw2p0sNOKQvFxEdSVrnNrX1Ro='

Note: If this command is invoked from configure mode with the run prefix the key is automatically installed
to the appropriate interface:

8.4. Interfaces 590

 VyOS Documentation, Release 1.5.x (circinus)

vyos@vyos# run generate pki wireguard key-pair install interface wg10

"generate" CLI command executed from config session.
Generated private-key was imported to CLI!

Use the following command to verify: show interfaces wireguard wg10

Corresponding public-key to use on peer system is: '7d9KwabjLhHpJiEJeIGd0CBlao/
˓→eTwFOh6xyCovTfG8='

vyos@vyos# compare
[edit interfaces]
+wireguard wg10 {
+ private-key CJweb8FC6BU3Loj4PC2pn5V82cDjIPs7G1saW0ZfLWc=
+}

show interfaces wireguard <interface> public-key

Retrieve public key portion from configured WIreGuard interface.

vyos@vyos:~$ show interfaces wireguard wg01 public-key

EKY0dxRrSD98QHjfHOK13mZ5PJ7hnddRZt5woB3szyw=

Optional

generate pki wireguard preshared-key

An additional layer of symmetric-key crypto can be used on top of the asymmetric crypto.
This is optional.

vyos@vyos:~$ generate pki wireguard preshared-key

Pre-shared key: OHH2EwZfMNK+1L6BXbYw3bKCtMrfjpR4mCAEeBlFnRs=

generate pki wireguard preshared-key install interface <interface> peer <peer>

An additional layer of symmetric-key crypto can be used on top of the asymmetric crypto. This command
automatically creates the required CLI command to install this PSK for a given peer.
This is optional.

vyos@vyos:~$ generate pki wireguard preshared-key install interface wg10 peer foo
"generate" CLI command executed from operational level.
Generated preshared-key is not stored to CLI, use configure mode commands to␣
˓→install key:

set interfaces wireguard wg10 peer foo preshared-key

˓→'32vQ1w1yFKTna8n7Gu7EimubSe2Y63m8bafz55EG3Ro='

Pre-shared key: +LuaZ8W6DjsDFJFX3jJzoNqrsXHhvq08JztM9z8LHCs=

Note: If this command is invoked from configure mode with the run prefix the key is automatically installed
to the appropriate interface:

8.4. Interfaces 591

 VyOS Documentation, Release 1.5.x (circinus)

Interface configuration

The next step is to configure your local side as well as the policy based trusted destination addresses. If you only initiate
a connection, the listen port and address/port is optional; however, if you act like a server and endpoints initiate the
connections to your system, you need to define a port your clients can connect to, otherwise the port is randomly chosen
and may make connection difficult with firewall rules, since the port may be different each time the system is rebooted.
You will also need the public key of your peer as well as the network(s) you want to tunnel (allowed-ips) to configure
a WireGuard tunnel. The public key below is always the public key from your peer, not your local one.
local side - commands
• WireGuard interface itself uses address 10.1.0.1/30
• We only allow the 192.168.2.0/24 subnet to travel over the tunnel
• Our remote end of the tunnel for peer to-wg02 is reachable at 192.0.2.1 port 51820
• The remote peer to-wg02 uses XMrlPykaxhdAAiSjhtPlvi30NVkvLQliQuKP7AI7CyI= as its public key portion
• We listen on port 51820
• We route all traffic for the 192.168.2.0/24 network to interface wg01

set interfaces wireguard wg01 address '10.1.0.1/30'

set interfaces wireguard wg01 description 'VPN-to-wg02'
set interfaces wireguard wg01 peer to-wg02 allowed-ips '192.168.2.0/24'
set interfaces wireguard wg01 peer to-wg02 address '192.0.2.1'
set interfaces wireguard wg01 peer to-wg02 port '51820'
set interfaces wireguard wg01 peer to-wg02 public-key
˓→'XMrlPykaxhdAAiSjhtPlvi30NVkvLQliQuKP7AI7CyI='

set interfaces wireguard wg01 port '51820'

set protocols static route 192.168.2.0/24 interface wg01

The last step is to define an interface route for 192.168.2.0/24 to get through the WireGuard interface wg01. Multiple
IPs or networks can be defined and routed. The last check is allowed-ips which either prevents or allows the traffic.

Warning: You can not assign the same allowed-ips statement to multiple WireGuard peers. This a design decision.
For more information please check the WireGuard mailing list.

set interfaces wireguard <interface> private-key <private-key>

Associates the previously generated private key to a specific WireGuard interface. The private key can be
generate via the command
generate pki wireguard key-pair.

set interfaces wireguard wg01 private-key 'iJJyEARGK52Ls1GYRCcFvPuTj7WyWYDo//

˓→BknoDU0XY='

The command show interfaces wireguard wg01 public-key will then show the public key, which needs
to be shared with the peer.
set interfaces wireguard <interface> per-client-thread
Provides a per-device control to enable/disable the threaded mode for all the NAPI instances of the given network
device, without the need for a device up/down.
If CLI option is not specified, this feature is disabled.

8.4. Interfaces 592

 VyOS Documentation, Release 1.5.x (circinus)

Example:

set interfaces wireguard wg01 per-client-thread

remote side - commands

set interfaces wireguard wg01 address '10.1.0.2/30'

set interfaces wireguard wg01 description 'VPN-to-wg01'
set interfaces wireguard wg01 peer to-wg01 allowed-ips '192.168.1.0/24'
set interfaces wireguard wg01 peer to-wg01 address '192.0.2.2'
set interfaces wireguard wg01 peer to-wg01 port '51820'
set interfaces wireguard wg01 peer to-wg01 public-key
˓→'EKY0dxRrSD98QHjfHOK13mZ5PJ7hnddRZt5woB3szyw='

set interfaces wireguard wg01 port '51820'

set interfaces wireguard wg01 private-key 'OLTQY3HuK5qWDgVs6fJR093SwPgOmCKkDI1+vJLGoFU='

set protocols static route 192.168.1.0/24 interface wg01

Firewall Exceptions

For the WireGuard traffic to pass through the WAN interface, you must create a firewall exception.

set firewall ipv4 name OUTSIDE_LOCAL rule 10 action accept

set firewall ipv4 name OUTSIDE_LOCAL rule 10 description 'Allow established/related'
set firewall ipv4 name OUTSIDE_LOCAL rule 10 state established enable
set firewall ipv4 name OUTSIDE_LOCAL rule 10 state related enable
set firewall ipv4 name OUTSIDE_LOCAL rule 20 action accept
set firewall ipv4 name OUTSIDE_LOCAL rule 20 description WireGuard_IN
set firewall ipv4 name OUTSIDE_LOCAL rule 20 destination port 51820
set firewall ipv4 name OUTSIDE_LOCAL rule 20 log enable
set firewall ipv4 name OUTSIDE_LOCAL rule 20 protocol udp
set firewall ipv4 name OUTSIDE_LOCAL rule 20 source

You should also ensure that the OUTSIDE_LOCAL firewall group is applied to the WAN interface and a direction
(local).

set interfaces ethernet eth0 firewall local name 'OUTSIDE-LOCAL'

Assure that your firewall rules allow the traffic, in which case you have a working VPN using WireGuard.

wg01# ping 192.168.1.1

PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=1.16 ms
64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=1.77 ms

wg02# ping 192.168.2.1

PING 192.168.2.1 (192.168.2.1) 56(84) bytes of data.
64 bytes from 192.168.2.1: icmp_seq=1 ttl=64 time=4.40 ms
64 bytes from 192.168.2.1: icmp_seq=2 ttl=64 time=1.02 ms

An additional layer of symmetric-key crypto can be used on top of the asymmetric crypto. This is optional.

vyos@vyos:~$ generate pki wireguard preshared-key

Pre-shared key: rvVDOoc2IYEnV+k5p7TNAmHBMEGTHbPU8Qqg8c/sUqc=

8.4. Interfaces 593

 VyOS Documentation, Release 1.5.x (circinus)

Copy the key, as it is not stored on the local filesystem. Because it is a symmetric key, only you and your peer should
have knowledge of its content. Make sure you distribute the key in a safe manner,

wg01# set interfaces wireguard wg01 peer to-wg02 preshared-key

˓→'rvVDOoc2IYEnV+k5p7TNAmHBMEGTHbPU8Qqg8c/sUqc='

wg02# set interfaces wireguard wg01 peer to-wg01 preshared-key

˓→'rvVDOoc2IYEnV+k5p7TNAmHBMEGTHbPU8Qqg8c/sUqc='

Remote Access “RoadWarrior” Example

With WireGuard, a Road Warrior VPN config is similar to a site-to-site VPN. It just lacks the address and port
statements.
In the following example, the IPs for the remote clients are defined in the peers. This allows the peers to interact with
one another. In comparison to the site-to-site example the persistent-keepalive flag is set to 15 seconds to assure
the connection is kept alive. This is mainly relevant if one of the peers is behind NAT and can’t be connected to if the
connection is lost. To be effective this value needs to be lower than the UDP timeout.

wireguard wg01 {
address 10.172.24.1/24
address 2001:db8:470:22::1/64
description RoadWarrior
peer MacBook {
allowed-ips 10.172.24.30/32
allowed-ips 2001:db8:470:22::30/128
persistent-keepalive 15
pubkey F5MbW7ye7DsoxdOaixjdrudshjjxN5UdNV+pGFHqehc=
}
peer iPhone {
allowed-ips 10.172.24.20/32
allowed-ips 2001:db8:470:22::20/128
persistent-keepalive 15
pubkey BknHcLFo8nOo8Dwq2CjaC/TedchKQ0ebxC7GYn7Al00=
}
port 2224
private-key OLTQY3HuK5qWDgVs6fJR093SwPgOmCKkDI1+vJLGoFU=
}

The following is the config for the iPhone peer above. It’s important to note that the AllowedIPs wildcard setting
directs all IPv4 and IPv6 traffic through the connection.

[Interface]
PrivateKey = ARAKLSDJsadlkfjasdfiowqeruriowqeuasdf=
Address = 10.172.24.20/24, 2001:db8:470:22::20/64
DNS = 10.0.0.53, 10.0.0.54

[Peer]
PublicKey = RIbtUTCfgzNjnLNPQ/ulkGnnB2vMWHm7l2H/xUfbyjc=
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = 192.0.2.1:2224
PersistentKeepalive = 25

However, split-tunneling can be achieved by specifying the remote subnets. This ensures that only traffic destined for
the remote site is sent over the tunnel. All other traffic is unaffected.

8.4. Interfaces 594

 VyOS Documentation, Release 1.5.x (circinus)

[Interface]
PrivateKey = 8Iasdfweirousd1EVGUk5XsT+wYFZ9mhPnQhmjzaJE6Go=
Address = 10.172.24.30/24, 2001:db8:470:22::30/64

[Peer]
PublicKey = RIbtUTCfgzNjnLNPQ/ulkGnnB2vMWHm7l2H/xUfbyjc=
AllowedIPs = 10.172.24.30/24, 2001:db8:470:22::/64
Endpoint = 192.0.2.1:2224
PersistentKeepalive = 25

Operational Commands

Status

show interfaces wireguard wg01 summary

Show info about the Wireguard service. It also shows the latest handshake.

vyos@vyos:~$ show interfaces wireguard wg01 summary

interface: wg01
public key:
private key: (hidden)
listening port: 51820

peer: <peer pubkey>

endpoint: <peer public IP>
allowed ips: 10.69.69.2/32
latest handshake: 23 hours, 45 minutes, 26 seconds ago
transfer: 1.26 MiB received, 6.47 MiB sent

show interfaces wireguard

Get a list of all wireguard interfaces

Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down

Interface IP Address S/L Description
--------- ---------- --- -----------
wg01 10.0.0.1/24 u/u

show interfaces wireguard <interface>

Show general information about specific WireGuard interface

vyos@vyos:~$ show interfaces wireguard wg01

interface: wg01
address: 10.0.0.1/24
public key: h1HkYlSuHdJN6Qv4Hz4bBzjGg5WUty+U1L7DJsZy1iE=
private key: (hidden)
listening port: 41751

RX: bytes packets errors dropped overrun mcast

0 0 0 0 0 0
TX: bytes packets errors dropped carrier collisions
0 0 0 0 0 0

8.4. Interfaces 595

 VyOS Documentation, Release 1.5.x (circinus)

Remote Access “RoadWarrior” clients

Some users tend to connect their mobile devices using WireGuard to their VyOS router. To ease deployment one can
generate a “per mobile” configuration from the VyOS CLI.

Warning: From a security perspective, it is not recommended to let a third party create and share the private
key for a secured connection. You should create the private portion on your own and only hand out the public key.
Please keep this in mind when using this convenience feature.

generate wireguard client-config <name> interface <interface> server <ip|fqdn> address

<client-ip>
Using this command, you will create a new client configuration which can connect to interface on this router.
The public key from the specified interface is automatically extracted and embedded into the configuration.
The command also generates a configuration snippet which can be copy/pasted into the VyOS CLI if needed.
The supplied <name> on the CLI will become the peer name in the snippet.
In addition you will specify the IP address or FQDN for the client where it will connect to. The address parameter
can be used up to two times and is used to assign the clients specific IPv4 (/32) or IPv6 (/128) address.

8.4.11 PPPoE

PPPoE (Point-to-Point Protocol over Ethernet) is a network protocol for encapsulating PPP frames inside Ethernet
frames. It appeared in 1999, in the context of the boom of DSL as the solution for tunneling packets over the DSL
connection to the ISPs (Internet Service Providers) IP network, and from there to the rest of the Internet. A 2005
networking book noted that “Most DSL providers use PPPoE, which provides authentication, encryption, and com-
pression.” Typical use of PPPoE involves leveraging the PPP facilities for authenticating the user with a username and
password, predominately via the PAP protocol and less often via CHAP.

Operating Modes

VyOS supports setting up PPPoE in two different ways to a PPPoE internet connection. This is because most ISPs
provide a modem that is also a wireless router.

Home Users

In this method, the DSL Modem/Router connects to the ISP for you with your credentials preprogrammed into the
device. This gives you an RFC 1918 address, such as 192.168.1.0/24 by default.
For a simple home network using just the ISP’s equipment, this is usually desirable. But if you want to run VyOS as
your firewall and router, this will result in having a double NAT and firewall setup. This results in a few extra layers of
complexity, particularly if you use some NAT or tunnel features.

8.4. Interfaces 596

 VyOS Documentation, Release 1.5.x (circinus)

8.4. Interfaces 597

 VyOS Documentation, Release 1.5.x (circinus)

Business Users

In order to have full control and make use of multiple static public IP addresses, your VyOS will have to initiate the
PPPoE connection and control it. In order for this method to work, you will have to figure out how to make your DSL
Modem/Router switch into a Bridged Mode so it only acts as a DSL Transceiver device to connect between the Ethernet
link of your VyOS and the phone cable. Once your DSL Transceiver is in Bridge Mode, you should get no IP address
from it. Please make sure you connect to the Ethernet Port 1 if your DSL Transceiver has a switch, as some of them
only work this way.
Once you have an Ethernet device connected, i.e. eth0, then you can configure it to open the PPPoE session for you and
your DSL Transceiver (Modem/Router) just acts to translate your messages in a way that vDSL/aDSL understands.

Configuration

Common interface configuration

set interfaces pppoe <interface> description <description>

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces pppoe pppoe0 description 'This is an awesome interface running on␣
˓→VyOS'

set interfaces pppoe <interface> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces pppoe pppoe0 disable

set interfaces pppoe <interface> mtu <mtu>

Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

set interfaces pppoe pppoe0 mtu 1600

set interfaces pppoe <interface> vrf <vrf>

Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces pppoe pppoe0 vrf red

8.4. Interfaces 598

 VyOS Documentation, Release 1.5.x (circinus)

PPPoE options

set interfaces pppoe <interface> access-concentrator <name>

Use this command to restrict the PPPoE session on a given access concentrator. Normally, a host sends a
PPPoE initiation packet to start the PPPoE discovery process, a number of access concentrators respond with
offer packets and the host selects one of the responding access concentrators to serve this session.
This command allows you to select a specific access concentrator when you know the access concentrators
<name>.
set interfaces pppoe <interface> authentication username <username>
Use this command to set the username for authenticating with a remote PPPoE endpoint. Authentication is
optional from the system’s point of view but most service providers require it.
set interfaces pppoe <interface> authentication password <password>
Use this command to set the password for authenticating with a remote PPPoE endpoint. Authentication is
optional from the system’s point of view but most service providers require it.
set interfaces pppoe <interface> connect-on-demand
When set the interface is enabled for “dial-on-demand”.
Use this command to instruct the system to establish a PPPoE connection automatically once traffic passes
through the interface. A disabled on-demand connection is established at boot time and remains up. If the link
fails for any reason, the link is brought back up immediately.
Enabled on-demand PPPoE connections bring up the link only when traffic needs to pass this link. If the link
fails for any reason, the link is brought back up automatically once traffic passes the interface again. If you
configure an on-demand PPPoE connection, you must also configure the idle timeout period, after which an idle
PPPoE link will be disconnected. A non-zero idle timeout will never disconnect the link after it first came up.
set interfaces pppoe <interface> no-default-route
Only request an address from the PPPoE server but do not install any default route.
Example:

set interfaces pppoe pppoe0 no-default-route

Note: This command got added in VyOS 1.4 and inverts the logic from the old default-route CLI option.

set interfaces pppoe <interface> default-route-distance <distance>

Set the distance for the default gateway sent by the PPPoE server.
Example:

set interfaces pppoe pppoe0 default-route-distance 220

set interfaces pppoe <interface> mru <mru>

Set the MRU (Maximum Receive Unit) to mru. PPPd will ask the peer to send packets of no more than mru
bytes. The value of mru must be between 128 and 16384.
A value of 296 works well on very slow links (40 bytes for TCP/IP header + 256 bytes of data).
The default is 1492.

8.4. Interfaces 599

 VyOS Documentation, Release 1.5.x (circinus)

Note: When using the IPv6 protocol, MRU must be at least 1280 bytes.

set interfaces pppoe <interface> idle-timeout <time>

Use this command to set the idle timeout interval to be used with on-demand PPPoE sessions. When an on-
demand connection is established, the link is brought up only when traffic is sent and is disabled when the link
is idle for the interval specified.
If this parameter is not set or 0, an on-demand link will not be taken down when it is idle and after the initial
establishment of the connection. It will stay up forever.
set interfaces pppoe <interface> holdoff <time>
Use this command to set re-dial delay time to be used with persist PPPoE sessions. When the PPPoE session is
terminated by peer, and on-demand option is not set, the router will attempt to re-establish the PPPoE link.
If this parameter is not set, the default holdoff time is 30 seconds.
set interfaces pppoe <interface> local-address <address>
Use this command to set the IP address of the local endpoint of a PPPoE session. If it is not set it will be
negotiated.
set interfaces pppoe <interface> no-peer-dns
Use this command to not install advertised DNS nameservers into the local system.
set interfaces pppoe <interface> remote-address <address>
Use this command to set the IP address of the remote endpoint of a PPPoE session. If it is not set it will be
negotiated.
set interfaces pppoe <interface> service-name <name>
Use this command to specify a service name by which the local PPPoE interface can select access concentrators
to connect with. It will connect to any access concentrator if not set.
set interfaces pppoe <interface> source-interface <source-interface>
Use this command to link the PPPoE connection to a physical interface. Each PPPoE connection must be estab-
lished over a physical interface. Interfaces can be regular Ethernet interfaces, VIFs or bonding interfaces/VIFs.
set interfaces pppoe <interface> ip adjust-mss <mss | clamp-mss-to-pmtu>
As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces pppoe <interface> ip disable-forwarding
Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

8.4. Interfaces 600

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces pppoe <interface> ip source-validation <strict | loose | disable>

Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.
• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation

IPv6

set interfaces pppoe <interface> ipv6 address autoconf

Use this command to enable acquisition of IPv6 address using stateless autoconfig (SLAAC).
set interfaces pppoe <interface> ipv6 adjust-mss <mss | clamp-mss-to-pmtu>
As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces pppoe <interface> ipv6 disable-forwarding
Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
DHCPv6 Prefix Delegation (PD)
VyOS 1.3 (equuleus) supports DHCPv6-PD (RFC 3633). DHCPv6 Prefix Delegation is supported by most ISPs who
provide native IPv6 for consumers on fixed networks.
set interfaces pppoe <interface> dhcpv6-options pd <id> length <length>
Some ISPs by default only delegate a /64 prefix. To request for a specific prefix size use this option to request
for a bigger delegation for this pd <id>. This value is in the range from 32 - 64 so you could request up to a /32
prefix (if your ISP allows this) down to a /64 delegation.
The default value corresponds to 64.
To request a /56 prefix from your ISP use:

set interfaces pppoe pppoe0 dhcpv6-options pd 0 length 56

set interfaces pppoe <interface> dhcpv6-options pd <id> interface <delegatee> address

<address>

8.4. Interfaces 601

 VyOS Documentation, Release 1.5.x (circinus)

Specify the interface address used locally on the interface where the prefix has been delegated to. ID must be a
decimal integer.
It will be combined with the delegated prefix and the sla-id to form a complete interface address. The default is
to use the EUI-64 address of the interface.
Example: Delegate a /64 prefix to interface eth8 which will use a local address on this router of
<prefix>::ffff, as the address 65534 will correspond to ffff in hexadecimal notation.

set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth8 address 65534

set interfaces pppoe <interface> dhcpv6-options pd <id> interface <delegatee> sla-id <id>
Specify the identifier value of the site-level aggregator (SLA) on the interface. ID must be a decimal number
greater then 0 which fits in the length of SLA IDs (see below).
Example: If ID is 1 and the client is delegated an IPv6 prefix 2001:db8:ffff::/48, dhcp6c will combine the two
values into a single IPv6 prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified interface.

set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth8 sla-id 1

Operation

show interfaces pppoe <interface>

Show detailed information on given <interface>

vyos@vyos:~$ show interfaces pppoe pppoe0

pppoe0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1492 qdisc pfifo_fast state␣
˓→UNKNOWN group default qlen 3

link/ppp
inet 192.0.2.1 peer 192.0.2.255/32 scope global pppoe0
valid_lft forever preferred_lft forever

RX: bytes packets errors dropped overrun mcast

7002658233 5064967 0 0 0 0
TX: bytes packets errors dropped carrier collisions
533822843 1620173 0 0 0 0

show interfaces pppoe <interface> queue

Displays queue information for a PPPoE interface.

vyos@vyos:~$ show interfaces pppoe pppoe0 queue

qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
Sent 534625359 bytes 1626761 pkt (dropped 62, overlimits 0 requeues 0)
backlog 0b 0p requeues 0

8.4. Interfaces 602

 VyOS Documentation, Release 1.5.x (circinus)

Connect/Disconnect

disconnect interface <interface>

Test disconnecting given connection-oriented interface. <interface> can be pppoe0 as the example.
connect interface <interface>
Test connecting given connection-oriented interface. <interface> can be pppoe0 as the example.

Example

Requirements:
• Your ISPs modem is connected to port eth0 of your VyOS box.
• No VLAN tagging required by your ISP.
• You need your PPPoE credentials from your DSL ISP in order to configure this. The usual username is in the
form of [email protected] but may vary depending on ISP.
• The largest MTU size you can use with DSL is 1492 due to PPPoE overhead. If you are switching from a DHCP
based ISP like cable then be aware that things like VPN links may need to have their MTU sizes adjusted to work
within this limit.
• With the name-server option set to none, VyOS will ignore the nameservers your ISP sends you and thus you
can fully rely on the ones you have configured statically.

Note: Syntax has changed from VyOS 1.2 (crux) and it will be automatically migrated during an upgrade.

Note: A default route is automatically installed once the interface is up. To change this behavior use the
no-default-route CLI option.

set interfaces pppoe pppoe0 authentication username 'userid'

set interfaces pppoe pppoe0 authentication password 'secret'
set interfaces pppoe pppoe0 source-interface 'eth0'

You should add a firewall to your configuration above as well by assigning it to the pppoe0 itself as shown here:

set firewall interface pppoe0 in name NET-IN

set firewall interface pppoe0 local name NET-LOCAL
set firewall interface pppoe0 out name NET-OUT

VLAN Example

Some recent ISPs require you to build the PPPoE connection through a VLAN interface. One of those ISPs is e.g.
Deutsche Telekom in Germany. VyOS can easily create a PPPoE session through an encapsulated VLAN interface.
The following configuration will run your PPPoE connection through VLAN7 which is the default VLAN for Deutsche
Telekom:

set interfaces pppoe pppoe0 authentication username 'userid'

set interfaces pppoe pppoe0 authentication password 'secret'
set interfaces pppoe pppoe0 source-interface 'eth0.7'

8.4. Interfaces 603

 VyOS Documentation, Release 1.5.x (circinus)

IPv6 DHCPv6-PD Example

The following configuration will setup a PPPoE session source from eth1 and assign a /64 prefix out of a /56 delegation
(requested from the ISP) to eth0. The IPv6 address assigned to eth0 will be <prefix>::1/64. If you do not know the
prefix size delegated to you, start with sla-len 0.
In addition we setup IPv6 RA (Router Advertisements) to make the prefix known on the eth0 link.

set interfaces pppoe pppoe0 authentication username vyos

set interfaces pppoe pppoe0 authentication password vyos
set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth0 address '1'
set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth0 sla-id '0'
set interfaces pppoe pppoe0 dhcpv6-options pd 0 length '56'
set interfaces pppoe pppoe0 ipv6 address autoconf
set interfaces pppoe pppoe0 source-interface eth1

set service router-advert interface eth0 prefix ::/64

8.4.12 MACVLAN - Pseudo Ethernet

Pseudo-Ethernet or MACVLAN interfaces can be seen as subinterfaces to regular ethernet interfaces. Each and every
subinterface is created a different media access control (MAC) address, for a single physical Ethernet port. Pseudo-
Ethernet interfaces have most of their application in virtualized environments,
By using Pseudo-Ethernet interfaces there will be less system overhead compared to running a traditional bridging
approach. Pseudo-Ethernet interfaces can also be used to workaround the general limit of 4096 virtual LANs (VLANs)
per physical Ethernet port, since that limit is with respect to a single MAC address.
Every Virtual Ethernet interfaces behaves like a real Ethernet interface. They can have IPv4/IPv6 addresses config-
ured, or can request addresses by DHCP/ DHCPv6 and are associated/mapped with a real ethernet port. This also
makes Pseudo-Ethernet interfaces interesting for testing purposes. A Pseudo-Ethernet device will inherit characteris-
tics (speed, duplex, . . . ) from its physical parent (the so called link) interface.
Once created in the system, Pseudo-Ethernet interfaces can be referenced in the exact same way as other Ethernet
interfaces. Notes about using Pseudo- Ethernet interfaces:
• Pseudo-Ethernet interfaces can not be reached from your internal host. This means that you can not try to ping
a Pseudo-Ethernet interface from the host system on which it is defined. The ping will be lost.
• Loopbacks occurs at the IP level the same way as for other interfaces, ethernet frames are not forwarded between
Pseudo-Ethernet interfaces.
• Pseudo-Ethernet interfaces may not work in environments which expect a NIC (Network Interface Card) to only
have a single address. This applies to: - VMware machines using default settings - Network switches with
security settings allowing only a single MAC address - xDSL modems that try to learn the MAC address of the
NIC

8.4. Interfaces 604

 VyOS Documentation, Release 1.5.x (circinus)

Configuration

Common interface configuration

set interfaces pseudo-ethernet <interface> address <address | dhcp | dhcpv6>

Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
• dhcp interface address is received by DHCP from a DHCP server on this segment.
• dhcpv6 interface address is received by DHCPv6 from a DHCPv6 server on this segment.

Note: When using DHCP to retrieve IPv4 address and if local customizations are needed, they should be
possible using the enter and exit hooks provided. The hook dirs are:
• /config/scripts/dhcp-client/pre-hooks.d/
• /config/scripts/dhcp-client/post-hooks.d/

Example:

set interfaces pseudo-ethernet peth0 address 192.0.2.1/24

set interfaces pseudo-ethernet peth0 address 2001:db8::1/64
set interfaces pseudo-ethernet peth0 address dhcp
set interfaces pseudo-ethernet peth0 address dhcpv6

set interfaces pseudo-ethernet <interface> description <description>

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces pseudo-ethernet peth0 description 'This is an awesome interface␣

˓→running on VyOS'

set interfaces pseudo-ethernet <interface> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces pseudo-ethernet peth0 disable

set interfaces pseudo-ethernet <interface> disable-flow-control

Ethernet flow control is a mechanism for temporarily stopping the transmission of data on Ethernet family com-
puter networks. The goal of this mechanism is to ensure zero packet loss in the presence of network congestion.
The first flow control mechanism, the pause frame, was defined by the IEEE 802.3x standard.
A sending station (computer or network switch) may be transmitting data faster than the other end of the link can
accept it. Using flow control, the receiving station can signal the sender requesting suspension of transmissions
until the receiver catches up.
Use this command to disable the generation of Ethernet flow control (pause frames).
Example:

8.4. Interfaces 605

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces pseudo-ethernet peth0 disable-flow-control

set interfaces pseudo-ethernet <interface> disable-link-detect

Use this command to direct an interface to not detect any physical state changes on a link, for example, when
the cable is unplugged.
Default is to detects physical link state changes.
Example:

set interfaces pseudo-ethernet peth0 disable-link-detect

set interfaces pseudo-ethernet <interface> mac <xx:xx:xx:xx:xx:xx>

Configure user defined MAC address on given <interface>.
Example:

set interfaces pseudo-ethernet peth0 mac '00:53:01:02:03:04'

set interfaces pseudo-ethernet <interface> mtu <mtu>

Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

set interfaces pseudo-ethernet peth0 mtu 1600

set interfaces pseudo-ethernet <interface> ip adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces pseudo-ethernet <interface> ip arp-cache-timeout
Once a neighbor has been found, the entry is considered to be valid for at least for this specific time. An entry’s
validity will be extended if it receives positive feedback from higher level protocols.
This defaults to 30 seconds.
Example:

set interfaces pseudo-ethernet peth0 ip arp-cache-timeout 180

set interfaces pseudo-ethernet <interface> ip disable-arp-filter

If set the kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but
it usually makes sense, because it increases the chance of successful communication. IP addresses are owned

8.4. Interfaces 606

 VyOS Documentation, Release 1.5.x (circinus)

by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing,
does this behaviour cause problems.
If not set (default) allows you to have multiple network interfaces on the same subnet, and have the ARPs for
each interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that
interface (therefore you must use source based routing for this to work).
In other words it allows control of which cards (usually 1) will respond to an arp request.
Example:

set interfaces pseudo-ethernet peth0 ip disable-arp-filter

set interfaces pseudo-ethernet <interface> ip disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

set interfaces pseudo-ethernet peth0 ip disable-forwarding

set interfaces pseudo-ethernet <interface> ip enable-directed-broadcast

Define different modes for IP directed broadcast forwarding as described in RFC 1812 and RFC 2644.
If configured, incoming IP directed broadcast packets on this interface will be forwarded.
If this option is unset (default), incoming IP directed broadcast packets will not be forwarded.

set interfaces pseudo-ethernet peth0 ip enable-directed-broadcast

set interfaces pseudo-ethernet <interface> ip enable-arp-accept

Define behavior for gratuitous ARP frames whose IP is not already present in the ARP table. If configured
create new entries in the ARP table.
Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on.
If the ARP table already contains the IP address of the gratuitous arp frame, the arp table will be updated
regardless if this setting is on or off.

set interfaces pseudo-ethernet peth0 ip enable-arp-accept

set interfaces pseudo-ethernet <interface> ip enable-arp-announce

Define different restriction levels for announcing the local source IP address from IP packets in ARP requests
sent on interface.
Use any local address, configured on any interface if this is not set.
If configured, try to avoid local addresses that are not in the target’s subnet for this interface. This mode is
useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of
their logical network configured on the receiving interface. When we generate the request we will check all our
subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no
such subnet we select source address according to the rules for level 2.

set interfaces pseudo-ethernet peth0 ip enable-arp-announce

set interfaces pseudo-ethernet <interface> ip enable-arp-ignore

Define different modes for sending replies in response to received ARP requests that resolve local target IP
addresses:

8.4. Interfaces 607

 VyOS Documentation, Release 1.5.x (circinus)

If configured, reply only if the target IP address is local address configured on the incoming interface.
If this option is unset (default), reply for any local target IP address, configured on any interface.

set interfaces pseudo-ethernet peth0 ip enable-arp-ignore

set interfaces pseudo-ethernet <interface> ip enable-proxy-arp

Use this command to enable proxy Address Resolution Protocol (ARP) on this interface. Proxy ARP allows
an Ethernet interface to respond with its own MAC address to ARP requests for destination IP addresses on
subnets attached to other interfaces on the system. Subsequent packets sent to those destination IP addresses
are forwarded appropriately by the system.
Example:

set interfaces pseudo-ethernet peth0 ip enable-proxy-arp

set interfaces pseudo-ethernet <interface> ip proxy-arp-pvlan

Private VLAN proxy arp. Basically allow proxy arp replies back to the same interface (from which the ARP
request/solicitation was received).
This is done to support (ethernet) switch features, like RFC 3069, where the individual ports are NOT allowed
to communicate with each other, but they are allowed to talk to the upstream router. As described in RFC 3069,
it is possible to allow these hosts to communicate through the upstream router by proxy_arp’ing.

Note: Does not need to be used together with proxy_arp.

This technology is known by different names:

• In RFC 3069 it is called VLAN Aggregation
• Cisco and Allied Telesyn call it Private VLAN
• Hewlett-Packard call it Source-Port filtering or port-isolation
• Ericsson call it MAC-Forced Forwarding (RFC Draft)
set interfaces pseudo-ethernet <interface> ip source-validation <strict | loose |
disable>
Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.
• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation
set interfaces pseudo-ethernet <interface> ipv6 address autoconf
SLAAC RFC 4862. IPv6 hosts can configure themselves automatically when connected to an IPv6 network us-
ing the Neighbor Discovery Protocol via ICMPv6 router discovery messages. When first connected to a network,
a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to
such a request with a router advertisement packet that contains Internet Layer configuration parameters.

8.4. Interfaces 608

 VyOS Documentation, Release 1.5.x (circinus)

Note: This method automatically disables IPv6 traffic forwarding on the interface in question.

Example:

set interfaces pseudo-ethernet peth0 ipv6 address autoconf

set interfaces pseudo-ethernet <interface> ipv6 address eui64 <prefix>

EUI-64 as specified in RFC 4291 allows a host to assign iteslf a unique 64-Bit IPv6 address.
Example:

set interfaces pseudo-ethernet peth0 ipv6 address eui64 2001:db8:beef::/64

set interfaces pseudo-ethernet <interface> ipv6 address no-default-link-local

Do not assign a link-local IPv6 address to this interface.
Example:

set interfaces pseudo-ethernet peth0 ipv6 address no-default-link-local

set interfaces pseudo-ethernet <interface> ipv6 disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
Example:

set interfaces pseudo-ethernet peth0 ipv6 disable-forwarding

set interfaces pseudo-ethernet <interface> ipv6 adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss6 <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces pseudo-ethernet <interface> ipv6 accept-dad <1-3>
Whether to accept DAD (Duplicate Address Detection).
• 0: Disable DAD
• 1: Enable DAD (default)
• 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate link-local address has been found.
Example:

8.4. Interfaces 609

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces pseudo-ethernet peth0 ipv6 accept-dad 2

set interfaces pseudo-ethernet <interface> ipv6 dup-addr-detect-transmits <n>

The amount of Duplicate Address Detection probes to send.
Default: 1
Example:

set interfaces pseudo-ethernet peth0 ipv6 dup-addr-detect-transmits 5

set interfaces pseudo-ethernet <interface> vrf <vrf>

Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces pseudo-ethernet peth0 vrf red

DHCP(v6)
set interfaces pseudo-ethernet <interface> dhcp-options client-id <description>
RFC 2131 states: The client MAY choose to explicitly provide the identifier through the ‘client identifier’
option. If the client supplies a ‘client identifier’, the client MUST use the same ‘client identifier’ in all subsequent
messages, and the server MUST use that identifier to identify the client.
Example:

set interfaces pseudo-ethernet peth0 dhcp-options client-id 'foo-bar'

set interfaces pseudo-ethernet <interface> dhcp-options host-name <hostname>

Instead of sending the real system hostname to the DHCP server, overwrite the host-name with this given-value.
Example:

set interfaces pseudo-ethernet peth0 dhcp-options host-name 'VyOS'

set interfaces pseudo-ethernet <interface> dhcp-options vendor-class-id <vendor-id>

This option is used by some DHCP clients to identify the vendor type and possibly the configuration of a DHCP
client. The information is a string of bytes whose contents are specific to the vendor and are not specified in a
standard.
The vendor-class-id option can be used to request a specific class of vendor options from the server.
Example:

set interfaces pseudo-ethernet peth0 dhcp-options vendor-class-id 'VyOS'

set interfaces pseudo-ethernet <interface> dhcp-options no-default-route

Only request an address from the DHCP server but do not request a default gateway.
Example:

8.4. Interfaces 610

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces pseudo-ethernet peth0 dhcp-options no-default-route

set interfaces pseudo-ethernet <interface> dhcp-options default-route-distance <distance>

Set the distance for the default gateway sent by the DHCP server.
Example:

set interfaces pseudo-ethernet peth0 dhcp-options default-route-distance 220

set interfaces pseudo-ethernet <interface> dhcp-options reject <address>

Reject DHCP leases from a given address or range. This is useful when a modem gives a local IP when first
starting.
• address can be specified multiple times, e.g. 192.168.100.1 and/or 192.168.100.0/24
Example:

set interfaces pseudo-ethernet peth0 dhcp-options reject 192.168.100.0/24

set interfaces pseudo-ethernet <interface> dhcp-options user-class <string>

This option is used by some DHCP clients as a way for users to specify identifying information to the client.
This can be used in a similar way to the vendor-class-identifier option, but the value of the option is specified
by the user, not the vendor.
Example:

set interfaces pseudo-ethernet peth0 dhcp-options user-class VyOS

set interfaces pseudo-ethernet <interface> dhcpv6-options duid <duid>

The DHCP unique identifier (DUID) is used by a client to get an IP address from a DHCPv6 server. It has a
2-byte DUID type field, and a variable-length identifier field up to 128 bytes. Its actual length depends on its
type. The server compares the DUID with its database and delivers configuration data (address, lease times,
DNS servers, etc.) to the client.

set interfaces pseudo-ethernet peth0 duid

˓→'0e:00:00:01:00:01:27:71:db:f0:00:50:56:bf:c5:6d'

set interfaces pseudo-ethernet <interface> dhcpv6-options no-release

When no-release is specified, dhcp6c will send a release message on client exit to prevent losing an assigned
address or prefix.

set interfaces pseudo-ethernet peth0 dhcpv6-options no-release

set interfaces pseudo-ethernet <interface> dhcpv6-options parameters-only

This statement specifies dhcp6c to only exchange informational configuration parameters with servers. A list of
DNS server addresses is an example of such parameters. This statement is useful when the client does not need
stateful configuration parameters such as IPv6 addresses or prefixes.

set interfaces pseudo-ethernet peth0 dhcpv6-options parameters-only

set interfaces pseudo-ethernet <interface> dhcpv6-options rapid-commit

When rapid-commit is specified, dhcp6c will include a rapid-commit option in solicit messages and wait for an
immediate reply instead of advertisements.

8.4. Interfaces 611

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces pseudo-ethernet peth0 dhcpv6-options rapid-commit

set interfaces pseudo-ethernet <interface> dhcpv6-options temporary

Request only a temporary address and not form an IA_NA (Identity Association for Non-temporary Addresses)
partnership.

set interfaces pseudo-ethernet peth0 dhcpv6-options temporary

DHCPv6 Prefix Delegation (PD)

VyOS 1.3 (equuleus) supports DHCPv6-PD (RFC 3633). DHCPv6 Prefix Delegation is supported by most ISPs who
provide native IPv6 for consumers on fixed networks.
set interfaces pseudo-ethernet <interface> dhcpv6-options pd <id> length <length>
Some ISPs by default only delegate a /64 prefix. To request for a specific prefix size use this option to request
for a bigger delegation for this pd <id>. This value is in the range from 32 - 64 so you could request up to a /32
prefix (if your ISP allows this) down to a /64 delegation.
The default value corresponds to 64.
To request a /56 prefix from your ISP use:

set interfaces pseudo-ethernet peth0 dhcpv6-options pd 0 length 56

set interfaces pseudo-ethernet <interface> dhcpv6-options pd <id> interface <delegatee>

address <address>
Specify the interface address used locally on the interface where the prefix has been delegated to. ID must be a
decimal integer.
It will be combined with the delegated prefix and the sla-id to form a complete interface address. The default is
to use the EUI-64 address of the interface.
Example: Delegate a /64 prefix to interface eth8 which will use a local address on this router of
<prefix>::ffff, as the address 65534 will correspond to ffff in hexadecimal notation.

set interfaces pseudo-ethernet peth0 dhcpv6-options pd 0 interface eth8 address␣

˓→65534

set interfaces pseudo-ethernet <interface> dhcpv6-options pd <id> interface <delegatee>

sla-id <id>
Specify the identifier value of the site-level aggregator (SLA) on the interface. ID must be a decimal number
greater then 0 which fits in the length of SLA IDs (see below).
Example: If ID is 1 and the client is delegated an IPv6 prefix 2001:db8:ffff::/48, dhcp6c will combine the two
values into a single IPv6 prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified interface.

set interfaces pseudo-ethernet peth0 dhcpv6-options pd 0 interface eth8 sla-id 1

8.4. Interfaces 612

 VyOS Documentation, Release 1.5.x (circinus)

Pseudo Ethernet/MACVLAN options

set interfaces pseudo-ethernet <interface> source-interface <ethX>

Specifies the physical <ethX> Ethernet interface associated with a Pseudo Ethernet <interface>.

VLAN

IEEE 802.1q, often referred to as Dot1q, is the networking standard that supports virtual LANs (VLANs) on an IEEE
802.3 Ethernet network. The standard defines a system of VLAN tagging for Ethernet frames and the accompanying
procedures to be used by bridges and switches in handling such frames. The standard also contains provisions for a
quality-of-service prioritization scheme commonly known as IEEE 802.1p and defines the Generic Attribute Registra-
tion Protocol.
Portions of the network which are VLAN-aware (i.e., IEEE 802.1q conformant) can include VLAN tags. When a frame
enters the VLAN-aware portion of the network, a tag is added to represent the VLAN membership. Each frame must
be distinguishable as being within exactly one VLAN. A frame in the VLAN-aware portion of the network that does
not contain a VLAN tag is assumed to be flowing on the native VLAN.
The standard was developed by IEEE 802.1, a working group of the IEEE 802 standards committee, and continues
to be actively revised. One of the notable revisions is 802.1Q-2014 which incorporated IEEE 802.1aq (Shortest Path
Bridging) and much of the IEEE 802.1d standard.
802.1q VLAN interfaces are represented as virtual sub-interfaces in VyOS. The term used for this is vif.
set interfaces pseudo-ethernet <interface> vif <vlan-id>
Create a new VLAN interface on interface <interface> using the VLAN number provided via <vlan-id>.
You can create multiple VLAN interfaces on a physical interface. The VLAN ID range is from 0 to 4094.

Note: Only 802.1Q-tagged packets are accepted on Ethernet vifs.

set interfaces pseudo-ethernet <interface> vif <vlan-id> address <address | dhcp |

dhcpv6>
Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
• dhcp interface address is received by DHCP from a DHCP server on this segment.
• dhcpv6 interface address is received by DHCPv6 from a DHCPv6 server on this segment.

Note: When using DHCP to retrieve IPv4 address and if local customizations are needed, they should be
possible using the enter and exit hooks provided. The hook dirs are:
• /config/scripts/dhcp-client/pre-hooks.d/
• /config/scripts/dhcp-client/post-hooks.d/

Example:

set interfaces pseudo-ethernet peth0 vif 10 address 192.0.2.1/24

set interfaces pseudo-ethernet peth0 vif 10 address 2001:db8::1/64
(continues on next page)

8.4. Interfaces 613

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set interfaces pseudo-ethernet peth0 vif 10 address dhcp
set interfaces pseudo-ethernet peth0 vif 10 address dhcpv6

set interfaces pseudo-ethernet <interface> vif <vlan-id> description <description>

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces pseudo-ethernet peth0 vif 10 description 'This is an awesome␣

˓→interface running on VyOS'

set interfaces pseudo-ethernet <interface> vif <vlan-id> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces pseudo-ethernet peth0 vif 10 disable

set interfaces pseudo-ethernet <interface> vif <vlan-id> disable-link-detect

Use this command to direct an interface to not detect any physical state changes on a link, for example, when
the cable is unplugged.
Default is to detects physical link state changes.
Example:

set interfaces pseudo-ethernet peth0 vif 10 disable-link-detect

set interfaces pseudo-ethernet <interface> vif <vlan-id> mac <xx:xx:xx:xx:xx:xx>

Configure user defined MAC address on given <interface>.
Example:

set interfaces pseudo-ethernet peth0 vif 10 mac '00:53:01:02:03:04'

set interfaces pseudo-ethernet <interface> vif <vlan-id> mtu <mtu>

Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

set interfaces pseudo-ethernet peth0 vif 10 mtu 1600

set interfaces pseudo-ethernet <interface> vif <vlan-id> ip adjust-mss <mss |

clamp-mss-to-pmtu>
As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

8.4. Interfaces 614

 VyOS Documentation, Release 1.5.x (circinus)

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces pseudo-ethernet <interface> vif <vlan-id> ip arp-cache-timeout
Once a neighbor has been found, the entry is considered to be valid for at least for this specific time. An entry’s
validity will be extended if it receives positive feedback from higher level protocols.
This defaults to 30 seconds.
Example:

set interfaces pseudo-ethernet peth0 vif 10 ip arp-cache-timeout 180

set interfaces pseudo-ethernet <interface> vif <vlan-id> ip disable-arp-filter

If set the kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but
it usually makes sense, because it increases the chance of successful communication. IP addresses are owned
by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing,
does this behaviour cause problems.
If not set (default) allows you to have multiple network interfaces on the same subnet, and have the ARPs for
each interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that
interface (therefore you must use source based routing for this to work).
In other words it allows control of which cards (usually 1) will respond to an arp request.
Example:

set interfaces pseudo-ethernet peth0 vif 10 ip disable-arp-filter

set interfaces pseudo-ethernet <interface> vif <vlan-id> ip disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

set interfaces pseudo-ethernet peth0 vif 10 ip disable-forwarding

set interfaces pseudo-ethernet <interface> vif <vlan-id> ip enable-directed-broadcast

Define different modes for IP directed broadcast forwarding as described in RFC 1812 and RFC 2644.
If configured, incoming IP directed broadcast packets on this interface will be forwarded.
If this option is unset (default), incoming IP directed broadcast packets will not be forwarded.

set interfaces pseudo-ethernet peth0 vif 10 ip enable-directed-broadcast

set interfaces pseudo-ethernet <interface> vif <vlan-id> ip enable-arp-accept

Define behavior for gratuitous ARP frames whose IP is not already present in the ARP table. If configured
create new entries in the ARP table.
Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on.
If the ARP table already contains the IP address of the gratuitous arp frame, the arp table will be updated
regardless if this setting is on or off.

set interfaces pseudo-ethernet peth0 vif 10 ip enable-arp-accept

8.4. Interfaces 615

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces pseudo-ethernet <interface> vif <vlan-id> ip enable-arp-announce

Define different restriction levels for announcing the local source IP address from IP packets in ARP requests
sent on interface.
Use any local address, configured on any interface if this is not set.
If configured, try to avoid local addresses that are not in the target’s subnet for this interface. This mode is
useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of
their logical network configured on the receiving interface. When we generate the request we will check all our
subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no
such subnet we select source address according to the rules for level 2.

set interfaces pseudo-ethernet peth0 vif 10 ip enable-arp-announce

set interfaces pseudo-ethernet <interface> vif <vlan-id> ip enable-arp-ignore

Define different modes for sending replies in response to received ARP requests that resolve local target IP
addresses:
If configured, reply only if the target IP address is local address configured on the incoming interface.
If this option is unset (default), reply for any local target IP address, configured on any interface.

set interfaces pseudo-ethernet peth0 vif 10 ip enable-arp-ignore

set interfaces pseudo-ethernet <interface> vif <vlan-id> ip enable-proxy-arp

Use this command to enable proxy Address Resolution Protocol (ARP) on this interface. Proxy ARP allows
an Ethernet interface to respond with its own MAC address to ARP requests for destination IP addresses on
subnets attached to other interfaces on the system. Subsequent packets sent to those destination IP addresses
are forwarded appropriately by the system.
Example:

set interfaces pseudo-ethernet peth0 vif 10 ip enable-proxy-arp

set interfaces pseudo-ethernet <interface> vif <vlan-id> ip proxy-arp-pvlan

Private VLAN proxy arp. Basically allow proxy arp replies back to the same interface (from which the ARP
request/solicitation was received).
This is done to support (ethernet) switch features, like RFC 3069, where the individual ports are NOT allowed
to communicate with each other, but they are allowed to talk to the upstream router. As described in RFC 3069,
it is possible to allow these hosts to communicate through the upstream router by proxy_arp’ing.

Note: Does not need to be used together with proxy_arp.

This technology is known by different names:

• In RFC 3069 it is called VLAN Aggregation
• Cisco and Allied Telesyn call it Private VLAN
• Hewlett-Packard call it Source-Port filtering or port-isolation
• Ericsson call it MAC-Forced Forwarding (RFC Draft)
set interfaces pseudo-ethernet <interface> vif <vlan-id> ip source-validation <strict |
loose | disable>

8.4. Interfaces 616

 VyOS Documentation, Release 1.5.x (circinus)

Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.
• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation
set interfaces pseudo-ethernet <interface> vif <vlan-id> ipv6 address autoconf
SLAAC RFC 4862. IPv6 hosts can configure themselves automatically when connected to an IPv6 network us-
ing the Neighbor Discovery Protocol via ICMPv6 router discovery messages. When first connected to a network,
a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to
such a request with a router advertisement packet that contains Internet Layer configuration parameters.

Note: This method automatically disables IPv6 traffic forwarding on the interface in question.

Example:

set interfaces pseudo-ethernet peth0 vif 10 ipv6 address autoconf

set interfaces pseudo-ethernet <interface> vif <vlan-id> ipv6 address eui64 <prefix>
EUI-64 as specified in RFC 4291 allows a host to assign iteslf a unique 64-Bit IPv6 address.
Example:

set interfaces pseudo-ethernet peth0 vif 10 ipv6 address eui64 2001:db8:beef::/64

set interfaces pseudo-ethernet <interface> vif <vlan-id> ipv6 address

no-default-link-local
Do not assign a link-local IPv6 address to this interface.
Example:

set interfaces pseudo-ethernet peth0 vif 10 ipv6 address no-default-link-local

set interfaces pseudo-ethernet <interface> vif <vlan-id> ipv6 disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
Example:

set interfaces pseudo-ethernet peth0 vif 10 ipv6 disable-forwarding

set interfaces pseudo-ethernet <interface> vif <vlan-id> ipv6 adjust-mss <mss |

clamp-mss-to-pmtu>
As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

8.4. Interfaces 617

 VyOS Documentation, Release 1.5.x (circinus)

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss6 <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces pseudo-ethernet <interface> vif <vlan-id> ipv6 accept-dad <1-3>
Whether to accept DAD (Duplicate Address Detection).
• 0: Disable DAD
• 1: Enable DAD (default)
• 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate link-local address has been found.
Example:

set interfaces pseudo-ethernet peth0 vif 10 ipv6 accept-dad 2

set interfaces pseudo-ethernet <interface> vif <vlan-id> ipv6 dup-addr-detect-transmits

<n>
The amount of Duplicate Address Detection probes to send.
Default: 1
Example:

set interfaces pseudo-ethernet peth0 vif 10 ipv6 dup-addr-detect-transmits 5

set interfaces pseudo-ethernet <interface> vif <vlan-id> vrf <vrf>

Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces pseudo-ethernet peth0 vif 10 vrf red

DHCP(v6)
set interfaces pseudo-ethernet <interface> vif <vlan-id> dhcp-options client-id
<description>
RFC 2131 states: The client MAY choose to explicitly provide the identifier through the ‘client identifier’
option. If the client supplies a ‘client identifier’, the client MUST use the same ‘client identifier’ in all subsequent
messages, and the server MUST use that identifier to identify the client.
Example:

set interfaces pseudo-ethernet peth0 vif 10 dhcp-options client-id 'foo-bar'

set interfaces pseudo-ethernet <interface> vif <vlan-id> dhcp-options host-name

<hostname>

8.4. Interfaces 618

 VyOS Documentation, Release 1.5.x (circinus)

Instead of sending the real system hostname to the DHCP server, overwrite the host-name with this given-value.
Example:

set interfaces pseudo-ethernet peth0 vif 10 dhcp-options host-name 'VyOS'

set interfaces pseudo-ethernet <interface> vif <vlan-id> dhcp-options vendor-class-id

<vendor-id>
This option is used by some DHCP clients to identify the vendor type and possibly the configuration of a DHCP
client. The information is a string of bytes whose contents are specific to the vendor and are not specified in a
standard.
The vendor-class-id option can be used to request a specific class of vendor options from the server.
Example:

set interfaces pseudo-ethernet peth0 vif 10 dhcp-options vendor-class-id 'VyOS'

set interfaces pseudo-ethernet <interface> vif <vlan-id> dhcp-options no-default-route

Only request an address from the DHCP server but do not request a default gateway.
Example:

set interfaces pseudo-ethernet peth0 vif 10 dhcp-options no-default-route

set interfaces pseudo-ethernet <interface> vif <vlan-id> dhcp-options

default-route-distance <distance>
Set the distance for the default gateway sent by the DHCP server.
Example:

set interfaces pseudo-ethernet peth0 vif 10 dhcp-options default-route-distance 220

set interfaces pseudo-ethernet <interface> vif <vlan-id> dhcp-options reject <address>

Reject DHCP leases from a given address or range. This is useful when a modem gives a local IP when first
starting.
• address can be specified multiple times, e.g. 192.168.100.1 and/or 192.168.100.0/24
Example:

set interfaces pseudo-ethernet peth0 vif 10 dhcp-options reject 192.168.100.0/24

set interfaces pseudo-ethernet <interface> vif <vlan-id> dhcp-options user-class <string>

This option is used by some DHCP clients as a way for users to specify identifying information to the client.
This can be used in a similar way to the vendor-class-identifier option, but the value of the option is specified
by the user, not the vendor.
Example:

set interfaces pseudo-ethernet peth0 vif 10 dhcp-options user-class VyOS

set interfaces pseudo-ethernet <interface> vif <vlan-id> dhcpv6-options duid <duid>

The DHCP unique identifier (DUID) is used by a client to get an IP address from a DHCPv6 server. It has a
2-byte DUID type field, and a variable-length identifier field up to 128 bytes. Its actual length depends on its

8.4. Interfaces 619

 VyOS Documentation, Release 1.5.x (circinus)

type. The server compares the DUID with its database and delivers configuration data (address, lease times,
DNS servers, etc.) to the client.

set interfaces pseudo-ethernet peth0 vif 10 duid

˓→'0e:00:00:01:00:01:27:71:db:f0:00:50:56:bf:c5:6d'

set interfaces pseudo-ethernet <interface> vif <vlan-id> dhcpv6-options no-release

When no-release is specified, dhcp6c will send a release message on client exit to prevent losing an assigned
address or prefix.

set interfaces pseudo-ethernet peth0 vif 10 dhcpv6-options no-release

set interfaces pseudo-ethernet <interface> vif <vlan-id> dhcpv6-options parameters-only

This statement specifies dhcp6c to only exchange informational configuration parameters with servers. A list of
DNS server addresses is an example of such parameters. This statement is useful when the client does not need
stateful configuration parameters such as IPv6 addresses or prefixes.

set interfaces pseudo-ethernet peth0 vif 10 dhcpv6-options parameters-only

set interfaces pseudo-ethernet <interface> vif <vlan-id> dhcpv6-options rapid-commit

When rapid-commit is specified, dhcp6c will include a rapid-commit option in solicit messages and wait for an
immediate reply instead of advertisements.

set interfaces pseudo-ethernet peth0 vif 10 dhcpv6-options rapid-commit

set interfaces pseudo-ethernet <interface> vif <vlan-id> dhcpv6-options temporary

Request only a temporary address and not form an IA_NA (Identity Association for Non-temporary Addresses)
partnership.

set interfaces pseudo-ethernet peth0 vif 10 dhcpv6-options temporary

DHCPv6 Prefix Delegation (PD)

VyOS 1.3 (equuleus) supports DHCPv6-PD (RFC 3633). DHCPv6 Prefix Delegation is supported by most ISPs who
provide native IPv6 for consumers on fixed networks.
set interfaces pseudo-ethernet <interface> vif <vlan-id> dhcpv6-options pd <id> length
<length>
Some ISPs by default only delegate a /64 prefix. To request for a specific prefix size use this option to request
for a bigger delegation for this pd <id>. This value is in the range from 32 - 64 so you could request up to a /32
prefix (if your ISP allows this) down to a /64 delegation.
The default value corresponds to 64.
To request a /56 prefix from your ISP use:

set interfaces pseudo-ethernet peth0 vif 10 dhcpv6-options pd 0 length 56

set interfaces pseudo-ethernet <interface> vif <vlan-id> dhcpv6-options pd <id> interface

<delegatee> address <address>
Specify the interface address used locally on the interface where the prefix has been delegated to. ID must be a
decimal integer.
It will be combined with the delegated prefix and the sla-id to form a complete interface address. The default is
to use the EUI-64 address of the interface.

8.4. Interfaces 620

 VyOS Documentation, Release 1.5.x (circinus)

Example: Delegate a /64 prefix to interface eth8 which will use a local address on this router of
<prefix>::ffff, as the address 65534 will correspond to ffff in hexadecimal notation.

set interfaces pseudo-ethernet peth0 vif 10 dhcpv6-options pd 0 interface eth8␣

˓→address 65534

set interfaces pseudo-ethernet <interface> vif <vlan-id> dhcpv6-options pd <id> interface

<delegatee> sla-id <id>
Specify the identifier value of the site-level aggregator (SLA) on the interface. ID must be a decimal number
greater then 0 which fits in the length of SLA IDs (see below).
Example: If ID is 1 and the client is delegated an IPv6 prefix 2001:db8:ffff::/48, dhcp6c will combine the two
values into a single IPv6 prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified interface.

set interfaces pseudo-ethernet peth0 vif 10 dhcpv6-options pd 0 interface eth8 sla-

˓→id 1

8.4.13 SSTP Client

SSTP (Secure Socket Tunneling Protocol) is a form of VTP (Virtual Private Network) tunnel that provides a mechanism
to transport PPP traffic through an SSL/TLS channel. SSL/TLS provides transport-level security with key negotiation,
encryption and traffic integrity checking. The use of SSL/TLS over TCP port 443 (by default, port can be changed)
allows SSTP to pass through virtually all firewalls and proxy servers except for authenticated web proxies.

Note: VyOS also comes with a build in SSTP server, see SSTP Server.

Configuration

Common interface configuration

set interfaces sstpc <interface> description <description>

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces sstpc sstpc0 description 'This is an awesome interface running on␣
˓→VyOS'

set interfaces sstpc <interface> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces sstpc sstpc0 disable

set interfaces sstpc <interface> mtu <mtu>

Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

8.4. Interfaces 621

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces sstpc sstpc0 mtu 1600

set interfaces sstpc <interface> vrf <vrf>

Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces sstpc sstpc0 vrf red

SSTP Client Options

set interfaces sstpc <interface> no-default-route

Only request an address from the SSTP server but do not install any default route.
Example:

set interfaces sstpc sstpc0 no-default-route

Note: This command got added in VyOS 1.4 and inverts the logic from the old default-route CLI option.

set interfaces sstpc <interface> default-route-distance <distance>

Set the distance for the default gateway sent by the SSTP server.
Example:

set interfaces sstpc sstpc0 default-route-distance 220

set interfaces sstpc <interface> no-peer-dns

Use this command to not install advertised DNS nameservers into the local system.
set interfaces sstpc <interface> server <address>
SSTP remote server to connect to. Can be either an IP address or FQDN.
set interfaces sstpc <interface> ip adjust-mss <mss | clamp-mss-to-pmtu>
As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.

8.4. Interfaces 622

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces sstpc <interface> ip disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
set interfaces sstpc <interface> ip source-validation <strict | loose | disable>
Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.
• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation

Operation

show interfaces sstpc <interface>

Show detailed information on given <interface>

vyos@vyos:~$ show interfaces sstpc sstpc10

sstpc10: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state␣
˓→UNKNOWN group default qlen 3

link/ppp
inet 192.0.2.5 peer 192.0.2.254/32 scope global sstpc10
valid_lft forever preferred_lft forever
inet6 fe80::fd53:c7ff:fe8b:144f/64 scope link
valid_lft forever preferred_lft forever

RX: bytes packets errors dropped overrun mcast

215 9 0 0 0 0
TX: bytes packets errors dropped carrier collisions
539 14 0 0 0 0

Connect/Disconnect

disconnect interface <interface>

Test disconnecting given connection-oriented interface. <interface> can be sstpc0 as the example.
connect interface <interface>
Test connecting given connection-oriented interface. <interface> can be sstpc0 as the example.

8.4. Interfaces 623

 VyOS Documentation, Release 1.5.x (circinus)

8.4.14 Tunnel

This article touches on ‘classic’ IP tunneling protocols.

GRE is often seen as a one size fits all solution when it comes to classic IP tunneling protocols, and for a good reason.
However, there are more specialized options, and many of them are supported by VyOS. There are also rather obscure
GRE options that can be useful.
All those protocols are grouped under interfaces tunnel in VyOS. Let’s take a closer look at the protocols and
options currently supported by VyOS.

Common interface configuration

set interfaces tunnel <interface> address <address>

Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
Example:

set interfaces tunnel tun0 address 192.0.2.1/24

set interfaces tunnel tun0 address 2001:db8::1/64

set interfaces tunnel <interface> description <description>

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces tunnel tun0 description 'This is an awesome interface running on VyOS
˓→'

set interfaces tunnel <interface> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces tunnel tun0 disable

set interfaces tunnel <interface> disable-flow-control

Ethernet flow control is a mechanism for temporarily stopping the transmission of data on Ethernet family com-
puter networks. The goal of this mechanism is to ensure zero packet loss in the presence of network congestion.
The first flow control mechanism, the pause frame, was defined by the IEEE 802.3x standard.
A sending station (computer or network switch) may be transmitting data faster than the other end of the link can
accept it. Using flow control, the receiving station can signal the sender requesting suspension of transmissions
until the receiver catches up.
Use this command to disable the generation of Ethernet flow control (pause frames).
Example:

set interfaces tunnel tun0 disable-flow-control

set interfaces tunnel <interface> disable-link-detect

8.4. Interfaces 624

 VyOS Documentation, Release 1.5.x (circinus)

Use this command to direct an interface to not detect any physical state changes on a link, for example, when
the cable is unplugged.
Default is to detects physical link state changes.
Example:

set interfaces tunnel tun0 disable-link-detect

set interfaces tunnel <interface> mtu <mtu>

Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

set interfaces tunnel tun0 mtu 1600

set interfaces tunnel <interface> ip adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces tunnel <interface> ip arp-cache-timeout
Once a neighbor has been found, the entry is considered to be valid for at least for this specific time. An entry’s
validity will be extended if it receives positive feedback from higher level protocols.
This defaults to 30 seconds.
Example:

set interfaces tunnel tun0 ip arp-cache-timeout 180

set interfaces tunnel <interface> ip disable-arp-filter

If set the kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but
it usually makes sense, because it increases the chance of successful communication. IP addresses are owned
by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing,
does this behaviour cause problems.
If not set (default) allows you to have multiple network interfaces on the same subnet, and have the ARPs for
each interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that
interface (therefore you must use source based routing for this to work).
In other words it allows control of which cards (usually 1) will respond to an arp request.
Example:

set interfaces tunnel tun0 ip disable-arp-filter

set interfaces tunnel <interface> ip disable-forwarding

8.4. Interfaces 625

 VyOS Documentation, Release 1.5.x (circinus)

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

set interfaces tunnel tun0 ip disable-forwarding

set interfaces tunnel <interface> ip enable-directed-broadcast

Define different modes for IP directed broadcast forwarding as described in RFC 1812 and RFC 2644.
If configured, incoming IP directed broadcast packets on this interface will be forwarded.
If this option is unset (default), incoming IP directed broadcast packets will not be forwarded.

set interfaces tunnel tun0 ip enable-directed-broadcast

set interfaces tunnel <interface> ip enable-arp-accept

Define behavior for gratuitous ARP frames whose IP is not already present in the ARP table. If configured
create new entries in the ARP table.
Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on.
If the ARP table already contains the IP address of the gratuitous arp frame, the arp table will be updated
regardless if this setting is on or off.

set interfaces tunnel tun0 ip enable-arp-accept

set interfaces tunnel <interface> ip enable-arp-announce

Define different restriction levels for announcing the local source IP address from IP packets in ARP requests
sent on interface.
Use any local address, configured on any interface if this is not set.
If configured, try to avoid local addresses that are not in the target’s subnet for this interface. This mode is
useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of
their logical network configured on the receiving interface. When we generate the request we will check all our
subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no
such subnet we select source address according to the rules for level 2.

set interfaces tunnel tun0 ip enable-arp-announce

set interfaces tunnel <interface> ip enable-arp-ignore

Define different modes for sending replies in response to received ARP requests that resolve local target IP
addresses:
If configured, reply only if the target IP address is local address configured on the incoming interface.
If this option is unset (default), reply for any local target IP address, configured on any interface.

set interfaces tunnel tun0 ip enable-arp-ignore

set interfaces tunnel <interface> ip enable-proxy-arp

Use this command to enable proxy Address Resolution Protocol (ARP) on this interface. Proxy ARP allows
an Ethernet interface to respond with its own MAC address to ARP requests for destination IP addresses on
subnets attached to other interfaces on the system. Subsequent packets sent to those destination IP addresses
are forwarded appropriately by the system.
Example:

8.4. Interfaces 626

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces tunnel tun0 ip enable-proxy-arp

set interfaces tunnel <interface> ip proxy-arp-pvlan

Private VLAN proxy arp. Basically allow proxy arp replies back to the same interface (from which the ARP
request/solicitation was received).
This is done to support (ethernet) switch features, like RFC 3069, where the individual ports are NOT allowed
to communicate with each other, but they are allowed to talk to the upstream router. As described in RFC 3069,
it is possible to allow these hosts to communicate through the upstream router by proxy_arp’ing.

Note: Does not need to be used together with proxy_arp.

This technology is known by different names:

• In RFC 3069 it is called VLAN Aggregation
• Cisco and Allied Telesyn call it Private VLAN
• Hewlett-Packard call it Source-Port filtering or port-isolation
• Ericsson call it MAC-Forced Forwarding (RFC Draft)
set interfaces tunnel <interface> ip source-validation <strict | loose | disable>
Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.
• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation
set interfaces tunnel <interface> ipv6 address autoconf
SLAAC RFC 4862. IPv6 hosts can configure themselves automatically when connected to an IPv6 network us-
ing the Neighbor Discovery Protocol via ICMPv6 router discovery messages. When first connected to a network,
a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to
such a request with a router advertisement packet that contains Internet Layer configuration parameters.

Note: This method automatically disables IPv6 traffic forwarding on the interface in question.

Example:

set interfaces tunnel tun0 ipv6 address autoconf

set interfaces tunnel <interface> ipv6 address eui64 <prefix>

EUI-64 as specified in RFC 4291 allows a host to assign iteslf a unique 64-Bit IPv6 address.
Example:

set interfaces tunnel tun0 ipv6 address eui64 2001:db8:beef::/64

set interfaces tunnel <interface> ipv6 address no-default-link-local

8.4. Interfaces 627

 VyOS Documentation, Release 1.5.x (circinus)

Do not assign a link-local IPv6 address to this interface.

Example:

set interfaces tunnel tun0 ipv6 address no-default-link-local

set interfaces tunnel <interface> ipv6 disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
Example:

set interfaces tunnel tun0 ipv6 disable-forwarding

set interfaces tunnel <interface> ipv6 adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss6 <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces tunnel <interface> ipv6 accept-dad <1-3>
Whether to accept DAD (Duplicate Address Detection).
• 0: Disable DAD
• 1: Enable DAD (default)
• 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate link-local address has been found.
Example:

set interfaces tunnel tun0 ipv6 accept-dad 2

set interfaces tunnel <interface> ipv6 dup-addr-detect-transmits <n>

The amount of Duplicate Address Detection probes to send.
Default: 1
Example:

set interfaces tunnel tun0 ipv6 dup-addr-detect-transmits 5

set interfaces tunnel <interface> vrf <vrf>

Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

8.4. Interfaces 628

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces tunnel tun0 vrf red

IPIP

This is one of the simplest types of tunnels, as defined by RFC 2003. It takes an IPv4 packet and sends it as a payload
of another IPv4 packet. For this reason, there are no other configuration options for this kind of tunnel.
An example:

set interfaces tunnel tun0 encapsulation ipip

set interfaces tunnel tun0 source-address 192.0.2.10
set interfaces tunnel tun0 remote 203.0.113.20
set interfaces tunnel tun0 address 192.168.100.200/24

IP6IP6

This is the IPv6 counterpart of IPIP. I’m not aware of an RFC that defines this encapsulation specifically, but it’s a
natural specific case of IPv6 encapsulation mechanisms described in :rfc:2473`.
It’s not likely that anyone will need it any time soon, but it does exist.
An example:

set interfaces tunnel tun0 encapsulation ip6ip6

set interfaces tunnel tun0 source-address 2001:db8:aa::1
set interfaces tunnel tun0 remote 2001:db8:aa::2
set interfaces tunnel tun0 address 2001:db8:bb::1/64

IPIP6

In the future this is expected to be a very useful protocol (though there are other proposals).
As the name implies, it’s IPv4 encapsulated in IPv6, as simple as that.
An example:

set interfaces tunnel tun0 encapsulation ipip6

set interfaces tunnel tun0 source-address 2001:db8:aa::1
set interfaces tunnel tun0 remote 2001:db8:aa::2
set interfaces tunnel tun0 address 192.168.70.80/24

6in4 (SIT)

6in4 uses tunneling to encapsulate IPv6 traffic over IPv4 links as defined in RFC 4213. The 6in4 traffic is sent over
IPv4 inside IPv4 packets whose IP headers have the IP protocol number set to 41. This protocol number is specifically
designated for IPv6 encapsulation, the IPv4 packet header is immediately followed by the IPv6 packet being carried.
The encapsulation overhead is the size of the IPv4 header of 20 bytes, therefore with an MTU of 1500 bytes, IPv6
packets of 1480 bytes can be sent without fragmentation. This tunneling technique is frequently used by IPv6 tunnel
brokers like Hurricane Electric.
An example:

8.4. Interfaces 629

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces tunnel tun0 encapsulation sit

set interfaces tunnel tun0 source-address 192.0.2.10
set interfaces tunnel tun0 remote 192.0.2.20
set interfaces tunnel tun0 address 2001:db8:bb::1/64

A full example of a Tunnelbroker.net config can be found at here.

Generic Routing Encapsulation (GRE)

A GRE tunnel operates at layer 3 of the OSI model and is represented by IP protocol 47. The main benefit of a GRE
tunnel is that you are able to carry multiple protocols inside the same tunnel. GRE also supports multicast traffic and
supports routing protocols that leverage multicast to form neighbor adjacencies.
A VyOS GRE tunnel can carry both IPv4 and IPv6 traffic and can also be created over either IPv4 (gre) or IPv6 (ip6gre).

Configuration

A basic configuration requires a tunnel source (source-address), a tunnel destination (remote), an encapsulation type
(gre), and an address (ipv4/ipv6). Below is a basic IPv4 only configuration example taken from a VyOS router and a
Cisco IOS router. The main difference between these two configurations is that VyOS requires you explicitly configure
the encapsulation type. The Cisco router defaults to GRE IP otherwise it would have to be configured as well.
VyOS Router:

set interfaces tunnel tun100 address '10.0.0.1/30'

set interfaces tunnel tun100 encapsulation 'gre'
set interfaces tunnel tun100 source-address '198.51.100.2'
set interfaces tunnel tun100 remote '203.0.113.10'

Cisco IOS Router:

interface Tunnel100
ip address 10.0.0.2 255.255.255.252
tunnel source 203.0.113.10
tunnel destination 198.51.100.2

Here is a second example of a dual-stack tunnel over IPv6 between a VyOS router and a Linux host using systemd-
networkd.
VyOS Router:

set interfaces tunnel tun101 address '2001:db8:feed:beef::1/126'

set interfaces tunnel tun101 address '192.168.5.1/30'
set interfaces tunnel tun101 encapsulation 'ip6gre'
set interfaces tunnel tun101 source-address '2001:db8:babe:face::3afe:3'
set interfaces tunnel tun101 remote '2001:db8:9bb:3ce::5'

Linux systemd-networkd:
This requires two files, one to create the device (XXX.netdev) and one to configure the network on the device
(XXX.network)

8.4. Interfaces 630

 VyOS Documentation, Release 1.5.x (circinus)

# cat /etc/systemd/network/gre-example.netdev
[NetDev]
Name=gre-example
Kind=ip6gre
MTUBytes=14180

[Tunnel]
Remote=2001:db8:babe:face::3afe:3

# cat /etc/systemd/network/gre-example.network
[Match]
Name=gre-example

[Network]
Address=2001:db8:feed:beef::2/126

[Address]
Address=192.168.5.2/30

Tunnel keys

GRE is also the only classic protocol that allows creating multiple tunnels with the same source and destination due to
its support for tunnel keys. Despite its name, this feature has nothing to do with security: it’s simply an identifier that
allows routers to tell one tunnel from another.
An example:

set interfaces tunnel tun0 source-address 192.0.2.10

set interfaces tunnel tun0 remote 192.0.2.20
set interfaces tunnel tun0 address 10.40.50.60/24
set interfaces tunnel tun0 parameters ip key 10

set interfaces tunnel tun0 source-address 192.0.2.10

set interfaces tunnel tun0 remote 192.0.2.20
set interfaces tunnel tun0 address 172.16.17.18/24
set interfaces tunnel tun0 parameters ip key 20

GRETAP

While normal GRE is for layer 3, GRETAP is for layer 2. GRETAP can encapsulate Ethernet frames, thus it can be
bridged with other interfaces to create datalink layer segments that span multiple remote sites.

set interfaces bridge br0 member interface eth0

set interfaces bridge br0 member interface tun0
set interfaces tunnel tun0 encapsulation gretap
set interfaces tunnel tun0 source-address 198.51.100.2
set interfaces tunnel tun0 remote 203.0.113.10

8.4. Interfaces 631

 VyOS Documentation, Release 1.5.x (circinus)

Troubleshooting

GRE is a well defined standard that is common in most networks. While not inherently difficult to configure there
are a couple of things to keep in mind to make sure the configuration performs as expected. A common cause for
GRE tunnels to fail to come up correctly include ACL or Firewall configurations that are discarding IP protocol 47 or
blocking your source/destination traffic.
1. Confirm IP connectivity between tunnel source-address and remote:

vyos@vyos:~$ ping 203.0.113.10 interface 198.51.100.2 count 4

PING 203.0.113.10 (203.0.113.10) from 198.51.100.2 : 56(84) bytes of data.
64 bytes from 203.0.113.10: icmp_seq=1 ttl=254 time=0.807 ms
64 bytes from 203.0.113.10: icmp_seq=2 ttl=254 time=1.50 ms
64 bytes from 203.0.113.10: icmp_seq=3 ttl=254 time=0.624 ms
64 bytes from 203.0.113.10: icmp_seq=4 ttl=254 time=1.41 ms

--- 203.0.113.10 ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 3007ms
rtt min/avg/max/mdev = 0.624/1.087/1.509/0.381 ms

2. Confirm the link type has been set to GRE:

vyos@vyos:~$ show interfaces tunnel tun100

tun100@NONE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1476 qdisc noqueue state UNKNOWN group␣
˓→default qlen 1000

link/gre 198.51.100.2 peer 203.0.113.10

inet 10.0.0.1/30 brd 10.0.0.3 scope global tun100
valid_lft forever preferred_lft forever
inet6 fe80::5efe:c612:2/64 scope link
valid_lft forever preferred_lft forever

RX: bytes packets errors dropped overrun mcast

2183 27 0 0 0 0
TX: bytes packets errors dropped carrier collisions
836 9 0 0 0 0

3. Confirm IP connectivity across the tunnel:

vyos@vyos:~$ ping 10.0.0.2 interface 10.0.0.1 count 4

PING 10.0.0.2 (10.0.0.2) from 10.0.0.1 : 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=255 time=1.05 ms
64 bytes from 10.0.0.2: icmp_seq=2 ttl=255 time=1.88 ms
64 bytes from 10.0.0.2: icmp_seq=3 ttl=255 time=1.98 ms
64 bytes from 10.0.0.2: icmp_seq=4 ttl=255 time=1.98 ms

--- 10.0.0.2 ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 3008ms
rtt min/avg/max/mdev = 1.055/1.729/1.989/0.395 ms

Note: There is also a GRE over IPv6 encapsulation available, it is called: ip6gre.

8.4. Interfaces 632

 VyOS Documentation, Release 1.5.x (circinus)

8.4.15 Virtual Ethernet

The veth devices are virtual Ethernet devices. They can act as tunnels between network namespaces to create a bridge
to a physical network device in another namespace or VRF, but can also be used as standalone network devices.

Note: veth interfaces need to be created in pairs - it’s called the peer name

Configuration

Common interface configuration

set interfaces virtual-ethernet <interface> address <address | dhcp | dhcpv6>

Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
• dhcp interface address is received by DHCP from a DHCP server on this segment.
• dhcpv6 interface address is received by DHCPv6 from a DHCPv6 server on this segment.

Note: When using DHCP to retrieve IPv4 address and if local customizations are needed, they should be
possible using the enter and exit hooks provided. The hook dirs are:
• /config/scripts/dhcp-client/pre-hooks.d/
• /config/scripts/dhcp-client/post-hooks.d/

Example:

set interfaces virtual-ethernet veth0 address 192.0.2.1/24

set interfaces virtual-ethernet veth0 address 2001:db8::1/64
set interfaces virtual-ethernet veth0 address dhcp
set interfaces virtual-ethernet veth0 address dhcpv6

set interfaces virtual-ethernet <interface> description <description>

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces virtual-ethernet veth0 description 'This is an awesome interface␣

˓→running on VyOS'

8.4. Interfaces 633

 VyOS Documentation, Release 1.5.x (circinus)

VLAN

Regular VLANs (802.1q)

IEEE 802.1q, often referred to as Dot1q, is the networking standard that supports virtual LANs (VLANs) on an IEEE
802.3 Ethernet network. The standard defines a system of VLAN tagging for Ethernet frames and the accompanying
procedures to be used by bridges and switches in handling such frames. The standard also contains provisions for a
quality-of-service prioritization scheme commonly known as IEEE 802.1p and defines the Generic Attribute Registra-
tion Protocol.
Portions of the network which are VLAN-aware (i.e., IEEE 802.1q conformant) can include VLAN tags. When a frame
enters the VLAN-aware portion of the network, a tag is added to represent the VLAN membership. Each frame must
be distinguishable as being within exactly one VLAN. A frame in the VLAN-aware portion of the network that does
not contain a VLAN tag is assumed to be flowing on the native VLAN.
The standard was developed by IEEE 802.1, a working group of the IEEE 802 standards committee, and continues
to be actively revised. One of the notable revisions is 802.1Q-2014 which incorporated IEEE 802.1aq (Shortest Path
Bridging) and much of the IEEE 802.1d standard.
802.1q VLAN interfaces are represented as virtual sub-interfaces in VyOS. The term used for this is vif.
set interfaces virtual-ethernet <interface> vif <vlan-id>
Create a new VLAN interface on interface <interface> using the VLAN number provided via <vlan-id>.
You can create multiple VLAN interfaces on a physical interface. The VLAN ID range is from 0 to 4094.

Note: Only 802.1Q-tagged packets are accepted on Ethernet vifs.

set interfaces virtual-ethernet <interface> vif <vlan-id> address <address | dhcp |

dhcpv6>
Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
• dhcp interface address is received by DHCP from a DHCP server on this segment.
• dhcpv6 interface address is received by DHCPv6 from a DHCPv6 server on this segment.

Note: When using DHCP to retrieve IPv4 address and if local customizations are needed, they should be
possible using the enter and exit hooks provided. The hook dirs are:
• /config/scripts/dhcp-client/pre-hooks.d/
• /config/scripts/dhcp-client/post-hooks.d/

Example:

set interfaces virtual-ethernet veth0 vif 10 address 192.0.2.1/24

set interfaces virtual-ethernet veth0 vif 10 address 2001:db8::1/64
set interfaces virtual-ethernet veth0 vif 10 address dhcp
set interfaces virtual-ethernet veth0 vif 10 address dhcpv6

set interfaces virtual-ethernet <interface> vif <vlan-id> description <description>

8.4. Interfaces 634

 VyOS Documentation, Release 1.5.x (circinus)

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces virtual-ethernet veth0 vif 10 description 'This is an awesome␣

˓→interface running on VyOS'

set interfaces virtual-ethernet <interface> vif <vlan-id> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces virtual-ethernet veth0 vif 10 disable

set interfaces virtual-ethernet <interface> vif <vlan-id> disable-link-detect

Use this command to direct an interface to not detect any physical state changes on a link, for example, when
the cable is unplugged.
Default is to detects physical link state changes.
Example:

set interfaces virtual-ethernet veth0 vif 10 disable-link-detect

set interfaces virtual-ethernet <interface> vif <vlan-id> mac <xx:xx:xx:xx:xx:xx>

Configure user defined MAC address on given <interface>.
Example:

set interfaces virtual-ethernet veth0 vif 10 mac '00:53:01:02:03:04'

set interfaces virtual-ethernet <interface> vif <vlan-id> mtu <mtu>

Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

set interfaces virtual-ethernet veth0 vif 10 mtu 1600

set interfaces virtual-ethernet <interface> vif <vlan-id> ip adjust-mss <mss |

clamp-mss-to-pmtu>
As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces virtual-ethernet <interface> vif <vlan-id> ip arp-cache-timeout

8.4. Interfaces 635

 VyOS Documentation, Release 1.5.x (circinus)

Once a neighbor has been found, the entry is considered to be valid for at least for this specific time. An entry’s
validity will be extended if it receives positive feedback from higher level protocols.
This defaults to 30 seconds.
Example:

set interfaces virtual-ethernet veth0 vif 10 ip arp-cache-timeout 180

set interfaces virtual-ethernet <interface> vif <vlan-id> ip disable-arp-filter

If set the kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but
it usually makes sense, because it increases the chance of successful communication. IP addresses are owned
by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing,
does this behaviour cause problems.
If not set (default) allows you to have multiple network interfaces on the same subnet, and have the ARPs for
each interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that
interface (therefore you must use source based routing for this to work).
In other words it allows control of which cards (usually 1) will respond to an arp request.
Example:

set interfaces virtual-ethernet veth0 vif 10 ip disable-arp-filter

set interfaces virtual-ethernet <interface> vif <vlan-id> ip disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

set interfaces virtual-ethernet veth0 vif 10 ip disable-forwarding

set interfaces virtual-ethernet <interface> vif <vlan-id> ip enable-directed-broadcast

Define different modes for IP directed broadcast forwarding as described in RFC 1812 and RFC 2644.
If configured, incoming IP directed broadcast packets on this interface will be forwarded.
If this option is unset (default), incoming IP directed broadcast packets will not be forwarded.

set interfaces virtual-ethernet veth0 vif 10 ip enable-directed-broadcast

set interfaces virtual-ethernet <interface> vif <vlan-id> ip enable-arp-accept

Define behavior for gratuitous ARP frames whose IP is not already present in the ARP table. If configured
create new entries in the ARP table.
Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on.
If the ARP table already contains the IP address of the gratuitous arp frame, the arp table will be updated
regardless if this setting is on or off.

set interfaces virtual-ethernet veth0 vif 10 ip enable-arp-accept

set interfaces virtual-ethernet <interface> vif <vlan-id> ip enable-arp-announce

Define different restriction levels for announcing the local source IP address from IP packets in ARP requests
sent on interface.
Use any local address, configured on any interface if this is not set.

8.4. Interfaces 636

 VyOS Documentation, Release 1.5.x (circinus)

If configured, try to avoid local addresses that are not in the target’s subnet for this interface. This mode is
useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of
their logical network configured on the receiving interface. When we generate the request we will check all our
subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no
such subnet we select source address according to the rules for level 2.

set interfaces virtual-ethernet veth0 vif 10 ip enable-arp-announce

set interfaces virtual-ethernet <interface> vif <vlan-id> ip enable-arp-ignore

Define different modes for sending replies in response to received ARP requests that resolve local target IP
addresses:
If configured, reply only if the target IP address is local address configured on the incoming interface.
If this option is unset (default), reply for any local target IP address, configured on any interface.

set interfaces virtual-ethernet veth0 vif 10 ip enable-arp-ignore

set interfaces virtual-ethernet <interface> vif <vlan-id> ip enable-proxy-arp

Use this command to enable proxy Address Resolution Protocol (ARP) on this interface. Proxy ARP allows
an Ethernet interface to respond with its own MAC address to ARP requests for destination IP addresses on
subnets attached to other interfaces on the system. Subsequent packets sent to those destination IP addresses
are forwarded appropriately by the system.
Example:

set interfaces virtual-ethernet veth0 vif 10 ip enable-proxy-arp

set interfaces virtual-ethernet <interface> vif <vlan-id> ip proxy-arp-pvlan

Private VLAN proxy arp. Basically allow proxy arp replies back to the same interface (from which the ARP
request/solicitation was received).
This is done to support (ethernet) switch features, like RFC 3069, where the individual ports are NOT allowed
to communicate with each other, but they are allowed to talk to the upstream router. As described in RFC 3069,
it is possible to allow these hosts to communicate through the upstream router by proxy_arp’ing.

Note: Does not need to be used together with proxy_arp.

This technology is known by different names:

• In RFC 3069 it is called VLAN Aggregation
• Cisco and Allied Telesyn call it Private VLAN
• Hewlett-Packard call it Source-Port filtering or port-isolation
• Ericsson call it MAC-Forced Forwarding (RFC Draft)
set interfaces virtual-ethernet <interface> vif <vlan-id> ip source-validation <strict |
loose | disable>
Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.

8.4. Interfaces 637

 VyOS Documentation, Release 1.5.x (circinus)

• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation
set interfaces virtual-ethernet <interface> vif <vlan-id> ipv6 address autoconf
SLAAC RFC 4862. IPv6 hosts can configure themselves automatically when connected to an IPv6 network us-
ing the Neighbor Discovery Protocol via ICMPv6 router discovery messages. When first connected to a network,
a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to
such a request with a router advertisement packet that contains Internet Layer configuration parameters.

Note: This method automatically disables IPv6 traffic forwarding on the interface in question.

Example:

set interfaces virtual-ethernet veth0 vif 10 ipv6 address autoconf

set interfaces virtual-ethernet <interface> vif <vlan-id> ipv6 address eui64 <prefix>
EUI-64 as specified in RFC 4291 allows a host to assign iteslf a unique 64-Bit IPv6 address.
Example:

set interfaces virtual-ethernet veth0 vif 10 ipv6 address eui64 2001:db8:beef::/64

set interfaces virtual-ethernet <interface> vif <vlan-id> ipv6 address

no-default-link-local
Do not assign a link-local IPv6 address to this interface.
Example:

set interfaces virtual-ethernet veth0 vif 10 ipv6 address no-default-link-local

set interfaces virtual-ethernet <interface> vif <vlan-id> ipv6 disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
Example:

set interfaces virtual-ethernet veth0 vif 10 ipv6 disable-forwarding

set interfaces virtual-ethernet <interface> vif <vlan-id> ipv6 adjust-mss <mss |

clamp-mss-to-pmtu>
As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss6 <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

8.4. Interfaces 638

 VyOS Documentation, Release 1.5.x (circinus)

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces virtual-ethernet <interface> vif <vlan-id> ipv6 accept-dad <1-3>
Whether to accept DAD (Duplicate Address Detection).
• 0: Disable DAD
• 1: Enable DAD (default)
• 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate link-local address has been found.
Example:

set interfaces virtual-ethernet veth0 vif 10 ipv6 accept-dad 2

set interfaces virtual-ethernet <interface> vif <vlan-id> ipv6 dup-addr-detect-transmits

<n>
The amount of Duplicate Address Detection probes to send.
Default: 1
Example:

set interfaces virtual-ethernet veth0 vif 10 ipv6 dup-addr-detect-transmits 5

set interfaces virtual-ethernet <interface> vif <vlan-id> vrf <vrf>

Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces virtual-ethernet veth0 vif 10 vrf red

DHCP(v6)
set interfaces virtual-ethernet <interface> vif <vlan-id> dhcp-options client-id
<description>
RFC 2131 states: The client MAY choose to explicitly provide the identifier through the ‘client identifier’
option. If the client supplies a ‘client identifier’, the client MUST use the same ‘client identifier’ in all subsequent
messages, and the server MUST use that identifier to identify the client.
Example:

set interfaces virtual-ethernet veth0 vif 10 dhcp-options client-id 'foo-bar'

set interfaces virtual-ethernet <interface> vif <vlan-id> dhcp-options host-name

<hostname>
Instead of sending the real system hostname to the DHCP server, overwrite the host-name with this given-value.
Example:

set interfaces virtual-ethernet veth0 vif 10 dhcp-options host-name 'VyOS'

set interfaces virtual-ethernet <interface> vif <vlan-id> dhcp-options vendor-class-id

<vendor-id>

8.4. Interfaces 639

 VyOS Documentation, Release 1.5.x (circinus)

This option is used by some DHCP clients to identify the vendor type and possibly the configuration of a DHCP
client. The information is a string of bytes whose contents are specific to the vendor and are not specified in a
standard.
The vendor-class-id option can be used to request a specific class of vendor options from the server.
Example:

set interfaces virtual-ethernet veth0 vif 10 dhcp-options vendor-class-id 'VyOS'

set interfaces virtual-ethernet <interface> vif <vlan-id> dhcp-options no-default-route

Only request an address from the DHCP server but do not request a default gateway.
Example:

set interfaces virtual-ethernet veth0 vif 10 dhcp-options no-default-route

set interfaces virtual-ethernet <interface> vif <vlan-id> dhcp-options

default-route-distance <distance>
Set the distance for the default gateway sent by the DHCP server.
Example:

set interfaces virtual-ethernet veth0 vif 10 dhcp-options default-route-distance 220

set interfaces virtual-ethernet <interface> vif <vlan-id> dhcp-options reject <address>

Reject DHCP leases from a given address or range. This is useful when a modem gives a local IP when first
starting.
• address can be specified multiple times, e.g. 192.168.100.1 and/or 192.168.100.0/24
Example:

set interfaces virtual-ethernet veth0 vif 10 dhcp-options reject 192.168.100.0/24

set interfaces virtual-ethernet <interface> vif <vlan-id> dhcp-options user-class

<string>
This option is used by some DHCP clients as a way for users to specify identifying information to the client.
This can be used in a similar way to the vendor-class-identifier option, but the value of the option is specified
by the user, not the vendor.
Example:

set interfaces virtual-ethernet veth0 vif 10 dhcp-options user-class VyOS

set interfaces virtual-ethernet <interface> vif <vlan-id> dhcpv6-options duid <duid>

The DHCP unique identifier (DUID) is used by a client to get an IP address from a DHCPv6 server. It has a
2-byte DUID type field, and a variable-length identifier field up to 128 bytes. Its actual length depends on its
type. The server compares the DUID with its database and delivers configuration data (address, lease times,
DNS servers, etc.) to the client.

set interfaces virtual-ethernet veth0 vif 10 duid

˓→'0e:00:00:01:00:01:27:71:db:f0:00:50:56:bf:c5:6d'

set interfaces virtual-ethernet <interface> vif <vlan-id> dhcpv6-options no-release

8.4. Interfaces 640

 VyOS Documentation, Release 1.5.x (circinus)

When no-release is specified, dhcp6c will send a release message on client exit to prevent losing an assigned
address or prefix.

set interfaces virtual-ethernet veth0 vif 10 dhcpv6-options no-release

set interfaces virtual-ethernet <interface> vif <vlan-id> dhcpv6-options parameters-only

This statement specifies dhcp6c to only exchange informational configuration parameters with servers. A list of
DNS server addresses is an example of such parameters. This statement is useful when the client does not need
stateful configuration parameters such as IPv6 addresses or prefixes.

set interfaces virtual-ethernet veth0 vif 10 dhcpv6-options parameters-only

set interfaces virtual-ethernet <interface> vif <vlan-id> dhcpv6-options rapid-commit

When rapid-commit is specified, dhcp6c will include a rapid-commit option in solicit messages and wait for an
immediate reply instead of advertisements.

set interfaces virtual-ethernet veth0 vif 10 dhcpv6-options rapid-commit

set interfaces virtual-ethernet <interface> vif <vlan-id> dhcpv6-options temporary

Request only a temporary address and not form an IA_NA (Identity Association for Non-temporary Addresses)
partnership.

set interfaces virtual-ethernet veth0 vif 10 dhcpv6-options temporary

DHCPv6 Prefix Delegation (PD)

VyOS 1.3 (equuleus) supports DHCPv6-PD (RFC 3633). DHCPv6 Prefix Delegation is supported by most ISPs who
provide native IPv6 for consumers on fixed networks.
set interfaces virtual-ethernet <interface> vif <vlan-id> dhcpv6-options pd <id> length
<length>
Some ISPs by default only delegate a /64 prefix. To request for a specific prefix size use this option to request
for a bigger delegation for this pd <id>. This value is in the range from 32 - 64 so you could request up to a /32
prefix (if your ISP allows this) down to a /64 delegation.
The default value corresponds to 64.
To request a /56 prefix from your ISP use:

set interfaces virtual-ethernet veth0 vif 10 dhcpv6-options pd 0 length 56

set interfaces virtual-ethernet <interface> vif <vlan-id> dhcpv6-options pd <id>

interface <delegatee> address <address>
Specify the interface address used locally on the interface where the prefix has been delegated to. ID must be a
decimal integer.
It will be combined with the delegated prefix and the sla-id to form a complete interface address. The default is
to use the EUI-64 address of the interface.
Example: Delegate a /64 prefix to interface eth8 which will use a local address on this router of
<prefix>::ffff, as the address 65534 will correspond to ffff in hexadecimal notation.

set interfaces virtual-ethernet veth0 vif 10 dhcpv6-options pd 0 interface eth8␣

˓→address 65534

8.4. Interfaces 641

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces virtual-ethernet <interface> vif <vlan-id> dhcpv6-options pd <id>

interface <delegatee> sla-id <id>
Specify the identifier value of the site-level aggregator (SLA) on the interface. ID must be a decimal number
greater then 0 which fits in the length of SLA IDs (see below).
Example: If ID is 1 and the client is delegated an IPv6 prefix 2001:db8:ffff::/48, dhcp6c will combine the two
values into a single IPv6 prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified interface.

set interfaces virtual-ethernet veth0 vif 10 dhcpv6-options pd 0 interface eth8 sla-

˓→id 1

QinQ (802.1ad)

IEEE 802.1ad was an Ethernet networking standard informally known as QinQ as an amendment to IEEE standard
802.1q VLAN interfaces as described above. 802.1ad was incorporated into the base 802.1q standard in 2011. The
technique is also known as provider bridging, Stacked VLANs, or simply QinQ or Q-in-Q. “Q-in-Q” can for supported
devices apply to C-tag stacking on C-tag (Ethernet Type = 0x8100).
The original 802.1q specification allows a single Virtual Local Area Network (VLAN) header to be inserted into an
Ethernet frame. QinQ allows multiple VLAN tags to be inserted into a single frame, an essential capability for im-
plementing Metro Ethernet network topologies. Just as QinQ extends 802.1Q, QinQ itself is extended by other Metro
Ethernet protocols.
In a multiple VLAN header context, out of convenience the term “VLAN tag” or just “tag” for short is often used in
place of “802.1q VLAN header”. QinQ allows multiple VLAN tags in an Ethernet frame; together these tags constitute
a tag stack. When used in the context of an Ethernet frame, a QinQ frame is a frame that has 2 VLAN 802.1q headers
(double-tagged).
In VyOS the terms vif-s and vif-c stand for the ethertype tags that are used.
The inner tag is the tag which is closest to the payload portion of the frame. It is officially called C-TAG (customer tag,
with ethertype 0x8100). The outer tag is the one closer/closest to the Ethernet header, its name is S-TAG (service tag
with Ethernet Type = 0x88a8).
set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> address
<address | dhcp | dhcpv6>
Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
• dhcp interface address is received by DHCP from a DHCP server on this segment.
• dhcpv6 interface address is received by DHCPv6 from a DHCPv6 server on this segment.

Note: When using DHCP to retrieve IPv4 address and if local customizations are needed, they should be
possible using the enter and exit hooks provided. The hook dirs are:
• /config/scripts/dhcp-client/pre-hooks.d/
• /config/scripts/dhcp-client/post-hooks.d/

Example:

8.4. Interfaces 642

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 address 192.0.2.1/24

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 address 2001:db8::1/64
set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 address dhcp
set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 address dhcpv6

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> description

<description>
Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 description 'This is an␣
˓→awesome interface running on VyOS'

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 disable

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id>

disable-link-detect
Use this command to direct an interface to not detect any physical state changes on a link, for example, when
the cable is unplugged.
Default is to detects physical link state changes.
Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 disable-link-detect

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> mac

<xx:xx:xx:xx:xx:xx>
Configure user defined MAC address on given <interface>.
Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 mac '00:53:01:02:03:04'

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> mtu <mtu>
Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 mtu 1600

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip adjust-mss

<mss | clamp-mss-to-pmtu>
As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

8.4. Interfaces 643

 VyOS Documentation, Release 1.5.x (circinus)

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip
arp-cache-timeout
Once a neighbor has been found, the entry is considered to be valid for at least for this specific time. An entry’s
validity will be extended if it receives positive feedback from higher level protocols.
This defaults to 30 seconds.
Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 ip arp-cache-timeout 180

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip

disable-arp-filter
If set the kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but
it usually makes sense, because it increases the chance of successful communication. IP addresses are owned
by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing,
does this behaviour cause problems.
If not set (default) allows you to have multiple network interfaces on the same subnet, and have the ARPs for
each interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that
interface (therefore you must use source based routing for this to work).
In other words it allows control of which cards (usually 1) will respond to an arp request.
Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 ip disable-arp-filter

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip

disable-forwarding
Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 ip disable-forwarding

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip

enable-directed-broadcast
Define different modes for IP directed broadcast forwarding as described in RFC 1812 and RFC 2644.
If configured, incoming IP directed broadcast packets on this interface will be forwarded.
If this option is unset (default), incoming IP directed broadcast packets will not be forwarded.

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 ip enable-directed-

˓→broadcast

8.4. Interfaces 644

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip

enable-arp-accept
Define behavior for gratuitous ARP frames whose IP is not already present in the ARP table. If configured
create new entries in the ARP table.
Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on.
If the ARP table already contains the IP address of the gratuitous arp frame, the arp table will be updated
regardless if this setting is on or off.

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 ip enable-arp-accept

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip

enable-arp-announce
Define different restriction levels for announcing the local source IP address from IP packets in ARP requests
sent on interface.
Use any local address, configured on any interface if this is not set.
If configured, try to avoid local addresses that are not in the target’s subnet for this interface. This mode is
useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of
their logical network configured on the receiving interface. When we generate the request we will check all our
subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no
such subnet we select source address according to the rules for level 2.

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 ip enable-arp-announce

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip

enable-arp-ignore
Define different modes for sending replies in response to received ARP requests that resolve local target IP
addresses:
If configured, reply only if the target IP address is local address configured on the incoming interface.
If this option is unset (default), reply for any local target IP address, configured on any interface.

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 ip enable-arp-ignore

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip

enable-proxy-arp
Use this command to enable proxy Address Resolution Protocol (ARP) on this interface. Proxy ARP allows
an Ethernet interface to respond with its own MAC address to ARP requests for destination IP addresses on
subnets attached to other interfaces on the system. Subsequent packets sent to those destination IP addresses
are forwarded appropriately by the system.
Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 ip enable-proxy-arp

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip

proxy-arp-pvlan
Private VLAN proxy arp. Basically allow proxy arp replies back to the same interface (from which the ARP
request/solicitation was received).

8.4. Interfaces 645

 VyOS Documentation, Release 1.5.x (circinus)

This is done to support (ethernet) switch features, like RFC 3069, where the individual ports are NOT allowed
to communicate with each other, but they are allowed to talk to the upstream router. As described in RFC 3069,
it is possible to allow these hosts to communicate through the upstream router by proxy_arp’ing.

Note: Does not need to be used together with proxy_arp.

This technology is known by different names:

• In RFC 3069 it is called VLAN Aggregation
• Cisco and Allied Telesyn call it Private VLAN
• Hewlett-Packard call it Source-Port filtering or port-isolation
• Ericsson call it MAC-Forced Forwarding (RFC Draft)
set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ip
source-validation <strict | loose | disable>
Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.
• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation
set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6 address
autoconf
SLAAC RFC 4862. IPv6 hosts can configure themselves automatically when connected to an IPv6 network us-
ing the Neighbor Discovery Protocol via ICMPv6 router discovery messages. When first connected to a network,
a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to
such a request with a router advertisement packet that contains Internet Layer configuration parameters.

Note: This method automatically disables IPv6 traffic forwarding on the interface in question.

Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 ipv6 address autoconf

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6 address
eui64 <prefix>
EUI-64 as specified in RFC 4291 allows a host to assign iteslf a unique 64-Bit IPv6 address.
Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 ipv6 address eui64␣
˓→2001:db8:beef::/64

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6 address
no-default-link-local

8.4. Interfaces 646

 VyOS Documentation, Release 1.5.x (circinus)

Do not assign a link-local IPv6 address to this interface.

Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 ipv6 address no-default-
˓→link-local

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6

disable-forwarding
Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 ipv6 disable-forwarding

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6

adjust-mss <mss | clamp-mss-to-pmtu>
As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss6 <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6
accept-dad <1-3>
Whether to accept DAD (Duplicate Address Detection).
• 0: Disable DAD
• 1: Enable DAD (default)
• 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate link-local address has been found.
Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 ipv6 accept-dad 2

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6

dup-addr-detect-transmits <n>
The amount of Duplicate Address Detection probes to send.
Default: 1
Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 ipv6 dup-addr-detect-

˓→transmits 5

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> vrf <vrf>

8.4. Interfaces 647

 VyOS Documentation, Release 1.5.x (circinus)

Place interface in given VRF instance.

See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 vrf red

DHCP(v6)
set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options
client-id <description>
RFC 2131 states: The client MAY choose to explicitly provide the identifier through the ‘client identifier’
option. If the client supplies a ‘client identifier’, the client MUST use the same ‘client identifier’ in all subsequent
messages, and the server MUST use that identifier to identify the client.
Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 dhcp-options client-id

˓→'foo-bar'

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options

host-name <hostname>
Instead of sending the real system hostname to the DHCP server, overwrite the host-name with this given-value.
Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 dhcp-options host-name

˓→'VyOS'

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options

vendor-class-id <vendor-id>
This option is used by some DHCP clients to identify the vendor type and possibly the configuration of a DHCP
client. The information is a string of bytes whose contents are specific to the vendor and are not specified in a
standard.
The vendor-class-id option can be used to request a specific class of vendor options from the server.
Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 dhcp-options vendor-class-

˓→id 'VyOS'

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options

no-default-route
Only request an address from the DHCP server but do not request a default gateway.
Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 dhcp-options no-default-

˓→route

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options

default-route-distance <distance>

8.4. Interfaces 648

 VyOS Documentation, Release 1.5.x (circinus)

Set the distance for the default gateway sent by the DHCP server.
Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 dhcp-options default-

˓→route-distance 220

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options

reject <address>
Reject DHCP leases from a given address or range. This is useful when a modem gives a local IP when first
starting.
• address can be specified multiple times, e.g. 192.168.100.1 and/or 192.168.100.0/24
Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 dhcp-options reject 192.
˓→168.100.0/24

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options

user-class <string>
This option is used by some DHCP clients as a way for users to specify identifying information to the client.
This can be used in a similar way to the vendor-class-identifier option, but the value of the option is specified
by the user, not the vendor.
Example:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 dhcp-options user-class␣

˓→VyOS

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id>

dhcpv6-options duid <duid>
The DHCP unique identifier (DUID) is used by a client to get an IP address from a DHCPv6 server. It has a
2-byte DUID type field, and a variable-length identifier field up to 128 bytes. Its actual length depends on its
type. The server compares the DUID with its database and delivers configuration data (address, lease times,
DNS servers, etc.) to the client.

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 duid

˓→'0e:00:00:01:00:01:27:71:db:f0:00:50:56:bf:c5:6d'

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id>

dhcpv6-options no-release
When no-release is specified, dhcp6c will send a release message on client exit to prevent losing an assigned
address or prefix.

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 dhcpv6-options no-release

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id>

dhcpv6-options parameters-only
This statement specifies dhcp6c to only exchange informational configuration parameters with servers. A list of
DNS server addresses is an example of such parameters. This statement is useful when the client does not need
stateful configuration parameters such as IPv6 addresses or prefixes.

8.4. Interfaces 649

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 dhcpv6-options parameters-

˓→only

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id>

dhcpv6-options rapid-commit
When rapid-commit is specified, dhcp6c will include a rapid-commit option in solicit messages and wait for an
immediate reply instead of advertisements.

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 dhcpv6-options rapid-

˓→commit

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id>

dhcpv6-options temporary
Request only a temporary address and not form an IA_NA (Identity Association for Non-temporary Addresses)
partnership.

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 dhcpv6-options temporary

DHCPv6 Prefix Delegation (PD)

VyOS 1.3 (equuleus) supports DHCPv6-PD (RFC 3633). DHCPv6 Prefix Delegation is supported by most ISPs who
provide native IPv6 for consumers on fixed networks.
set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id>
dhcpv6-options pd <id> length <length>
Some ISPs by default only delegate a /64 prefix. To request for a specific prefix size use this option to request
for a bigger delegation for this pd <id>. This value is in the range from 32 - 64 so you could request up to a /32
prefix (if your ISP allows this) down to a /64 delegation.
The default value corresponds to 64.
To request a /56 prefix from your ISP use:

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 dhcpv6-options pd 0␣

˓→length 56

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id>

dhcpv6-options pd <id> interface <delegatee> address <address>
Specify the interface address used locally on the interface where the prefix has been delegated to. ID must be a
decimal integer.
It will be combined with the delegated prefix and the sla-id to form a complete interface address. The default is
to use the EUI-64 address of the interface.
Example: Delegate a /64 prefix to interface eth8 which will use a local address on this router of
<prefix>::ffff, as the address 65534 will correspond to ffff in hexadecimal notation.

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 dhcpv6-options pd 0␣

˓→interface eth8 address 65534

set interfaces virtual-ethernet <interface> vif-s <vlan-id> vif-c <vlan-id>

dhcpv6-options pd <id> interface <delegatee> sla-id <id>
Specify the identifier value of the site-level aggregator (SLA) on the interface. ID must be a decimal number
greater then 0 which fits in the length of SLA IDs (see below).

8.4. Interfaces 650

 VyOS Documentation, Release 1.5.x (circinus)

Example: If ID is 1 and the client is delegated an IPv6 prefix 2001:db8:ffff::/48, dhcp6c will combine the two
values into a single IPv6 prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified interface.

set interfaces virtual-ethernet veth0 vif-s 1000 vif-c 20 dhcpv6-options pd 0␣

˓→interface eth8 sla-id 1

set interfaces virtual-ethernet <interface> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces virtual-ethernet veth0 disable

set interfaces virtual-ethernet <interface> vrf <vrf>

Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces virtual-ethernet veth0 vrf red

Operation

show interfaces virtual-ethernet

Show brief interface information.

vyos@vyos:~$ show interfaces virtual-ethernet

Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
veth10 100.64.0.0/31 u/u
veth11 100.64.0.1/31 u/u

show interfaces virtual-ethernet <interface>

Show detailed information on given <interface>

vyos@vyos:~$ show interfaces virtual-ethernet veth11

10: veth11@veth10: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master␣
˓→red state UP group default qlen 1000

link/ether b2:7b:df:47:e9:11 brd ff:ff:ff:ff:ff:ff

inet 100.64.0.1/31 scope global veth11
valid_lft forever preferred_lft forever
inet6 fe80::b07b:dfff:fe47:e911/64 scope link
valid_lft forever preferred_lft forever

RX: bytes packets errors dropped overrun mcast

0 0 0 0 0 0
TX: bytes packets errors dropped carrier collisions
1369707 4267 0 0 0 0

8.4. Interfaces 651

 VyOS Documentation, Release 1.5.x (circinus)

Example

Interconnect the global VRF with vrf “red” using the veth10 <-> veth 11 pair

set interfaces virtual-ethernet veth10 address '100.64.0.0/31'

set interfaces virtual-ethernet veth10 peer-name 'veth11'
set interfaces virtual-ethernet veth11 address '100.64.0.1/31'
set interfaces virtual-ethernet veth11 peer-name 'veth10'
set interfaces virtual-ethernet veth11 vrf 'red'
set vrf name red table '1000'

vyos@vyos:~$ ping 100.64.0.1

PING 100.64.0.1 (100.64.0.1) 56(84) bytes of data.
64 bytes from 100.64.0.1: icmp_seq=1 ttl=64 time=0.080 ms
64 bytes from 100.64.0.1: icmp_seq=2 ttl=64 time=0.119 ms

8.4.16 VTI - Virtual Tunnel Interface

Set Virtual Tunnel Interface

set interfaces vti vti0 address 192.168.2.249/30

set interfaces vti vti0 address 2001:db8:2::249/64

Results in:

vyos@vyos# show interfaces vti

vti vti0 {
address 192.168.2.249/30
address 2001:db8:2::249/64
description "Description"
}

Warning: When using site-to-site IPsec with VTI interfaces, be sure to disable route autoinstall

set vpn ipsec options disable-route-autoinstall

More details about the IPsec and VTI issue and option disable-route-autoinstall https://blog.vyos.io/
vyos-1-dot-2-0-development-news-in-july
The root cause of the problem is that for VTI tunnels to work, their traffic selectors have to be set to 0.0.0.0/0 for traffic
to match the tunnel, even though actual routing decision is made according to netfilter marks. Unless route insertion is
disabled entirely, StrongSWAN thus mistakenly inserts a default route through the VTI peer address, which makes all
traffic routed to nowhere.

8.4. Interfaces 652

 VyOS Documentation, Release 1.5.x (circinus)

8.4.17 VXLAN

VXLAN is a network virtualization technology that attempts to address the scalability problems associated with large
cloud computing deployments. It uses a VLAN-like encapsulation technique to encapsulate OSI layer 2 Ethernet frames
within layer 4 UDP datagrams, using 4789 as the default IANA-assigned destination UDP port number. VXLAN
endpoints, which terminate VXLAN tunnels and may be either virtual or physical switch ports, are known as VTEPs
(VXLAN tunnel endpoints).
VXLAN is an evolution of efforts to standardize an overlay encapsulation protocol. It increases the scalability up to
16 million logical networks and allows for layer 2 adjacency across IP networks. Multicast or unicast with head-end
replication (HER) is used to flood broadcast, unknown unicast, and multicast (BUM) traffic.
The VXLAN specification was originally created by VMware, Arista Networks and Cisco. Other backers of the
VXLAN technology include Huawei, Broadcom, Citrix, Pica8, Big Switch Networks, Cumulus Networks, Dell EMC,
Ericsson, Mellanox, FreeBSD, OpenBSD, Red Hat, Joyent, and Juniper Networks.
VXLAN was officially documented by the IETF in RFC 7348.
If configuring VXLAN in a VyOS virtual machine, ensure that MAC spoofing (Hyper-V) or Forged Transmits (ESX)
are permitted, otherwise forwarded frames may be blocked by the hypervisor.

Note: As VyOS is based on Linux and there was no official IANA port assigned for VXLAN, VyOS uses a default
port of 8472. You can change the port on a per VXLAN interface basis to get it working across multiple vendors.

Configuration

Common interface configuration

set interfaces vxlan <interface> address <address>

Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
Example:

set interfaces vxlan vxlan0 address 192.0.2.1/24

set interfaces vxlan vxlan0 address 2001:db8::1/64

set interfaces vxlan <interface> description <description>

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces vxlan vxlan0 description 'This is an awesome interface running on␣
˓→VyOS'

set interfaces vxlan <interface> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

8.4. Interfaces 653

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces vxlan vxlan0 disable

set interfaces vxlan <interface> disable-flow-control

Ethernet flow control is a mechanism for temporarily stopping the transmission of data on Ethernet family com-
puter networks. The goal of this mechanism is to ensure zero packet loss in the presence of network congestion.
The first flow control mechanism, the pause frame, was defined by the IEEE 802.3x standard.
A sending station (computer or network switch) may be transmitting data faster than the other end of the link can
accept it. Using flow control, the receiving station can signal the sender requesting suspension of transmissions
until the receiver catches up.
Use this command to disable the generation of Ethernet flow control (pause frames).
Example:

set interfaces vxlan vxlan0 disable-flow-control

set interfaces vxlan <interface> disable-link-detect

Use this command to direct an interface to not detect any physical state changes on a link, for example, when
the cable is unplugged.
Default is to detects physical link state changes.
Example:

set interfaces vxlan vxlan0 disable-link-detect

set interfaces vxlan <interface> mac <xx:xx:xx:xx:xx:xx>

Configure user defined MAC address on given <interface>.
Example:

set interfaces vxlan vxlan0 mac '00:53:01:02:03:04'

set interfaces vxlan <interface> mtu <mtu>

Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

set interfaces vxlan vxlan0 mtu 1600

set interfaces vxlan <interface> ip adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.

8.4. Interfaces 654

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces vxlan <interface> ip arp-cache-timeout

Once a neighbor has been found, the entry is considered to be valid for at least for this specific time. An entry’s
validity will be extended if it receives positive feedback from higher level protocols.
This defaults to 30 seconds.
Example:

set interfaces vxlan vxlan0 ip arp-cache-timeout 180

set interfaces vxlan <interface> ip disable-arp-filter

If set the kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but
it usually makes sense, because it increases the chance of successful communication. IP addresses are owned
by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing,
does this behaviour cause problems.
If not set (default) allows you to have multiple network interfaces on the same subnet, and have the ARPs for
each interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that
interface (therefore you must use source based routing for this to work).
In other words it allows control of which cards (usually 1) will respond to an arp request.
Example:

set interfaces vxlan vxlan0 ip disable-arp-filter

set interfaces vxlan <interface> ip disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

set interfaces vxlan vxlan0 ip disable-forwarding

set interfaces vxlan <interface> ip enable-directed-broadcast

Define different modes for IP directed broadcast forwarding as described in RFC 1812 and RFC 2644.
If configured, incoming IP directed broadcast packets on this interface will be forwarded.
If this option is unset (default), incoming IP directed broadcast packets will not be forwarded.

set interfaces vxlan vxlan0 ip enable-directed-broadcast

set interfaces vxlan <interface> ip enable-arp-accept

Define behavior for gratuitous ARP frames whose IP is not already present in the ARP table. If configured
create new entries in the ARP table.
Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on.
If the ARP table already contains the IP address of the gratuitous arp frame, the arp table will be updated
regardless if this setting is on or off.

set interfaces vxlan vxlan0 ip enable-arp-accept

set interfaces vxlan <interface> ip enable-arp-announce

Define different restriction levels for announcing the local source IP address from IP packets in ARP requests
sent on interface.
Use any local address, configured on any interface if this is not set.

8.4. Interfaces 655

 VyOS Documentation, Release 1.5.x (circinus)

If configured, try to avoid local addresses that are not in the target’s subnet for this interface. This mode is
useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of
their logical network configured on the receiving interface. When we generate the request we will check all our
subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no
such subnet we select source address according to the rules for level 2.

set interfaces vxlan vxlan0 ip enable-arp-announce

set interfaces vxlan <interface> ip enable-arp-ignore

Define different modes for sending replies in response to received ARP requests that resolve local target IP
addresses:
If configured, reply only if the target IP address is local address configured on the incoming interface.
If this option is unset (default), reply for any local target IP address, configured on any interface.

set interfaces vxlan vxlan0 ip enable-arp-ignore

set interfaces vxlan <interface> ip enable-proxy-arp

Use this command to enable proxy Address Resolution Protocol (ARP) on this interface. Proxy ARP allows
an Ethernet interface to respond with its own MAC address to ARP requests for destination IP addresses on
subnets attached to other interfaces on the system. Subsequent packets sent to those destination IP addresses
are forwarded appropriately by the system.
Example:

set interfaces vxlan vxlan0 ip enable-proxy-arp

set interfaces vxlan <interface> ip proxy-arp-pvlan

Private VLAN proxy arp. Basically allow proxy arp replies back to the same interface (from which the ARP
request/solicitation was received).
This is done to support (ethernet) switch features, like RFC 3069, where the individual ports are NOT allowed
to communicate with each other, but they are allowed to talk to the upstream router. As described in RFC 3069,
it is possible to allow these hosts to communicate through the upstream router by proxy_arp’ing.

Note: Does not need to be used together with proxy_arp.

This technology is known by different names:

• In RFC 3069 it is called VLAN Aggregation
• Cisco and Allied Telesyn call it Private VLAN
• Hewlett-Packard call it Source-Port filtering or port-isolation
• Ericsson call it MAC-Forced Forwarding (RFC Draft)
set interfaces vxlan <interface> ip source-validation <strict | loose | disable>
Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.

8.4. Interfaces 656

 VyOS Documentation, Release 1.5.x (circinus)

• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation
set interfaces vxlan <interface> ipv6 address autoconf
SLAAC RFC 4862. IPv6 hosts can configure themselves automatically when connected to an IPv6 network us-
ing the Neighbor Discovery Protocol via ICMPv6 router discovery messages. When first connected to a network,
a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to
such a request with a router advertisement packet that contains Internet Layer configuration parameters.

Note: This method automatically disables IPv6 traffic forwarding on the interface in question.

Example:

set interfaces vxlan vxlan0 ipv6 address autoconf

set interfaces vxlan <interface> ipv6 address eui64 <prefix>

EUI-64 as specified in RFC 4291 allows a host to assign iteslf a unique 64-Bit IPv6 address.
Example:

set interfaces vxlan vxlan0 ipv6 address eui64 2001:db8:beef::/64

set interfaces vxlan <interface> ipv6 address no-default-link-local

Do not assign a link-local IPv6 address to this interface.
Example:

set interfaces vxlan vxlan0 ipv6 address no-default-link-local

set interfaces vxlan <interface> ipv6 disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
Example:

set interfaces vxlan vxlan0 ipv6 disable-forwarding

set interfaces vxlan <interface> ipv6 adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss6 <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces vxlan <interface> ipv6 accept-dad <1-3>

8.4. Interfaces 657

 VyOS Documentation, Release 1.5.x (circinus)

Whether to accept DAD (Duplicate Address Detection).

• 0: Disable DAD
• 1: Enable DAD (default)
• 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate link-local address has been found.
Example:

set interfaces vxlan vxlan0 ipv6 accept-dad 2

set interfaces vxlan <interface> ipv6 dup-addr-detect-transmits <n>

The amount of Duplicate Address Detection probes to send.
Default: 1
Example:

set interfaces vxlan vxlan0 ipv6 dup-addr-detect-transmits 5

set interfaces vxlan <interface> vrf <vrf>

Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces vxlan vxlan0 vrf red

VXLAN specific options

set interfaces vxlan <interface> vni <number>

Each VXLAN segment is identified through a 24-bit segment ID, termed the VNI, This allows up to 16M
VXLAN segments to coexist within the same administrative domain.
set interfaces vxlan <interface> port <port>
Configure port number of remote VXLAN endpoint.

Note: As VyOS is Linux based the default port used is not using 4789 as the default IANA-assigned destination
UDP port number. Instead VyOS uses the Linux default port of 8472.

set interfaces vxlan <interface> source-address <interface>

Source IP address used for VXLAN underlay. This is mandatory when using VXLAN via L2VPN/EVPN.
set interfaces vxlan <interface> gpe
Enables the Generic Protocol extension (VXLAN-GPE). Currently, this is only supported together with the
external keyword.
set interfaces vxlan <interface> parameters external
Specifies whether an external control plane (e.g. BGP L2VPN/EVPN) or the internal FDB should be used.
set interfaces vxlan <interface> parameters neighbor-suppress

8.4. Interfaces 658

 VyOS Documentation, Release 1.5.x (circinus)

In order to minimize the flooding of ARP and ND messages in the VXLAN network, EVPN includes provisions
RFC 7432#section-10 that allow participating VTEPs to suppress such messages in case they know the MAC-IP
binding and can reply on behalf of the remote host.
set interfaces vxlan <interface> parameters nolearning
Specifies if unknown source link layer addresses and IP addresses are entered into the VXLAN device forwarding
database.
set interfaces vxlan <interface> parameters vni-filter
Specifies whether the VXLAN device is capable of vni filtering.
Only works with a VXLAN device with external flag set.

Note: The device can only receive packets with VNIs configured in the VNI filtering table.

Unicast

set interfaces vxlan <interface> remote <address>

IPv4/IPv6 remote address of the VXLAN tunnel. An alternative to multicast, the remote IPv4/IPv6 address can
be set directly.

Multicast

set interfaces vxlan <interface> source-interface <interface>

Interface used for VXLAN underlay. This is mandatory when using VXLAN via a multicast network. VXLAN
traffic will always enter and exit this interface.
set interfaces vxlan <interface> group <address>
Multicast group address for the VXLAN interface. VXLAN tunnels can be built either via Multicast or via
Unicast.
Both IPv4 and IPv6 multicast is possible.

Multicast VXLAN

Topology: PC4 - Leaf2 - Spine1 - Leaf3 - PC5

PC4 has IP 10.0.0.4/24 and PC5 has IP 10.0.0.5/24, so they believe they are in the same broadcast domain.
Let’s assume PC4 on Leaf2 wants to ping PC5 on Leaf3. Instead of setting Leaf3 as our remote end manually, Leaf2
encapsulates the packet into a UDP-packet and sends it to its’ designated multicast-address via Spine1. When Spine1
receives this packet it forwards it to all other leaves who has joined the same multicast-group, in this case Leaf3. When
Leaf3 receives the packet it forwards it, while at the same time learning that PC4 is reachable behind Leaf2, because
the encapsulated packet had Leaf2’s IP address set as source IP.
PC5 receives the ping echo, responds with an echo reply that Leaf3 receives and this time forwards to Leaf2’s unicast
address directly because it learned the location of PC4 above. When Leaf2 receives the echo reply from PC5 it sees
that it came from Leaf3 and so remembers that PC5 is reachable via Leaf3.
Thanks to this discovery, any subsequent traffic between PC4 and PC5 will not be using the multicast-address between
the leaves as they both know behind which Leaf the PCs are connected. This saves traffic as less multicast packets sent
reduces the load on the network, which improves scalability when more leaves are added.

8.4. Interfaces 659

 VyOS Documentation, Release 1.5.x (circinus)

For optimal scalability, Multicast shouldn’t be used at all, but instead use BGP to signal all connected devices between
leaves. Unfortunately, VyOS does not yet support this.

Single VXLAN device (SVD)

FRR supports a new way of configuring VLAN-to-VNI mappings for EVPN-VXLAN, when working with the Linux
kernel. In this new way, the mapping of a VLAN to a VNI is configured against a container VXLAN interface which
is referred to as a SVD (Single VXLAN device).
Multiple VLAN to VNI mappings can be configured against the same SVD. This allows for a significant scaling of the
number of VNIs since a separate VXLAN interface is no longer required for each VNI.
set interfaces vxlan <interface> vlan-to-vni <vlan> vni <vni>
Maps the VNI to the specified VLAN id. The VLAN can then be consumed by a bridge.
Sample configuration of SVD with VLAN to VNI mappings is shown below.

set interfaces bridge br0 member interface vxlan0

set interfaces vxlan vxlan0 parameters external
set interfaces vxlan vxlan0 source-interface 'dum0'
set interfaces vxlan vxlan0 vlan-to-vni 10 vni '10010'
set interfaces vxlan vxlan0 vlan-to-vni 11 vni '10011'
set interfaces vxlan vxlan0 vlan-to-vni 30 vni '10030'
set interfaces vxlan vxlan0 vlan-to-vni 31 vni '10031'

Example

The setup is this: Leaf2 - Spine1 - Leaf3

Spine1 is a Cisco IOS router running version 15.4, Leaf2 and Leaf3 are each VyOS routers running 1.2.
This topology was built using GNS3.
Topology:

Spine1:
fa0/2 towards Leaf2, IP-address: 10.1.2.1/24
fa0/3 towards Leaf3, IP-address: 10.1.3.1/24

Leaf2:
Eth0 towards Spine1, IP-address: 10.1.2.2/24
Eth1 towards a vlan-aware switch

Leaf3:
Eth0 towards Spine1, IP-address 10.1.3.3/24
Eth1 towards a vlan-aware switch

Spine1 Configuration:

conf t
ip multicast-routing
!
interface fastethernet0/2
ip address 10.1.2.1 255.255.255.0
(continues on next page)

8.4. Interfaces 660

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

ip pim sparse-dense-mode
!
interface fastethernet0/3
ip address 10.1.3.1 255.255.255.0
ip pim sparse-dense-mode
!
router ospf 1
network 10.0.0.0 0.255.255.255 area 0

Multicast-routing is required for the leaves to forward traffic between each other in a more scalable way. This also
requires PIM to be enabled towards the leaves so that the Spine can learn what multicast groups each Leaf expects
traffic from.
Leaf2 configuration:

set interfaces ethernet eth0 address '10.1.2.2/24'

set protocols ospf area 0 network '10.0.0.0/8'

! Our first vxlan interface

set interfaces bridge br241 address '172.16.241.1/24'
set interfaces bridge br241 member interface 'eth1.241'
set interfaces bridge br241 member interface 'vxlan241'

set interfaces vxlan vxlan241 group '239.0.0.241'

set interfaces vxlan vxlan241 source-interface 'eth0'
set interfaces vxlan vxlan241 vni '241'

! Our seconds vxlan interface

set interfaces bridge br242 address '172.16.242.1/24'
set interfaces bridge br242 member interface 'eth1.242'
set interfaces bridge br242 member interface 'vxlan242'

set interfaces vxlan vxlan242 group '239.0.0.242'

set interfaces vxlan vxlan242 source-interface 'eth0'
set interfaces vxlan vxlan242 vni '242'

Leaf3 configuration:

set interfaces ethernet eth0 address '10.1.3.3/24'

set protocols ospf area 0 network '10.0.0.0/8'

! Our first vxlan interface

set interfaces bridge br241 address '172.16.241.1/24'
set interfaces bridge br241 member interface 'eth1.241'
set interfaces bridge br241 member interface 'vxlan241'

set interfaces vxlan vxlan241 group '239.0.0.241'

set interfaces vxlan vxlan241 source-interface 'eth0'
set interfaces vxlan vxlan241 vni '241'

! Our seconds vxlan interface

set interfaces bridge br242 address '172.16.242.1/24'
set interfaces bridge br242 member interface 'eth1.242'
(continues on next page)

8.4. Interfaces 661

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set interfaces bridge br242 member interface 'vxlan242'

set interfaces vxlan vxlan242 group '239.0.0.242'

set interfaces vxlan vxlan242 source-interface 'eth0'
set interfaces vxlan vxlan242 vni '242'

As you can see, the Leaf2 and Leaf3 configurations are almost identical. There are lots of commands above, I’ll try to
go into more detail below. Command descriptions are placed under the command boxes:

set interfaces bridge br241 address '172.16.241.1/24'

This commands creates a bridge that is used to bind traffic on eth1 vlan 241 with the vxlan241-interface. The IP address
is not required. It may however be used as a default gateway for each Leaf which allows devices on the vlan to reach
other subnets. This requires that the subnets are redistributed by OSPF so that the Spine will learn how to reach it.
To do this you need to change the OSPF network from ‘10.0.0.0/8’ to ‘0.0.0.0/0’ to allow 172.16/12-networks to be
advertised.

set interfaces bridge br241 member interface 'eth1.241'

set interfaces bridge br241 member interface 'vxlan241'

Binds eth1.241 and vxlan241 to each other by making them both member interfaces of the same bridge.

set interfaces vxlan vxlan241 group '239.0.0.241'

The multicast-group used by all leaves for this vlan extension. Has to be the same on all leaves that has this interface.

set interfaces vxlan vxlan241 source-interface 'eth0'

Sets the interface to listen for multicast packets on. Could be a loopback, not yet tested.

set interfaces vxlan vxlan241 vni '241'

Sets the unique id for this vxlan-interface. Not sure how it correlates with multicast-address.

set interfaces vxlan vxlan241 port 12345

The destination port used for creating a VXLAN interface in Linux defaults to its pre-standard value of 8472 to preserve
backward compatibility. A configuration directive to support a user-specified destination port to override that behavior
is available using the above command.

Unicast VXLAN

Alternatively to multicast, the remote IPv4 address of the VXLAN tunnel can be set directly. Let’s change the Multicast
example from above:

# leaf2 and leaf3

delete interfaces vxlan vxlan241 group '239.0.0.241'
delete interfaces vxlan vxlan241 source-interface 'eth0'

# leaf2
set interface vxlan vxlan241 remote 10.1.3.3

(continues on next page)

8.4. Interfaces 662

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

# leaf3
set interface vxlan vxlan241 remote 10.1.2.2

The default port udp is set to 8472. It can be changed with set interface vxlan <vxlanN> port <port>

8.4.18 WLAN/WIFI - Wireless LAN

The WLAN (Wireless LAN) interface provides 802.11 (a/b/g/n/ac) wireless support (commonly referred to as Wi-Fi)
by means of compatible hardware. If your hardware supports it, VyOS supports multiple logical wireless interfaces
per physical device.
There are three modes of operation for a wireless interface:
• WAP (Wireless Access-Point) mode provides network access to connecting stations if the physical hardware
supports acting as a WAP
• Station mode acts as a Wi-Fi client accessing the network through an available WAP
• Monitor mode lets the system passively monitor wireless traffic
If the system detects an unconfigured wireless device, it will be automatically added the configuration tree, specifying
any detected settings (for example, its MAC address) and configured to run in monitor mode.

Configuration

Common interface configuration

set interfaces wireless <interface> address <address | dhcp | dhcpv6>

Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
• dhcp interface address is received by DHCP from a DHCP server on this segment.
• dhcpv6 interface address is received by DHCPv6 from a DHCPv6 server on this segment.

Note: When using DHCP to retrieve IPv4 address and if local customizations are needed, they should be
possible using the enter and exit hooks provided. The hook dirs are:
• /config/scripts/dhcp-client/pre-hooks.d/
• /config/scripts/dhcp-client/post-hooks.d/

Example:

set interfaces wireless wlan0 address 192.0.2.1/24

set interfaces wireless wlan0 address 2001:db8::1/64
set interfaces wireless wlan0 address dhcp
set interfaces wireless wlan0 address dhcpv6

set interfaces wireless <interface> description <description>

8.4. Interfaces 663

 VyOS Documentation, Release 1.5.x (circinus)

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces wireless wlan0 description 'This is an awesome interface running on␣
˓→VyOS'

set interfaces wireless <interface> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces wireless wlan0 disable

set interfaces wireless <interface> disable-flow-control

Ethernet flow control is a mechanism for temporarily stopping the transmission of data on Ethernet family com-
puter networks. The goal of this mechanism is to ensure zero packet loss in the presence of network congestion.
The first flow control mechanism, the pause frame, was defined by the IEEE 802.3x standard.
A sending station (computer or network switch) may be transmitting data faster than the other end of the link can
accept it. Using flow control, the receiving station can signal the sender requesting suspension of transmissions
until the receiver catches up.
Use this command to disable the generation of Ethernet flow control (pause frames).
Example:

set interfaces wireless wlan0 disable-flow-control

set interfaces wireless <interface> disable-link-detect

Use this command to direct an interface to not detect any physical state changes on a link, for example, when
the cable is unplugged.
Default is to detects physical link state changes.
Example:

set interfaces wireless wlan0 disable-link-detect

set interfaces wireless <interface> mac <xx:xx:xx:xx:xx:xx>

Configure user defined MAC address on given <interface>.
Example:

set interfaces wireless wlan0 mac '00:53:01:02:03:04'

set interfaces wireless <interface> mtu <mtu>

Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

set interfaces wireless wlan0 mtu 1600

set interfaces wireless <interface> ip adjust-mss <mss | clamp-mss-to-pmtu>

8.4. Interfaces 664

 VyOS Documentation, Release 1.5.x (circinus)

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces wireless <interface> ip arp-cache-timeout
Once a neighbor has been found, the entry is considered to be valid for at least for this specific time. An entry’s
validity will be extended if it receives positive feedback from higher level protocols.
This defaults to 30 seconds.
Example:

set interfaces wireless wlan0 ip arp-cache-timeout 180

set interfaces wireless <interface> ip disable-arp-filter

If set the kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but
it usually makes sense, because it increases the chance of successful communication. IP addresses are owned
by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing,
does this behaviour cause problems.
If not set (default) allows you to have multiple network interfaces on the same subnet, and have the ARPs for
each interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that
interface (therefore you must use source based routing for this to work).
In other words it allows control of which cards (usually 1) will respond to an arp request.
Example:

set interfaces wireless wlan0 ip disable-arp-filter

set interfaces wireless <interface> ip disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

set interfaces wireless wlan0 ip disable-forwarding

set interfaces wireless <interface> ip enable-directed-broadcast

Define different modes for IP directed broadcast forwarding as described in RFC 1812 and RFC 2644.
If configured, incoming IP directed broadcast packets on this interface will be forwarded.
If this option is unset (default), incoming IP directed broadcast packets will not be forwarded.

set interfaces wireless wlan0 ip enable-directed-broadcast

set interfaces wireless <interface> ip enable-arp-accept

8.4. Interfaces 665

 VyOS Documentation, Release 1.5.x (circinus)

Define behavior for gratuitous ARP frames whose IP is not already present in the ARP table. If configured
create new entries in the ARP table.
Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on.
If the ARP table already contains the IP address of the gratuitous arp frame, the arp table will be updated
regardless if this setting is on or off.

set interfaces wireless wlan0 ip enable-arp-accept

set interfaces wireless <interface> ip enable-arp-announce

Define different restriction levels for announcing the local source IP address from IP packets in ARP requests
sent on interface.
Use any local address, configured on any interface if this is not set.
If configured, try to avoid local addresses that are not in the target’s subnet for this interface. This mode is
useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of
their logical network configured on the receiving interface. When we generate the request we will check all our
subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no
such subnet we select source address according to the rules for level 2.

set interfaces wireless wlan0 ip enable-arp-announce

set interfaces wireless <interface> ip enable-arp-ignore

Define different modes for sending replies in response to received ARP requests that resolve local target IP
addresses:
If configured, reply only if the target IP address is local address configured on the incoming interface.
If this option is unset (default), reply for any local target IP address, configured on any interface.

set interfaces wireless wlan0 ip enable-arp-ignore

set interfaces wireless <interface> ip enable-proxy-arp

Use this command to enable proxy Address Resolution Protocol (ARP) on this interface. Proxy ARP allows
an Ethernet interface to respond with its own MAC address to ARP requests for destination IP addresses on
subnets attached to other interfaces on the system. Subsequent packets sent to those destination IP addresses
are forwarded appropriately by the system.
Example:

set interfaces wireless wlan0 ip enable-proxy-arp

set interfaces wireless <interface> ip proxy-arp-pvlan

Private VLAN proxy arp. Basically allow proxy arp replies back to the same interface (from which the ARP
request/solicitation was received).
This is done to support (ethernet) switch features, like RFC 3069, where the individual ports are NOT allowed
to communicate with each other, but they are allowed to talk to the upstream router. As described in RFC 3069,
it is possible to allow these hosts to communicate through the upstream router by proxy_arp’ing.

Note: Does not need to be used together with proxy_arp.

This technology is known by different names:

8.4. Interfaces 666

 VyOS Documentation, Release 1.5.x (circinus)

• In RFC 3069 it is called VLAN Aggregation

• Cisco and Allied Telesyn call it Private VLAN
• Hewlett-Packard call it Source-Port filtering or port-isolation
• Ericsson call it MAC-Forced Forwarding (RFC Draft)
set interfaces wireless <interface> ip source-validation <strict | loose | disable>
Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.
• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation
set interfaces wireless <interface> ipv6 address autoconf
SLAAC RFC 4862. IPv6 hosts can configure themselves automatically when connected to an IPv6 network us-
ing the Neighbor Discovery Protocol via ICMPv6 router discovery messages. When first connected to a network,
a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to
such a request with a router advertisement packet that contains Internet Layer configuration parameters.

Note: This method automatically disables IPv6 traffic forwarding on the interface in question.

Example:

set interfaces wireless wlan0 ipv6 address autoconf

set interfaces wireless <interface> ipv6 address eui64 <prefix>

EUI-64 as specified in RFC 4291 allows a host to assign iteslf a unique 64-Bit IPv6 address.
Example:

set interfaces wireless wlan0 ipv6 address eui64 2001:db8:beef::/64

set interfaces wireless <interface> ipv6 address no-default-link-local

Do not assign a link-local IPv6 address to this interface.
Example:

set interfaces wireless wlan0 ipv6 address no-default-link-local

set interfaces wireless <interface> ipv6 disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
Example:

set interfaces wireless wlan0 ipv6 disable-forwarding

set interfaces wireless <interface> ipv6 adjust-mss <mss | clamp-mss-to-pmtu>

8.4. Interfaces 667

 VyOS Documentation, Release 1.5.x (circinus)

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss6 <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces wireless <interface> ipv6 accept-dad <1-3>
Whether to accept DAD (Duplicate Address Detection).
• 0: Disable DAD
• 1: Enable DAD (default)
• 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate link-local address has been found.
Example:

set interfaces wireless wlan0 ipv6 accept-dad 2

set interfaces wireless <interface> ipv6 dup-addr-detect-transmits <n>

The amount of Duplicate Address Detection probes to send.
Default: 1
Example:

set interfaces wireless wlan0 ipv6 dup-addr-detect-transmits 5

set interfaces wireless <interface> vrf <vrf>

Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces wireless wlan0 vrf red

DHCP(v6)
set interfaces wireless <interface> dhcp-options client-id <description>
RFC 2131 states: The client MAY choose to explicitly provide the identifier through the ‘client identifier’
option. If the client supplies a ‘client identifier’, the client MUST use the same ‘client identifier’ in all subsequent
messages, and the server MUST use that identifier to identify the client.
Example:

set interfaces wireless wlan0 dhcp-options client-id 'foo-bar'

set interfaces wireless <interface> dhcp-options host-name <hostname>

8.4. Interfaces 668

 VyOS Documentation, Release 1.5.x (circinus)

Instead of sending the real system hostname to the DHCP server, overwrite the host-name with this given-value.
Example:

set interfaces wireless wlan0 dhcp-options host-name 'VyOS'

set interfaces wireless <interface> dhcp-options vendor-class-id <vendor-id>

This option is used by some DHCP clients to identify the vendor type and possibly the configuration of a DHCP
client. The information is a string of bytes whose contents are specific to the vendor and are not specified in a
standard.
The vendor-class-id option can be used to request a specific class of vendor options from the server.
Example:

set interfaces wireless wlan0 dhcp-options vendor-class-id 'VyOS'

set interfaces wireless <interface> dhcp-options no-default-route

Only request an address from the DHCP server but do not request a default gateway.
Example:

set interfaces wireless wlan0 dhcp-options no-default-route

set interfaces wireless <interface> dhcp-options default-route-distance <distance>

Set the distance for the default gateway sent by the DHCP server.
Example:

set interfaces wireless wlan0 dhcp-options default-route-distance 220

set interfaces wireless <interface> dhcp-options reject <address>

Reject DHCP leases from a given address or range. This is useful when a modem gives a local IP when first
starting.
• address can be specified multiple times, e.g. 192.168.100.1 and/or 192.168.100.0/24
Example:

set interfaces wireless wlan0 dhcp-options reject 192.168.100.0/24

set interfaces wireless <interface> dhcp-options user-class <string>

This option is used by some DHCP clients as a way for users to specify identifying information to the client.
This can be used in a similar way to the vendor-class-identifier option, but the value of the option is specified
by the user, not the vendor.
Example:

set interfaces wireless wlan0 dhcp-options user-class VyOS

set interfaces wireless <interface> dhcpv6-options duid <duid>

The DHCP unique identifier (DUID) is used by a client to get an IP address from a DHCPv6 server. It has a
2-byte DUID type field, and a variable-length identifier field up to 128 bytes. Its actual length depends on its
type. The server compares the DUID with its database and delivers configuration data (address, lease times,
DNS servers, etc.) to the client.

8.4. Interfaces 669

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces wireless wlan0 duid '0e:00:00:01:00:01:27:71:db:f0:00:50:56:bf:c5:6d'

set interfaces wireless <interface> dhcpv6-options no-release

When no-release is specified, dhcp6c will send a release message on client exit to prevent losing an assigned
address or prefix.

set interfaces wireless wlan0 dhcpv6-options no-release

set interfaces wireless <interface> dhcpv6-options parameters-only

This statement specifies dhcp6c to only exchange informational configuration parameters with servers. A list of
DNS server addresses is an example of such parameters. This statement is useful when the client does not need
stateful configuration parameters such as IPv6 addresses or prefixes.

set interfaces wireless wlan0 dhcpv6-options parameters-only

set interfaces wireless <interface> dhcpv6-options rapid-commit

When rapid-commit is specified, dhcp6c will include a rapid-commit option in solicit messages and wait for an
immediate reply instead of advertisements.

set interfaces wireless wlan0 dhcpv6-options rapid-commit

set interfaces wireless <interface> dhcpv6-options temporary

Request only a temporary address and not form an IA_NA (Identity Association for Non-temporary Addresses)
partnership.

set interfaces wireless wlan0 dhcpv6-options temporary

DHCPv6 Prefix Delegation (PD)

VyOS 1.3 (equuleus) supports DHCPv6-PD (RFC 3633). DHCPv6 Prefix Delegation is supported by most ISPs who
provide native IPv6 for consumers on fixed networks.
set interfaces wireless <interface> dhcpv6-options pd <id> length <length>
Some ISPs by default only delegate a /64 prefix. To request for a specific prefix size use this option to request
for a bigger delegation for this pd <id>. This value is in the range from 32 - 64 so you could request up to a /32
prefix (if your ISP allows this) down to a /64 delegation.
The default value corresponds to 64.
To request a /56 prefix from your ISP use:

set interfaces wireless wlan0 dhcpv6-options pd 0 length 56

set interfaces wireless <interface> dhcpv6-options pd <id> interface <delegatee> address

<address>
Specify the interface address used locally on the interface where the prefix has been delegated to. ID must be a
decimal integer.
It will be combined with the delegated prefix and the sla-id to form a complete interface address. The default is
to use the EUI-64 address of the interface.
Example: Delegate a /64 prefix to interface eth8 which will use a local address on this router of
<prefix>::ffff, as the address 65534 will correspond to ffff in hexadecimal notation.

8.4. Interfaces 670

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces wireless wlan0 dhcpv6-options pd 0 interface eth8 address 65534

set interfaces wireless <interface> dhcpv6-options pd <id> interface <delegatee> sla-id

<id>
Specify the identifier value of the site-level aggregator (SLA) on the interface. ID must be a decimal number
greater then 0 which fits in the length of SLA IDs (see below).
Example: If ID is 1 and the client is delegated an IPv6 prefix 2001:db8:ffff::/48, dhcp6c will combine the two
values into a single IPv6 prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified interface.

set interfaces wireless wlan0 dhcpv6-options pd 0 interface eth8 sla-id 1

System Wide configuration

set system wireless country-code <cc>

Country code (ISO/IEC 3166-1). Used to set regulatory domain. Set as needed to indicate country in which
device is operating. This can limit available channels and transmit power.

Note: This option is mandatory in Access-Point mode.

Wireless options

set system wireless country-code <cc>

Country code (ISO/IEC 3166-1). Used to set regulatory domain. Set as needed to indicate country in which the
box is operating. This can limit available channels and transmit power.

Note: This option is mandatory in Access-Point mode.

set interfaces wireless <interface> channel <number>

Channel number (IEEE 802.11), for 2.4Ghz (802.11 b/g/n) channels range from 1-14. On 5Ghz (802.11
a/h/j/n/ac) channels available are 0, 34 to 173. On 6GHz (802.11 ax) channels range from 1 to 233.
set interfaces wireless <interface> disable-broadcast-ssid
Send empty SSID in beacons and ignore probe request frames that do not specify full SSID, i.e., require stations
to know the SSID.
set interfaces wireless <interface> expunge-failing-stations
Disassociate stations based on excessive transmission failures or other indications of connection loss.
This depends on the driver capabilities and may not be available with all drivers.
set interfaces wireless <interface> isolate-stations
Client isolation can be used to prevent low-level bridging of frames between associated stations in the BSS.
By default, this bridging is allowed.
set interfaces wireless <interface> max-stations

8.4. Interfaces 671

 VyOS Documentation, Release 1.5.x (circinus)

Maximum number of stations allowed in station table. New stations will be rejected after the station table is
full. IEEE 802.11 has a limit of 2007 different association IDs, so this number should not be larger than that.
This defaults to 2007.
set interfaces wireless <interface> mgmt-frame-protection
Management Frame Protection (MFP) according to IEEE 802.11w

Note: MFP (Management Frame Protection) is required for WPA3.

set interfaces wireless <interface> enable-bf-protection

Beacon Protection: management frame protection for Beacon frames.

Note: This option requires MFP to be enabled.

set interfaces wireless <interface> mode <a | b | g | n | ac | ax>

Operation mode of wireless radio.
• a - 802.11a - 54 Mbits/sec
• b - 802.11b - 11 Mbits/sec
• g - 802.11g - 54 Mbits/sec (default)
• n - 802.11n - 600 Mbits/sec
• ac - 802.11ac - 1300 Mbits/sec
• ax - 802.11ax - exceeds 1GBit/sec

Note: In VyOS, 802.11ax is only implemented for 6GHz as of yet.

set interfaces wireless <interface> physical-device <device>

Wireless hardware device used as underlay radio.
This defaults to phy0.
set interfaces wireless <interface> reduce-transmit-power <number>
Adds the Power Constraint information element to Beacon and Probe Response frames.
This option adds the Power Constraint information element when applicable and the Country information ele-
ment is configured. The Power Constraint element is required by Transmit Power Control.
Valid values are 0..255.
set interfaces wireless <interface> ssid <ssid>
SSID to be used in IEEE 802.11 management frames
set interfaces wireless <interface> type <access-point | station | monitor>
Wireless device type for this interface
• access-point - Access-point forwards packets between other nodes
• station - Connects to another access point
• monitor - Passively monitor all packets on the frequency/channel

8.4. Interfaces 672

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces wireless <interface> per-client-thread

Provides a per-device control to enable/disable the threaded mode for all the NAPI instances of the given network
device, without the need for a device up/down.
If CLI option is not specified, this feature is disabled.
Example:

set interfaces wireless wlan0 per-client-thread

PPDU

set interfaces wireless <interface> capabilities require-ht

set interfaces wireless <interface> capabilities require-vht
set interfaces wireless <interface> capabilities require-he

HT (High Throughput) capabilities (802.11n)

set interfaces wireless <interface> capabilities ht 40mhz-incapable

Device is incapable of 40 MHz, do not advertise. This sets [40-INTOLERANT]
set interfaces wireless <interface> capabilities ht auto-powersave
WMM-PS Unscheduled Automatic Power Save Delivery [U-APSD]
set interfaces wireless <interface> capabilities ht channel-set-width <ht20 | ht40+ |
ht40->
Supported channel width set.
• ht20 - 20 MHz channel width
• ht40- - Both 20 MHz and 40 MHz with secondary channel below the primary channel
• ht40+ - Both 20 MHz and 40 MHz with secondary channel above the primary channel

Note: There are limits on which channels can be used with HT40- and HT40+. Following table shows the
channels that may be available for HT40- and HT40+ use per IEEE 802.11n Annex J:
Depending on the location, not all of these channels may be available for use!

freq HT40- HT40+

2.4 GHz 5-13 1-7 (1-9 in Europe/Japan)
5 GHz 40,48,56,64 36,44,52,60

Note: 40 MHz channels may switch their primary and secondary channels if needed or creation of 40 MHz
channel maybe rejected based on overlapping BSSes. These changes are done automatically when hostapd is
setting up the 40 MHz channel.

set interfaces wireless <interface> capabilities ht delayed-block-ack

Enable HT-delayed Block Ack [DELAYED-BA]

8.4. Interfaces 673

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces wireless <interface> capabilities ht dsss-cck-40

DSSS/CCK Mode in 40 MHz, this sets [DSSS_CCK-40]
set interfaces wireless <interface> capabilities ht greenfield
This enables the greenfield option which sets the [GF] option
set interfaces wireless <interface> capabilities ht ldpc
Enable LDPC coding capability
set interfaces wireless <interface> capabilities ht lsig-protection
Enable L-SIG TXOP protection capability
set interfaces wireless <interface> capabilities ht max-amsdu <3839 | 7935>
Maximum A-MSDU length 3839 (default) or 7935 octets
set interfaces wireless <interface> capabilities ht short-gi <20 | 40>
Short GI capabilities for 20 and 40 MHz
set interfaces wireless <interface> capabilities ht smps <static | dynamic>
Spatial Multiplexing Power Save (SMPS) settings
set interfaces wireless <interface> capabilities ht stbc rx <num>
Enable receiving PPDU using STBC (Space Time Block Coding)
set interfaces wireless <interface> capabilities ht stbc tx
Enable sending PPDU using STBC (Space Time Block Coding)

VHT (Very High Throughput) capabilities (802.11ac)

set interfaces wireless <interface> capabilities vht antenna-count

Number of antennas on this card
set interfaces wireless <interface> capabilities vht antenna-pattern-fixed
Set if antenna pattern does not change during the lifetime of an association
set interfaces wireless <interface> capabilities vht beamform <single-user-beamformer |
single-user-beamformee | multi-user-beamformer | multi-user-beamformee>
Beamforming capabilities:
• single-user-beamformer - Support for operation as single user beamformer
• single-user-beamformee - Support for operation as single user beamformee
• multi-user-beamformer - Support for operation as multi user beamformer
• multi-user-beamformee - Support for operation as multi user beamformee
set interfaces wireless <interface> capabilities vht center-channel-freq <freq-1 |
freq-2> <number>
VHT operating channel center frequency - center freq 1 (for use with 80, 80+80 and 160 modes)
VHT operating channel center frequency - center freq 2 (for use with the 80+80 mode)
<number> must be from 34 - 173. For 80 MHz channels it should be channel + 6.

8.4. Interfaces 674

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces wireless <interface> capabilities vht channel-set-width <0 | 1 | 2 | 3>

• 0 - 20 or 40 MHz channel width (default)
• 1 - 80 MHz channel width
• 2 - 160 MHz channel width
• 3 - 80+80 MHz channel width
set interfaces wireless <interface> capabilities vht ldpc
Enable LDPC (Low Density Parity Check) coding capability
set interfaces wireless <interface> capabilities vht link-adaptation
VHT link adaptation capabilities
set interfaces wireless <interface> capabilities vht max-mpdu <value>
Increase Maximum MPDU length to 7991 or 11454 octets (default 3895 octets)
set interfaces wireless <interface> capabilities vht max-mpdu-exp <value>
Set the maximum length of A-MPDU pre-EOF padding that the station can receive
set interfaces wireless <interface> capabilities vht short-gi <80 | 160>
Short GI capabilities
set interfaces wireless <interface> capabilities vht stbc rx <num>
Enable receiving PPDU using STBC (Space Time Block Coding)
set interfaces wireless <interface> capabilities vht stbc tx
Enable sending PPDU using STBC (Space Time Block Coding)
set interfaces wireless <interface> capabilities vht tx-powersave
Enable VHT TXOP Power Save Mode
set interfaces wireless <interface> capabilities vht vht-cf
Station supports receiving VHT variant HT Control field

HE (High Efficiency) capabilities (802.11ax)

set interfaces wireless <interface> capabilities he antenna-pattern-fixed

Tell the AP that antenna positions are fixed and will not change during the lifetime of an association.
set interfaces wireless <interface> capabilities he beamform <single-user-beamformer |
single-user-beamformee | multi-user-beamformer>
Beamforming capabilities:
• single-user-beamformer - Support for operation as single user beamformer
• single-user-beamformee - Support for operation as single user beamformee
• multi-user-beamformer - Support for operation as single user beamformer
set interfaces wireless <interface> capabilities he bss-color <number>
BSS coloring helps to prevent channel jamming when multiple APs use the same channels.
Valid values are 1..63

8.4. Interfaces 675

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces wireless <interface> capabilities he center-channel-freq <freq-1 | freq-2>

<number>
HE operating channel center frequency - center freq 1 (for use with 80, 80+80 and 160 modes)
HE operating channel center frequency - center freq 2 (for use with the 80+80 mode)
<number> must be within 1..233. For 80 MHz channels it should be channel + 6 and for 160 MHz channels, it
should be channel + 14.
set interfaces wireless <interface> capabilities he channel-set-width <number>
<number> must be one of:
• 131 - 20 MHz channel width
• 132 - 40 MHz channel width
• 133 - 80 MHz channel width
• 134 - 160 MHz channel width
• 135 - 80+80 MHz channel width

Wireless options (Station/Client)

The example creates a wireless station (commonly referred to as Wi-Fi client) that accesses the network through the
WAP defined in the above example. The default physical device (phy0) is used.

set system wireless country-code de

set interfaces wireless wlan0 type station
set interfaces wireless wlan0 address dhcp
set interfaces wireless wlan0 ssid Test
set interfaces wireless wlan0 security wpa passphrase '12345678'

Resulting in

system {
wireless {
country-code de
}
}
interfaces {
wireless wlan0 {
address dhcp
security {
wpa {
passphrase "12345678"
}
}
ssid TEST
type station
}

8.4. Interfaces 676

 VyOS Documentation, Release 1.5.x (circinus)

Security

WPA (Wi-Fi Protected Access), WPA2 Enterprise and WPA3 Enterprise in combination with 802.1x based authenti-
cation can be used to authenticate users or computers in a domain.
The wireless client (supplicant) authenticates against the RADIUS server (authentication server) using an EAP method
configured on the RADIUS server. The WAP (also referred to as authenticator) role is to send all authentication
messages between the supplicant and the configured authentication server, thus the RADIUS server is responsible for
authenticating the users.
The WAP in this example has the following characteristics:
• IP address 192.168.2.1/24
• Network ID (SSID) Enterprise-TEST
• WPA passphrase 12345678
• Use 802.11n protocol
• Wireless channel 1
• RADIUS server at 192.168.3.10 with shared-secret VyOSPassword

set system wireless country-code de

set interfaces wireless wlan0 address '192.168.2.1/24'
set interfaces wireless wlan0 type access-point
set interfaces wireless wlan0 channel 1
set interfaces wireless wlan0 mode n
set interfaces wireless wlan0 ssid 'TEST'
set interfaces wireless wlan0 security wpa mode wpa2
set interfaces wireless wlan0 security wpa cipher CCMP
set interfaces wireless wlan0 security wpa radius server 192.168.3.10 key 'VyOSPassword'
set interfaces wireless wlan0 security wpa radius server 192.168.3.10 port 1812

Resulting in

system {
wireless {
country-code de
}
}
interfaces {
[...]
wireless wlan0 {
address 192.168.2.1/24
channel 1
mode n
security {
wpa {
cipher CCMP
mode wpa2
radius {
server 192.168.3.10 {
key 'VyOSPassword'
port 1812
}
(continues on next page)

8.4. Interfaces 677

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

}
}
}
ssid "Enterprise-TEST"
type access-point
}
}

VLAN

Regular VLANs (802.1q)

IEEE 802.1q, often referred to as Dot1q, is the networking standard that supports virtual LANs (VLANs) on an IEEE
802.3 Ethernet network. The standard defines a system of VLAN tagging for Ethernet frames and the accompanying
procedures to be used by bridges and switches in handling such frames. The standard also contains provisions for a
quality-of-service prioritization scheme commonly known as IEEE 802.1p and defines the Generic Attribute Registra-
tion Protocol.
Portions of the network which are VLAN-aware (i.e., IEEE 802.1q conformant) can include VLAN tags. When a frame
enters the VLAN-aware portion of the network, a tag is added to represent the VLAN membership. Each frame must
be distinguishable as being within exactly one VLAN. A frame in the VLAN-aware portion of the network that does
not contain a VLAN tag is assumed to be flowing on the native VLAN.
The standard was developed by IEEE 802.1, a working group of the IEEE 802 standards committee, and continues
to be actively revised. One of the notable revisions is 802.1Q-2014 which incorporated IEEE 802.1aq (Shortest Path
Bridging) and much of the IEEE 802.1d standard.
802.1q VLAN interfaces are represented as virtual sub-interfaces in VyOS. The term used for this is vif.
set interfaces wireless <interface> vif <vlan-id>
Create a new VLAN interface on interface <interface> using the VLAN number provided via <vlan-id>.
You can create multiple VLAN interfaces on a physical interface. The VLAN ID range is from 0 to 4094.

Note: Only 802.1Q-tagged packets are accepted on Ethernet vifs.

set interfaces wireless <interface> vif <vlan-id> address <address | dhcp | dhcpv6>
Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
• dhcp interface address is received by DHCP from a DHCP server on this segment.
• dhcpv6 interface address is received by DHCPv6 from a DHCPv6 server on this segment.

Note: When using DHCP to retrieve IPv4 address and if local customizations are needed, they should be
possible using the enter and exit hooks provided. The hook dirs are:
• /config/scripts/dhcp-client/pre-hooks.d/
• /config/scripts/dhcp-client/post-hooks.d/

8.4. Interfaces 678

 VyOS Documentation, Release 1.5.x (circinus)

Example:

set interfaces wireless wlan0 vif 10 address 192.0.2.1/24

set interfaces wireless wlan0 vif 10 address 2001:db8::1/64
set interfaces wireless wlan0 vif 10 address dhcp
set interfaces wireless wlan0 vif 10 address dhcpv6

set interfaces wireless <interface> vif <vlan-id> description <description>

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces wireless wlan0 vif 10 description 'This is an awesome interface␣

˓→running on VyOS'

set interfaces wireless <interface> vif <vlan-id> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces wireless wlan0 vif 10 disable

set interfaces wireless <interface> vif <vlan-id> disable-link-detect

Use this command to direct an interface to not detect any physical state changes on a link, for example, when
the cable is unplugged.
Default is to detects physical link state changes.
Example:

set interfaces wireless wlan0 vif 10 disable-link-detect

set interfaces wireless <interface> vif <vlan-id> mac <xx:xx:xx:xx:xx:xx>

Configure user defined MAC address on given <interface>.
Example:

set interfaces wireless wlan0 vif 10 mac '00:53:01:02:03:04'

set interfaces wireless <interface> vif <vlan-id> mtu <mtu>

Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

set interfaces wireless wlan0 vif 10 mtu 1600

set interfaces wireless <interface> vif <vlan-id> ip adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

8.4. Interfaces 679

 VyOS Documentation, Release 1.5.x (circinus)

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces wireless <interface> vif <vlan-id> ip arp-cache-timeout
Once a neighbor has been found, the entry is considered to be valid for at least for this specific time. An entry’s
validity will be extended if it receives positive feedback from higher level protocols.
This defaults to 30 seconds.
Example:

set interfaces wireless wlan0 vif 10 ip arp-cache-timeout 180

set interfaces wireless <interface> vif <vlan-id> ip disable-arp-filter

If set the kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but
it usually makes sense, because it increases the chance of successful communication. IP addresses are owned
by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing,
does this behaviour cause problems.
If not set (default) allows you to have multiple network interfaces on the same subnet, and have the ARPs for
each interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that
interface (therefore you must use source based routing for this to work).
In other words it allows control of which cards (usually 1) will respond to an arp request.
Example:

set interfaces wireless wlan0 vif 10 ip disable-arp-filter

set interfaces wireless <interface> vif <vlan-id> ip disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

set interfaces wireless wlan0 vif 10 ip disable-forwarding

set interfaces wireless <interface> vif <vlan-id> ip enable-directed-broadcast

Define different modes for IP directed broadcast forwarding as described in RFC 1812 and RFC 2644.
If configured, incoming IP directed broadcast packets on this interface will be forwarded.
If this option is unset (default), incoming IP directed broadcast packets will not be forwarded.

set interfaces wireless wlan0 vif 10 ip enable-directed-broadcast

set interfaces wireless <interface> vif <vlan-id> ip enable-arp-accept

Define behavior for gratuitous ARP frames whose IP is not already present in the ARP table. If configured
create new entries in the ARP table.
Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on.

8.4. Interfaces 680

 VyOS Documentation, Release 1.5.x (circinus)

If the ARP table already contains the IP address of the gratuitous arp frame, the arp table will be updated
regardless if this setting is on or off.

set interfaces wireless wlan0 vif 10 ip enable-arp-accept

set interfaces wireless <interface> vif <vlan-id> ip enable-arp-announce

Define different restriction levels for announcing the local source IP address from IP packets in ARP requests
sent on interface.
Use any local address, configured on any interface if this is not set.
If configured, try to avoid local addresses that are not in the target’s subnet for this interface. This mode is
useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of
their logical network configured on the receiving interface. When we generate the request we will check all our
subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no
such subnet we select source address according to the rules for level 2.

set interfaces wireless wlan0 vif 10 ip enable-arp-announce

set interfaces wireless <interface> vif <vlan-id> ip enable-arp-ignore

Define different modes for sending replies in response to received ARP requests that resolve local target IP
addresses:
If configured, reply only if the target IP address is local address configured on the incoming interface.
If this option is unset (default), reply for any local target IP address, configured on any interface.

set interfaces wireless wlan0 vif 10 ip enable-arp-ignore

set interfaces wireless <interface> vif <vlan-id> ip enable-proxy-arp

Use this command to enable proxy Address Resolution Protocol (ARP) on this interface. Proxy ARP allows
an Ethernet interface to respond with its own MAC address to ARP requests for destination IP addresses on
subnets attached to other interfaces on the system. Subsequent packets sent to those destination IP addresses
are forwarded appropriately by the system.
Example:

set interfaces wireless wlan0 vif 10 ip enable-proxy-arp

set interfaces wireless <interface> vif <vlan-id> ip proxy-arp-pvlan

Private VLAN proxy arp. Basically allow proxy arp replies back to the same interface (from which the ARP
request/solicitation was received).
This is done to support (ethernet) switch features, like RFC 3069, where the individual ports are NOT allowed
to communicate with each other, but they are allowed to talk to the upstream router. As described in RFC 3069,
it is possible to allow these hosts to communicate through the upstream router by proxy_arp’ing.

Note: Does not need to be used together with proxy_arp.

This technology is known by different names:

• In RFC 3069 it is called VLAN Aggregation
• Cisco and Allied Telesyn call it Private VLAN
• Hewlett-Packard call it Source-Port filtering or port-isolation

8.4. Interfaces 681

 VyOS Documentation, Release 1.5.x (circinus)

• Ericsson call it MAC-Forced Forwarding (RFC Draft)

set interfaces wireless <interface> vif <vlan-id> ip source-validation <strict | loose |
disable>
Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.
• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation
set interfaces wireless <interface> vif <vlan-id> ipv6 address autoconf
SLAAC RFC 4862. IPv6 hosts can configure themselves automatically when connected to an IPv6 network us-
ing the Neighbor Discovery Protocol via ICMPv6 router discovery messages. When first connected to a network,
a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to
such a request with a router advertisement packet that contains Internet Layer configuration parameters.

Note: This method automatically disables IPv6 traffic forwarding on the interface in question.

Example:

set interfaces wireless wlan0 vif 10 ipv6 address autoconf

set interfaces wireless <interface> vif <vlan-id> ipv6 address eui64 <prefix>
EUI-64 as specified in RFC 4291 allows a host to assign iteslf a unique 64-Bit IPv6 address.
Example:

set interfaces wireless wlan0 vif 10 ipv6 address eui64 2001:db8:beef::/64

set interfaces wireless <interface> vif <vlan-id> ipv6 address no-default-link-local

Do not assign a link-local IPv6 address to this interface.
Example:

set interfaces wireless wlan0 vif 10 ipv6 address no-default-link-local

set interfaces wireless <interface> vif <vlan-id> ipv6 disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
Example:

set interfaces wireless wlan0 vif 10 ipv6 disable-forwarding

set interfaces wireless <interface> vif <vlan-id> ipv6 adjust-mss <mss |

clamp-mss-to-pmtu>
As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

8.4. Interfaces 682

 VyOS Documentation, Release 1.5.x (circinus)

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss6 <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces wireless <interface> vif <vlan-id> ipv6 accept-dad <1-3>
Whether to accept DAD (Duplicate Address Detection).
• 0: Disable DAD
• 1: Enable DAD (default)
• 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate link-local address has been found.
Example:

set interfaces wireless wlan0 vif 10 ipv6 accept-dad 2

set interfaces wireless <interface> vif <vlan-id> ipv6 dup-addr-detect-transmits <n>

The amount of Duplicate Address Detection probes to send.
Default: 1
Example:

set interfaces wireless wlan0 vif 10 ipv6 dup-addr-detect-transmits 5

set interfaces wireless <interface> vif <vlan-id> vrf <vrf>

Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces wireless wlan0 vif 10 vrf red

DHCP(v6)
set interfaces wireless <interface> vif <vlan-id> dhcp-options client-id <description>
RFC 2131 states: The client MAY choose to explicitly provide the identifier through the ‘client identifier’
option. If the client supplies a ‘client identifier’, the client MUST use the same ‘client identifier’ in all subsequent
messages, and the server MUST use that identifier to identify the client.
Example:

set interfaces wireless wlan0 vif 10 dhcp-options client-id 'foo-bar'

set interfaces wireless <interface> vif <vlan-id> dhcp-options host-name <hostname>

Instead of sending the real system hostname to the DHCP server, overwrite the host-name with this given-value.
Example:

8.4. Interfaces 683

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces wireless wlan0 vif 10 dhcp-options host-name 'VyOS'

set interfaces wireless <interface> vif <vlan-id> dhcp-options vendor-class-id

<vendor-id>
This option is used by some DHCP clients to identify the vendor type and possibly the configuration of a DHCP
client. The information is a string of bytes whose contents are specific to the vendor and are not specified in a
standard.
The vendor-class-id option can be used to request a specific class of vendor options from the server.
Example:

set interfaces wireless wlan0 vif 10 dhcp-options vendor-class-id 'VyOS'

set interfaces wireless <interface> vif <vlan-id> dhcp-options no-default-route

Only request an address from the DHCP server but do not request a default gateway.
Example:

set interfaces wireless wlan0 vif 10 dhcp-options no-default-route

set interfaces wireless <interface> vif <vlan-id> dhcp-options default-route-distance

<distance>
Set the distance for the default gateway sent by the DHCP server.
Example:

set interfaces wireless wlan0 vif 10 dhcp-options default-route-distance 220

set interfaces wireless <interface> vif <vlan-id> dhcp-options reject <address>

Reject DHCP leases from a given address or range. This is useful when a modem gives a local IP when first
starting.
• address can be specified multiple times, e.g. 192.168.100.1 and/or 192.168.100.0/24
Example:

set interfaces wireless wlan0 vif 10 dhcp-options reject 192.168.100.0/24

set interfaces wireless <interface> vif <vlan-id> dhcp-options user-class <string>

This option is used by some DHCP clients as a way for users to specify identifying information to the client.
This can be used in a similar way to the vendor-class-identifier option, but the value of the option is specified
by the user, not the vendor.
Example:

set interfaces wireless wlan0 vif 10 dhcp-options user-class VyOS

set interfaces wireless <interface> vif <vlan-id> dhcpv6-options duid <duid>

The DHCP unique identifier (DUID) is used by a client to get an IP address from a DHCPv6 server. It has a
2-byte DUID type field, and a variable-length identifier field up to 128 bytes. Its actual length depends on its
type. The server compares the DUID with its database and delivers configuration data (address, lease times,
DNS servers, etc.) to the client.

8.4. Interfaces 684

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces wireless wlan0 vif 10 duid

˓→'0e:00:00:01:00:01:27:71:db:f0:00:50:56:bf:c5:6d'

set interfaces wireless <interface> vif <vlan-id> dhcpv6-options no-release

When no-release is specified, dhcp6c will send a release message on client exit to prevent losing an assigned
address or prefix.

set interfaces wireless wlan0 vif 10 dhcpv6-options no-release

set interfaces wireless <interface> vif <vlan-id> dhcpv6-options parameters-only

This statement specifies dhcp6c to only exchange informational configuration parameters with servers. A list of
DNS server addresses is an example of such parameters. This statement is useful when the client does not need
stateful configuration parameters such as IPv6 addresses or prefixes.

set interfaces wireless wlan0 vif 10 dhcpv6-options parameters-only

set interfaces wireless <interface> vif <vlan-id> dhcpv6-options rapid-commit

When rapid-commit is specified, dhcp6c will include a rapid-commit option in solicit messages and wait for an
immediate reply instead of advertisements.

set interfaces wireless wlan0 vif 10 dhcpv6-options rapid-commit

set interfaces wireless <interface> vif <vlan-id> dhcpv6-options temporary

Request only a temporary address and not form an IA_NA (Identity Association for Non-temporary Addresses)
partnership.

set interfaces wireless wlan0 vif 10 dhcpv6-options temporary

DHCPv6 Prefix Delegation (PD)

VyOS 1.3 (equuleus) supports DHCPv6-PD (RFC 3633). DHCPv6 Prefix Delegation is supported by most ISPs who
provide native IPv6 for consumers on fixed networks.
set interfaces wireless <interface> vif <vlan-id> dhcpv6-options pd <id> length <length>
Some ISPs by default only delegate a /64 prefix. To request for a specific prefix size use this option to request
for a bigger delegation for this pd <id>. This value is in the range from 32 - 64 so you could request up to a /32
prefix (if your ISP allows this) down to a /64 delegation.
The default value corresponds to 64.
To request a /56 prefix from your ISP use:

set interfaces wireless wlan0 vif 10 dhcpv6-options pd 0 length 56

set interfaces wireless <interface> vif <vlan-id> dhcpv6-options pd <id> interface

<delegatee> address <address>
Specify the interface address used locally on the interface where the prefix has been delegated to. ID must be a
decimal integer.
It will be combined with the delegated prefix and the sla-id to form a complete interface address. The default is
to use the EUI-64 address of the interface.
Example: Delegate a /64 prefix to interface eth8 which will use a local address on this router of
<prefix>::ffff, as the address 65534 will correspond to ffff in hexadecimal notation.

8.4. Interfaces 685

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces wireless wlan0 vif 10 dhcpv6-options pd 0 interface eth8 address␣

˓→65534

set interfaces wireless <interface> vif <vlan-id> dhcpv6-options pd <id> interface

<delegatee> sla-id <id>
Specify the identifier value of the site-level aggregator (SLA) on the interface. ID must be a decimal number
greater then 0 which fits in the length of SLA IDs (see below).
Example: If ID is 1 and the client is delegated an IPv6 prefix 2001:db8:ffff::/48, dhcp6c will combine the two
values into a single IPv6 prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified interface.

set interfaces wireless wlan0 vif 10 dhcpv6-options pd 0 interface eth8 sla-id 1

QinQ (802.1ad)

IEEE 802.1ad was an Ethernet networking standard informally known as QinQ as an amendment to IEEE standard
802.1q VLAN interfaces as described above. 802.1ad was incorporated into the base 802.1q standard in 2011. The
technique is also known as provider bridging, Stacked VLANs, or simply QinQ or Q-in-Q. “Q-in-Q” can for supported
devices apply to C-tag stacking on C-tag (Ethernet Type = 0x8100).
The original 802.1q specification allows a single Virtual Local Area Network (VLAN) header to be inserted into an
Ethernet frame. QinQ allows multiple VLAN tags to be inserted into a single frame, an essential capability for im-
plementing Metro Ethernet network topologies. Just as QinQ extends 802.1Q, QinQ itself is extended by other Metro
Ethernet protocols.
In a multiple VLAN header context, out of convenience the term “VLAN tag” or just “tag” for short is often used in
place of “802.1q VLAN header”. QinQ allows multiple VLAN tags in an Ethernet frame; together these tags constitute
a tag stack. When used in the context of an Ethernet frame, a QinQ frame is a frame that has 2 VLAN 802.1q headers
(double-tagged).
In VyOS the terms vif-s and vif-c stand for the ethertype tags that are used.
The inner tag is the tag which is closest to the payload portion of the frame. It is officially called C-TAG (customer tag,
with ethertype 0x8100). The outer tag is the one closer/closest to the Ethernet header, its name is S-TAG (service tag
with Ethernet Type = 0x88a8).
set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> address <address |
dhcp | dhcpv6>
Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
• dhcp interface address is received by DHCP from a DHCP server on this segment.
• dhcpv6 interface address is received by DHCPv6 from a DHCPv6 server on this segment.

Note: When using DHCP to retrieve IPv4 address and if local customizations are needed, they should be
possible using the enter and exit hooks provided. The hook dirs are:
• /config/scripts/dhcp-client/pre-hooks.d/
• /config/scripts/dhcp-client/post-hooks.d/

Example:

8.4. Interfaces 686

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces wireless wlan0 vif-s 1000 vif-c 20 address 192.0.2.1/24

set interfaces wireless wlan0 vif-s 1000 vif-c 20 address 2001:db8::1/64
set interfaces wireless wlan0 vif-s 1000 vif-c 20 address dhcp
set interfaces wireless wlan0 vif-s 1000 vif-c 20 address dhcpv6

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> description

<description>
Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 description 'This is an awesome␣
˓→interface running on VyOS'

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 disable

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> disable-link-detect

Use this command to direct an interface to not detect any physical state changes on a link, for example, when
the cable is unplugged.
Default is to detects physical link state changes.
Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 disable-link-detect

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> mac

<xx:xx:xx:xx:xx:xx>
Configure user defined MAC address on given <interface>.
Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 mac '00:53:01:02:03:04'

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> mtu <mtu>
Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 mtu 1600

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> ip adjust-mss <mss |
clamp-mss-to-pmtu>
As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

8.4. Interfaces 687

 VyOS Documentation, Release 1.5.x (circinus)

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> ip arp-cache-timeout
Once a neighbor has been found, the entry is considered to be valid for at least for this specific time. An entry’s
validity will be extended if it receives positive feedback from higher level protocols.
This defaults to 30 seconds.
Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 ip arp-cache-timeout 180

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> ip disable-arp-filter

If set the kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but
it usually makes sense, because it increases the chance of successful communication. IP addresses are owned
by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing,
does this behaviour cause problems.
If not set (default) allows you to have multiple network interfaces on the same subnet, and have the ARPs for
each interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that
interface (therefore you must use source based routing for this to work).
In other words it allows control of which cards (usually 1) will respond to an arp request.
Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 ip disable-arp-filter

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> ip disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

set interfaces wireless wlan0 vif-s 1000 vif-c 20 ip disable-forwarding

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> ip

enable-directed-broadcast
Define different modes for IP directed broadcast forwarding as described in RFC 1812 and RFC 2644.
If configured, incoming IP directed broadcast packets on this interface will be forwarded.
If this option is unset (default), incoming IP directed broadcast packets will not be forwarded.

set interfaces wireless wlan0 vif-s 1000 vif-c 20 ip enable-directed-broadcast

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> ip enable-arp-accept

Define behavior for gratuitous ARP frames whose IP is not already present in the ARP table. If configured
create new entries in the ARP table.
Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on.

8.4. Interfaces 688

 VyOS Documentation, Release 1.5.x (circinus)

If the ARP table already contains the IP address of the gratuitous arp frame, the arp table will be updated
regardless if this setting is on or off.

set interfaces wireless wlan0 vif-s 1000 vif-c 20 ip enable-arp-accept

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> ip

enable-arp-announce
Define different restriction levels for announcing the local source IP address from IP packets in ARP requests
sent on interface.
Use any local address, configured on any interface if this is not set.
If configured, try to avoid local addresses that are not in the target’s subnet for this interface. This mode is
useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of
their logical network configured on the receiving interface. When we generate the request we will check all our
subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no
such subnet we select source address according to the rules for level 2.

set interfaces wireless wlan0 vif-s 1000 vif-c 20 ip enable-arp-announce

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> ip enable-arp-ignore

Define different modes for sending replies in response to received ARP requests that resolve local target IP
addresses:
If configured, reply only if the target IP address is local address configured on the incoming interface.
If this option is unset (default), reply for any local target IP address, configured on any interface.

set interfaces wireless wlan0 vif-s 1000 vif-c 20 ip enable-arp-ignore

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> ip enable-proxy-arp

Use this command to enable proxy Address Resolution Protocol (ARP) on this interface. Proxy ARP allows
an Ethernet interface to respond with its own MAC address to ARP requests for destination IP addresses on
subnets attached to other interfaces on the system. Subsequent packets sent to those destination IP addresses
are forwarded appropriately by the system.
Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 ip enable-proxy-arp

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> ip proxy-arp-pvlan

Private VLAN proxy arp. Basically allow proxy arp replies back to the same interface (from which the ARP
request/solicitation was received).
This is done to support (ethernet) switch features, like RFC 3069, where the individual ports are NOT allowed
to communicate with each other, but they are allowed to talk to the upstream router. As described in RFC 3069,
it is possible to allow these hosts to communicate through the upstream router by proxy_arp’ing.

Note: Does not need to be used together with proxy_arp.

This technology is known by different names:

• In RFC 3069 it is called VLAN Aggregation
• Cisco and Allied Telesyn call it Private VLAN

8.4. Interfaces 689

 VyOS Documentation, Release 1.5.x (circinus)

• Hewlett-Packard call it Source-Port filtering or port-isolation

• Ericsson call it MAC-Forced Forwarding (RFC Draft)
set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> ip source-validation
<strict | loose | disable>
Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.
• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation
set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6 address autoconf
SLAAC RFC 4862. IPv6 hosts can configure themselves automatically when connected to an IPv6 network us-
ing the Neighbor Discovery Protocol via ICMPv6 router discovery messages. When first connected to a network,
a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to
such a request with a router advertisement packet that contains Internet Layer configuration parameters.

Note: This method automatically disables IPv6 traffic forwarding on the interface in question.

Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 ipv6 address autoconf

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6 address eui64
<prefix>
EUI-64 as specified in RFC 4291 allows a host to assign iteslf a unique 64-Bit IPv6 address.
Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 ipv6 address eui64␣
˓→2001:db8:beef::/64

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6 address
no-default-link-local
Do not assign a link-local IPv6 address to this interface.
Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 ipv6 address no-default-link-local

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6

disable-forwarding
Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 ipv6 disable-forwarding

8.4. Interfaces 690

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6 adjust-mss <mss
| clamp-mss-to-pmtu>
As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss6 <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6 accept-dad <1-3>
Whether to accept DAD (Duplicate Address Detection).
• 0: Disable DAD
• 1: Enable DAD (default)
• 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate link-local address has been found.
Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 ipv6 accept-dad 2

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> ipv6

dup-addr-detect-transmits <n>
The amount of Duplicate Address Detection probes to send.
Default: 1
Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 ipv6 dup-addr-detect-transmits 5

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> vrf <vrf>
Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 vrf red

DHCP(v6)
set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options
client-id <description>
RFC 2131 states: The client MAY choose to explicitly provide the identifier through the ‘client identifier’
option. If the client supplies a ‘client identifier’, the client MUST use the same ‘client identifier’ in all subsequent
messages, and the server MUST use that identifier to identify the client.
Example:

8.4. Interfaces 691

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces wireless wlan0 vif-s 1000 vif-c 20 dhcp-options client-id 'foo-bar'

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options

host-name <hostname>
Instead of sending the real system hostname to the DHCP server, overwrite the host-name with this given-value.
Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 dhcp-options host-name 'VyOS'

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options

vendor-class-id <vendor-id>
This option is used by some DHCP clients to identify the vendor type and possibly the configuration of a DHCP
client. The information is a string of bytes whose contents are specific to the vendor and are not specified in a
standard.
The vendor-class-id option can be used to request a specific class of vendor options from the server.
Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 dhcp-options vendor-class-id 'VyOS
˓→'

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options

no-default-route
Only request an address from the DHCP server but do not request a default gateway.
Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 dhcp-options no-default-route

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options

default-route-distance <distance>
Set the distance for the default gateway sent by the DHCP server.
Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 dhcp-options default-route-

˓→distance 220

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options reject
<address>
Reject DHCP leases from a given address or range. This is useful when a modem gives a local IP when first
starting.
• address can be specified multiple times, e.g. 192.168.100.1 and/or 192.168.100.0/24
Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 dhcp-options reject 192.168.100.0/
˓→24

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> dhcp-options

user-class <string>

8.4. Interfaces 692

 VyOS Documentation, Release 1.5.x (circinus)

This option is used by some DHCP clients as a way for users to specify identifying information to the client.
This can be used in a similar way to the vendor-class-identifier option, but the value of the option is specified
by the user, not the vendor.
Example:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 dhcp-options user-class VyOS

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> dhcpv6-options duid
<duid>
The DHCP unique identifier (DUID) is used by a client to get an IP address from a DHCPv6 server. It has a
2-byte DUID type field, and a variable-length identifier field up to 128 bytes. Its actual length depends on its
type. The server compares the DUID with its database and delivers configuration data (address, lease times,
DNS servers, etc.) to the client.

set interfaces wireless wlan0 vif-s 1000 vif-c 20 duid

˓→'0e:00:00:01:00:01:27:71:db:f0:00:50:56:bf:c5:6d'

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> dhcpv6-options

no-release
When no-release is specified, dhcp6c will send a release message on client exit to prevent losing an assigned
address or prefix.

set interfaces wireless wlan0 vif-s 1000 vif-c 20 dhcpv6-options no-release

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> dhcpv6-options

parameters-only
This statement specifies dhcp6c to only exchange informational configuration parameters with servers. A list of
DNS server addresses is an example of such parameters. This statement is useful when the client does not need
stateful configuration parameters such as IPv6 addresses or prefixes.

set interfaces wireless wlan0 vif-s 1000 vif-c 20 dhcpv6-options parameters-only

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> dhcpv6-options

rapid-commit
When rapid-commit is specified, dhcp6c will include a rapid-commit option in solicit messages and wait for an
immediate reply instead of advertisements.

set interfaces wireless wlan0 vif-s 1000 vif-c 20 dhcpv6-options rapid-commit

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> dhcpv6-options

temporary
Request only a temporary address and not form an IA_NA (Identity Association for Non-temporary Addresses)
partnership.

set interfaces wireless wlan0 vif-s 1000 vif-c 20 dhcpv6-options temporary

DHCPv6 Prefix Delegation (PD)

VyOS 1.3 (equuleus) supports DHCPv6-PD (RFC 3633). DHCPv6 Prefix Delegation is supported by most ISPs who
provide native IPv6 for consumers on fixed networks.
set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> dhcpv6-options pd
<id> length <length>

8.4. Interfaces 693

 VyOS Documentation, Release 1.5.x (circinus)

Some ISPs by default only delegate a /64 prefix. To request for a specific prefix size use this option to request
for a bigger delegation for this pd <id>. This value is in the range from 32 - 64 so you could request up to a /32
prefix (if your ISP allows this) down to a /64 delegation.
The default value corresponds to 64.
To request a /56 prefix from your ISP use:

set interfaces wireless wlan0 vif-s 1000 vif-c 20 dhcpv6-options pd 0 length 56

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> dhcpv6-options pd

<id> interface <delegatee> address <address>
Specify the interface address used locally on the interface where the prefix has been delegated to. ID must be a
decimal integer.
It will be combined with the delegated prefix and the sla-id to form a complete interface address. The default is
to use the EUI-64 address of the interface.
Example: Delegate a /64 prefix to interface eth8 which will use a local address on this router of
<prefix>::ffff, as the address 65534 will correspond to ffff in hexadecimal notation.

set interfaces wireless wlan0 vif-s 1000 vif-c 20 dhcpv6-options pd 0 interface␣

˓→eth8 address 65534

set interfaces wireless <interface> vif-s <vlan-id> vif-c <vlan-id> dhcpv6-options pd

<id> interface <delegatee> sla-id <id>
Specify the identifier value of the site-level aggregator (SLA) on the interface. ID must be a decimal number
greater then 0 which fits in the length of SLA IDs (see below).
Example: If ID is 1 and the client is delegated an IPv6 prefix 2001:db8:ffff::/48, dhcp6c will combine the two
values into a single IPv6 prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified interface.

set interfaces wireless wlan0 vif-s 1000 vif-c 20 dhcpv6-options pd 0 interface␣

˓→eth8 sla-id 1

Operation

show interfaces wireless info

Use this command to view operational status and wireless-specific information about all wireless interfaces.

vyos@vyos:~$ show interfaces wireless info

Interface Type SSID Channel
wlan0 access-point VyOS-TEST-0 1

show interfaces wireless detail

Use this command to view operational status and details wireless-specific information about all wireless interfaces.

vyos@vyos:~$ show interfaces wireless detail

wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default␣
˓→qlen 1000

link/ether XX:XX:XX:XX:XX:c3 brd XX:XX:XX:XX:XX:ff

inet xxx.xxx.99.254/24 scope global wlan0
valid_lft forever preferred_lft forever
(continues on next page)

8.4. Interfaces 694

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

inet6 fe80::xxxx:xxxx:fe54:2fc3/64 scope link
valid_lft forever preferred_lft forever

RX: bytes packets errors dropped overrun mcast

66072 282 0 0 0 0
TX: bytes packets errors dropped carrier collisions
83413 430 0 0 0 0

wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default␣

˓→qlen 1000

link/ether XX:XX:XX:XX:XX:c3 brd XX:XX:XX:XX:XX:ff

inet xxx.xxx.100.254/24 scope global wlan0
valid_lft forever preferred_lft forever
inet6 fe80::xxxx:xxxx:ffff:2ed3/64 scope link
valid_lft forever preferred_lft forever

RX: bytes packets errors dropped overrun mcast

166072 5282 0 0 0 0
TX: bytes packets errors dropped carrier collisions
183413 5430 0 0 0 0

show interfaces wireless <wlanX>

This command shows both status and statistics on the specified wireless interface. The wireless interface identifier can
range from wlan0 to wlan999.

vyos@vyos:~$ show interfaces wireless wlan0

wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default␣
˓→qlen 1000

link/ether XX:XX:XX:XX:XX:c3 brd XX:XX:XX:XX:XX:ff

inet xxx.xxx.99.254/24 scope global wlan0
valid_lft forever preferred_lft forever
inet6 fe80::xxxx:xxxx:fe54:2fc3/64 scope link
valid_lft forever preferred_lft forever

RX: bytes packets errors dropped overrun mcast

66072 282 0 0 0 0
TX: bytes packets errors dropped carrier collisions
83413 430 0 0 0 0

show interfaces wireless <wlanX> brief

This command gives a brief status overview of a specified wireless interface. The wireless interface identifier can range
from wlan0 to wlan999.

vyos@vyos:~$ show interfaces wireless wlan0 brief

Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
wlan0 192.168.2.254/24 u/u

show interfaces wireless <wlanX> queue

Use this command to view wireless interface queue information. The wireless interface identifier can range from wlan0
to wlan999.

8.4. Interfaces 695

 VyOS Documentation, Release 1.5.x (circinus)

vyos@vyos:~$ show interfaces wireless wlan0 queue

qdisc pfifo_fast 0: root bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
Sent 810323 bytes 6016 pkt (dropped 0, overlimits 0 requeues 0)
rate 0bit 0pps backlog 0b 0p requeues 0

show interfaces wireless <wlanX> scan

This command is used to retrieve information about WAP within the range of your wireless interface. This command
is useful on wireless interfaces configured in station mode.

Note: Scanning is not supported on all wireless drivers and wireless hardware. Refer to your driver and wireless
hardware documentation for further details.

vyos@vyos:~$ show interfaces wireless wlan0 scan

Address SSID Channel Signal (dbm)
00:53:3b:88:6e:d8 WLAN-576405 1 -64.00
00:53:3b:88:6e:da Telekom_FON 1 -64.00
00:53:00:f2:c2:a4 BabyView_F2C2A4 6 -60.00
00:53:3b:88:6e:d6 Telekom_FON 100 -72.00
00:53:3b:88:6e:d4 WLAN-576405 100 -71.00
00:53:44:a4:96:ec KabelBox-4DC8 56 -81.00
00:53:d9:7a:67:c2 WLAN-741980 1 -75.00
00:53:7c:99:ce:76 Vodafone Homespot 1 -86.00
00:53:44:a4:97:21 KabelBox-4DC8 1 -78.00
00:53:44:a4:97:21 Vodafone Hotspot 1 -79.00
00:53:44:a4:97:21 Vodafone Homespot 1 -79.00
00:53:86:40:30:da Telekom_FON 1 -86.00
00:53:7c:99:ce:76 Vodafone Hotspot 1 -86.00
00:53:44:46:d2:0b Vodafone Hotspot 1 -87.00

Examples

The following example creates a WAP. When configuring multiple WAP interfaces, you must specify unique IP ad-
dresses, channels, Network IDs commonly referred to as SSID (Service Set Identifier), and MAC addresses.
The WAP in this example has the following characteristics:
• IP address 192.168.2.1/24
• Network ID (SSID) TEST
• WPA passphrase 12345678
• Use 802.11n protocol
• Wireless channel 1

set system wireless country-code de

set interfaces wireless wlan0 address '192.168.2.1/24'
set interfaces wireless wlan0 type access-point
set interfaces wireless wlan0 channel 1
set interfaces wireless wlan0 mode n
set interfaces wireless wlan0 ssid 'TEST'
set interfaces wireless wlan0 security wpa mode wpa2
(continues on next page)

8.4. Interfaces 696

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set interfaces wireless wlan0 security wpa cipher CCMP
set interfaces wireless wlan0 security wpa passphrase '12345678'

Resulting in

system {
wireless {
country-code de
}
}
interfaces {
[...]
wireless wlan0 {
address 192.168.2.1/24
channel 1
mode n
security {
wpa {
cipher CCMP
mode wpa2
passphrase "12345678"
}
}
ssid "TEST"
type access-point
}
}
system {
[...]
wifi-regulatory-domain DE
}

To get it to work as an access point with this configuration you will need to set up a DHCP server to work with that
network. You can - of course - also bridge the Wireless interface with any configured bridge (Bridge) on the system.

Intel AX200

The Intel AX200 card does not work out of the box in AP mode, see https://unix.stackexchange.com/questions/598275/
intel-ax200-ap-mode. You can still put this card into AP mode using the following configuration:

set system wireless country-code 'us'

set interfaces wireless wlan0 channel '1'
set interfaces wireless wlan0 mode 'n'
set interfaces wireless wlan0 physical-device 'phy0'
set interfaces wireless wlan0 ssid 'VyOS'
set interfaces wireless wlan0 type 'access-point'

8.4. Interfaces 697

 VyOS Documentation, Release 1.5.x (circinus)

8.4.19 WWAN - Wireless Wide-Area-Network

The Wireless Wide-Area-Network interface provides access (through a wireless modem/wwan) to wireless networks
provided by various cellular providers.
VyOS uses the interfaces wwan subsystem for configuration.

Configuration

Common interface configuration

set interfaces wwan <interface> address <address | dhcp | dhcpv6>

Configure interface <interface> with one or more interface addresses.
• address can be specified multiple times as IPv4 and/or IPv6 address, e.g. 192.0.2.1/24 and/or
2001:db8::1/64
• dhcp interface address is received by DHCP from a DHCP server on this segment.
• dhcpv6 interface address is received by DHCPv6 from a DHCPv6 server on this segment.

Note: When using DHCP to retrieve IPv4 address and if local customizations are needed, they should be
possible using the enter and exit hooks provided. The hook dirs are:
• /config/scripts/dhcp-client/pre-hooks.d/
• /config/scripts/dhcp-client/post-hooks.d/

Example:

set interfaces wwan wwan0 address 192.0.2.1/24

set interfaces wwan wwan0 address 2001:db8::1/64
set interfaces wwan wwan0 address dhcp
set interfaces wwan wwan0 address dhcpv6

set interfaces wwan <interface> description <description>

Set a human readable, descriptive alias for this connection. Alias is used by e.g. the show interfaces com-
mand or SNMP based monitoring tools.
Example:

set interfaces wwan wwan0 description 'This is an awesome interface running on VyOS'

set interfaces wwan <interface> disable

Disable given <interface>. It will be placed in administratively down (A/D) state.
Example:

set interfaces wwan wwan0 disable

set interfaces wwan <interface> disable-link-detect

Use this command to direct an interface to not detect any physical state changes on a link, for example, when
the cable is unplugged.
Default is to detects physical link state changes.

8.4. Interfaces 698

 VyOS Documentation, Release 1.5.x (circinus)

Example:

set interfaces wwan wwan0 disable-link-detect

set interfaces wwan <interface> mtu <mtu>

Configure MTU on given <interface>. It is the size (in bytes) of the largest ethernet frame sent on this link.
Example:

set interfaces wwan wwan0 mtu 1600

set interfaces wwan <interface> ip adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss <value>

Hint: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting in 1452 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces wwan <interface> ip arp-cache-timeout
Once a neighbor has been found, the entry is considered to be valid for at least for this specific time. An entry’s
validity will be extended if it receives positive feedback from higher level protocols.
This defaults to 30 seconds.
Example:

set interfaces wwan wwan0 ip arp-cache-timeout 180

set interfaces wwan <interface> ip disable-arp-filter

If set the kernel can respond to arp requests with addresses from other interfaces. This may seem wrong but
it usually makes sense, because it increases the chance of successful communication. IP addresses are owned
by the complete host on Linux, not by particular interfaces. Only for more complex setups like load-balancing,
does this behaviour cause problems.
If not set (default) allows you to have multiple network interfaces on the same subnet, and have the ARPs for
each interface be answered based on whether or not the kernel would route a packet from the ARP’d IP out that
interface (therefore you must use source based routing for this to work).
In other words it allows control of which cards (usually 1) will respond to an arp request.
Example:

set interfaces wwan wwan0 ip disable-arp-filter

set interfaces wwan <interface> ip disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.

8.4. Interfaces 699

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces wwan wwan0 ip disable-forwarding

set interfaces wwan <interface> ip enable-directed-broadcast

Define different modes for IP directed broadcast forwarding as described in RFC 1812 and RFC 2644.
If configured, incoming IP directed broadcast packets on this interface will be forwarded.
If this option is unset (default), incoming IP directed broadcast packets will not be forwarded.

set interfaces wwan wwan0 ip enable-directed-broadcast

set interfaces wwan <interface> ip enable-arp-accept

Define behavior for gratuitous ARP frames whose IP is not already present in the ARP table. If configured
create new entries in the ARP table.
Both replies and requests type gratuitous arp will trigger the ARP table to be updated, if this setting is on.
If the ARP table already contains the IP address of the gratuitous arp frame, the arp table will be updated
regardless if this setting is on or off.

set interfaces wwan wwan0 ip enable-arp-accept

set interfaces wwan <interface> ip enable-arp-announce

Define different restriction levels for announcing the local source IP address from IP packets in ARP requests
sent on interface.
Use any local address, configured on any interface if this is not set.
If configured, try to avoid local addresses that are not in the target’s subnet for this interface. This mode is
useful when target hosts reachable via this interface require the source IP address in ARP requests to be part of
their logical network configured on the receiving interface. When we generate the request we will check all our
subnets that include the target IP and will preserve the source address if it is from such subnet. If there is no
such subnet we select source address according to the rules for level 2.

set interfaces wwan wwan0 ip enable-arp-announce

set interfaces wwan <interface> ip enable-arp-ignore

Define different modes for sending replies in response to received ARP requests that resolve local target IP
addresses:
If configured, reply only if the target IP address is local address configured on the incoming interface.
If this option is unset (default), reply for any local target IP address, configured on any interface.

set interfaces wwan wwan0 ip enable-arp-ignore

set interfaces wwan <interface> ip enable-proxy-arp

Use this command to enable proxy Address Resolution Protocol (ARP) on this interface. Proxy ARP allows
an Ethernet interface to respond with its own MAC address to ARP requests for destination IP addresses on
subnets attached to other interfaces on the system. Subsequent packets sent to those destination IP addresses
are forwarded appropriately by the system.
Example:

set interfaces wwan wwan0 ip enable-proxy-arp

8.4. Interfaces 700

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces wwan <interface> ip proxy-arp-pvlan

Private VLAN proxy arp. Basically allow proxy arp replies back to the same interface (from which the ARP
request/solicitation was received).
This is done to support (ethernet) switch features, like RFC 3069, where the individual ports are NOT allowed
to communicate with each other, but they are allowed to talk to the upstream router. As described in RFC 3069,
it is possible to allow these hosts to communicate through the upstream router by proxy_arp’ing.

Note: Does not need to be used together with proxy_arp.

This technology is known by different names:

• In RFC 3069 it is called VLAN Aggregation
• Cisco and Allied Telesyn call it Private VLAN
• Hewlett-Packard call it Source-Port filtering or port-isolation
• Ericsson call it MAC-Forced Forwarding (RFC Draft)
set interfaces wwan <interface> ip source-validation <strict | loose | disable>
Enable policy for source validation by reversed path, as specified in RFC 3704. Current recommended practice
in RFC 3704 is to enable strict mode to prevent IP spoofing from DDos attacks. If using asymmetric routing or
other complicated routing, then loose mode is recommended.
• strict: Each incoming packet is tested against the FIB and if the interface is not the best reverse path the
packet check will fail. By default failed packets are discarded.
• loose: Each incoming packet’s source address is also tested against the FIB and if the source address is not
reachable via any interface the packet check will fail.
• disable: No source validation
set interfaces wwan <interface> ipv6 address autoconf
SLAAC RFC 4862. IPv6 hosts can configure themselves automatically when connected to an IPv6 network us-
ing the Neighbor Discovery Protocol via ICMPv6 router discovery messages. When first connected to a network,
a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to
such a request with a router advertisement packet that contains Internet Layer configuration parameters.

Note: This method automatically disables IPv6 traffic forwarding on the interface in question.

Example:

set interfaces wwan wwan0 ipv6 address autoconf

set interfaces wwan <interface> ipv6 address eui64 <prefix>

EUI-64 as specified in RFC 4291 allows a host to assign iteslf a unique 64-Bit IPv6 address.
Example:

set interfaces wwan wwan0 ipv6 address eui64 2001:db8:beef::/64

set interfaces wwan <interface> ipv6 address no-default-link-local

Do not assign a link-local IPv6 address to this interface.
Example:

8.4. Interfaces 701

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces wwan wwan0 ipv6 address no-default-link-local

set interfaces wwan <interface> ipv6 disable-forwarding

Configure interface-specific Host/Router behaviour. If set, the interface will switch to host mode and IPv6
forwarding will be disabled on this interface.
Example:

set interfaces wwan wwan0 ipv6 disable-forwarding

set interfaces wwan <interface> ipv6 adjust-mss <mss | clamp-mss-to-pmtu>

As Internet wide PMTU discovery rarely works, we sometimes need to clamp our TCP MSS value to a specific
value. This is a field in the TCP options part of a SYN packet. By setting the MSS value, you are telling the
remote side unequivocally ‘do not try to send me packets bigger than this value’.

Note: This command was introduced in VyOS 1.4 - it was previously called: set firewall options
interface <name> adjust-mss6 <value>

Hint: MSS value = MTU - 40 (IPv6 header) - 20 (TCP header), resulting in 1432 bytes on a 1492 byte MTU.

Instead of a numerical MSS value clamp-mss-to-pmtu can be used to automatically set the proper value.
set interfaces wwan <interface> ipv6 accept-dad <1-3>
Whether to accept DAD (Duplicate Address Detection).
• 0: Disable DAD
• 1: Enable DAD (default)
• 2: Enable DAD, and disable IPv6 operation if MAC-based duplicate link-local address has been found.
Example:

set interfaces wwan wwan0 ipv6 accept-dad 2

set interfaces wwan <interface> ipv6 dup-addr-detect-transmits <n>

The amount of Duplicate Address Detection probes to send.
Default: 1
Example:

set interfaces wwan wwan0 ipv6 dup-addr-detect-transmits 5

set interfaces wwan <interface> vrf <vrf>

Place interface in given VRF instance.
See also:
There is an entire chapter about how to configure a VRF, please check this for additional information.
Example:

set interfaces wwan wwan0 vrf red

8.4. Interfaces 702

 VyOS Documentation, Release 1.5.x (circinus)

DHCP(v6)
set interfaces wwan <interface> dhcp-options client-id <description>
RFC 2131 states: The client MAY choose to explicitly provide the identifier through the ‘client identifier’
option. If the client supplies a ‘client identifier’, the client MUST use the same ‘client identifier’ in all subsequent
messages, and the server MUST use that identifier to identify the client.
Example:

set interfaces wwan wwan0 dhcp-options client-id 'foo-bar'

set interfaces wwan <interface> dhcp-options host-name <hostname>

Instead of sending the real system hostname to the DHCP server, overwrite the host-name with this given-value.
Example:

set interfaces wwan wwan0 dhcp-options host-name 'VyOS'

set interfaces wwan <interface> dhcp-options vendor-class-id <vendor-id>

This option is used by some DHCP clients to identify the vendor type and possibly the configuration of a DHCP
client. The information is a string of bytes whose contents are specific to the vendor and are not specified in a
standard.
The vendor-class-id option can be used to request a specific class of vendor options from the server.
Example:

set interfaces wwan wwan0 dhcp-options vendor-class-id 'VyOS'

set interfaces wwan <interface> dhcp-options no-default-route

Only request an address from the DHCP server but do not request a default gateway.
Example:

set interfaces wwan wwan0 dhcp-options no-default-route

set interfaces wwan <interface> dhcp-options default-route-distance <distance>

Set the distance for the default gateway sent by the DHCP server.
Example:

set interfaces wwan wwan0 dhcp-options default-route-distance 220

set interfaces wwan <interface> dhcp-options reject <address>

Reject DHCP leases from a given address or range. This is useful when a modem gives a local IP when first
starting.
• address can be specified multiple times, e.g. 192.168.100.1 and/or 192.168.100.0/24
Example:

set interfaces wwan wwan0 dhcp-options reject 192.168.100.0/24

set interfaces wwan <interface> dhcp-options user-class <string>

8.4. Interfaces 703

 VyOS Documentation, Release 1.5.x (circinus)

This option is used by some DHCP clients as a way for users to specify identifying information to the client.
This can be used in a similar way to the vendor-class-identifier option, but the value of the option is specified
by the user, not the vendor.
Example:

set interfaces wwan wwan0 dhcp-options user-class VyOS

set interfaces wwan <interface> dhcpv6-options duid <duid>

The DHCP unique identifier (DUID) is used by a client to get an IP address from a DHCPv6 server. It has a
2-byte DUID type field, and a variable-length identifier field up to 128 bytes. Its actual length depends on its
type. The server compares the DUID with its database and delivers configuration data (address, lease times,
DNS servers, etc.) to the client.

set interfaces wwan wwan0 duid '0e:00:00:01:00:01:27:71:db:f0:00:50:56:bf:c5:6d'

set interfaces wwan <interface> dhcpv6-options no-release

When no-release is specified, dhcp6c will send a release message on client exit to prevent losing an assigned
address or prefix.

set interfaces wwan wwan0 dhcpv6-options no-release

set interfaces wwan <interface> dhcpv6-options parameters-only

This statement specifies dhcp6c to only exchange informational configuration parameters with servers. A list of
DNS server addresses is an example of such parameters. This statement is useful when the client does not need
stateful configuration parameters such as IPv6 addresses or prefixes.

set interfaces wwan wwan0 dhcpv6-options parameters-only

set interfaces wwan <interface> dhcpv6-options rapid-commit

When rapid-commit is specified, dhcp6c will include a rapid-commit option in solicit messages and wait for an
immediate reply instead of advertisements.

set interfaces wwan wwan0 dhcpv6-options rapid-commit

set interfaces wwan <interface> dhcpv6-options temporary

Request only a temporary address and not form an IA_NA (Identity Association for Non-temporary Addresses)
partnership.

set interfaces wwan wwan0 dhcpv6-options temporary

DHCPv6 Prefix Delegation (PD)

VyOS 1.3 (equuleus) supports DHCPv6-PD (RFC 3633). DHCPv6 Prefix Delegation is supported by most ISPs who
provide native IPv6 for consumers on fixed networks.
set interfaces wwan <interface> dhcpv6-options pd <id> length <length>
Some ISPs by default only delegate a /64 prefix. To request for a specific prefix size use this option to request
for a bigger delegation for this pd <id>. This value is in the range from 32 - 64 so you could request up to a /32
prefix (if your ISP allows this) down to a /64 delegation.
The default value corresponds to 64.
To request a /56 prefix from your ISP use:

8.4. Interfaces 704

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces wwan wwan0 dhcpv6-options pd 0 length 56

set interfaces wwan <interface> dhcpv6-options pd <id> interface <delegatee> address

<address>
Specify the interface address used locally on the interface where the prefix has been delegated to. ID must be a
decimal integer.
It will be combined with the delegated prefix and the sla-id to form a complete interface address. The default is
to use the EUI-64 address of the interface.
Example: Delegate a /64 prefix to interface eth8 which will use a local address on this router of
<prefix>::ffff, as the address 65534 will correspond to ffff in hexadecimal notation.

set interfaces wwan wwan0 dhcpv6-options pd 0 interface eth8 address 65534

set interfaces wwan <interface> dhcpv6-options pd <id> interface <delegatee> sla-id <id>
Specify the identifier value of the site-level aggregator (SLA) on the interface. ID must be a decimal number
greater then 0 which fits in the length of SLA IDs (see below).
Example: If ID is 1 and the client is delegated an IPv6 prefix 2001:db8:ffff::/48, dhcp6c will combine the two
values into a single IPv6 prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified interface.

set interfaces wwan wwan0 dhcpv6-options pd 0 interface eth8 sla-id 1

WirelessModem (WWAN) options

set interfaces wwan <interface> apn <apn>

Every WWAN connection requires an APN (Access Point Name) which is used by the client to dial into the
ISPs network. This is a mandatory parameter. Contact your Service Provider for correct APN.

Operation

show interfaces wwan <interface>

Show detailed information on given <interface>

vyos@vyos:~$ show interfaces wwan wwan0

wwan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN␣
˓→group default qlen 1000

link/ether 02:c2:f3:00:01:02 brd ff:ff:ff:ff:ff:ff

inet 10.155.144.12/30 brd 10.155.144.15 scope global dynamic wwan0
valid_lft 7012sec preferred_lft 7012sec
inet6 fe80::c2:f3ff:fe00:0102/64 scope link
valid_lft forever preferred_lft forever

RX: bytes packets errors dropped overrun mcast

640 2 0 0 0 0
TX: bytes packets errors dropped carrier collisions
3229 16 0 0 0 0

show interfaces wwan <interface> summary

Show detailed information summary on given <interface>

8.4. Interfaces 705

 VyOS Documentation, Release 1.5.x (circinus)

vyos@vyos:~$ show interfaces wwan wwan0 summary

--------------------------------
General | dbus path: /org/freedesktop/ModemManager1/Modem/0
| device id: 79f4e9cc2e9fc8d4a3b8c8f6327c2e363170194d
--------------------------------
Hardware | manufacturer: Sierra Wireless, Incorporated
| model: MC7710
| revision: SWI9200X_03.05.29.03ap r6485 CNSHZ-ED-XP0031␣
˓→2014/12/02 17:53:15

| h/w revision: 1.0

| supported: gsm-umts, lte
| current: gsm-umts, lte
| equipment id: 358xxxxxxxxxxxx
--------------------------------
System | device: /sys/devices/pci0000:00/0000:00:13.0/usb3/3-1/3-
˓→1.3

| drivers: qcserial, qmi_wwan

| plugin: Generic
| primary port: cdc-wdm0
| ports: ttyUSB0 (qcdm), ttyUSB2 (at), cdc-wdm0 (qmi),␣
˓→wwan0 (net)

--------------------------------
Numbers | own: 4917xxxxxxxx
--------------------------------
Status | lock: sim-pin2
| unlock retries: sim-pin (3), sim-pin2 (3), sim-puk (10), sim-
˓→puk2 (10)

| state: connected
| power state: on
| access tech: lte
| signal quality: 63% (recent)
--------------------------------
Modes | supported: allowed: 2g; preferred: none
| allowed: 3g; preferred: none
| allowed: 4g; preferred: none
| allowed: 2g, 3g; preferred: 3g
| allowed: 2g, 3g; preferred: 2g
| allowed: 2g, 4g; preferred: 4g
| allowed: 2g, 4g; preferred: 2g
| allowed: 3g, 4g; preferred: 3g
| allowed: 3g, 4g; preferred: 4g
| allowed: 2g, 3g, 4g; preferred: 4g
| allowed: 2g, 3g, 4g; preferred: 3g
| allowed: 2g, 3g, 4g; preferred: 2g
| current: allowed: 2g, 3g, 4g; preferred: 2g
--------------------------------
Bands | supported: egsm, dcs, pcs, utran-1, utran-8, eutran-1,␣
˓→eutran-3,

| eutran-7, eutran-8, eutran-20

| current: egsm, dcs, pcs, utran-1, utran-8, eutran-1,␣
˓→eutran-3,

| eutran-7, eutran-8, eutran-20

--------------------------------
(continues on next page)

8.4. Interfaces 706

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

IP | supported: ipv4, ipv6, ipv4v6
--------------------------------
3GPP | imei: 358xxxxxxxxxxxx
| operator id: 26201
| operator name: Telekom.de
| registration: home
--------------------------------
3GPP EPS | ue mode of operation: ps-1
--------------------------------
SIM | dbus path: /org/freedesktop/ModemManager1/SIM/0
--------------------------------
Bearer | dbus path: /org/freedesktop/ModemManager1/Bearer/0

show interfaces wwan <interface> capabilities

Show WWAN module hardware capabilities.

vyos@vyos:~$ show interfaces wwan wwan0 capabilities

Max TX channel rate: '50000000'
Max RX channel rate: '100000000'
Data Service: 'simultaneous-cs-ps'
SIM: 'supported'
Networks: 'gsm, umts, lte'
Bands: 'gsm-dcs-1800, gsm-900-extended, gsm-900-primary, gsm-pcs-1900, wcdma-2100,␣
˓→wcdma-900'

LTE bands: '1, 3, 7, 8, 20'

show interfaces wwan <interface> firmware

Show WWAN module firmware.

vyos@vyos:~$ show interfaces wwan wwan0 firmware

Model: MC7710
Boot version: SWI9200X_03.05.29.03bt r6485 CNSHZ-ED-XP0031 2014/12/02 17:33:08
AMSS version: SWI9200X_03.05.29.03ap r6485 CNSHZ-ED-XP0031 2014/12/02 17:53:15
SKU ID: unknown
Package ID: unknown
Carrier ID: 0
Config version: unknown

show interfaces wwan <interface> imei

Show WWAN module IMEI.

vyos@vyos:~$ show interfaces wwan wwan0 imei

ESN: '0'
IMEI: '358xxxxxxxxxxxx'
MEID: 'unknown'

show interfaces wwan <interface> imsi

Show WWAN module IMSI.

vyos@vyos:~$ show interfaces wwan wwan0 imsi

IMSI: '262xxxxxxxxxxxx'

8.4. Interfaces 707

 VyOS Documentation, Release 1.5.x (circinus)

show interfaces wwan <interface> model

Show WWAN module model.

vyos@vyos:~$ show interfaces wwan wwan0 model

Model: 'MC7710'

show interfaces wwan <interface> msisdn

Show WWAN module MSISDN.

vyos@vyos:~$ show interfaces wwan wwan0 msisdn

MSISDN: '4917xxxxxxxx'

show interfaces wwan <interface> revision

Show WWAN module hardware revision.

vyos@vyos:~$ show interfaces wwan wwan0 revision

Revision: 'SWI9200X_03.05.29.03ap r6485 CNSHZ-ED-XP0031 2014/12/02 17:53:15'

show interfaces wwan <interface> signal

Show WWAN module signal strength.

vyos@vyos:~$ show interfaces wwan wwan0 signal

LTE:
RSSI: '-74 dBm'
RSRQ: '-7 dB'
RSRP: '-100 dBm'
SNR: '13.0 dB'
Radio Interface: 'lte'
Active Band Class: 'eutran-3'
Active Channel: '1300'

show interfaces wwan <interface> sim

Show WWAN module SIM card information.

vyos@vyos:~$ show interfaces wwan wwan0 sim

Provisioning applications:
Primary GW: slot '1', application '1'
Primary 1X: session doesn't exist
Secondary GW: session doesn't exist
Secondary 1X: session doesn't exist
Slot [1]:
Card state: 'present'
UPIN state: 'not-initialized'
UPIN retries: '0'
UPUK retries: '0'
Application [1]:
Application type: 'usim (2)'
Application state: 'ready'
Application ID:
A0:00:00:00:87:10:02:FF:49:94:20:89:03:10:00:00
Personalization state: 'ready'
UPIN replaces PIN1: 'no'
(continues on next page)

8.4. Interfaces 708

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

PIN1 state: 'disabled'
PIN1 retries: '3'
PUK1 retries: '10'
PIN2 state: 'enabled-not-verified'
PIN2 retries: '3'
PUK2 retries: '10'

Example

The following example is based on a Sierra Wireless MC7710 miniPCIe card (only the form factor in reality it runs
UBS) and Deutsche Telekom as ISP. The card is assembled into a PC Engines APU4.

set interfaces wwan wwan0 apn 'internet.telekom'

set interfaces wwan wwan0 address 'dhcp'

Supported Modules

The following hardware modules have been tested successfully in an PC Engines APU4 board:
• Sierra Wireless AirPrime MC7304 miniPCIe card (LTE)
• Sierra Wireless AirPrime MC7430 miniPCIe card (LTE)
• Sierra Wireless AirPrime MC7455 miniPCIe card (LTE)
• Sierra Wireless AirPrime MC7710 miniPCIe card (LTE)
• Huawei ME909u-521 miniPCIe card (LTE)
• Huawei ME909s-120 miniPCIe card (LTE)

Firmware Update

All available WWAN cards have a built-in, reprogrammable firmware. Most vendors provide regular updates to
firmware used in the baseband chip.
As VyOS makes use of the QMI interface to connect to the WWAN modem cards, the firmware can be reprogrammed.
To update the firmware, VyOS also ships the qmi-firmware-update binary. To upgrade the firmware of an
e.g. Sierra Wireless MC7710 module to the firmware provided in the file 9999999_9999999_9200_03.05.14.
00_00_generic_000.000_001_SPKG_MC.cwe use the following command:

$ sudo qmi-firmware-update --update -d 1199:68a2 \

9999999_9999999_9200_03.05.14.00_00_generic_000.000_001_SPKG_MC.cwe

8.4. Interfaces 709

 VyOS Documentation, Release 1.5.x (circinus)

8.5 Load-balancing

8.5.1 WAN load balancing

Outbound traffic can be balanced between two or more outbound interfaces. If a path fails, traffic is balanced across
the remaining healthy paths, a recovered path is automatically added back to the routing table and used by the load
balancer. The load balancer automatically adds routes for each path to the routing table and balances traffic across the
configured interfaces, determined by interface health and weight.
In a minimal configuration, the following must be provided:
• an interface with a nexthop
• one rule with a LAN (inbound-interface) and the WAN (interface).
Let’s assume we have two DHCP WAN interfaces and one LAN (eth2):

set load-balancing wan interface-health eth0 nexthop 'dhcp'

set load-balancing wan interface-health eth1 nexthop 'dhcp'
set load-balancing wan rule 1 inbound-interface 'eth2'
set load-balancing wan rule 1 interface eth0
set load-balancing wan rule 1 interface eth1

Note: WAN Load Balacing should not be used when dynamic routing protocol is used/needed. This feature creates
customized routing tables and firewall rules, that makes it incompatible to use with routing protocols.

Balancing Rules

Interfaces, their weight and the type of traffic to be balanced are defined in numbered balancing rule sets. The rule sets
are executed in numerical order against outgoing packets. In case of a match the packet is sent through an interface
specified in the matching rule. If a packet doesn’t match any rule it is sent by using the system routing table. Rule
numbers can’t be changed.
Create a load balancing rule, it can be a number between 1 and 9999:

vyos@vyos# set load-balancing wan rule 1

Possible completions:
description Description for this rule
> destination Destination
exclude Exclude packets matching this rule from wan load balance
failover Enable failover for packets matching this rule from wan load␣
˓→balance

inbound-interface Inbound interface name (e.g., "eth0") [REQUIRED]

+> interface Interface name [REQUIRED]
> limit Enable packet limit for this rule
per-packet-balancing Option to match traffic per-packet instead of the default, per-
˓→flow

protocol Protocol to match

> source Source information

8.5. Load-balancing 710

 VyOS Documentation, Release 1.5.x (circinus)

Interface weight

Let’s expand the example from above and add weight to the interfaces. The bandwidth from eth0 is larger than eth1.
Per default, outbound traffic is distributed randomly across available interfaces. Weights can be assigned to interfaces
to influence the balancing.

set load-balancing wan rule 1 interface eth0 weight 2

set load-balancing wan rule 1 interface eth1 weight 1

66% of traffic is routed to eth0, eth1 gets 33% of traffic.

Rate limit

A packet rate limit can be set for a rule to apply the rule to traffic above or below a specified threshold. To configure
the rate limiting use:

set load-balancing wan rule <rule> limit <parameter>

• burst: Number of packets allowed to overshoot the limit within period. Default 5.
• period: Time window for rate calculation. Possible values: second (one second), minute (one minute), hour
(one hour). Default is second.
• rate: Number of packets. Default 5.
• threshold: below or above the specified rate limit.

Flow and packet-based balancing

Outgoing traffic is balanced in a flow-based manner. A connection tracking table is used to track flows by their source
address, destination address and port. Each flow is assigned to an interface according to the defined balancing rules
and subsequent packets are sent through the same interface. This has the advantage that packets always arrive in order
if links with different speeds are in use.
Packet-based balancing can lead to a better balance across interfaces when out of order packets are no issue. Per-packet-
based balancing can be set for a balancing rule with:

set load-balancing wan rule <rule> per-packet-balancing

Exclude traffic

To exclude traffic from load balancing, traffic matching an exclude rule is not balanced but routed through the system
routing table instead:

set load-balancing wan rule <rule> exclude

8.5. Load-balancing 711

 VyOS Documentation, Release 1.5.x (circinus)

Health checks

The health of interfaces and paths assigned to the load balancer is periodically checked by sending ICMP packets (ping)
to remote destinations, a TTL test or the execution of a user defined script. If an interface fails the health check it is
removed from the load balancer’s pool of interfaces. To enable health checking for an interface:

vyos@vyos# set load-balancing wan interface-health <interface>

Possible completions:
failure-count Failure count
nexthop Outbound interface nexthop address. Can be 'dhcp or ip address'␣
˓→[REQUIRED]

success-count Success count

+> test Rule number

Specify nexthop on the path to the destination, ipv4-address can be set to dhcp

set load-balancing wan interface-health <interface> nexthop <ipv4-address>

Set the number of health check failures before an interface is marked as unavailable, range for number is 1 to 10,
default 1. Or set the number of successful health checks before an interface is added back to the interface pool, range
for number is 1 to 10, default 1.

set load-balancing wan interface-health <interface> failure-count <number>

set load-balancing wan interface-health <interface> success-count <number>

Each health check is configured in its own test, tests are numbered and processed in numeric order. For multi target
health checking multiple tests can be defined:

vyos@vyos# set load-balancing wan interface-health eth1 test 0

Possible completions:
resp-time Ping response time (seconds)
target Health target address
test-script Path to user defined script
ttl-limit Ttl limit (hop count)
type WLB test type

• resp-time: the maximum response time for ping in seconds. Range 1. . . 30, default 5
• target: the target to be sent ICMP packets to, address can be an IPv4 address or hostname
• test-script: A user defined script must return 0 to be considered successful and non-zero to fail. Scripts are
located in /config/scripts, for different locations the full path needs to be provided
• ttl-limit: For the UDP TTL limit test the hop count limit must be specified. The limit must be shorter than
the path length, an ICMP time expired message is needed to be returned for a successful test. default 1
• type: Specify the type of test. type can be ping, ttl or a user defined script

8.5. Load-balancing 712

 VyOS Documentation, Release 1.5.x (circinus)

Source NAT rules

Per default, interfaces used in a load balancing pool replace the source IP of each outgoing packet with its own address
to ensure that replies arrive on the same interface. This works through automatically generated source NAT (SNAT)
rules, these rules are only applied to balanced traffic. In cases where this behaviour is not desired, the automatic
generation of SNAT rules can be disabled:

set load-balancing wan disable-source-nat

Sticky Connections

Inbound connections to a WAN interface can be improperly handled when the reply is sent back to the client.

Upon reception of an incoming packet, when a response is sent, it might be desired to ensure that it leaves from the
same interface as the inbound one. This can be achieved by enabling sticky connections in the load balancing:

set load-balancing wan sticky-connections inbound

Failover

In failover mode, one interface is set to be the primary interface and other interfaces are secondary or spare. Instead
of balancing traffic across all healthy interfaces, only the primary interface is used and in case of failure, a secondary
interface selected from the pool of available interfaces takes over. The primary interface is selected based on its weight
and health, others become secondary interfaces. Secondary interfaces to take over a failed primary interface are chosen
from the load balancer’s interface pool, depending on their weight and health. Interface roles can also be selected based
on rule order by including interfaces in balancing rules and ordering those rules accordingly. To put the load balancer
in failover mode, create a failover rule:

set load-balancing wan rule <number> failover

8.5. Load-balancing 713

 VyOS Documentation, Release 1.5.x (circinus)

Because existing sessions do not automatically fail over to a new path, the session table can be flushed on each connec-
tion state change:

set load-balancing wan flush-connections

Warning: Flushing the session table will cause other connections to fall back from flow-based to packet-based
balancing until each flow is reestablished.

Script execution

A script can be run when an interface state change occurs. Scripts are run from /config/scripts, for a different location
specify the full path:

set load-balancing wan hook script-name

Two environment variables are available:

• WLB_INTERFACE_NAME=[interfacename]: Interface to be monitored
• WLB_INTERFACE_STATE=[ACTIVE|FAILED]: Interface state

Warning: Blocking call with no timeout. System will become unresponsive if script does not return!

Handling and monitoring

Show WAN load balancer information including test types and targets. A character at the start of each line depicts the
state of the test
• + successful
• - failed
• a blank indicates that no test has been carried out

vyos@vyos:~$ show wan-load-balance

Interface: eth0
Status: failed
Last Status Change: Tue Jun 11 20:12:19 2019
-Test: ping Target:
Last Interface Success: 55s
Last Interface Failure: 0s
# Interface Failure(s): 5

Interface: eth1
Status: active
Last Status Change: Tue Jun 11 20:06:42 2019
+Test: ping Target:
Last Interface Success: 0s
Last Interface Failure: 6m26s
# Interface Failure(s): 0

Show connection data of load balanced traffic:

8.5. Load-balancing 714

 VyOS Documentation, Release 1.5.x (circinus)

vyos@vyos:~$ show wan-load-balance connection

conntrack v1.4.2 (conntrack-tools): 3 flow entries have been shown.
Type State Src Dst Packets Bytes
tcp TIME_WAIT 10.1.1.13:38040 203.0.113.2:80 203.0.113.2 192.
˓→168.188.71

udp 10.1.1.13:41891 198.51.100.3:53 198.51.100.3 192.

˓→168.188.71

udp 10.1.1.13:55437 198.51.100.3:53 198.51.100.3 192.

˓→168.188.71

Restart

restart wan-load-balance

8.5.2 Reverse-proxy

VyOS reverse-proxy is balancer and proxy server that provides high-availability, load balancing and proxying for TCP
(level 4) and HTTP-based (level 7) applications.

Configuration

Service configuration is responsible for binding to a specific port, while the backend configuration determines the type
of load balancing to be applied and specifies the real servers to be utilized.

Service

set load-balancing reverse-proxy service <name> listen-address <address>

Set service to bind on IP address, by default listen on any IPv4 and IPv6
set load-balancing reverse-proxy service <name> port <port>
Create service <name> to listen on <port>
set load-balancing reverse-proxy service <name> mode <tcp|http>
Configure service <name> mode TCP or HTTP
set load-balancing reverse-proxy service <name> backend <name>
Configure service <name> to use the backend <name>
set load-balancing reverse-proxy service <name> ssl certificate <name>
Set SSL certificate <name> for service <name>
set load-balancing reverse-proxy service <name> http-response-headers <header-name> value
<header-value>
Set custom HTTP headers to be included in all responses

8.5. Load-balancing 715

 VyOS Documentation, Release 1.5.x (circinus)

Rules

Rules allow to control and route incoming traffic to specific backend based on predefined conditions. Rules allow to
define matching criteria and perform action accordingly.
set load-balancing reverse-proxy service <name> rule <rule> domain-name <name>
Match domain name
set load-balancing reverse-proxy service <name> rule <rule> ssl <sni>
SSL match Server Name Indication (SNI) option:
• req-ssl-sni SSL Server Name Indication (SNI) request match
• ssl-fc-sni SSL frontend connection Server Name Indication match
• ssl-fc-sni-end SSL frontend match end of connection Server Name
Indication
set load-balancing reverse-proxy service <name> rule <rule> url-path <match> <url>
Allows to define URL path matching rules for a specific service.
With this command, you can specify how the URL path should be matched against incoming requests.
The available options for <match> are:
• begin Matches the beginning of the URL path
• end Matches the end of the URL path.
• exact Requires an exactly match of the URL path
set load-balancing reverse-proxy service <name> rule <rule> set backend <name>
Assign a specific backend to a rule
set load-balancing reverse-proxy service <name> rule <rule> redirect-location <url>
Redirect URL to a new location

Backend

set load-balancing reverse-proxy backend <name> balance <balance>

Load-balancing algorithms to be used for distributed requests among the available servers
Balance algorithms:
• source-address Distributes requests based on the source IP address of the client
• round-robin Distributes requests in a circular manner, sequentially sending each request to the next
server in line
• least-connection Distributes requests to the server with the fewest active connections
set load-balancing reverse-proxy backend <name> mode <mode>
Configure backend <name> mode TCP or HTTP
set load-balancing reverse-proxy backend <name> server <name> address <x.x.x.x>
Set the address of the backend server to which the incoming traffic will be forwarded
set load-balancing reverse-proxy backend <name> server <name> port <port>

8.5. Load-balancing 716

 VyOS Documentation, Release 1.5.x (circinus)

Set the address of the backend port

set load-balancing reverse-proxy backend <name> server <name> check
Active health check backend server
set load-balancing reverse-proxy backend <name> server <name> send-proxy
Send a Proxy Protocol version 1 header (text format)
set load-balancing reverse-proxy backend <name> server <name> send-proxy-v2
Send a Proxy Protocol version 2 header (binary format)
set load-balancing reverse-proxy backend <name> ssl ca-certificate <ca-certificate>
Configure requests to the backend server to use SSL encryption and authenticate backend against <ca-certificate>
set load-balancing reverse-proxy backend <name> ssl no-verify
Configure requests to the backend server to use SSL encryption without validating server certificate
set load-balancing reverse-proxy backend <name> http-response-headers <header-name> value
<header-value>
Set custom HTTP headers to be included in all responses using the backend

Global

Global parameters
set load-balancing reverse-proxy global-parameters max-connections <num>
Limit maximum number of connections
set load-balancing reverse-proxy global-parameters ssl-bind-ciphers <ciphers>
Limit allowed cipher algorithms used during SSL/TLS handshake
set load-balancing reverse-proxy global-parameters tls-version-min <version>
Specify the minimum required TLS version 1.2 or 1.3

Health checks

HTTP checks

For web application providing information about their state HTTP health checks can be used to determine their avail-
ability.
set load-balancing reverse-proxy backend <name> http-check
Enables HTTP health checks using OPTION HTTP requests against ‘/’ and expecting a successful response
code in the 200-399 range.
set load-balancing reverse-proxy backend <name> http-check method <method>
Sets the HTTP method to be used, can be either: option, get, post, put
set load-balancing reverse-proxy backend <name> http-check uri <path>
Sets the endpoint to be used for health checks
set load-balancing reverse-proxy backend <name> http-check expect <condition>

8.5. Load-balancing 717

 VyOS Documentation, Release 1.5.x (circinus)

Sets the expected result condition for considering a server healthy.

Some possible examples are:
• status 200 Expecting a 200 response code
• status 200-399 Expecting a non-failure response code
• string success Expecting the string success in the response body

TCP checks

Health checks can also be configured for TCP mode backends. You can configure protocol aware checks for a range of
Layer 7 protocols:
set load-balancing reverse-proxy backend <name> health-check <protocol>
Available health check protocols:
• ldap LDAP protocol check.
• redis Redis protocol check.
• mysql MySQL protocol check.
• pgsql PostgreSQL protocol check.
• smtp SMTP protocol check.

Note: If you specify a server to be checked but do not configure a protocol, a basic TCP health check will be attempted.
A server shall be deemed online if it responses to a connection attempt with a valid SYN/ACK packet.

Redirect HTTP to HTTPS

Configure the load-balancing reverse-proxy service for HTTP.

This configuration listen on port 80 and redirect incoming requests to HTTPS:

set load-balancing reverse-proxy service http port '80'

set load-balancing reverse-proxy service http redirect-http-to-https

The name of the service can be different, in this example it is only for convenience.

Examples

Level 4 balancing

This configuration enables the TCP reverse proxy for the “my-tcp-api” service. Incoming TCP connections on port 8888
will be load balanced across the backend servers (srv01 and srv02) using the round-robin load-balancing algorithm.

set load-balancing reverse-proxy service my-tcp-api backend 'bk-01'

set load-balancing reverse-proxy service my-tcp-api mode 'tcp'
set load-balancing reverse-proxy service my-tcp-api port '8888'

set load-balancing reverse-proxy backend bk-01 balance 'round-robin'

(continues on next page)

8.5. Load-balancing 718

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set load-balancing reverse-proxy backend bk-01 mode 'tcp'

set load-balancing reverse-proxy backend bk-01 server srv01 address '192.0.2.11'

set load-balancing reverse-proxy backend bk-01 server srv01 port '8881'
set load-balancing reverse-proxy backend bk-01 server srv02 address '192.0.2.12'
set load-balancing reverse-proxy backend bk-01 server srv02 port '8882'

Balancing based on domain name

The following configuration demonstrates how to use VyOS to achieve load balancing based on the domain name.
The HTTP service listen on TCP port 80.
Rule 10 matches requests with the domain name node1.example.com forwards to the backend bk-api-01
Rule 20 matches requests with the domain name node2.example.com forwards to the backend bk-api-02

set load-balancing reverse-proxy service http description 'bind app listen on 443 port'
set load-balancing reverse-proxy service http mode 'tcp'
set load-balancing reverse-proxy service http port '80'

set load-balancing reverse-proxy service http rule 10 domain-name 'node1.example.com'

set load-balancing reverse-proxy service http rule 10 set backend 'bk-api-01'
set load-balancing reverse-proxy service http rule 20 domain-name 'node2.example.com'
set load-balancing reverse-proxy service http rule 20 set backend 'bk-api-02'

set load-balancing reverse-proxy backend bk-api-01 description 'My API-1'

set load-balancing reverse-proxy backend bk-api-01 mode 'tcp'
set load-balancing reverse-proxy backend bk-api-01 server api01 address '127.0.0.1'
set load-balancing reverse-proxy backend bk-api-01 server api01 port '4431'
set load-balancing reverse-proxy backend bk-api-02 description 'My API-2'
set load-balancing reverse-proxy backend bk-api-02 mode 'tcp'
set load-balancing reverse-proxy backend bk-api-02 server api01 address '127.0.0.2'
set load-balancing reverse-proxy backend bk-api-02 server api01 port '4432'

Terminate SSL

The following configuration terminates SSL on the router.

The http service is listens on port 80 and force redirects from HTTP to HTTPS.
The https service listens on port 443 with backend bk-default to handle HTTPS traffic. It uses certificate named
cert for SSL termination. HSTS header is set with a 1-year expiry, to tell browsers to always use SSL for site.
Rule 10 matches requests with the exact URL path /.well-known/xxx and redirects to location /certs/.
Rule 20 matches requests with URL paths ending in /mail or exact path /email/bar redirect to location /postfix/.
Additional global parameters are set, including the maximum number connection limit of 4000 and a minimum TLS
version of 1.3.

set load-balancing reverse-proxy service http description 'Force redirect to HTTPS'

set load-balancing reverse-proxy service http port '80'
(continues on next page)

8.5. Load-balancing 719

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set load-balancing reverse-proxy service http redirect-http-to-https

set load-balancing reverse-proxy service https backend 'bk-default'

set load-balancing reverse-proxy service https description 'listen on 443 port'
set load-balancing reverse-proxy service https mode 'http'
set load-balancing reverse-proxy service https port '443'
set load-balancing reverse-proxy service https ssl certificate 'cert'
set load-balancing reverse-proxy service https http-response-headers Strict-Transport-
˓→Security value 'max-age=31536000'

set load-balancing reverse-proxy service https rule 10 url-path exact '/.well-known/xxx'

set load-balancing reverse-proxy service https rule 10 set redirect-location '/certs/'
set load-balancing reverse-proxy service https rule 20 url-path end '/mail'
set load-balancing reverse-proxy service https rule 20 url-path exact '/email/bar'
set load-balancing reverse-proxy service https rule 20 set redirect-location '/postfix/'

set load-balancing reverse-proxy backend bk-default description 'Default backend'

set load-balancing reverse-proxy backend bk-default mode 'http'
set load-balancing reverse-proxy backend bk-default server sr01 address '192.0.2.23'
set load-balancing reverse-proxy backend bk-default server sr01 port '80'

set load-balancing reverse-proxy global-parameters max-connections '4000'

set load-balancing reverse-proxy global-parameters tls-version-min '1.3'

SSL Bridging

The following configuration terminates incoming HTTPS traffic on the router, then re-encrypts the traffic and sends
to the backend server via HTTPS. This is useful if encryption is required for both legs, but you do not want to install
publicly trusted certificates on each backend server.
Backend service certificates are checked against the certificate authority specified in the configuration, which could be
an internal CA.
The https service listens on port 443 with backend bk-bridge-ssl to handle HTTPS traffic. It uses certificate named
cert for SSL termination.
The bk-bridge-ssl backend connects to sr01 server on port 443 via HTTPS and checks backend server has a valid
certificate trusted by CA cacert

set load-balancing reverse-proxy service https backend 'bk-bridge-ssl'

set load-balancing reverse-proxy service https description 'listen on 443 port'
set load-balancing reverse-proxy service https mode 'http'
set load-balancing reverse-proxy service https port '443'
set load-balancing reverse-proxy service https ssl certificate 'cert'

set load-balancing reverse-proxy backend bk-bridge-ssl description 'SSL backend'

set load-balancing reverse-proxy backend bk-bridge-ssl mode 'http'
set load-balancing reverse-proxy backend bk-bridge-ssl ssl ca-certificate 'cacert'
set load-balancing reverse-proxy backend bk-bridge-ssl server sr01 address '192.0.2.23'
set load-balancing reverse-proxy backend bk-bridge-ssl server sr01 port '443'

8.5. Load-balancing 720

 VyOS Documentation, Release 1.5.x (circinus)

Balancing with HTTP health checks

This configuration enables HTTP health checks on backend servers.

set load-balancing reverse-proxy service my-tcp-api backend 'bk-01'

set load-balancing reverse-proxy service my-tcp-api mode 'tcp'
set load-balancing reverse-proxy service my-tcp-api port '8888'

set load-balancing reverse-proxy backend bk-01 balance 'round-robin'

set load-balancing reverse-proxy backend bk-01 mode 'tcp'

set load-balancing reverse-proxy backend bk-01 http-check method 'get'

set load-balancing reverse-proxy backend bk-01 http-check uri '/health'
set load-balancing reverse-proxy backend bk-01 http-check expect 'status 200'

set load-balancing reverse-proxy backend bk-01 server srv01 address '192.0.2.11'

set load-balancing reverse-proxy backend bk-01 server srv01 port '8881'
set load-balancing reverse-proxy backend bk-01 server srv01 check
set load-balancing reverse-proxy backend bk-01 server srv02 address '192.0.2.12'
set load-balancing reverse-proxy backend bk-01 server srv02 port '8882'
set load-balancing reverse-proxy backend bk-01 server srv02 check

8.6 NAT

8.6.1 NAT44

NAT (Network Address Translation) is a common method of remapping one IP address space into another by modifying
network address information in the IP header of packets while they are in transit across a traffic routing device. The
technique was originally used as a shortcut to avoid the need to readdress every host when a network was moved. It has
become a popular and essential tool in conserving global address space in the face of IPv4 address exhaustion. One
Internet-routable IP address of a NAT gateway can be used for an entire private network.
IP masquerading is a technique that hides an entire IP address space, usually consisting of private IP addresses, behind
a single IP address in another, usually public address space. The hidden addresses are changed into a single (public)
IP address as the source address of the outgoing IP packets so they appear as originating not from the hidden host but
from the routing device itself. Because of the popularity of this technique to conserve IPv4 address space, the term
NAT has become virtually synonymous with IP masquerading.
As network address translation modifies the IP address information in packets, NAT implementations may vary in their
specific behavior in various addressing cases and their effect on network traffic. The specifics of NAT behavior are not
commonly documented by vendors of equipment containing NAT implementations.
The computers on an internal network can use any of the addresses set aside by the IANA (Internet Assigned Numbers
Authority) for private addressing (see RFC 1918). These reserved IP addresses are not in use on the Internet, so an
external machine will not directly route to them. The following addresses are reserved for private use:
• 10.0.0.0 to 10.255.255.255 (CIDR: 10.0.0.0/8)
• 172.16.0.0 to 172.31.255.255 (CIDR: 172.16.0.0/12)
• 192.168.0.0 to 192.168.255.255 (CIDR: 192.168.0.0/16)
If an ISP deploys a CGN (Carrier-grade NAT), and uses RFC 1918 address space to number customer gateways, the
risk of address collision, and therefore routing failures, arises when the customer network already uses an RFC 1918
address space.

8.6. NAT 721

 VyOS Documentation, Release 1.5.x (circinus)

This prompted some ISPs to develop a policy within the ARIN (American Registry for Internet Numbers) to allocate
new private address space for CGNs, but ARIN deferred to the IETF before implementing the policy indicating that
the matter was not a typical allocation issue but a reservation of addresses for technical purposes (per RFC 2860).
IETF published RFC 6598, detailing a shared address space for use in ISP CGN deployments that can handle the same
network prefixes occurring both on inbound and outbound interfaces. ARIN returned address space to the IANA for
this allocation.
The allocated address block is 100.64.0.0/10.
Devices evaluating whether an IPv4 address is public must be updated to recognize the new address space. Allocating
more private IPv4 address space for NAT devices might prolong the transition to IPv6.

Overview

Different NAT Types

SNAT

SNAT (Source Network Address Translation) is the most common form of NAT and is typically referred to simply as
NAT. To be more correct, what most people refer to as NAT is actually the process of PAT (Port Address Translation),
or NAT overload. SNAT is typically used by internal users/private hosts to access the Internet - the source address is
translated and thus kept private.

DNAT

DNAT (Destination Network Address Translation) changes the destination address of packets passing through the
router, while SNAT changes the source address of packets. DNAT is typically used when an external (public) host
needs to initiate a session with an internal (private) host. A customer needs to access a private service behind the
routers public IP. A connection is established with the routers public IP address on a well known port and thus all traffic
for this port is rewritten to address the internal (private) host.

Bidirectional NAT

This is a common scenario where both SNAT and DNAT are configured at the same time. It’s commonly used when
internal (private) hosts need to establish a connection with external resources and external systems need to access
internal (private) resources.

NAT, Routing, Firewall Interaction

There is a very nice picture/explanation in the Vyatta documentation which should be rewritten here.

8.6. NAT 722

 VyOS Documentation, Release 1.5.x (circinus)

NAT Ruleset

NAT is configured entirely on a series of so called rules. Rules are numbered and evaluated by the underlying OS in
numerical order! The rule numbers can be changes by utilizing the rename and copy commands.

Note: Changes to the NAT system only affect newly established connections. Already established connections are not
affected.

Hint: When designing your NAT ruleset leave some space between consecutive rules for later extension. Your ruleset
could start with numbers 10, 20, 30. You thus can later extend the ruleset and place new rules between existing ones.

Rules will be created for both SNAT and DNAT .

For Bidirectional NAT a rule for both SNAT and DNAT needs to be created.

Traffic Filters

Traffic Filters are used to control which packets will have the defined NAT rules applied. Five different filters can be
applied within a NAT rule.
• outbound-interface - applicable only to SNAT . It configures the interface which is used for the outside traffic
that this translation rule applies to. Interface groups, inverted selection and wildcard, are also supported.
Examples:

set nat source rule 20 outbound-interface name eth0

set nat source rule 30 outbound-interface name bond1*
set nat source rule 20 outbound-interface name !vtun2
set nat source rule 20 outbound-interface group GROUP1
set nat source rule 20 outbound-interface group !GROUP2

• inbound-interface - applicable only to DNAT . It configures the interface which is used for the inside traffic the
translation rule applies to. Interface groups, inverted selection and wildcard, are also supported.
Example:

set nat destination rule 20 inbound-interface name eth0

set nat destination rule 30 inbound-interface name bond1*
set nat destination rule 20 inbound-interface name !vtun2
set nat destination rule 20 inbound-interface group GROUP1
set nat destination rule 20 inbound-interface group !GROUP2

• protocol - specify which types of protocols this translation rule applies to. Only packets matching the specified
protocol are NATed. By default this applies to all protocols.
Example:
– Set SNAT rule 20 to only NAT TCP and UDP packets
– Set DNAT rule 20 to only NAT UDP packets

set nat source rule 20 protocol tcp_udp

set nat destination rule 20 protocol udp

8.6. NAT 723

 VyOS Documentation, Release 1.5.x (circinus)

• source - specifies which packets the NAT translation rule applies to based on the packets source IP address and/or
source port. Only matching packets are considered for NAT.
Example:
– Set SNAT rule 20 to only NAT packets arriving from the 192.0.2.0/24 network
– Set SNAT rule 30 to only NAT packets arriving from the 203.0.113.0/24 network with a source port of 80
and 443

set nat source rule 20 source address 192.0.2.0/24

set nat source rule 30 source address 203.0.113.0/24
set nat source rule 30 source port 80,443

• destination - specify which packets the translation will be applied to, only based on the destination address
and/or port number configured.

Note: If no destination is specified the rule will match on any destination address and port.

Example:
– Configure SNAT rule (40) to only NAT packets with a destination address of 192.0.2.1.

set nat source rule 40 destination address 192.0.2.1

Address Conversion

Every NAT rule has a translation command defined. The address defined for the translation is the address used when
the address information in a packet is replaced.

Source Address

For SNAT rules the packets source address will be replaced with the address specified in the translation command. A
port translation can also be specified and is part of the translation address.

Note: The translation address must be set to one of the available addresses on the configured outbound-interface or it
must be set to masquerade which will use the primary IP address of the outbound-interface as its translation address.

Note: When using NAT for a large number of host systems it recommended that a minimum of 1 IP address is used to
NAT every 256 private host systems. This is due to the limit of 65,000 port numbers available for unique translations
and a reserving an average of 200-300 sessions per host system.

Example:
• Define a discrete source IP address of 100.64.0.1 for SNAT rule 20
• Use address masquerade (the interfaces primary address) on rule 30
• For a large amount of private machines behind the NAT your address pool might to be bigger. Use any address
in the range 100.64.0.10 - 100.64.0.20 on SNAT rule 40 when doing the translation

8.6. NAT 724

 VyOS Documentation, Release 1.5.x (circinus)

set nat source rule 20 translation address 100.64.0.1

set nat source rule 30 translation address 'masquerade'
set nat source rule 40 translation address 100.64.0.10-100.64.0.20

Destination Address

For DNAT rules the packets destination address will be replaced by the specified address in the translation address
command.
Example:
• DNAT rule 10 replaces the destination address of an inbound packet with 192.0.2.10

set nat destination rule 10 translation address 192.0.2.10

Also, in DNAT , redirection to localhost is supported. The redirect statement is a special form of dnat which always
translates the destination address to the local host’s one.
Example of redirection:

set nat destination rule 10 translation redirect port 22

NAT Load Balance

Advanced configuration can be used in order to apply source or destination NAT, and within a single rule, be able to
define multiple translated addresses, so NAT balances the translations among them.
NAT Load Balance uses an algorithm that generates a hash and based on it, then it applies corresponding translation.
This hash can be generated randomly, or can use data from the ip header: source-address, destination-address, source-
port and/or destination-port. By default, it will generate the hash randomly.
When defining the translated address, called backends, a weight must be configured. This lets the user define load
balance distribution according to their needs. Them sum of all the weights defined for the backends should be equal
to 100. In oder words, the weight defined for the backend is the percentage of the connections that will receive such
backend.
set nat [source | destination] rule <rule> load-balance hash [source-address |
destination-address | source-port | destination-port | random]
set nat [source | destination] rule <rule> load-balance backend <x.x.x.x> weight <1-100>

Configuration Examples

To setup SNAT, we need to know:

• The internal IP addresses we want to translate
• The outgoing interface to perform the translation on
• The external IP address to translate to
In the example used for the Quick Start configuration above, we demonstrate the following configuration:

set nat source rule 100 outbound-interface name 'eth0'

set nat source rule 100 source address '192.168.0.0/24'
set nat source rule 100 translation address 'masquerade'

8.6. NAT 725

 VyOS Documentation, Release 1.5.x (circinus)

Which generates the following configuration:

rule 100 {
outbound-interface {
name eth0
}
source {
address 192.168.0.0/24
}
translation {
address masquerade
}
}

In this example, we use masquerade as the translation address instead of an IP address. The masquerade target is
effectively an alias to say “use whatever IP address is on the outgoing interface”, rather than a statically configured IP
address. This is useful if you use DHCP for your outgoing interface and do not know what the external address will be.
When using NAT for a large number of host systems it recommended that a minimum of 1 IP address is used to NAT
every 256 host systems. This is due to the limit of 65,000 port numbers available for unique translations and a reserving
an average of 200-300 sessions per host system.
Example: For an ~8,000 host network a source NAT pool of 32 IP addresses is recommended.
A pool of addresses can be defined by using a hyphen between two IP addresses:

set nat source rule 100 translation address '203.0.113.32-203.0.113.63'

Avoiding “leaky” NAT

Linux netfilter will not NAT traffic marked as INVALID. This often confuses people into thinking that Linux (or
specifically VyOS) has a broken NAT implementation because non-NATed traffic is seen leaving an external interface.
This is actually working as intended, and a packet capture of the “leaky” traffic should reveal that the traffic is either an
additional TCP “RST”, “FIN,ACK”, or “RST,ACK” sent by client systems after Linux netfilter considers the connection
closed. The most common is the additional TCP RST some host implementations send after terminating a connection
(which is implementation-specific).
In other words, connection tracking has already observed the connection be closed and has transition the flow to IN-
VALID to prevent attacks from attempting to reuse the connection.
You can avoid the “leaky” behavior by using a firewall policy that drops “invalid” state packets.
Having control over the matching of INVALID state traffic, e.g. the ability to selectively log, is an important trou-
bleshooting tool for observing broken protocol behavior. For this reason, VyOS does not globally drop invalid state
traffic, instead allowing the operator to make the determination on how the traffic is handled.

8.6. NAT 726

 VyOS Documentation, Release 1.5.x (circinus)

Hairpin NAT/NAT Reflection

A typical problem with using NAT and hosting public servers is the ability for internal systems to reach an internal
server using it’s external IP address. The solution to this is usually the use of split-DNS to correctly point host systems
to the internal address when requests are made internally. Because many smaller networks lack DNS infrastructure,
a work-around is commonly deployed to facilitate the traffic by NATing the request from internal hosts to the source
address of the internal interface on the firewall.
This technique is commonly referred to as NAT Reflection or Hairpin NAT.
Example:
• Redirect Microsoft RDP traffic from the outside (WAN, external) world via DNAT in rule 100 to the internal,
private host 192.0.2.40.
• Redirect Microsoft RDP traffic from the internal (LAN, private) network via DNAT in rule 110 to the internal,
private host 192.0.2.40. We also need a SNAT rule 110 for the reverse path of the traffic. The internal network
192.0.2.0/24 is reachable via interface eth0.10.

set nat destination rule 100 description 'Regular destination NAT from external'
set nat destination rule 100 destination port '3389'
set nat destination rule 100 inbound-interface name 'pppoe0'
set nat destination rule 100 protocol 'tcp'
set nat destination rule 100 translation address '192.0.2.40'

set nat destination rule 110 description 'NAT Reflection: INSIDE'

set nat destination rule 110 destination port '3389'
set nat destination rule 110 inbound-interface name 'eth0.10'
set nat destination rule 110 protocol 'tcp'
set nat destination rule 110 translation address '192.0.2.40'

set nat source rule 110 description 'NAT Reflection: INSIDE'

set nat source rule 110 destination address '192.0.2.0/24'
set nat source rule 110 outbound-interface name 'eth0.10'
set nat source rule 110 protocol 'tcp'
set nat source rule 110 source address '192.0.2.0/24'
set nat source rule 110 translation address 'masquerade'

Which results in a configuration of:

vyos@vyos# show nat

destination {
rule 100 {
description "Regular destination NAT from external"
destination {
port 3389
}
inbound-interface {
name pppoe0
}
protocol tcp
translation {
address 192.0.2.40
}
}
(continues on next page)

8.6. NAT 727

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

rule 110 {
description "NAT Reflection: INSIDE"
destination {
port 3389
}
inbound-interface {
name eth0.10
}
protocol tcp
translation {
address 192.0.2.40
}
}
}
source {
rule 110 {
description "NAT Reflection: INSIDE"
destination {
address 192.0.2.0/24
}
outbound-interface {
name eth0.10
}
protocol tcp
source {
address 192.0.2.0/24
}
translation {
address masquerade
}
}
}

Destination NAT

DNAT is typically referred to as a Port Forward. When using VyOS as a NAT router and firewall, a common config-
uration task is to redirect incoming traffic to a system behind the firewall.
In this example, we will be using the example Quick Start configuration above as a starting point.
To setup a destination NAT rule we need to gather:
• The interface traffic will be coming in on;
• The protocol and port we wish to forward;
• The IP address of the internal system we wish to forward traffic to.
In our example, we will be forwarding web server traffic to an internal web server on 192.168.0.100. HTTP traffic
makes use of the TCP protocol on port 80. For other common port numbers, see: https://en.wikipedia.org/wiki/List_
of_TCP_and_UDP_port_numbers
Our configuration commands would be:

8.6. NAT 728

 VyOS Documentation, Release 1.5.x (circinus)

set nat destination rule 10 description 'Port Forward: HTTP to 192.168.0.100'

set nat destination rule 10 destination port '80'
set nat destination rule 10 inbound-interface name 'eth0'
set nat destination rule 10 protocol 'tcp'
set nat destination rule 10 translation address '192.168.0.100'

Which would generate the following NAT destination configuration:

nat {
destination {
rule 10 {
description "Port Forward: HTTP to 192.168.0.100"
destination {
port 80
}
inbound-interface {
name eth0
}
protocol tcp
translation {
address 192.168.0.100
}
}
}
}

Note: If forwarding traffic to a different port than it is arriving on, you may also configure the translation port using
set nat destination rule [n] translation port.

This establishes our Port Forward rule, but if we created a firewall policy it will likely block the traffic.

Firewall rules for Destination NAT

It is important to note that when creating firewall rules, the DNAT translation occurs before traffic traverses the firewall.
In other words, the destination address has already been translated to 192.168.0.100.
So in our firewall ruleset, we want to allow traffic which previously matched a destination nat rule. In order to avoid
creating many rules, one for each destination nat rule, we can accept all ‘dnat’ connections with one simple rule, using
connection-status matcher:

set firewall ipv4 forward filter rule 10 action accept

set firewall ipv4 forward filter rule 10 connection-status nat destination
set firewall ipv4 forward filter rule 10 state new enable

This would generate the following configuration:

ipv4 {
forward {
filter {
rule 10 {
action accept
(continues on next page)

8.6. NAT 729

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

connection-status {
nat destination
}
state {
new enable
}
}
}
}
}

1-to-1 NAT

Another term often used for DNAT is 1-to-1 NAT. For a 1-to-1 NAT configuration, both DNAT and SNAT are used to
NAT all traffic from an external IP address to an internal IP address and vice-versa.
Typically, a 1-to-1 NAT rule omits the destination port (all ports) and replaces the protocol with either all or ip.
Then a corresponding SNAT rule is created to NAT outgoing traffic for the internal IP to a reserved external IP. This
dedicates an external IP address to an internal IP address and is useful for protocols which don’t have the notion of
ports, such as GRE.
Here’s an extract of a simple 1-to-1 NAT configuration with one internal and one external interface:

set interfaces ethernet eth0 address '192.168.1.1/24'

set interfaces ethernet eth0 description 'Inside interface'
set interfaces ethernet eth1 address '192.0.2.30/24'
set interfaces ethernet eth1 description 'Outside interface'
set nat destination rule 2000 description '1-to-1 NAT example'
set nat destination rule 2000 destination address '192.0.2.30'
set nat destination rule 2000 inbound-interface name 'eth1'
set nat destination rule 2000 translation address '192.168.1.10'
set nat source rule 2000 description '1-to-1 NAT example'
set nat source rule 2000 outbound-interface name 'eth1'
set nat source rule 2000 source address '192.168.1.10'
set nat source rule 2000 translation address '192.0.2.30'

Firewall rules are written as normal, using the internal IP address as the source of outbound rules and the destination
of inbound rules.

NAT before VPN

Some application service providers (ASPs) operate a VPN gateway to provide access to their internal resources, and
require that a connecting organisation translate all traffic to the service provider network to a source address provided
by the ASP.

8.6. NAT 730

 VyOS Documentation, Release 1.5.x (circinus)

Load Balance

Here we provide two examples on how to apply NAT Load Balance.

First scenario: apply destination NAT for all HTTP traffic comming through interface eth0, and user 4 backends. First
backend should received 30% of the request, second backend should get 20%, third 15% and the fourth 35% We will
use source and destination address for hash generation.

set nat destination rule 10 inbound-interface name eth0

set nat destination rule 10 protocol tcp
set nat destination rule 10 destination port 80
set nat destination rule 10 load-balance hash source-address
set nat destination rule 10 load-balance hash destination-address
set nat destination rule 10 load-balance backend 198.51.100.101 weight 30
set nat destination rule 10 load-balance backend 198.51.100.102 weight 20
set nat destination rule 10 load-balance backend 198.51.100.103 weight 15
set nat destination rule 10 load-balance backend 198.51.100.104 weight 35

Second scenario: apply source NAT for all outgoing connections from LAN 10.0.0.0/8, using 3 public addresses and
equal distribution. We will generate the hash randomly.

set nat source rule 10 outbound-interface name eth0

set nat source rule 10 source address 10.0.0.0/8
set nat source rule 10 load-balance hash random
set nat source rule 10 load-balance backend 192.0.2.251 weight 33
set nat source rule 10 load-balance backend 192.0.2.252 weight 33
set nat source rule 10 load-balance backend 192.0.2.253 weight 34

Example Network

Here’s one example of a network environment for an ASP. The ASP requests that all connections from this company
should come from 172.29.41.89 - an address that is assigned by the ASP and not in use at the customer site.

Fig. 1: NAT before VPN Topology

8.6. NAT 731

 VyOS Documentation, Release 1.5.x (circinus)

Configuration

The required configuration can be broken down into 4 major pieces:

• A dummy interface for the provider-assigned IP;
• NAT (specifically, Source NAT);
• IPSec IKE and ESP Groups;
• IPSec VPN tunnels.

Dummy interface

The dummy interface allows us to have an equivalent of the Cisco IOS Loopback interface - a router-internal interface
we can use for IP addresses the router must know about, but which are not actually assigned to a real network.
We only need a single step for this interface:

set interfaces dummy dum0 address '172.29.41.89/32'

NAT Configuration

set nat source rule 110 description 'Internal to ASP'

set nat source rule 110 destination address '172.27.1.0/24'
set nat source rule 110 source address '192.168.43.0/24'
set nat source rule 110 translation address '172.29.41.89'
set nat source rule 120 description 'Internal to ASP'
set nat source rule 120 destination address '10.125.0.0/16'
set nat source rule 120 source address '192.168.43.0/24'
set nat source rule 120 translation address '172.29.41.89'

IPSec IKE and ESP

The ASP has documented their IPSec requirements:

• IKE Phase:
– aes256 Encryption
– sha256 Hashes
• ESP Phase:
– aes256 Encryption
– sha256 Hashes
– DH Group 14
Additionally, we want to use VPNs only on our eth1 interface (the external interface in the image above)

set vpn ipsec ike-group my-ike key-exchange 'ikev1'

set vpn ipsec ike-group my-ike lifetime '7800'
set vpn ipsec ike-group my-ike proposal 1 dh-group '14'
(continues on next page)

8.6. NAT 732

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set vpn ipsec ike-group my-ike proposal 1 encryption 'aes256'
set vpn ipsec ike-group my-ike proposal 1 hash 'sha256'

set vpn ipsec esp-group my-esp lifetime '3600'

set vpn ipsec esp-group my-esp mode 'tunnel'
set vpn ipsec esp-group my-esp pfs 'disable'
set vpn ipsec esp-group my-esp proposal 1 encryption 'aes256'
set vpn ipsec esp-group my-esp proposal 1 hash 'sha256'

set vpn ipsec interface 'eth1'

IPSec VPN Tunnels

We’ll use the IKE and ESP groups created above for this VPN. Because we need access to 2 different subnets on the
far side, we will need two different tunnels. If you changed the names of the ESP group and IKE group in the previous
step, make sure you use the correct names here too.

set vpn ipsec authentication psk vyos id '203.0.113.46'

set vpn ipsec authentication psk vyos id '198.51.100.243'
set vpn ipsec authentication psk vyos secret 'MYSECRETPASSWORD'
set vpn ipsec site-to-site peer branch authentication local-id '203.0.113.46'
set vpn ipsec site-to-site peer branch authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer branch authentication remote-id '198.51.100.243'
set vpn ipsec site-to-site peer branch connection-type 'initiate'
set vpn ipsec site-to-site peer branch default-esp-group 'my-esp'
set vpn ipsec site-to-site peer branch ike-group 'my-ike'
set vpn ipsec site-to-site peer branch ikev2-reauth 'inherit'
set vpn ipsec site-to-site peer branch local-address '203.0.113.46'
set vpn ipsec site-to-site peer branch remote-address '198.51.100.243'
set vpn ipsec site-to-site peer branch tunnel 0 local prefix '172.29.41.89/32'
set vpn ipsec site-to-site peer branch tunnel 0 remote prefix '172.27.1.0/24'
set vpn ipsec site-to-site peer branch tunnel 1 local prefix '172.29.41.89/32'
set vpn ipsec site-to-site peer branch tunnel 1 remote prefix '10.125.0.0/16'

Testing and Validation

If you’ve completed all the above steps you no doubt want to see if it’s all working.
Start by checking for IPSec SAs (Security Associations) with:

$ show vpn ipsec sa

Peer ID / IP Local ID / IP
------------ -------------
198.51.100.243 203.0.113.46

Tunnel State Bytes Out/In Encrypt Hash NAT-T A-Time L-Time Proto
------ ----- ------------- ------- ---- ----- ------ ------ -----
0 up 0.0/0.0 aes256 sha256 no 1647 3600 all
1 up 0.0/0.0 aes256 sha256 no 865 3600 all

8.6. NAT 733

 VyOS Documentation, Release 1.5.x (circinus)

That looks good - we defined 2 tunnels and they’re both up and running.

8.6.2 NAT64

NAT64 (IPv6-to-IPv4 Prefix Translation) is a critical component in modern networking, facilitating communication
between IPv6 and IPv4 networks. This documentation outlines the setup, configuration, and usage of the NAT64 feature
in your project. Whether you are transitioning to IPv6 or need to seamlessly connect IPv4 and IPv6 devices. NAT64 is
a stateful translation mechanism that translates IPv6 addresses to IPv4 addresses and IPv4 addresses to IPv6 addresses.
NAT64 is used to enable IPv6-only clients to contact IPv4 servers using unicast UDP, TCP, or ICMP.

Overview

Different NAT Types

SNAT64

SNAT64 (IPv6-to-IPv4 Source Address Translation) is a stateful translation mechanism that translates IPv6 addresses
to IPv4 addresses.
64:ff9b::/96 is the well-known prefix for IPv4-embedded IPv6 addresses. The prefix is used to represent IPv4
addresses in an IPv6 address format. The IPv4 address is encoded in the low-order 32 bits of the IPv6 address. The
high-order 32 bits are set to the well-known prefix 64:ff9b::/96.

Configuration Examples

The following examples show how to configure NAT64 on a VyOS router. The 192.0.2.10 address is used as the IPv4
address for the translation pool.
NAT64 server configuration:

set interfaces ethernet eth0 address '192.0.2.1/24'

set interfaces ethernet eth0 address '192.0.2.10/24'
set interfaces ethernet eth0 description 'WAN'
set interfaces ethernet eth1 address '2001:db8::1/64'
set interfaces ethernet eth1 description 'LAN'

set service dns forwarding allow-from '2001:db8::/64'

set service dns forwarding dns64-prefix '64:ff9b::/96'
set service dns forwarding listen-address '2001:db8::1'

set nat64 source rule 100 source prefix '64:ff9b::/96'

set nat64 source rule 100 translation pool 10 address '192.0.2.10'
set nat64 source rule 100 translation pool 10 port '1-65535'

NAT64 client configuration:

set interfaces ethernet eth1 address '2001:db8::2/64'

set protocols static route6 64:ff9b::/96 next-hop 2001:db8::1
set system name-server '2001:db8::1'

Test from the IPv6 only client:

8.6. NAT 734

 VyOS Documentation, Release 1.5.x (circinus)

vyos@r1:~$ ping 64:ff9b::192.0.2.1 count 2

PING 64:ff9b::192.0.2.1(64:ff9b::c000:201) 56 data bytes
64 bytes from 64:ff9b::c000:201: icmp_seq=1 ttl=63 time=0.351 ms
64 bytes from 64:ff9b::c000:201: icmp_seq=2 ttl=63 time=0.373 ms

--- 64:ff9b::192.0.2.1 ping statistics ---

2 packets transmitted, 2 received, 0% packet loss, time 1023ms
rtt min/avg/max/mdev = 0.351/0.362/0.373/0.011 ms

8.6.3 NAT66(NPTv6)

NPTv6 (IPv6-to-IPv6 Network Prefix Translation) is an address translation technology based on IPv6 networks, used
to convert an IPv6 address prefix in an IPv6 message into another IPv6 address prefix. We call this address translation
method NAT66. Devices that support the NAT66 function are called NAT66 devices, which can provide NAT66 source
and destination address translation functions.

Overview

Different NAT Types

SNAT66

SNPTv6 (Source IPv6-to-IPv6 Network Prefix Translation) The conversion function is mainly used in the following
scenarios:
• A single internal network and external network. Use the NAT66 device to connect a single internal network and
public network, and the hosts in the internal network use IPv6 address prefixes that only support routing within
the local range. When a host in the internal network accesses the external network, the source IPv6 address prefix
in the message will be converted into a global unicast IPv6 address prefix by the NAT66 device.
• Redundancy and load sharing. There are multiple NAT66 devices at the edge of an IPv6 network to another IPv6
network. The path through the NAT66 device to another IPv6 network forms an equivalent route, and traffic can
be load-shared on these NAT66 devices. In this case, you can configure the same source address translation rules
on these NAT66 devices, so that any NAT66 device can handle IPv6 traffic between different sites.
• Multi-homed. In a multi-homed network environment, the NAT66 device connects to an internal network and
simultaneously connects to different external networks. Address translation can be configured on each external
network side interface of the NAT66 device to convert the same internal network address into different external
network addresses, and realize the mapping of the same internal address to multiple external addresses.

DNAT66

The DNPTv6 (Destination IPv6-to-IPv6 Network Prefix Translation) destination address translation function is used
in scenarios where the server in the internal network provides services to the external network, such as providing Web
services or FTP services to the external network. By configuring the mapping relationship between the internal server
address and the external network address on the external network side interface of the NAT66 device, external network
users can access the internal network server through the designated external network address.

8.6. NAT 735

 VyOS Documentation, Release 1.5.x (circinus)

Prefix Conversion

Source Prefix

Every SNAT66 rule has a translation command defined. The prefix defined for the translation is the prefix used when
the address information in a packet is replaced.
The SNAT66 rule replaces the source address of the packet and calculates the converted address using the prefix spec-
ified in the rule.
Example:
• Convert the address prefix of a single fc01::/64 network to fc00::/64
• Output from eth0 network interface

set nat66 source rule 1 outbound-interface name 'eth0'

set nat66 source rule 1 source prefix 'fc01::/64'
set nat66 source rule 1 translation address 'fc00::/64'

Destination Prefix

For the DNAT66 rule, the destination address of the packet isreplaced by the address calculated from the specified
address or prefix in the translation address command
Example:
• Convert the address prefix of a single fc00::/64 network to fc01::/64
• Input from eth0 network interface

set nat66 destination rule 1 inbound-interface name 'eth0'

set nat66 destination rule 1 destination address 'fc00::/64'
set nat66 destination rule 1 translation address 'fc01::/64'

Configuration Examples

Use the following topology to build a nat66 based isolated network between internal and external networks (dynamic
prefix is not supported):
R1:

set interfaces ethernet eth0 ipv6 address autoconf

set interfaces ethernet eth1 address 'fc01::1/64'
set nat66 destination rule 1 destination address 'fc00:470:f1cd:101::/64'
set nat66 destination rule 1 inbound-interface name 'eth0'
set nat66 destination rule 1 translation address 'fc01::/64'
set nat66 source rule 1 outbound-interface name 'eth0'
set nat66 source rule 1 source prefix 'fc01::/64'
set nat66 source rule 1 translation address 'fc00:470:f1cd:101::/64'

R2:

8.6. NAT 736

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces bridge br1 address 'fc01::2/64'

set interfaces bridge br1 member interface eth0
set interfaces bridge br1 member interface eth1
set protocols static route6 ::/0 next-hop fc01::1
set service router-advert interface br1 prefix ::/0

Use the following topology to translate internal user local addresses (fc::/7) to DHCPv6-PD provided prefixes from
an ISP connected to a VyOS HA pair.
Configure both routers (a and b) for DHCPv6-PD via dummy interface:

set interfaces dummy dum1 description 'DHCPv6-PD NPT dummy'

set interfaces bonding bond0 vif 20 dhcpv6-options pd 0 interface dum1 address '0'
set interfaces bonding bond0 vif 20 dhcpv6-options pd 1 interface dum1 address '0'
set interfaces bonding bond0 vif 20 dhcpv6-options pd 2 interface dum1 address '0'
set interfaces bonding bond0 vif 20 dhcpv6-options pd 3 interface dum1 address '0'
set interfaces bonding bond0 vif 20 dhcpv6-options rapid-commit
commit

Get the DHCPv6-PD prefixes from both routers:

trae@cr01a-vyos# run show interfaces dummy dum1 br

Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
dum1 2001:db8:123:b008::/64 u/u DHCPv6-PD NPT dummy
2001:db8:123:b00a::/64
2001:db8:123:b00b::/64
2001:db8:123:b009::/64

(continues on next page)

8.6. NAT 737

 VyOS Documentation, Release 1.5.x (circinus)

8.6. NAT 738

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

trae@cr01b-vyos# run show int dummy dum1 brief
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
dum1 2001:db8:123:b00d::/64 u/u DHCPv6-PD NPT dummy
2001:db8:123:b00c::/64
2001:db8:123:b00e::/64
2001:db8:123:b00f::/64

Configure the A-side router for NPTv6 using the prefixes above:
set nat66 source rule 10 description 'NPT to VLAN 10'
set nat66 source rule 10 outbound-interface name 'bond0.20'
set nat66 source rule 10 source prefix 'fd52:d62e:8011:a::/64'
set nat66 source rule 10 translation address '2001:db8:123:b008::/64'
set nat66 source rule 20 description 'NPT to VLAN 70'
set nat66 source rule 20 outbound-interface name 'bond0.20'
set nat66 source rule 20 source prefix 'fd52:d62e:8011:46::/64'
set nat66 source rule 20 translation address '2001:db8:123:b009::/64'
set nat66 source rule 30 description 'NPT to VLAN 200'
set nat66 source rule 30 outbound-interface name 'bond0.20'
set nat66 source rule 30 source prefix 'fd52:d62e:8011:c8::/64'
set nat66 source rule 30 translation address '2001:db8:123:b00a::/64'
set nat66 source rule 40 description 'NPT to VLAN 240'
set nat66 source rule 40 outbound-interface name 'bond0.20'
set nat66 source rule 40 source prefix 'fd52:d62e:8011:f0::/64'
set nat66 source rule 40 translation address '2001:db8:123:b00b::/64'
commit

Configure the B-side router for NPTv6 using the prefixes above:

set nat66 source rule 10 description 'NPT to VLAN 10'

set nat66 source rule 10 outbound-interface name 'bond0.20'
set nat66 source rule 10 source prefix 'fd52:d62e:8011:a::/64'
set nat66 source rule 10 translation address '2001:db8:123:b00c::/64'
set nat66 source rule 20 description 'NPT to VLAN 70'
set nat66 source rule 20 outbound-interface name 'bond0.20'
set nat66 source rule 20 source prefix 'fd52:d62e:8011:46::/64'
set nat66 source rule 20 translation address '2001:db8:123:b00d::/64'
set nat66 source rule 30 description 'NPT to VLAN 200'
set nat66 source rule 30 outbound-interface name 'bond0.20'
set nat66 source rule 30 source prefix 'fd52:d62e:8011:c8::/64'
set nat66 source rule 30 translation address '2001:db8:123:b00e::/64'
set nat66 source rule 40 description 'NPT to VLAN 240'
set nat66 source rule 40 outbound-interface name 'bond0.20'
set nat66 source rule 40 source prefix 'fd52:d62e:8011:f0::/64'
set nat66 source rule 40 translation address '2001:db8:123:b00f::/64'
commit

Verify that connections are hitting the rule on both sides:

trae@cr01a-vyos# run show nat66 source statistics
Rule Packets Bytes Interface
(continues on next page)

8.6. NAT 739

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

------ --------- ------- -----------
10 1 104 bond0.20
20 1 104 bond0.20
30 8093 669445 bond0.20
40 2446 216912 bond0.20

8.6.4 CGNAT

CGNAT (Carrier-Grade Network Address Translation) , also known as Large-Scale NAT (LSN), is a type of network
address translation used by Internet Service Providers (ISPs) to enable multiple private IP addresses to share a single
public IP address. This technique helps to conserve the limited IPv4 address space. The 100.64.0.0/10 address block
is reserved for use in carrier-grade NAT

Overview

CGNAT works by placing a NAT device within the ISP’s network. This device translates private IP addresses from
customer networks to a limited pool of public IP addresses assigned to the ISP. This allows many customers to share a
smaller number of public IP addresses.
Not all RFC 6888 requirements are implemented in CGNAT.
Implemented the following RFC 6888 requirements:
• REQ 2: A CGN must have a default “IP address pooling” behavior of “Paired”. CGN must use the same external
IP address mapping for all sessions associated with the same internal IP address, be they TCP, UDP, ICMP,
something else, or a mix of different protocols.
• REQ 3: The CGN function should not have any limitations on the size or the contiguity of the external address
pool.
• REQ 4: A CGN must support limiting the number of external ports (or, equivalently, “identifiers” for ICMP) that
are assigned per subscriber

Advantages of CGNAT

• IPv4 Address Conservation: CGNAT helps mitigate the exhaustion of IPv4 addresses by allowing multiple
customers to share a single public IP address.
• Scalability: ISPs can support more customers without needing a proportional increase in public IP addresses.
• Cost-Effective: Reduces the cost associated with acquiring additional public IPv4 addresses.

Considerations

• Traceability Issues: Since multiple users share the same public IP address, tracking individual users for security
and legal purposes can be challenging.
• Performance Overheads: The translation process can introduce latency and potential performance bottlenecks,
especially under high load.
• Application Compatibility: Some applications and protocols may not work well with CGNAT due to their
reliance on unique public IP addresses.

8.6. NAT 740

 VyOS Documentation, Release 1.5.x (circinus)

• Port Allocation Limits: Each public IP address has a limited number of ports, which can be exhausted, affecting
the ability to establish new connections.
• Port Control Protocol: PCP is not implemented.

Port calculation

When implementing CGNAT, ensuring that there are enough ports allocated per subscriber is critical. Below is a
summary based on RFC 6888.
1. Total Ports Available:
• Total Ports: 65536 (0 to 65535)
• Reserved Ports: Assume 1024 ports are reserved for well-known services and administrative purposes.
• Usable Ports: 65536 - 1024 = 64512
2. Estimate Ports Needed per Subscriber:
• Example: A household might need 1000 ports to ensure smooth operation for multiple devices and appli-
cations.
3. Calculate the Number of Subscribers per Public IP:
• Usable Ports / Ports per Subscriber
• 64512 / 1000 64 subscribers per public IP

Configuration

set nat cgnat pool external <pool-name> external-port-range <port-range>

Set an external port-range for the external pool, the default range is 1024-65535. Multiple entries can be added
to the same pool.
set nat cgnat pool external <pool-name> external-port-range per-user-limit port <num>
Set external source port limits that will be allocated to each subscriber individually. The default value is 2000.
set nat cgnat pool external <pool-name> range [address | address range | network] [seq]
Set the range of external IP addresses for the CGNAT pool. The sequence is optional; if set, a lower value means
higher priority.
set nat cgnat pool internal <pool-name> range [address range | network]
Set the range of internal IP addresses for the CGNAT pool.
set nat cgnat pool rule <num> source pool <internal-pool-name>
Set the rule for the source pool.
set nat cgnat pool rule <num> translation pool <external-pool-name>
Set the rule for the translation pool.
set nat cgnat log-allocation
Enable logging of IP address and ports allocations.

8.6. NAT 741

 VyOS Documentation, Release 1.5.x (circinus)

Configuration Examples

Single external address

Example of setting up a basic CGNAT configuration: In the following example, we define an external pool named ext-1
with one external IP address
Each subscriber will be allocated a maximum of 2000 ports from the external pool.

set nat cgnat pool external ext1 external-port-range '1024-65535'

set nat cgnat pool external ext1 per-user-limit port '2000'
set nat cgnat pool external ext1 range '192.0.2.222/32'
set nat cgnat pool internal int1 range '100.64.0.0/28'
set nat cgnat rule 10 source pool 'int1'
set nat cgnat rule 10 translation pool 'ext1'

Multiple external addresses

set nat cgnat pool external ext1 external-port-range '1024-65535'

set nat cgnat pool external ext1 per-user-limit port '8000'
set nat cgnat pool external ext1 range '192.0.2.1-192.0.2.2'
set nat cgnat pool external ext1 range '203.0.113.253-203.0.113.254'
set nat cgnat pool internal int1 range '100.64.0.1-100.64.0.32'
set nat cgnat rule 10 source pool 'int1'
set nat cgnat rule 10 translation pool 'ext1'

External address sequences

set nat cgnat pool external ext-01 per-user-limit port '16000'

set nat cgnat pool external ext-01 range 203.0.113.1/32 seq '10'
set nat cgnat pool external ext-01 range 192.0.2.1/32 seq '20'
set nat cgnat pool internal int-01 range '100.64.0.0/29'
set nat cgnat rule 10 source pool 'int-01'
set nat cgnat rule 10 translation pool 'ext-01'

Operation commands

show nat cgnat allocation

Show address and port allocations
show nat cgnat allocation external-address <address>
Show all allocations for an external IP address
show nat cgnat allocation internal-address <address>
Show all allocations for an internal IP address

8.6. NAT 742

 VyOS Documentation, Release 1.5.x (circinus)

Show CGNAT allocations

vyos@vyos:~$ show nat cgnat allocation

Internal IP External IP Port range
------------- ------------- ------------
100.64.0.0 203.0.113.1 1024-17023
100.64.0.1 203.0.113.1 17024-33023
100.64.0.2 203.0.113.1 33024-49023
100.64.0.3 203.0.113.1 49024-65023
100.64.0.4 192.0.2.1 1024-17023
100.64.0.5 192.0.2.1 17024-33023
100.64.0.6 192.0.2.1 33024-49023
100.64.0.7 192.0.2.1 49024-65023

vyos@vyos:~$ show nat cgnat allocation internal-address 100.64.0.4

Internal IP External IP Port range
------------- ------------- ------------
100.64.0.4 192.0.2.1 1024-17023

Further Reading

• RFC 6598 - IANA-Reserved IPv4 Prefix for Shared Address Space

• RFC 6888 - Requirements for CGNAT
:lastproofread:2021-07-12

8.7 Policy

Policies are used for filtering and traffic management. With policies, network administrators could filter and treat traffic
according to their needs.
There could be a wide range of routing policies. Some examples are listed below:
• Filter traffic based on source/destination address.
• Set some metric to routes learned from a particular neighbor.
• Set some attributes (like AS PATH or Community value) to advertised routes to neighbors.
• Prefer a specific routing protocol routes over another routing protocol running on the same router.
Policies, in VyOS, are implemented using FRR filtering and route maps. Detailed information of FRR could be found
in http://docs.frrouting.org/

8.7. Policy 743

 VyOS Documentation, Release 1.5.x (circinus)

8.7.1 Policy Sections

Access List Policy

Filtering is used for both input and output of the routing information. Once filtering is defined, it can be applied in any
direction. VyOS makes filtering possible using acls and prefix lists.
Basic filtering can be done using access-list and access-list6.

Configuration

Access Lists

set policy access-list <acl_number>

This command creates the new access list policy, where <acl_number> must be a number from 1 to 2699.
set policy access-list <acl_number> description <text>
Set description for the access list.
set policy access-list <acl_number> rule <1-65535> action <permit|deny>
This command creates a new rule in the access list and defines an action.
set policy access-list <acl_number> rule <1-65535> <destination|source>
<any|host|inverse-mask|network>
This command defines matching parameters for access list rule. Matching criteria could be applied to destination
or source parameters:
• any: any IP address to match.
• host: single host IP address to match.
• inverse-match: network/netmask to match (requires network be defined).
• network: network/netmask to match (requires inverse-match be defined).

IPv6 Access List

Basic filtering could also be applied to IPv6 traffic.

set policy access-list6 <text>
This command creates the new IPv6 access list, identified by <text>
set policy access-list6 <text> description <text>
Set description for the IPv6 access list.
set policy access-list6 <text> rule <1-65535> action <permit|deny>
This command creates a new rule in the IPv6 access list and defines an action.
set policy access-list6 <text> rule <1-65535> source <any|exact-match|network>
This command defines matching parameters for IPv6 access list rule. Matching criteria could be applied to
source parameters:
• any: any IPv6 address to match.

8.7. Policy 744

 VyOS Documentation, Release 1.5.x (circinus)

• exact-match: exact match of the network prefixes.

• network: network/netmask to match (requires inverse-match be defined) BUG, NO invert-match option in
access-list6

Prefix List Policy

Prefix lists provides the most powerful prefix based filtering mechanism. In addition to access-list functionality, ip
prefix-list has prefix length range specification.
If no ip prefix list is specified, it acts as permit. If ip prefix list is defined, and no match is found, default deny is applied.
Prefix filtering can be done using prefix-list and prefix-list6.

Configuration

Prefix Lists

set policy prefix-list <text>

This command creates the new prefix-list policy, identified by <text>.
set policy prefix-list <text> description <text>
Set description for the prefix-list policy.
set policy prefix-list <text> rule <1-65535> action <permit|deny>
This command creates a new rule in the prefix-list and defines an action.
set policy prefix-list <text> rule <1-65535> description <text>
Set description for rule in the prefix-list.
set policy prefix-list <text> rule <1-65535> prefix <x.x.x.x/x>
Prefix to match against.
set policy prefix-list <text> rule <1-65535> ge <0-32>
Netmask greater than length.
set policy prefix-list <text> rule <1-65535> le <0-32>
Netmask less than length

IPv6 Prefix Lists

set policy prefix-list6 <text>

This command creates the new IPv6 prefix-list policy, identified by <text>.
set policy prefix-list6 <text> description <text>
Set description for the IPv6 prefix-list policy.
set policy prefix-list6 <text> rule <1-65535> action <permit|deny>
This command creates a new rule in the IPv6 prefix-list and defines an action.
set policy prefix-list6 <text> rule <1-65535> description <text>

8.7. Policy 745

 VyOS Documentation, Release 1.5.x (circinus)

Set description for rule in IPv6 prefix-list.

set policy prefix-list6 <text> rule <1-65535> prefix <h:h:h:h:h:h:h:h/x>
IPv6 prefix.
set policy prefix-list6 <text> rule <1-65535> ge <0-128>
Netmask greater than length.
set policy prefix-list6 <text> rule <1-65535> le <0-128>
Netmask less than length

Route and Route6 Policy

IPv4 route and IPv6 route policies are defined in this section. These route policies can then be associated to interfaces.

Rule-Sets

A rule-set is a named collection of rules that can be applied to an interface. Each rule is numbered, has an action to
apply if the rule is matched, and the ability to specify the criteria to match. Data packets go through the rules from 1 -
999999, at the first match the action of the rule will be executed.
set policy route <name> description <text>
set policy route6 <name> description <text>
Provide a rule-set description.
set policy route <name> default-log
set policy route6 <name> default-log
Option to log packets hitting default-action.
set policy route <name> rule <n> description <text>
set policy route6 <name> rule <n> description <text>
Provide a description for each rule.
set policy route <name> rule <n> log <enable|disable>
set policy route6 <name> rule <n> log <enable|disable>
Option to enable or disable log matching rule.

Matching criteria

There are a lot of matching criteria options available, both for policy route and policy route6. These options
are listed in this section.
set policy route <name> rule <n> connection-mark <1-2147483647>
set policy route6 <name> rule <n> connection-mark <1-2147483647>
Set match criteria based on connection mark.
set policy route <name> rule <n> source address <match_criteria>
set policy route <name> rule <n> destination address <match_criteria>

8.7. Policy 746

 VyOS Documentation, Release 1.5.x (circinus)

set policy route6 <name> rule <n> source address <match_criteria>

set policy route6 <name> rule <n> destination address <match_criteria>
Set match criteria based on source or destination ipv4|ipv6 address, where <match_criteria> could be:
For ipv4:
• <x.x.x.x>: IP address to match.
• <x.x.x.x/x>: Subnet to match.
• <x.x.x.x>-<x.x.x.x>: IP range to match.
• !<x.x.x.x>: Match everything except the specified address.
• !<x.x.x.x/x>: Match everything except the specified subnet.
• !<x.x.x.x>-<x.x.x.x>: Match everything except the specified range.
And for ipv6:
• <h:h:h:h:h:h:h:h>: IPv6 address to match.
• <h:h:h:h:h:h:h:h/x>: IPv6 prefix to match.
• <h:h:h:h:h:h:h:h>-<h:h:h:h:h:h:h:h>: IPv6 range to match.
• !<h:h:h:h:h:h:h:h>: Match everything except the specified address.
• !<h:h:h:h:h:h:h:h/x>: Match everything except the specified prefix.
• !<h:h:h:h:h:h:h:h>-<h:h:h:h:h:h:h:h>: Match everything except the specified range.
set policy route <name> rule <n> source group <address-group|domain-group|mac-group|network-group|port-g
<text>
set policy route <name> rule <n> destination group <address-group|domain-group|mac-group|network-group|p
<text>
set policy route6 <name> rule <n> source group <address-group|domain-group|mac-group|network-group|port-
<text>
set policy route6 <name> rule <n> destination group <address-group|domain-group|mac-group|network-group|
<text>
Set match criteria based on source or destination groups, where <text> would be the group name/identifier.
Prepend character ‘!’ for inverted matching criteria.
set policy route <name> rule <n> destination port <match_criteria>
set policy route6 <name> rule <n> destination port <match_criteria>
Set match criteria based on destination port, where <match_criteria> could be:
• <port name>: Named port (any name in /etc/services, e.g., http).
• <1-65535>: Numbered port.
• <start>-<end>: Numbered port range (e.g., 1001-1005).
Multiple destination ports can be specified as a comma-separated list. The whole list can also be “negated”
using ‘!’. For example: ‘!22,telnet,http,123,1001-1005’
set policy route <name> rule <n> disable
set policy route6 <name> rule <n> disable
Option to disable rule.

8.7. Policy 747

 VyOS Documentation, Release 1.5.x (circinus)

set policy route <name> rule <n> dscp <text>

set policy route6 <name> rule <n> dscp <text>
set policy route <name> rule <n> dscp-exclude <text>
set policy route6 <name> rule <n> dscp-exclude <text>
Match based on dscp value criteria. Multiple values from 0 to 63 and ranges are supported.
set policy route <name> rule <n> fragment <match-grag|match-non-frag>
set policy route6 <name> rule <n> fragment <match-grag|match-non-frag>
Set IP fragment match, where:
• match-frag: Second and further fragments of fragmented packets.
• match-non-frag: Head fragments or unfragmented packets.
set policy route <name> rule <n> icmp <code | type>
set policy route6 <name> rule <n> icmpv6 <code | type>
Match based on icmp|icmpv6 code and type.
set policy route <name> rule <n> icmp type-name <text>
set policy route6 <name> rule <n> icmpv6 type-name <text>
Match based on icmp|icmpv6 type-name criteria. Use tab for information about what type-name criteria are
supported.
set policy route <name> rule <n> ipsec <match-ipsec|match-none>
set policy route6 <name> rule <n> ipsec <match-ipsec|match-none>
Set IPSec inbound match criterias, where:
• match-ipsec: match inbound IPsec packets.
• match-none: match inbound non-IPsec packets.
set policy route <name> rule <n> limit burst <0-4294967295>
set policy route6 <name> rule <n> limit burst <0-4294967295>
Set maximum number of packets to alow in excess of rate.
set policy route <name> rule <n> limit rate <text>
set policy route6 <name> rule <n> limit rate <text>
Set maximum average matching rate. Format for rate: integer/time_unit, where time_unit could be any one of
second, minute, hour or day.For example 1/second implies rule to be matched at an average of once per second.
set policy route <name> rule <n> protocol <text | 0-255 | tcp_udp | all >
set policy route6 <name> rule <n> protocol <text | 0-255 | tcp_udp | all >
Match a protocol criteria. A protocol number or a name which is defined in: /etc/protocols. Special names
are all for all protocols and tcp_udp for tcp and udp based packets. The ! negates the selected protocol.
set policy route <name> rule <n> packet-length <text>
set policy route6 <name> rule <n> packet-length <text>
set policy route <name> rule <n> packet-length-exclude <text>
set policy route6 <name> rule <n> packet-length-exclude <text>

8.7. Policy 748

 VyOS Documentation, Release 1.5.x (circinus)

Match based on packet length criteria. Multiple values from 1 to 65535 and ranges are supported.
set policy route <name> rule <n> packet-type [broadcast | host | multicast | other]
set policy route6 <name> rule <n> packet-type [broadcast | host | multicast | other]
Match based on packet type criteria.
set policy route <name> rule <n> recent count <1-255>
set policy route6 <name> rule <n> recent count <1-255>
set policy route <name> rule <n> recent time <1-4294967295>
set policy route6 <name> rule <n> recent time <1-4294967295>
Set parameters for matching recently seen sources. This match could be used by seeting count (source address
seen more than <1-255> times) and/or time (source address seen in the last <0-4294967295> seconds).
set policy route <name> rule <n> state <established | invalid | new | related>
set policy route6 <name> rule <n> state <established | invalid | new | related>
Set match criteria based on session state.
set policy route <name> rule <n> tcp flags <text>
set policy route6 <name> rule <n> tcp flags <text>
Set match criteria based on tcp flags. Allowed values for TCP flags: SYN ACK FIN RST URG PSH
ALL. When specifying more than one flag, flags should be comma-separated. For example : value of
‘SYN,!ACK,!FIN,!RST’ will only match packets with the SYN flag set, and the ACK, FIN and RST flags unset.
set policy route <name> rule <n> time monthdays <text>
set policy route6 <name> rule <n> time monthdays <text>
set policy route <name> rule <n> time startdate <text>
set policy route6 <name> rule <n> time startdate <text>
set policy route <name> rule <n> time starttime <text>
set policy route6 <name> rule <n> time starttime <text>
set policy route <name> rule <n> time stopdate <text>
set policy route6 <name> rule <n> time stopdate <text>
set policy route <name> rule <n> time stoptime <text>
set policy route6 <name> rule <n> time stoptime <text>
set policy route <name> rule <n> time weekdays <text>
set policy route6 <name> rule <n> time weekdays <text>
set policy route <name> rule <n> time utc
set policy route6 <name> rule <n> time utc
Time to match the defined rule.
set policy route rule <n> ttl <eq | gt | lt> <0-255>
Match time to live parameter, where ‘eq’ stands for ‘equal’; ‘gt’ stands for ‘greater than’, and ‘lt’ stands for ‘less
than’.
set policy route6 rule <n> hop-limit <eq | gt | lt> <0-255>

8.7. Policy 749

 VyOS Documentation, Release 1.5.x (circinus)

Match hop-limit parameter, where ‘eq’ stands for ‘equal’; ‘gt’ stands for ‘greater than’, and ‘lt’ stands for ‘less
than’.

Actions

When mathcing all patterns defined in a rule, then different actions can be made. This includes droping the packet,
modifying certain data, or setting a different routing table.
set policy route <name> rule <n> action drop
set policy route6 <name> rule <n> action drop
Set rule action to drop.
set policy route <name> rule <n> set connection-mark <1-2147483647>
set policy route6 <name> rule <n> set connection-mark <1-2147483647>
Set a specific connection mark.
set policy route <name> rule <n> set dscp <0-63>
set policy route6 <name> rule <n> set dscp <0-63>
Set packet modifications: Packet Differentiated Services Codepoint (DSCP)
set policy route <name> rule <n> set mark <1-2147483647>
set policy route6 <name> rule <n> set mark <1-2147483647>
Set a specific packet mark.
set policy route <name> rule <n> set table <main | 1-200>
set policy route6 <name> rule <n> set table <main | 1-200>
Set the routing table to forward packet with.
set policy route <name> rule <n> set tcp-mss <500-1460>
set policy route6 <name> rule <n> set tcp-mss <500-1460>
Set packet modifications: Explicitly set TCP Maximum segment size value.

Route Map Policy

Route map is a powerfull command, that gives network administrators a very useful and flexible tool for traffic manip-
ulation.

Configuration

Route Map

set policy route-map <text>

This command creates a new route-map policy, identified by <text>.
set policy route-map <text> description <text>
Set description for the route-map policy.
set policy route-map <text> rule <1-65535> action <permit|deny>

8.7. Policy 750

 VyOS Documentation, Release 1.5.x (circinus)

Set action for the route-map policy.

set policy route-map <text> rule <1-65535> call <text>
Call another route-map policy on match.
set policy route-map <text> rule <1-65535> continue <1-65535>
Jump to a different rule in this route-map on a match.
set policy route-map <text> rule <1-65535> description <text>
Set description for the rule in the route-map policy.
set policy route-map <text> rule <1-65535> match as-path <text>
BGP as-path list to match.
set policy route-map <text> rule <1-65535> match community community-list <text>
BGP community-list to match.
set policy route-map <text> rule <1-65535> match community exact-match
Set BGP community-list to exactly match.
set policy route-map <text> rule <1-65535> match extcommunity <text>
BGP extended community to match.
set policy route-map <text> rule <1-65535> match interface <text>
First hop interface of a route to match.
set policy route-map <text> rule <1-65535> match ip address access-list <1-2699>
IP address of route to match, based on access-list.
set policy route-map <text> rule <1-65535> match ip address prefix-list <text>
IP address of route to match, based on prefix-list.
set policy route-map <text> rule <1-65535> match ip address prefix-len <0-32>
IP address of route to match, based on specified prefix-length. Note that this can be used for kernel routes only.
Do not apply to the routes of dynamic routing protocols (e.g. BGP, RIP, OSFP), as this can lead to unexpected
results..
set policy route-map <text> rule <1-65535> match ip nexthop access-list <1-2699>
IP next-hop of route to match, based on access-list.
set policy route-map <text> rule <1-65535> match ip nexthop address <x.x.x.x>
IP next-hop of route to match, based on ip address.
set policy route-map <text> rule <1-65535> match ip nexthop prefix-len <0-32>
IP next-hop of route to match, based on prefix length.
set policy route-map <text> rule <1-65535> match ip nexthop prefix-list <text>
IP next-hop of route to match, based on prefix-list.
set policy route-map <text> rule <1-65535> match ip nexthop type <blackhole>
IP next-hop of route to match, based on type.
set policy route-map <text> rule <1-65535> match ip route-source access-list <1-2699>
IP route source of route to match, based on access-list.

8.7. Policy 751

 VyOS Documentation, Release 1.5.x (circinus)

set policy route-map <text> rule <1-65535> match ip route-source prefix-list <text>
IP route source of route to match, based on prefix-list.
set policy route-map <text> rule <1-65535> match ipv6 address access-list <text>
IPv6 address of route to match, based on IPv6 access-list.
set policy route-map <text> rule <1-65535> match ipv6 address prefix-list <text>
IPv6 address of route to match, based on IPv6 prefix-list.
set policy route-map <text> rule <1-65535> match ipv6 address prefix-len <0-128>
IPv6 address of route to match, based on specified prefix-length. Note that this can be used for kernel routes only.
Do not apply to the routes of dynamic routing protocols (e.g. BGP, RIP, OSFP), as this can lead to unexpected
results..
set policy route-map <text> rule <1-65535> match ipv6 nexthop <h:h:h:h:h:h:h:h>
Nexthop IPv6 address to match.
set policy route-map <text> rule <1-65535> match large-community large-community-list
<text>
Match BGP large communities.
set policy route-map <text> rule <1-65535> match local-preference <0-4294967295>
Match local preference.
set policy route-map <text> rule <1-65535> match metric <1-65535>
Match route metric.
set policy route-map <text> rule <1-65535> match origin <egp|igp|incomplete>
Boarder Gateway Protocol (BGP) origin code to match.
set policy route-map <text> rule <1-65535> match peer <x.x.x.x>
Peer IP address to match.
set policy route-map <text> rule <1-65535> match protocol <protocol>
Source protocol to match.
• babel - Babel routing protocol (Babel)
• bgp - Border Gateway Protocol (BGP)
• connected - Connected routes (directly attached subnet or host)
• isis - Intermediate System to Intermediate System (IS-IS)
• kernel - Kernel routes
• ospf - Open Shortest Path First (OSPFv2)
• ospfv3 - Open Shortest Path First (IPv6) (OSPFv3)
• rip - Routing Information Protocol (RIP)
• ripng - Routing Information Protocol next-generation (IPv6) (RIPng)
• static - Statically configured routes
• table - Non-main Kernel Routing Table
• vnc - Virtual Network Control (VNC)

8.7. Policy 752

 VyOS Documentation, Release 1.5.x (circinus)

set policy route-map <text> rule <1-65535> match rpki <invalid|notfound|valid>

Match RPKI validation result.
set policy route-map <text> rule <1-65535> match tag <1-65535>
Route tag to match.
set policy route-map <text> rule <1-65535> on-match goto <1-65535>
Exit policy on match: go to rule <1-65535>
set policy route-map <text> rule <1-65535> on-match next
Exit policy on match: go to next sequence number.
set policy route-map <text> rule <1-65535> set aggregator <as|ip> <1-4294967295|x.x.x.x>
BGP aggregator attribute: AS number or IP address of an aggregation.
set policy route-map <text> rule <1-65535> set as-path exclude <1-4294967295 | all>
Drop AS-NUMBER from the BGP AS path.
If all is specified, remove all AS numbers from the AS_PATH of the BGP path’s NLRI.
set policy route-map <text> rule <1-65535> set as-path prepend <1-4294967295>
Prepend the given string of AS numbers to the AS_PATH of the BGP path’s NLRI.
set policy route-map <text> rule <1-65535> set as-path prepend-last-as <n>
Prepend the existing last AS number (the leftmost ASN) to the AS_PATH.
set policy route-map <text> rule <1-65535> set atomic-aggregate
BGP atomic aggregate attribute.
set policy route-map <text> rule <1-65535> set community <add|replace> <community>
Add or replace BGP community attribute in format <0-65535:0-65535> or from well-known community list
set policy route-map <text> rule <1-65535> set community none
Delete all BGP communities
set policy route-map <text> rule <1-65535> set community delete <text>
Delete BGP communities matching the community-list.
set policy route-map <text> rule <1-65535> set large-community <add|replace>
<GA:LDP1:LDP2>
Add or replace BGP large-community attribute in format <0-4294967295:0-4294967295:0-4294967295>
set policy route-map <text> rule <1-65535> set large-community none
Delete all BGP large-communities
set policy route-map <text> rule <1-65535> set large-community delete <text>
Delete BGP communities matching the large-community-list.
set policy route-map <text> rule <1-65535> set extcommunity bandwidth
<1-25600|cumulative|num-multipaths>
Set extcommunity bandwidth
set policy route-map <text> rule <1-65535> set extcommunity bandwidth-non-transitive
The link bandwidth extended community is encoded as non-transitive

8.7. Policy 753

 VyOS Documentation, Release 1.5.x (circinus)

set policy route-map <text> rule <1-65535> set extcommunity rt <text>

Set route target value in format <0-65535:0-4294967295> or <IP:0-65535>.
set policy route-map <text> rule <1-65535> set extcommunity soo <text>
Set site of origin value in format <0-65535:0-4294967295> or <IP:0-65535>.
set policy route-map <text> rule <1-65535> set extcommunity none
Clear all BGP extcommunities.
set policy route-map <text> rule <1-65535> set distance <0-255>
Locally significant administrative distance.
set policy route-map <text> rule <1-65535> set ip-next-hop <x.x.x.x>
Nexthop IP address.
set policy route-map <text> rule <1-65535> set ip-next-hop unchanged
Set the next-hop as unchanged. Pass through the route-map without changing its value
set policy route-map <text> rule <1-65535> set ip-next-hop peer-address
Set the BGP nexthop address to the address of the peer. For an incoming route-map this means the ip address of
our peer is used. For an outgoing route-map this means the ip address of our self is used to establish the peering
with our neighbor.
set policy route-map <text> rule <1-65535> set ipv6-next-hop <global|local>
<h:h:h:h:h:h:h:h>
Nexthop IPv6 address.
set policy route-map <text> rule <1-65535> set ipv6-next-hop peer-address
Set the BGP nexthop address to the address of the peer. For an incoming route-map this means the ip address of
our peer is used. For an outgoing route-map this means the ip address of our self is used to establish the peering
with our neighbor.
set policy route-map <text> rule <1-65535> set ipv6-next-hop prefer-global
For Incoming and Import Route-maps if we receive a v6 global and v6 LL address for the route, then prefer to
use the global address as the nexthop.
set policy route-map <text> rule <1-65535> set local-preference <0-4294967295>
Set BGP local preference attribute.
set policy route-map <text> rule <1-65535> set metric <+/-metric|0-4294967295|rtt|+rtt|-rtt>
Set the route metric. When used with BGP, set the BGP attribute MED to a specific value. Use +/- to add
or subtract the specified value to/from the existing/MED. Use rtt to set the MED to the round trip time or
+rtt/-rtt to add/subtract the round trip time to/from the MED.
set policy route-map <text> rule <1-65535> set metric-type <type-1|type-2>
Set OSPF external metric-type.
set policy route-map <text> rule <1-65535> set origin <igp|egp|incomplete>
Set BGP origin code.
set policy route-map <text> rule <1-65535> set originator-id <x.x.x.x>
Set BGP originator ID attribute.
set policy route-map <text> rule <1-65535> set src <x.x.x.x|h:h:h:h:h:h:h:h>

8.7. Policy 754

 VyOS Documentation, Release 1.5.x (circinus)

Set source IP/IPv6 address for route.

set policy route-map <text> rule <1-65535> set table <1-200>
Set prefixes to table.
set policy route-map <text> rule <1-65535> set tag <1-65535>
Set tag value for routing protocol.
set policy route-map <text> rule <1-65535> set weight <0-4294967295>
Set BGP weight attribute

List of well-known communities

• local-as - Well-known communities value NO_EXPORT_SUBCONFED 0xFFFFFF03

• no-advertise - Well-known communities value NO_ADVERTISE 0xFFFFFF02
• no-export - Well-known communities value NO_EXPORT 0xFFFFFF01
• internet - Well-known communities value 0
• graceful-shutdown - Well-known communities value GRACEFUL_SHUTDOWN 0xFFFF0000
• accept-own - Well-known communities value ACCEPT_OWN 0xFFFF0001
• route-filter-translated-v4 - Well-known communities value ROUTE_FILTER_TRANSLATED_v4
0xFFFF0002
• route-filter-v4 - Well-known communities value ROUTE_FILTER_v4 0xFFFF0003
• route-filter-translated-v6 - Well-known communities value ROUTE_FILTER_TRANSLATED_v6
0xFFFF0004
• route-filter-v6 - Well-known communities value ROUTE_FILTER_v6 0xFFFF0005
• llgr-stale - Well-known communities value LLGR_STALE 0xFFFF0006
• no-llgr - Well-known communities value NO_LLGR 0xFFFF0007
• accept-own-nexthop - Well-known communities value accept-own-nexthop 0xFFFF0008
• blackhole - Well-known communities value BLACKHOLE 0xFFFF029A
• no-peer - Well-known communities value NOPEER 0xFFFFFF04

Local Route Policy

Policies for local traffic are defined in this section.

8.7. Policy 755

 VyOS Documentation, Release 1.5.x (circinus)

Configuration

Local Route IPv4

set policy local-route rule <1-32765> set table <1-200|main>

Set routing table to forward packet to.
set policy local-route rule <1-32765> source <x.x.x.x|x.x.x.x/x>
Set source address or prefix to match.
set policy local-route rule <1-32765> destination <x.x.x.x|x.x.x.x/x>
Set destination address or prefix to match.
set policy local-route rule <1-32765> inbound-interface <interface>
Set inbound interface to match.

Local Route IPv6

set policy local-route6 rule <1-32765> set table <1-200|main>

Set routing table to forward packet to.
set policy local-route6 rule <1-32765> source <h:h:h:h:h:h:h:h | h:h:h:h:h:h:h:h/x>
Set source address or prefix to match.
set policy local-route6 rule <1-32765> destination <h:h:h:h:h:h:h:h | h:h:h:h:h:h:h:h/x>
Set destination address or prefix to match.
set policy local-route6 rule <1-32765> inbound-interface <interface>
Set inbound interface to match.

BGP - AS Path Policy

VyOS provides policies commands exclusively for BGP traffic filtering and manipulation: as-path-list is one of them.

Configuration

policy as-path-list

set policy as-path-list <text>

Create as-path-policy identified by name <text>.
set policy as-path-list <text> description <text>
Set description for as-path-list policy.
set policy as-path-list <text> rule <1-65535> action <permit|deny>
Set action to take on entries matching this rule.
set policy as-path-list <text> rule <1-65535> description <text>
Set description for rule.

8.7. Policy 756

 VyOS Documentation, Release 1.5.x (circinus)

set policy as-path-list <text> rule <1-65535> regex <text>

Regular expression to match against an AS path. For example “64501 64502”.

BGP - Community List

VyOS provides policies commands exclusively for BGP traffic filtering and manipulation: community-list is one of
them.

Configuration

policy community-list

set policy community-list <text>

Creat community-list policy identified by name <text>.
set policy community-list <text> description <text>
Set description for community-list policy.
set policy community-list <text> rule <1-65535> action <permit|deny>
Set action to take on entries matching this rule.
set policy community-list <text> rule <1-65535> description <text>
Set description for rule.
set policy community-list <text> rule <1-65535> regex <aa:nn|local-AS|no-advertise|no-export|internet|ad
Regular expression to match against a community-list.

BGP - Extended Community List

VyOS provides policies commands exclusively for BGP traffic filtering and manipulation: extcommunity-list is one
of them.

Configuration

policy extcommunity-list

set policy extcommunity-list <text>

Creat extcommunity-list policy identified by name <text>.
set policy extcommunity-list <text> description <text>
Set description for extcommunity-list policy.
set policy extcommunity-list <text> rule <1-65535> action <permit|deny>
Set action to take on entries matching this rule.
set policy extcommunity-list <text> rule <1-65535> description <text>
Set description for rule.
set policy extcommunity-list <text> rule <1-65535> regex <text>

8.7. Policy 757

 VyOS Documentation, Release 1.5.x (circinus)

Regular expression to match against an extended community list, where text could be:
• <aa:nn:nn>: Extended community list regular expression.
• <rt aa:nn:nn>: Route Target regular expression.
• <soo aa:nn:nn>: Site of Origin regular expression.

BGP - Large Community List

VyOS provides policies commands exclusively for BGP traffic filtering and manipulation: large-community-list is
one of them.

Configuration

policy large-community-list

set policy large-community-list <text>

Create large-community-list policy identified by name <text>.
set policy large-community-list <text> description <text>
Set description for large-community-list policy.
set policy large-community-list <text> rule <1-65535> action <permit|deny>
Set action to take on entries matching this rule.
set policy large-community-list <text> rule <1-65535> description <text>
Set description for rule.
set policy large-community-list <text> rule <1-65535> regex <aa:nn:nn>
Regular expression to match against a large community list.

8.7.2 Examples

Examples of policies usage:

BGP Example

Policy definition:

# Create policy
set policy route-map setmet rule 2 action 'permit'
set policy route-map setmet rule 2 set as-path prepend '2 2 2'

# Apply policy to BGP

set protocols bgp system-as 1
set protocols bgp neighbor 203.0.113.2 address-family ipv4-unicast route-map import
˓→'setmet'

set protocols bgp neighbor 203.0.113.2 address-family ipv4-unicast soft-reconfiguration

˓→'inbound'

8.7. Policy 758

 VyOS Documentation, Release 1.5.x (circinus)

Using ‘soft-reconfiguration’ we get the policy update without bouncing the neighbor.
Routes learned before routing policy applied:

vyos@vos1:~$ show ip bgp

BGP table version is 0, local router ID is 192.168.56.101
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, R Removed
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

*> 198.51.100.3/32 203.0.113.2 1 0 2 i < Path

Total number of prefixes 1

Routes learned after routing policy applied:

vyos@vos1:~$ show ip bgp

BGP table version is 0, local router ID is 192.168.56.101
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, R Removed
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

*> 198.51.100.3/32 203.0.113.2 1 0 2 2 2 2 i

Total number of prefixes 1

vyos@vos1:~$

You now see the longer AS path.

Transparent Proxy

The following example will show how VyOS can be used to redirect web traffic to an external transparent proxy:

set policy route FILTER-WEB rule 1000 destination port 80

set policy route FILTER-WEB rule 1000 protocol tcp
set policy route FILTER-WEB rule 1000 set table 100

This creates a route policy called FILTER-WEB with one rule to set the routing table for matching traffic (TCP port
80) to table ID 100 instead of the default routing table.
To create routing table 100 and add a new default gateway to be used by traffic matching our route policy:

set protocols static table 100 route 0.0.0.0/0 next-hop 10.255.0.2

This can be confirmed using the show ip route table 100 operational command.
Finally, to apply the policy route to ingress traffic on our LAN interface, we use:

set policy route FILTER-WEB interface eth1

8.7. Policy 759

 VyOS Documentation, Release 1.5.x (circinus)

Multiple Uplinks

VyOS Policy-Based Routing (PBR) works by matching source IP address ranges and forwarding the traffic using dif-
ferent routing tables.
Routing tables that will be used in this example are:
• table 10 Routing table used for VLAN 10 (192.168.188.0/24)
• table 11 Routing table used for VLAN 11 (192.168.189.0/24)
• main Routing table used by VyOS and other interfaces not participating in PBR

Fig. 2: Policy-Based Routing with multiple ISP uplinks (source ./draw.io/pbr_example_1.drawio)

Add default routes for routing table 10 and table 11

set protocols static table 10 route 0.0.0.0/0 next-hop 192.0.1.1

set protocols static table 11 route 0.0.0.0/0 next-hop 192.0.2.2

Add policy route matching VLAN source addresses

8.7. Policy 760

 VyOS Documentation, Release 1.5.x (circinus)

set policy route PBR rule 20 set table '10'

set policy route PBR rule 20 description 'Route VLAN10 traffic to table 10'
set policy route PBR rule 20 source address '192.168.188.0/24'

set policy route PBR rule 30 set table '11'

set policy route PBR rule 30 description 'Route VLAN11 traffic to table 11'
set policy route PBR rule 30 source address '192.168.189.0/24'

Apply routing policy to inbound direction of out VLAN interfaces

set policy route 'PBR' interface eth0.10

set policy route 'PBR' interface eth0.11

OPTIONAL: Exclude Inter-VLAN traffic (between VLAN10 and VLAN11) from PBR

set firewall group network-group VLANS-GR description 'VLANs networks'

set firewall group network-group VLANS-GR network '192.168.188.0/24'
set firewall group network-group VLANS-GR network '192.168.189.0/24'

set policy route PBR rule 10 description 'VLAN10 <-> VLAN11 shortcut'
set policy route PBR rule 10 destination group network-group 'VLANS-GR'
set policy route PBR rule 10 set table 'main'

These commands allow the VLAN10 and VLAN11 hosts to communicate with each other using the main routing table.

Local route

The following example allows VyOS to use PBR (Policy-Based Routing) for traffic, which originated from the router
itself. That solution for multiple ISP’s and VyOS router will respond from the same interface that the packet was
received. Also, it used, if we want that one VPN tunnel to be through one provider, and the second through another.
• 203.0.113.254 IP addreess on VyOS eth1 from ISP1
• 192.168.2.254 IP addreess on VyOS eth2 from ISP2
• table 10 Routing table used for ISP1
• table 11 Routing table used for ISP2

set policy local-route rule 101 set table '10'

set policy local-route rule 101 source '203.0.113.254'
set policy local-route rule 102 set table '11'
set policy local-route rule 102 source '192.0.2.254'
set protocols static table 10 route 0.0.0.0/0 next-hop '203.0.113.1'
set protocols static table 11 route 0.0.0.0/0 next-hop '192.0.2.2'

Add multiple source IP in one rule with same priority

set policy local-route rule 101 set table '10'

set policy local-route rule 101 source '203.0.113.254'
set policy local-route rule 101 source '203.0.113.253'
set policy local-route rule 101 source '198.51.100.0/24'

8.7. Policy 761

 VyOS Documentation, Release 1.5.x (circinus)

Clamp MSS for a specific IP

This example shows how to target an MSS clamp (in our example to 1360 bytes) to a specific destination IP.

set policy route IP-MSS-CLAMP rule 10 description 'Clamp TCP session MSS to 1360 for 198.
˓→51.100.30'

set policy route IP-MSS-CLAMP rule 10 destination address '198.51.100.30/32'

set policy route IP-MSS-CLAMP rule 10 protocol 'tcp'
set policy route IP-MSS-CLAMP rule 10 set tcp-mss '1360'
set policy route IP-MSS-CLAMP rule 10 tcp flags 'SYN'

To apply this policy to the correct interface, configure it on the interface the inbound local host will send through to
reach our destined target host (in our example eth1).

set policy route IP-MSS-CLAMP interface eth1

You can view that the policy is being correctly (or incorrectly) utilised with the following command:

show policy route statistics

8.8 PKI

VyOS 1.4 changed the way in how encryption keys or certificates are stored on the system. In the pre VyOS 1.4 era,
certificates got stored under /config and every service referenced a file. That made copying a running configuration
from system A to system B a bit harder, as you had to copy the files and their permissions by hand.
T3642 describes a new CLI subsystem that serves as a “certstore” to all services requiring any kind of encryption
key(s). In short, public and private certificates are now stored in PKCS#8 format in the regular VyOS CLI. Keys can
now be added, edited, and deleted using the regular set/edit/delete CLI commands.
VyOS not only can now manage certificates issued by 3rd party Certificate Authorities, it can also act as a CA on its
own. You can create your own root CA and sign keys with it by making use of some simple op-mode commands.
Don’t be afraid that you need to re-do your configuration. Key transformation is handled, as always, by our migration
scripts, so this will be a smooth transition for you!

8.8.1 Key Generation

Certificate Authority (CA)

VyOS now also has the ability to create CAs, keys, Diffie-Hellman and other keypairs from an easy to access operational
level command.
generate pki ca
Create a new CA and output the CAs public and private key on the console.
generate pki ca install <name>
Create a new CA and output the CAs public and private key on the console.

Note: In addition to the command above, the output is in a format which can be used to directly import the key
into the VyOS CLI by simply copy-pasting the output from op-mode into configuration mode.

8.8. PKI 762

 VyOS Documentation, Release 1.5.x (circinus)

name is used for the VyOS CLI command to identify this key. This key name is then used in the CLI configuration
to reference the key instance.

generate pki ca sign <ca-name>

Create a new subordinate CA and sign it using the private key referenced by ca-name.
generate pki ca sign <ca-name> install <name>
Create a new subordinate CA and sign it using the private key referenced by name.

Note: In addition to the command above, the output is in a format which can be used to directly import the key
into the VyOS CLI by simply copy-pasting the output from op-mode into configuration mode.
name is used for the VyOS CLI command to identify this key. This key name is then used in the CLI configuration
to reference the key instance.

Certificates

generate pki certificate

Create a new public/private keypair and output the certificate on the console.
generate pki certificate install <name>
Create a new public/private keypair and output the certificate on the console.

Note: In addition to the command above, the output is in a format which can be used to directly import the key
into the VyOS CLI by simply copy-pasting the output from op-mode into configuration mode.
name is used for the VyOS CLI command to identify this key. This key name is then used in the CLI configuration
to reference the key instance.

generate pki certificate self-signed

Create a new self-signed certificate. The public/private is then shown on the console.
generate pki certificate self-signed install <name>
Create a new self-signed certificate. The public/private is then shown on the console.

Note: In addition to the command above, the output is in a format which can be used to directly import the key
into the VyOS CLI by simply copy-pasting the output from op-mode into configuration mode.
name is used for the VyOS CLI command to identify this key. This key name is then used in the CLI configuration
to reference the key instance.

generate pki certificate sign <ca-name>

Create a new public/private keypair which is signed by the CA referenced by ca-name. The signed certificate is
then output to the console.
generate pki certificate sign <ca-name> install <name>
Create a new public/private keypair which is signed by the CA referenced by ca-name. The signed certificate is
then output to the console.

8.8. PKI 763

 VyOS Documentation, Release 1.5.x (circinus)

Note: In addition to the command above, the output is in a format which can be used to directly import the key
into the VyOS CLI by simply copy-pasting the output from op-mode into configuration mode.
name is used for the VyOS CLI command to identify this key. This key name is then used in the CLI configuration
to reference the key instance.

Diffie-Hellman parameters

generate pki dh
Generate a new set of DH (Diffie-Hellman) parameters. The key size is requested by the CLI and defaults to
2048 bit.
The generated parameters are then output to the console.
generate pki dh install <name>
Generate a new set of DH parameters. The key size is requested by the CLI and defaults to 2048 bit.

Note: In addition to the command above, the output is in a format which can be used to directly import the key
into the VyOS CLI by simply copy-pasting the output from op-mode into configuration mode.
name is used for the VyOS CLI command to identify this key. This key name is then used in the CLI configuration
to reference the key instance.

OpenVPN

generate pki openvpn shared-secret

Generate a new OpenVPN shared secret. The generated secret is the output to the console.
generate pki openvpn shared-secret install <name>
Generate a new OpenVPN shared secret. The generated secret is the output to the console.

Note: In addition to the command above, the output is in a format which can be used to directly import the key
into the VyOS CLI by simply copy-pasting the output from op-mode into configuration mode.
name is used for the VyOS CLI command to identify this key. This key name is then used in the CLI configuration
to reference the key instance.

WireGuard

generate pki wireguard key-pair

Generate a new WireGuard public/private key portion and output the result to the console.
generate pki wireguard key-pair install <interface>
Generate a new WireGuard public/private key portion and output the result to the console.

Note: In addition to the command above, the output is in a format which can be used to directly import the key
into the VyOS CLI by simply copy-pasting the output from op-mode into configuration mode.

8.8. PKI 764

 VyOS Documentation, Release 1.5.x (circinus)

interface is used for the VyOS CLI command to identify the WireGuard interface where this private key is
to be used.

generate pki wireguard preshared-key

Generate a WireGuard pre-shared secret used for peers to communicate.
generate pki wireguard preshared-key install <peer>
Generate a WireGuard pre-shared secret used for peers to communicate.

Note: In addition to the command above, the output is in a format which can be used to directly import the key
into the VyOS CLI by simply copy-pasting the output from op-mode into configuration mode.
peer is used for the VyOS CLI command to identify the WireGuard peer where this secret is to be used.

8.8.2 Key usage (CLI)

CA (Certificate Authority)

set pki ca <name> certificate

Add the public CA certificate for the CA named name to the VyOS CLI.

Note: When loading the certificate you need to manually strip the -----BEGIN CERTIFICATE----- and
-----END CERTIFICATE----- tags. Also, the certificate/key needs to be presented in a single line without
line breaks (\n), this can be done using the following shell command:
$ tail -n +2 ca.pem | head -n -1 | tr -d '\n'

set pki ca <name> crl

Certificate revocation list in PEM format.
set pki ca <name> description
A human readable description what this CA is about.
set pki ca <name> private key
Add the CAs private key to the VyOS CLI. This should never leave the system, and is only required if you use
VyOS as your certificate generator as mentioned above.

Note: When loading the certificate you need to manually strip the -----BEGIN KEY----- and -----END
KEY----- tags. Also, the certificate/key needs to be presented in a single line without line breaks (\n), this can
be done using the following shell command:
$ tail -n +2 ca.key | head -n -1 | tr -d '\n'

set pki ca <name> private password-protected

Mark the CAs private key as password protected. User is asked for the password when the key is referenced.

8.8. PKI 765

 VyOS Documentation, Release 1.5.x (circinus)

Server Certificate

After we have imported the CA certificate(s) we can now import and add certificates used by services on this router.
set pki certificate <name> certificate
Add public key portion for the certificate named name to the VyOS CLI.

Note: When loading the certificate you need to manually strip the -----BEGIN CERTIFICATE----- and
-----END CERTIFICATE----- tags. Also, the certificate/key needs to be presented in a single line without
line breaks (\n), this can be done using the following shell command:
$ tail -n +2 cert.pem | head -n -1 | tr -d '\n'

set pki certificate <name> description

A human readable description what this certificate is about.
set pki certificate <name> private key
Add the private key portion of this certificate to the CLI. This should never leave the system as it is used to
decrypt the data.

Note: When loading the certificate you need to manually strip the -----BEGIN KEY----- and -----END
KEY----- tags. Also, the certificate/key needs to be presented in a single line without line breaks (\n), this can
be done using the following shell command:
$ tail -n +2 cert.key | head -n -1 | tr -d '\n'

set pki certificate <name> private password-protected

Mark the private key as password protected. User is asked for the password when the key is referenced.
set pki certificate <name> revoke
If CA is present, this certificate will be included in generated CRLs

Import files to PKI format

VyOS provides this utility to import existing certificates/key files directly into PKI from op-mode. Previous to VyOS
1.4, certificates were stored under the /config folder permanently and will be retained post upgrade.
import pki ca <name> file <Path to CA certificate file>
Import the public CA certificate from the defined file to VyOS CLI.
import pki ca <name> key-file <Path to private key file>
Import the CAs private key portion to the CLI. This should never leave the system as it is used to decrypt the
data. The key is required if you use VyOS as your certificate generator.
import pki certificate <name> file <path to certificate>
Import the certificate from the file to VyOS CLI.
import pki certificate <name> key-file <path to private key>
Import the private key of the certificate to the VyOS CLI. This should never leave the system as it is used to
decrypt the data.
import pki openvpn shared-secret <name> file <path to OpenVPN secret key>

8.8. PKI 766

 VyOS Documentation, Release 1.5.x (circinus)

Import the OpenVPN shared secret stored in file to the VyOS CLI.

ACME

The VyOS PKI subsystem can also be used to automatically retrieve Certificates using the ACME (Automatic Certificate
Management Environment) protocol.
set pki certificate <name> acme domain-name <name>
Domain names to apply, multiple domain-names can be specified.
This is a mandatory option
set pki certificate <name> acme email <address>
Email used for registration and recovery contact.
This is a mandatory option
set pki certificate <name> acme listen-address <address>
The address the server listens to during http-01 challenge
set pki certificate <name> acme rsa-key-size <2048 | 3072 | 4096>
Size of the RSA key.
This options defaults to 2048
set pki certificate <name> acme url <url>
ACME Directory Resource URI.
This defaults to https://acme-v02.api.letsencrypt.org/directory

Note: During initial deployment we recommend using the staging API of LetsEncrypt to prevent and black-
listing of your system. The API endpoint is https://acme-staging-v02.api.letsencrypt.org/directory

8.8.3 Operation

VyOS operational mode commands are not only available for generating keys but also to display them.
show pki ca
Show a list of installed CA certificates.

vyos@vyos:~$ show pki ca

Certificate Authorities:
Name Subject Issuer CN ␣
˓→ Issued Expiry Private Key Parent
-------------- ------------------------------------------------------- -----------
˓→------ ------------------- ------------------- ------------- --------------
DST_Root_CA_X3 CN=ISRG Root X1,O=Internet Security Research Group,C=US CN=DST␣
˓→Root CA X3 2021-01-20 19:14:03 2024-09-30 18:14:03 No N/A
R3 CN=R3,O=Let's Encrypt,C=US CN=ISRG␣
˓→Root X1 2020-09-04 00:00:00 2025-09-15 16:00:00 No DST_Root_CA_X3
vyos_rw CN=VyOS RW CA,O=VyOS,L=Some-City,ST=Some-State,C=GB CN=VyOS RW␣
˓→CA 2021-07-05 13:46:03 2026-07-04 13:46:03 Yes N/A

8.8. PKI 767

 VyOS Documentation, Release 1.5.x (circinus)

show pki ca <name>

Show only information for specified Certificate Authority.
show pki certificate
Show a list of installed certificates

vyos@vyos:~$ show pki certificate

Certificates:
Name Type Subject CN Issuer CN Issued ␣
˓→Expiry Revoked Private Key CA Present
--------- ------ --------------------- ------------- ------------------- ------
˓→------------- --------- ------------- -------------
ac2 Server CN=ac2.vyos.net CN=R3 2021-07-05 07:29:59 2021-
˓→10-03 07:29:58 No Yes Yes (R3)
rw_server Server CN=VyOS RW CN=VyOS RW CA 2021-07-05 13:48:02 2022-
˓→07-05 13:48:02 No Yes Yes (vyos_rw)

show pki certificate <name>

Show only information for specified certificate.
show pki crl
Show a list of installed CRLs (Certificate Revocation List).
renew certbot
Manually trigger certificate renewal. This will be done twice a day.

8.8.4 Examples

Create a CA chain and leaf certificates

This configuration generates & installs into the VyOS PKI system a root certificate authority, alongside two interme-
diary certificate authorities for client & server certificates. These CAs are then used to generate a server certificate for
the router, and a client certificate for a user.
• vyos_root_ca is the root certificate authority.
• vyos_client_ca and vyos_server_ca are intermediary certificate authorities, which are signed by the root
CA.
• vyos_cert is a leaf server certificate used to identify the VyOS router, signed by the server intermediary CA.
• vyos_example_user is a leaf client certificate used to identify a user, signed by client intermediary CA.
First, we create the root certificate authority.

[edit]
vyos@vyos# run generate pki ca install vyos_root_ca
Enter private key type: [rsa, dsa, ec] (Default: rsa) rsa
Enter private key bits: (Default: 2048) 2048
Enter country code: (Default: GB) GB
Enter state: (Default: Some-State) Some-State
Enter locality: (Default: Some-City) Some-City
Enter organization name: (Default: VyOS) VyOS
Enter common name: (Default: vyos.io) VyOS Root CA
(continues on next page)

8.8. PKI 768

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Enter how many days certificate will be valid: (Default: 1825) 1825
Note: If you plan to use the generated key on this router, do not encrypt the private␣
˓→key.

Do you want to encrypt the private key with a passphrase? [y/N] n

2 value(s) installed. Use "compare" to see the pending changes, and "commit" to apply.

Secondly, we create the intermediary certificate authorities, which are used to sign the leaf certificates.

[edit]
vyos@vyos# run generate pki ca sign vyos_root_ca install vyos_server_ca
Do you already have a certificate request? [y/N] n
Enter private key type: [rsa, dsa, ec] (Default: rsa) rsa
Enter private key bits: (Default: 2048) 2048
Enter country code: (Default: GB) GB
Enter state: (Default: Some-State) Some-State
Enter locality: (Default: Some-City) Some-City
Enter organization name: (Default: VyOS) VyOS
Enter common name: (Default: vyos.io) VyOS Intermediary Server CA
Enter how many days certificate will be valid: (Default: 1825) 1095
Note: If you plan to use the generated key on this router, do not encrypt the private␣
˓→key.

Do you want to encrypt the private key with a passphrase? [y/N] n

2 value(s) installed. Use "compare" to see the pending changes, and "commit" to apply.

[edit]
vyos@vyos# run generate pki ca sign vyos_root_ca install vyos_client_ca
Do you already have a certificate request? [y/N] n
Enter private key type: [rsa, dsa, ec] (Default: rsa) rsa
Enter private key bits: (Default: 2048) 2048
Enter country code: (Default: GB) GB
Enter state: (Default: Some-State) Some-State
Enter locality: (Default: Some-City) Some-City
Enter organization name: (Default: VyOS) VyOS
Enter common name: (Default: vyos.io) VyOS Intermediary Client CA
Enter how many days certificate will be valid: (Default: 1825) 1095
Note: If you plan to use the generated key on this router, do not encrypt the private␣
˓→key.

Do you want to encrypt the private key with a passphrase? [y/N] n

2 value(s) installed. Use "compare" to see the pending changes, and "commit" to apply.

Lastly, we can create the leaf certificates that devices and users will utilise.

[edit]
vyos@vyos# run generate pki certificate sign vyos_server_ca install vyos_cert
Do you already have a certificate request? [y/N] n
Enter private key type: [rsa, dsa, ec] (Default: rsa) rsa
Enter private key bits: (Default: 2048) 2048
Enter country code: (Default: GB) GB
Enter state: (Default: Some-State) Some-State
Enter locality: (Default: Some-City) Some-City
Enter organization name: (Default: VyOS) VyOS
(continues on next page)

8.8. PKI 769

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Enter common name: (Default: vyos.io) vyos.net
Do you want to configure Subject Alternative Names? [y/N] y
Enter alternative names in a comma separate list, example: ipv4:1.1.1.1,ipv6:fe80::1,
˓→dns:vyos.net

Enter Subject Alternative Names: dns:vyos.net,dns:www.vyos.net

Enter how many days certificate will be valid: (Default: 365) 365
Enter certificate type: (client, server) (Default: server) server
Note: If you plan to use the generated key on this router, do not encrypt the private␣
˓→key.

Do you want to encrypt the private key with a passphrase? [y/N] n

2 value(s) installed. Use "compare" to see the pending changes, and "commit" to apply.

[edit]
vyos@vyos# run generate pki certificate sign vyos_client_ca install vyos_example_user
Do you already have a certificate request? [y/N] n
Enter private key type: [rsa, dsa, ec] (Default: rsa) rsa
Enter private key bits: (Default: 2048) 2048
Enter country code: (Default: GB) GB
Enter state: (Default: Some-State) Some-State
Enter locality: (Default: Some-City) Some-City
Enter organization name: (Default: VyOS) VyOS
Enter common name: (Default: vyos.io) Example User
Do you want to configure Subject Alternative Names? [y/N] y
Enter alternative names in a comma separate list, example: ipv4:1.1.1.1,ipv6:fe80::1,
˓→dns:vyos.net,rfc822:[email protected]

Enter Subject Alternative Names: rfc822:[email protected]

Enter how many days certificate will be valid: (Default: 365) 365
Enter certificate type: (client, server) (Default: server) client
Note: If you plan to use the generated key on this router, do not encrypt the private␣
˓→key.

Do you want to encrypt the private key with a passphrase? [y/N] n

2 value(s) installed. Use "compare" to see the pending changes, and "commit" to apply.

8.9 Protocols

8.9.1 Babel

Babel is a modern routing protocol designed to be robust and efficient both in ordinary wired networks and in wireless
mesh networks. By default, it uses hop-count on wired networks and a variant of ETX on wireless links, It can be
configured to take radio diversity into account and to automatically compute a link’s latency and include it in the
metric. It is defined in RFC 8966.
Babel a dual stack protocol. A single Babel instance is able to perform routing for both IPv4 and IPv6.

8.9. Protocols 770

 VyOS Documentation, Release 1.5.x (circinus)

General Configuration

VyOS does not have a special command to start the Babel process. The Babel process starts when the first Babel
enabled interface is configured.
set protocols babel interface <interface>
This command specifies a Babel enabled interface by interface name. Both the sending and receiving of Babel
packets will be enabled on the interface specified in this command.

Optional Configuration

set protocols babel parameters diversity

This command enables routing using radio frequency diversity. This is highly recommended in networks with
many wireless nodes.

Note: If you enable this, you will probably want to set diversity-factor and channel below.

set protocols babel parameters diversity-factor <1-256>

This command sets the multiplicative factor used for diversity routing, in units of 1/256; lower values cause
diversity to play a more important role in route selection. The default it 256, which means that diversity plays
no role in route selection; you will probably want to set that to 128 or less on nodes with multiple independent
radios.
set protocols babel parameters resend-delay <milliseconds>
This command specifies the time in milliseconds after which an ‘important’ request or update will be resent.
The default is 2000 ms.
set protocols babel parameters smoothing-half-life <seconds>
This command specifies the time constant, in seconds, of the smoothing algorithm used for implementing hys-
teresis. Larger values reduce route oscillation at the cost of very slightly increasing convergence time. The value
0 disables hysteresis, and is suitable for wired networks. The default is 4 s.

Interfaces Configuration

set protocols babel interface <interface> type <auto|wired|wireless>

This command sets the interface type:
auto – automatically determines the interface type. wired – enables optimisations for wired interfaces. wireless
– disables a number of optimisations that are only correct on wired interfaces. Specifying wireless is always
correct, but may cause slower convergence and extra routing traffic.
set protocols babel interface <interface> split-horizon <default|disable|enable>
This command specifies whether to perform split-horizon on the interface. Specifying no babel split-horizon is
always correct, while babel split-horizon is an optimisation that should only be used on symmetric and transitive
(wired) networks.
default – enable split-horizon on wired interfaces, and disable split-horizon on wireless interfaces. enable –
enable split-horizon on this interfaces. disable – disable split-horizon on this interfaces.
set protocols babel interface <interface> hello-interval <milliseconds>

8.9. Protocols 771

 VyOS Documentation, Release 1.5.x (circinus)

This command specifies the time in milliseconds between two scheduled hellos. On wired links, Babel notices
a link failure within two hello intervals; on wireless links, the link quality value is reestimated at every hello
interval. The default is 4000 ms.
set protocols babel interface <interface> update-interval <milliseconds>
This command specifies the time in milliseconds between two scheduled updates. Since Babel makes extensive
use of triggered updates, this can be set to fairly high values on links with little packet loss. The default is 20000
ms.
set protocols babel interface <interface> rxcost <1-65534>
This command specifies the base receive cost for this interface. For wireless interfaces, it specifies the multiplier
used for computing the ETX reception cost (default 256); for wired interfaces, it specifies the cost that will be
advertised to neighbours.
set protocols babel interface <interface> rtt-decay <1-256>
This command specifies the decay factor for the exponential moving average of RTT samples, in units of 1/256.
Higher values discard old samples faster. The default is 42.
set protocols babel interface <interface> rtt-min <milliseconds>
This command specifies the minimum RTT, in milliseconds, starting from which we increase the cost to a
neighbour. The additional cost is linear in (rtt - rtt-min). The default is 10 ms.
set protocols babel interface <interface> rtt-max <milliseconds>
This command specifies the maximum RTT, in milliseconds, above which we don’t increase the cost to a neigh-
bour. The default is 120 ms.
set protocols babel interface <interface> max-rtt-penalty <milliseconds>
This command specifies the maximum cost added to a neighbour because of RTT, i.e. when the RTT is higher
or equal than rtt-max. The default is 150. Setting it to 0 effectively disables the use of a RTT-based cost.
set protocols babel interface <interface> enable-timestamps
This command enables sending timestamps with each Hello and IHU message in order to compute RTT values.
It is recommended to enable timestamps on tunnel interfaces.
set protocols babel interface <interface> channel <1-254|interfering|noninterfering>
This command set the channel number that diversity routing uses for this interface (see diversity option above).
1-254 – interfaces with a channel number interfere with interfering interfaces and interfaces with the same
channel number. interfering – interfering interfaces are assumed to interfere with all other channels except
noninterfering channels. noninterfering – noninterfering interfaces are assumed to only interfere with them-
selves.

Redistribution Configuration

set protocols babel redistribute <ipv4|ipv6> <route source>

This command redistributes routing information from the given route source to the Babel process.
IPv4 route source: bgp, connected, eigrp, isis, kernel, nhrp, ospf, rip, static.
IPv6 route source: bgp, connected, eigrp, isis, kernel, nhrp, ospfv3, ripng, static.
set protocols babel distribute-list <ipv4|ipv6> access-list <in|out> <number>
This command can be used to filter the Babel routes using access lists. in and out this is the direction in which
the access lists are applied.

8.9. Protocols 772

 VyOS Documentation, Release 1.5.x (circinus)

set protocols babel distribute-list <ipv4|ipv6> interface <interface> access-list

<in|out> <number>
This command allows you apply access lists to a chosen interface to filter the Babel routes.
set protocols babel distribute-list <ipv4|ipv6> prefix-list <in|out> <name>
This command can be used to filter the Babel routes using prefix lists. in and out this is the direction in which
the prefix lists are applied.
set protocols babel distribute-list <ipv4|ipv6> interface <interface> prefix-list
<in|out> <name>
This command allows you apply prefix lists to a chosen interface to filter the Babel routes.

Configuration Example

Simple Babel configuration using 2 nodes and redistributing connected interfaces.

Node 1:

set interfaces loopback lo address 10.1.1.1/32

set interfaces loopback lo address fd12:3456:dead:beef::1/128
set protocols babel interface eth0 type wired
set protocols babel redistribute ipv4 connected
set protocols babel redistribute ipv6 connected

Node 2:

set interfaces loopback lo address 10.2.2.2/32

set interfaces loopback lo address fd12:3456:beef:dead::2/128
set protocols babel interface eth0 type wired
set protocols babel redistribute ipv4 connected
set protocols babel redistribute ipv6 connected

8.9.2 BFD

BFD (Bidirectional Forwarding Detection) is described and extended by the following RFCs: RFC 5880, RFC 5881
and RFC 5883.
In the age of very fast networks, a second of unreachability may equal millions of lost packets. The idea behind BFD
is to detect very quickly when a peer is down and take action extremely fast.
BFD sends lots of small UDP packets very quickly to ensures that the peer is still alive.
This allows avoiding the timers defined in BGP and OSPF protocol to expires.

8.9. Protocols 773

 VyOS Documentation, Release 1.5.x (circinus)

Configure BFD

set protocols bfd peer <address>

Set BFD peer IPv4 address or IPv6 address
set protocols bfd peer <address> echo-mode
Enables the echo transmission mode
set protocols bfd peer <address> multihop
Allow this BFD peer to not be directly connected
set protocols bfd peer <address> source [address <address> | interface <interface>]
Bind listener to specific interface/address, mandatory for IPv6
set protocols bfd peer <address> interval echo-interval <10-60000>
The minimal echo receive transmission interval that this system is capable of handling
set protocols bfd peer <address> interval multiplier <2-255>
Remote transmission interval will be multiplied by this value
set protocols bfd peer <address> interval [receive | transmit] <10-60000>
Interval in milliseconds
set protocols bfd peer <address> shutdown
Disable a BFD peer
set protocols bfd peer <address> minimum-ttl <1-254>
For multi hop sessions only. Configure the minimum expected TTL for an incoming BFD control packet.
This feature serves the purpose of thightening the packet validation requirements to avoid receiving BFD control
packets from other sessions.

Enable BFD in BGP

set protocols bgp neighbor <neighbor> bfd

Enable BFD on a single BGP neighbor
set protocols bgp peer-group <neighbor> bfd
Enable BFD on a BGP peer group

Enable BFD in OSPF

set protocols ospf interface <interface> bfd

Enable BFD for OSPF on an interface
set protocols ospfv3 interface <interface> bfd
Enable BFD for OSPFv3 on an interface

8.9. Protocols 774

 VyOS Documentation, Release 1.5.x (circinus)

Enable BFD in ISIS

set protocols isis <name> interface <interface> bfd

Enable BFD for ISIS on an interface

Operational Commands

show bfd peers

Show all BFD peers

BFD Peers:
peer 198.51.100.33 vrf default interface eth4.100
ID: 4182341893
Remote ID: 12678929647
Status: up
Uptime: 1 month(s), 16 hour(s), 29 minute(s), 38 second(s)
Diagnostics: ok
Remote diagnostics: ok
Local timers:
Receive interval: 300ms
Transmission interval: 300ms
Echo transmission interval: 50ms
Remote timers:
Receive interval: 300ms
Transmission interval: 300ms
Echo transmission interval: 0ms

peer 198.51.100.55 vrf default interface eth4.101

ID: 4618932327
Remote ID: 3312345688
Status: up
Uptime: 20 hour(s), 16 minute(s), 19 second(s)
Diagnostics: ok
Remote diagnostics: ok
Local timers:
Receive interval: 300ms
Transmission interval: 300ms
Echo transmission interval: 50ms
Remote timers:
Receive interval: 300ms
Transmission interval: 300ms
Echo transmission interval: 0ms

8.9. Protocols 775

 VyOS Documentation, Release 1.5.x (circinus)

BFD Static Route Monitoring

A monitored static route conditions the installation to the RIB on the BFD session running state: when BFD session is
up the route is installed to RIB, but when the BFD session is down it is removed from the RIB.

Configuration

set protocols static route <subnet> next-hop <address> bfd profile <profile>
Configure a static route for <subnet> using gateway <address> and use the gateway address as BFD peer desti-
nation address.
set protocols static route <subnet> next-hop <address> bfd multi-hop source <address>
profile <profile>
Configure a static route for <subnet> using gateway <address> , use source address to indentify the peer when
is multi-hop session and the gateway address as BFD peer destination address.
set protocols static route6 <subnet> next-hop <address> bfd profile <profile>
Configure a static route for <subnet> using gateway <address> and use the gateway address as BFD peer desti-
nation address.
set protocols static route6 <subnet> next-hop <address> bfd multi-hop source <address>
profile <profile>
Configure a static route for <subnet> using gateway <address> , use source address to indentify the peer when
is multi-hop session and the gateway address as BFD peer destination address.

Operational Commands

show bfd static routes

Showing BFD monitored static routes

Showing BFD monitored static routes:

Next hops:
VRF default IPv4 Unicast:
10.10.13.3/32 peer 192.168.2.3 (status: installed)
172.16.10.3/32 peer 192.168.10.1 (status: uninstalled)

VRF default IPv4 Multicast:

VRF default IPv6 Unicast:

8.9. Protocols 776

 VyOS Documentation, Release 1.5.x (circinus)

8.9.3 BGP

BGP (Border Gateway Protocol) is one of the Exterior Gateway Protocols and the de facto standard interdomain routing
protocol. The latest BGP version is 4. BGP-4 is described in RFC 1771 and updated by RFC 4271. RFC 2858 adds
multiprotocol support to BGP.
VyOS makes use of FRR (Free Range Routing) and we would like to thank them for their effort!

Basic Concepts

Autonomous Systems

From RFC 1930:

An AS is a connected group of one or more IP prefixes run by one or more network operators which has a
SINGLE and CLEARLY DEFINED routing policy.
Each AS (Autonomous System) has an identifying number associated with it called an ASN (Autonomous System
Number). This is a two octet value ranging in value from 1 to 65535. The AS numbers 64512 through 65535 are
defined as private AS numbers. Private AS numbers must not be advertised on the global Internet. The 2-byte AS
number range has been exhausted. 4-byte AS numbers are specified in RFC 6793, and provide a pool of 4294967296
AS numbers.
The ASN is one of the essential elements of BGP. BGP is a distance vector routing protocol, and the AS-Path framework
provides distance vector metric and loop detection to BGP.
set protocols bgp system-as <asn>
Set local ASN that this router represents. This is a a mandatory option!

Address Families

Multiprotocol extensions enable BGP to carry routing information for multiple network layer protocols. BGP supports
an Address Family Identifier (AFI) for IPv4 and IPv6.

Route Selection

The route selection process used by FRR’s BGP implementation uses the following decision criterion, starting at the
top of the list and going towards the bottom until one of the factors can be used.
1. Weight check
Prefer higher local weight routes to lower routes.
2. Local preference check
Prefer higher local preference routes to lower.
3. Local route check
Prefer local routes (statics, aggregates, redistributed) to received routes.
4. AS path length check
Prefer shortest hop-count AS_PATHs.
5. Origin check
Prefer the lowest origin type route. That is, prefer IGP origin routes to EGP, to Incomplete routes.

8.9. Protocols 777

 VyOS Documentation, Release 1.5.x (circinus)

6. MED check
Where routes with a MED were received from the same AS, prefer the route with the lowest MED.
7. External check
Prefer the route received from an external, eBGP peer over routes received from other types of peers.
8. IGP cost check
Prefer the route with the lower IGP cost.
9. Multi-path check
If multi-pathing is enabled, then check whether the routes not yet distinguished in preference may be considered
equal. If bgp bestpath as-path multipath-relax is set, all such routes are considered equal, otherwise
routes received via iBGP with identical AS_PATHs or routes received from eBGP neighbours in the same AS
are considered equal.
10. Already-selected external check
Where both routes were received from eBGP peers, then prefer the route which is already selected. Note that this
check is not applied if bgp bestpath compare-routerid is configured. This check can prevent some cases
of oscillation.
11. Router-ID check
Prefer the route with the lowest router-ID. If the route has an ORIGINATOR_ID attribute, through iBGP reflec-
tion, then that router ID is used, otherwise the router-ID of the peer the route was received from is used.
12. Cluster-List length check
The route with the shortest cluster-list length is used. The cluster-list reflects the iBGP reflection path the route
has taken.
13. Peer address
Prefer the route received from the peer with the higher transport layer address, as a last-resort tie-breaker.

Capability Negotiation

When adding IPv6 routing information exchange feature to BGP. There were some proposals. IETF (Internet Engi-
neering Task Force) IDR (Inter Domain Routing) adopted a proposal called Multiprotocol Extension for BGP. The
specification is described in RFC 2283. The protocol does not define new protocols. It defines new attributes to ex-
isting BGP. When it is used exchanging IPv6 routing information it is called BGP-4+. When it is used for exchanging
multicast routing information it is called MBGP.
bgpd supports Multiprotocol Extension for BGP. So if a remote peer supports the protocol, bgpd can exchange IPv6
and/or multicast routing information.
Traditional BGP did not have the feature to detect a remote peer’s capabilities, e.g. whether it can handle prefix types
other than IPv4 unicast routes. This was a big problem using Multiprotocol Extension for BGP in an operational
network. RFC 2842 adopted a feature called Capability Negotiation. bgpd use this Capability Negotiation to detect
the remote peer’s capabilities. If a peer is only configured as an IPv4 unicast neighbor, bgpd does not send these
Capability Negotiation packets (at least not unless other optional BGP features require capability negotiation).
By default, FRR will bring up peering with minimal common capability for the both sides. For example, if the local
router has unicast and multicast capabilities and the remote router only has unicast capability the local router will
establish the connection with unicast only capability. When there are no common capabilities, FRR sends Unsupported
Capability error and then resets the connection.

8.9. Protocols 778

 VyOS Documentation, Release 1.5.x (circinus)

Configuration

BGP Router Configuration

First of all you must configure BGP router with the ASN. The AS number is an identifier for the autonomous system.
The BGP protocol uses the AS number for detecting whether the BGP connection is internal or external. VyOS does
not have a special command to start the BGP process. The BGP process starts when the first neighbor is configured.
set protocols bgp system-as <asn>
Set local autonomous system number that this router represents. This is a mandatory option!

Peers Configuration

Defining Peers

set protocols bgp neighbor <address|interface> remote-as <nasn>

This command creates a new neighbor whose remote-as is <nasn>. The neighbor address can be an IPv4 address
or an IPv6 address or an interface to use for the connection. The command is applicable for peer and peer group.
set protocols bgp neighbor <address|interface> remote-as internal
Create a peer as you would when you specify an ASN, except that if the peers ASN is different than mine as
specified under the protocols bgp <asn> command the connection will be denied.
set protocols bgp neighbor <address|interface> remote-as external
Create a peer as you would when you specify an ASN, except that if the peers ASN is the same as mine as
specified under the protocols bgp <asn> command the connection will be denied.
set protocols bgp neighbor <address|interface> local-role <role> [strict]
BGP roles are defined in RFC RFC 9234 and provide an easy way to add route leak prevention, detection and
mitigation. The local Role value is negotiated with the new BGP Role capability which has a built-in check of
the corresponding value. In case of a mismatch the new OPEN Roles Mismatch Notification <2, 11> would be
sent. The correct Role pairs are:
Provider - Customer
Peer - Peer
RS-Server - RS-Client
If strict is set the BGP session won’t become established until the BGP neighbor sets local Role on its side.
This configuration parameter is defined in RFC RFC 9234 and is used to enforce the corresponding configuration
at your counter-parts side.
Routes that are sent from provider, rs-server, or the peer local-role (or if received by customer, rs-client, or the
peer local-role) will be marked with a new Only to Customer (OTC) attribute.
Routes with this attribute can only be sent to your neighbor if your local-role is provider or rs-server. Routes
with this attribute can be received only if your local-role is customer or rs-client.
In case of peer-peer relationship routes can be received only if OTC value is equal to your neighbor AS number.
All these rules with OTC will help to detect and mitigate route leaks and happen automatically if local-role is
set.
set protocols bgp neighbor <address|interface> shutdown
This command disable the peer or peer group. To reenable the peer use the delete form of this command.

8.9. Protocols 779

 VyOS Documentation, Release 1.5.x (circinus)

set protocols bgp neighbor <address|interface> description <text>

Set description of the peer or peer group.
set protocols bgp neighbor <address|interface> update-source <address|interface>
Specify the IPv4 source address to use for the BGP session to this neighbor, may be specified as either an IPv4
address directly or as an interface name.

Capability Negotiation

set protocols bgp neighbor <address|interface> capability dynamic

This command would allow the dynamic update of capabilities over an established BGP session.
set protocols bgp neighbor <address|interface> capability extended-nexthop
Allow bgp to negotiate the extended-nexthop capability with it’s peer. If you are peering over a IPv6 Link-Local
address then this capability is turned on automatically. If you are peering over a IPv6 Global Address then
turning on this command will allow BGP to install IPv4 routes with IPv6 nexthops if you do not have IPv4
configured on interfaces.
set protocols bgp neighbor <address|interface> disable-capability-negotiation
Suppress sending Capability Negotiation as OPEN message optional parameter to the peer. This command only
affects the peer is configured other than IPv4 unicast configuration.
When remote peer does not have capability negotiation feature, remote peer will not send any capabilities at all.
In that case, bgp configures the peer with configured capabilities.
You may prefer locally configured capabilities more than the negotiated capabilities even though remote peer
sends capabilities. If the peer is configured by override-capability, VyOS ignores received capabilities
then override negotiated capabilities with configured values.
Additionally you should keep in mind that this feature fundamentally disables the ability to use widely deployed
BGP features. BGP unnumbered, hostname support, AS4, Addpath, Route Refresh, ORF, Dynamic Capabilities,
and graceful restart.
set protocols bgp neighbor <address|interface> override-capability
This command allow override the result of Capability Negotiation with local configuration. Ignore remote peer’s
capability value.
set protocols bgp neighbor <address|interface> strict-capability-match
This command forces strictly compare remote capabilities and local capabilities. If capabilities are different,
send Unsupported Capability error then reset connection.
You may want to disable sending Capability Negotiation OPEN message optional parameter to the peer when
remote peer does not implement Capability Negotiation. Please use disable-capability-negotiation
command to disable the feature.

8.9. Protocols 780

 VyOS Documentation, Release 1.5.x (circinus)

Peer Parameters

set protocols bgp neighbor <address|interface> address-family <ipv4-unicast|ipv6-unicast>

allowas-in number <number>
This command accept incoming routes with AS path containing AS number with the same value as the current
system AS. This is used when you want to use the same AS number in your sites, but you can’t connect them
directly.
The number parameter (1-10) configures the amount of accepted occurences of the system AS number in AS
path.
This command is only allowed for eBGP peers. It is not applicable for peer groups.
set protocols bgp neighbor <address|interface> address-family <ipv4-unicast|ipv6-unicast>
as-override
This command override AS number of the originating router with the local AS number.
Usually this configuration is used in PEs (Provider Edge) to replace the incoming customer AS number so the
connected CE ( Customer Edge) can use the same AS number as the other customer sites. This allows customers
of the provider network to use the same AS number across their sites.
This command is only allowed for eBGP peers.
set protocols bgp neighbor <address|interface> address-family <ipv4-unicast|ipv6-unicast>
attribute-unchanged <as-path|med|next-hop>
This command specifies attributes to be left unchanged for advertisements sent to a peer or peer group.
set protocols bgp neighbor <address|interface> address-family <ipv4-unicast|ipv6-unicast>
maximum-prefix <number>
This command specifies a maximum number of prefixes we can receive from a given peer. If this number is
exceeded, the BGP session will be destroyed. The number range is 1 to 4294967295.
set protocols bgp neighbor <address|interface> address-family <ipv4-unicast|ipv6-unicast>
nexthop-self
This command forces the BGP speaker to report itself as the next hop for an advertised route it advertised to a
neighbor.
set protocols bgp neighbor <address|interface> address-family <ipv4-unicast|ipv6-unicast>
remove-private-as
This command removes the private ASN of routes that are advertised to the configured peer. It removes only
private ASNs on routes advertised to EBGP peers.
If the AS-Path for the route has only private ASNs, the private ASNs are removed.
If the AS-Path for the route has a private ASN between public ASNs, it is assumed that this is a design choice,
and the private ASN is not removed.
set protocols bgp neighbor <address|interface> address-family <ipv4-unicast|ipv6-unicast>
soft-reconfiguration inbound
Changes in BGP policies require the BGP session to be cleared. Clearing has a large negative impact on network
operations. Soft reconfiguration enables you to generate inbound updates from a neighbor, change and activate
BGP policies without clearing the BGP session.
This command specifies that route updates received from this neighbor will be stored unmodified, regardless of
the inbound policy. When inbound soft reconfiguration is enabled, the stored updates are processed by the new
policy configuration to create new inbound updates.

8.9. Protocols 781

 VyOS Documentation, Release 1.5.x (circinus)

Note: Storage of route updates uses memory. If you enable soft reconfiguration inbound for multiple neighbors,
the amount of memory used can become significant.

set protocols bgp neighbor <address|interface> address-family <ipv4-unicast|ipv6-unicast>

weight <number>
This command specifies a default weight value for the neighbor’s routes. The number range is 1 to 65535.
set protocols bgp neighbor <address|interface> advertisement-interval <seconds>
This command specifies the minimum route advertisement interval for the peer. The interval value is 0 to 600
seconds, with the default advertisement interval being 0.
set protocols bgp neighbor <address|interface> disable-connected-check
This command allows peerings between directly connected eBGP peers using loopback addresses without ad-
justing the default TTL of 1.
set protocols bgp neighbor <address|interface> disable-send-community <extended|standard>
This command specifies that the community attribute should not be sent in route updates to a peer. By default
community attribute is sent.
set protocols bgp neighbor <address|interface> ebgp-multihop <number>
This command allows sessions to be established with eBGP neighbors when they are multiple hops away. When
the neighbor is not directly connected and this knob is not enabled, the session will not establish. The number
of hops range is 1 to 255. This command is mutually exclusive with ttl-security hops.
set protocols bgp neighbor <address|interface> local-as <asn> [no-prepend] [replace-as]
Specify an alternate AS for this BGP process when interacting with the specified peer or peer group. With no
modifiers, the specified local-as is prepended to the received AS_PATH when receiving routing updates from
the peer, and prepended to the outgoing AS_PATH (after the process local AS) when transmitting local routes
to the peer.
If the no-prepend attribute is specified, then the supplied local-as is not prepended to the received AS_PATH.
If the replace-as attribute is specified, then only the supplied local-as is prepended to the AS_PATH when
transmitting local-route updates to this peer.

Note: This command is only allowed for eBGP peers.

set protocols bgp neighbor <address|interface> passive

Configures the BGP speaker so that it only accepts inbound connections from, but does not initiate outbound
connections to the peer or peer group.
set protocols bgp neighbor <address|interface> password <text>
This command specifies a MD5 password to be used with the tcp socket that is being used to connect to the
remote peer.
set protocols bgp neighbor <address|interface> ttl-security hops <number>
This command enforces Generalized TTL Security Mechanism (GTSM), as specified in RFC 5082. With this
command, only neighbors that are specified number of hops away will be allowed to become neighbors. The
number of hops range is 1 to 254. This command is mutually exclusive with ebgp-multihop.

8.9. Protocols 782

 VyOS Documentation, Release 1.5.x (circinus)

Peer Groups

Peer groups are used to help improve scaling by generating the same update information to all members of a peer group.
Note that this means that the routes generated by a member of a peer group will be sent back to that originating peer
with the originator identifier attribute set to indicated the originating peer. All peers not associated with a specific peer
group are treated as belonging to a default peer group, and will share updates.
set protocols bgp peer-group <name>
This command defines a new peer group. You can specify to the group the same parameters that you can specify
for specific neighbors.

Note: If you apply a parameter to an individual neighbor IP address, you override the action defined for a peer
group that includes that IP address.

set protocols bgp neighbor <address|interface> peer-group <name>

This command bind specific peer to peer group with a given name.

Network Advertisement Configuration

set protocols bgp address-family <ipv4-unicast|ipv6-unicast> network <prefix>

This command is used for advertising IPv4 or IPv6 networks.

Note: By default, the BGP prefix is advertised even if it’s not present in the routing table. This behaviour
differs from the implementation of some vendors.

set protocols bgp parameters network-import-check

This configuration modifies the behavior of the network statement. If you have this configured the underlying
network must exist in the routing table.
set protocols bgp neighbor <address|interface> address-family <ipv4-unicast|ipv6-unicast>
default-originate [route-map <name>]
By default, VyOS does not advertise a default route (0.0.0.0/0) even if it is in routing table. When you want to
announce default routes to the peer, use this command. Using optional argument route-map you can inject the
default route to given neighbor only if the conditions in the route map are met.

Route Aggregation Configuration

set protocols bgp address-family <ipv4-unicast|ipv6-unicast> aggregate-address <prefix>

This command specifies an aggregate address. The router will also announce longer-prefixes inside of the
aggregate address.
set protocols bgp address-family <ipv4-unicast|ipv6-unicast> aggregate-address <prefix>
as-set
This command specifies an aggregate address with a mathematical set of autonomous systems. This command
summarizes the AS_PATH attributes of all the individual routes.
set protocols bgp address-family <ipv4-unicast|ipv6-unicast> aggregate-address <prefix>
summary-only

8.9. Protocols 783

 VyOS Documentation, Release 1.5.x (circinus)

This command specifies an aggregate address and provides that longer-prefixes inside of the aggregate address
are suppressed before sending BGP updates out to peers.
set protocols bgp neighbor <address|interface> address-family <ipv4-unicast|ipv6-unicast>
unsuppress-map <name>
This command applies route-map to selectively unsuppress prefixes suppressed by summarisation.

Redistribution Configuration

set protocols bgp address-family <ipv4-unicast|ipv6-unicast> redistribute <route source>

This command redistributes routing information from the given route source to the BGP process. There are six
modes available for route source: connected, kernel, ospf, rip, static, table.
set protocols bgp address-family <ipv4-unicast|ipv6-unicast> redistribute <route source>
metric <number>
This command specifies metric (MED) for redistributed routes. The metric range is 0 to 4294967295. There
are six modes available for route source: connected, kernel, ospf, rip, static, table.
set protocols bgp address-family <ipv4-unicast|ipv6-unicast> redistribute <route source>
route-map <name>
This command allows to use route map to filter redistributed routes. There are six modes available for route
source: connected, kernel, ospf, rip, static, table.

General Configuration

Common parameters

set protocols bgp parameters allow-martian-nexthop

When a peer receives a martian nexthop as part of the NLRI for a route permit the nexthop to be used as such,
instead of rejecting and resetting the connection.
set protocols bgp parameters router-id <id>
This command specifies the router-ID. If router ID is not specified it will use the highest interface IP address.
set protocols bgp address-family <ipv4-unicast|ipv6-unicast> maximum-paths <ebgp|ibgp>
<number>
This command defines the maximum number of parallel routes that the BGP can support. In order for BGP
to use the second path, the following attributes have to match: Weight, Local Preference, AS Path (both AS
number and AS path length), Origin code, MED, IGP metric. Also, the next hop address for each path must be
different.
set protocols bgp parameters no-hard-administrative-reset
Do not send Hard Reset CEASE Notification for “Administrative Reset” events. When set and Graceful Restart
Notification capability is exchanged between the peers, Graceful Restart procedures apply, and routes will be
retained.
set protocols bgp parameters log-neighbor-changes
This command enable logging neighbor up/down changes and reset reason.
set protocols bgp parameters no-client-to-client-reflection

8.9. Protocols 784

 VyOS Documentation, Release 1.5.x (circinus)

This command disables route reflection between route reflector clients. By default, the clients of a
route reflector are not required to be fully meshed and the routes from a client are reflected to other
clients. However, if the clients are fully meshed, route reflection is not required. In this case, use the
no-client-to-client-reflection command to disable client-to-client reflection.
set protocols bgp parameters no-fast-external-failover
Disable immediate session reset if peer’s connected link goes down.
set protocols bgp listen range <prefix> peer-group <name>
This command is useful if one desires to loosen the requirement for BGP to have strictly defined neighbors.
Specifically what is allowed is for the local router to listen to a range of IPv4 or IPv6 addresses defined by a
prefix and to accept BGP open messages. When a TCP connection (and subsequently a BGP open message)
from within this range tries to connect the local router then the local router will respond and connect with the
parameters that are defined within the peer group. One must define a peer-group for each range that is listed. If
no peer-group is defined then an error will keep you from committing the configuration.
set protocols bgp listen limit <number>
This command goes hand in hand with the listen range command to limit the amount of BGP neighbors that are
allowed to connect to the local router. The limit range is 1 to 5000.
set protocols bgp parameters ebgp-requires-policy
This command changes the eBGP behavior of FRR. By default FRR enables RFC 8212 functionality which
affects how eBGP routes are advertised, namely no routes are advertised across eBGP sessions without some
sort of egress route-map/policy in place. In VyOS however we have this RFC functionality disabled by default
so that we can preserve backwards compatibility with older versions of VyOS. With this option one can enable
RFC 8212 functionality to operate.
set protocols bgp parameters labeled-unicast <explicit-null | ipv4-explicit-null |
ipv6-explicit-null>
By default, locally advertised prefixes use the implicit-null label to encode in the outgoing NLRI.
The following command uses the explicit-null label value for all the BGP instances.

Administrative Distance

set protocols bgp parameters distance global <external|internal|local> <distance>

This command change distance value of BGP. The arguments are the distance values for external routes, internal
routes and local routes respectively. The distance range is 1 to 255.
set protocols bgp parameters distance prefix <subnet> distance <distance>
This command sets the administrative distance for a particular route. The distance range is 1 to 255.

Note: Routes with a distance of 255 are effectively disabled and not installed into the kernel.

8.9. Protocols 785

 VyOS Documentation, Release 1.5.x (circinus)

Timers

set protocols bgp timers holdtime <seconds>

This command specifies hold-time in seconds. The timer range is 4 to 65535. The default value is 180 second.
If you set value to 0 VyOS will not hold routes.
set protocols bgp timers keepalive <seconds>
This command specifies keep-alive time in seconds. The timer can range from 4 to 65535. The default value is
60 second.

Route Dampening

When a route fails, a routing update is sent to withdraw the route from the network’s routing tables. When the route is
re-enabled, the change in availability is also advertised. A route that continually fails and returns requires a great deal
of network traffic to update the network about the route’s status.
Route dampening wich described in RFC 2439 enables you to identify routes that repeatedly fail and return. If route
dampening is enabled, an unstable route accumulates penalties each time the route fails and returns. If the accumulated
penalties exceed a threshold, the route is no longer advertised. This is route suppression. Routes that have been
suppressed are re-entered into the routing table only when the amount of their penalty falls below a threshold.
A penalty of 1000 is assessed each time the route fails. When the penalties reach a predefined threshold (suppress-
value), the router stops advertising the route.
Once a route is assessed a penalty, the penalty is decreased by half each time a predefined amount of time elapses (half-
life-time). When the accumulated penalties fall below a predefined threshold (reuse-value), the route is unsuppressed
and added back into the BGP routing table.
No route is suppressed indefinitely. Maximum-suppress-time defines the maximum time a route can be suppressed
before it is re-advertised.
set protocols bgp parameters dampening half-life <minutes>
This command defines the amount of time in minutes after which a penalty is reduced by half. The timer range
is 10 to 45 minutes.
set protocols bgp parameters dampening re-use <seconds>
This command defines the accumulated penalty amount at which the route is re-advertised. The penalty range
is 1 to 20000.
set protocols bgp parameters dampening start-suppress-time <seconds>
This command defines the accumulated penalty amount at which the route is suppressed. The penalty range is
1 to 20000.
set protocols bgp parameters dampening max-suppress-time <seconds>
This command defines the maximum time in minutes that a route is suppressed. The timer range is 1 to 255
minutes.

8.9. Protocols 786

 VyOS Documentation, Release 1.5.x (circinus)

Route Selection Configuration

set protocols bgp parameters always-compare-med

This command provides to compare the MED on routes, even when they were received from different neigh-
bouring ASes. Setting this option makes the order of preference of routes more defined, and should eliminate
MED induced oscillations.
set protocols bgp parameters bestpath as-path confed
This command specifies that the length of confederation path sets and sequences should be taken into account
during the BGP best path decision process.
set protocols bgp parameters bestpath as-path multipath-relax
This command specifies that BGP decision process should consider paths of equal AS_PATH length candidates
for multipath computation. Without the knob, the entire AS_PATH must match for multipath computation.
set protocols bgp parameters bestpath as-path ignore
Ignore AS_PATH length when selecting a route
set protocols bgp parameters bestpath compare-routerid
Ensure that when comparing routes where both are equal on most metrics, including local-pref, AS_PATH
length, IGP cost, MED, that the tie is broken based on router-ID.
If this option is enabled, then the already-selected check, where already selected eBGP routes are preferred, is
skipped.
If a route has an ORIGINATOR_ID attribute because it has been reflected, that ORIGINATOR_ID will be used.
Otherwise, the router-ID of the peer the route was received from will be used.
The advantage of this is that the route-selection (at this point) will be more deterministic. The disadvantage is
that a few or even one lowest-ID router may attract all traffic to otherwise-equal paths because of this check. It
may increase the possibility of MED or IGP oscillation, unless other measures were taken to avoid these. The
exact behaviour will be sensitive to the iBGP and reflection topology.
set protocols bgp parameters bestpath med confed
This command specifies that BGP considers the MED when comparing routes originated from different sub-
ASs within the confederation to which this BGP speaker belongs. The default state, where the MED attribute
is not considered.
set protocols bgp parameters bestpath med missing-as-worst
This command specifies that a route with a MED is always considered to be better than a route without a MED
by causing the missing MED attribute to have a value of infinity. The default state, where the missing MED
attribute is considered to have a value of zero.
set protocols bgp parameters default local-pref <local-pref value>
This command specifies the default local preference value. The local preference range is 0 to 4294967295.
set protocols bgp parameters deterministic-med
This command provides to compare different MED values that advertised by neighbours in the same AS for
routes selection. When this command is enabled, routes from the same autonomous system are grouped together,
and the best entries of each group are compared.
set protocols bgp address-family ipv4-unicast network <prefix> backdoor
This command allows the router to prefer route to specified prefix learned via IGP through backdoor link instead
of a route to the same prefix learned via EBGP.

8.9. Protocols 787

 VyOS Documentation, Release 1.5.x (circinus)

Route Filtering Configuration

In order to control and modify routing information that is exchanged between peers you can use route-map, filter-list,
prefix-list, distribute-list.
For inbound updates the order of preference is:
• route-map
• filter-list
• prefix-list, distribute-list
For outbound updates the order of preference is:
• prefix-list, distribute-list
• filter-list
• route-map

Note: The attributes prefix-list and distribute-list are mutually exclusive, and only one com-
mand (distribute-list or prefix-list) can be applied to each inbound or outbound direction for a particular
neighbor.

set protocols bgp neighbor <address|interface> address-family <ipv4-unicast|ipv6-unicast>

distribute-list <export|import> <number>
This command applies the access list filters named in <number> to the specified BGP neighbor to restrict the
routing information that BGP learns and/or advertises. The arguments export and import specify the direction
in which the access list are applied.
set protocols bgp neighbor <address|interface> address-family <ipv4-unicast|ipv6-unicast>
prefix-list <export|import> <name>
This command applies the prfefix list filters named in <name> to the specified BGP neighbor to restrict the
routing information that BGP learns and/or advertises. The arguments export and import specify the direction
in which the prefix list are applied.
set protocols bgp neighbor <address|interface> address-family <ipv4-unicast|ipv6-unicast>
route-map <export|import> <name>
This command applies the route map named in <name> to the specified BGP neighbor to control and modify
routing information that is exchanged between peers. The arguments export and import specify the direction
in which the route map are applied.
set protocols bgp neighbor <address|interface> address-family <ipv4-unicast|ipv6-unicast>
filter-list <export|import> <name>
This command applies the AS path access list filters named in <name> to the specified BGP neighbor to restrict
the routing information that BGP learns and/or advertises. The arguments export and import specify the
direction in which the AS path access list are applied.
set protocols bgp neighbor <address|interface> address-family <ipv4-unicast|ipv6-unicast>
capability orf <receive|send>
This command enables the ORF capability (described in RFC 5291) on the local router, and enables ORF
capability advertisement to the specified BGP peer. The receive keyword configures a router to advertise ORF
receive capabilities. The send keyword configures a router to advertise ORF send capabilities. To advertise a
filter from a sender, you must create an IP prefix list for the specified BGP peer applied in inbound derection.
set protocols bgp neighbor <address|interface> solo

8.9. Protocols 788

 VyOS Documentation, Release 1.5.x (circinus)

This command prevents from sending back prefixes learned from the neighbor.

BGP Scaling Configuration

BGP routers connected inside the same AS through BGP belong to an internal BGP session, or IBGP. In order to
prevent routing table loops, IBGP speaker does not advertise IBGP-learned routes to other IBGP speaker (Split Horizon
mechanism). As such, IBGP requires a full mesh of all peers. For large networks, this quickly becomes unscalable.
There are two ways that help us to mitigate the BGPs full-mesh requirement in a network:
• Using BGP route-reflectors
• Using BGP confederation

Route Reflector Configuration

Introducing route reflectors removes the need for the full-mesh. When you configure a route reflector you have to tell
the router whether the other IBGP router is a client or non-client. A client is an IBGP router that the route reflector
will “reflect” routes to, the non-client is just a regular IBGP neighbor. Route reflectors mechanism is described in RFC
4456 and updated by RFC 7606.
set protocols bgp neighbor <address> address-family <ipv4-unicast|ipv6-unicast>
route-reflector-client
This command specifies the given neighbor as route reflector client.
set protocols bgp parameters cluster-id <id>
This command specifies cluster ID which identifies a collection of route reflectors and their clients, and is used
by route reflectors to avoid looping. By default cluster ID is set to the BGP router id value, but can be set to an
arbitrary 32-bit value.

Confederation Configuration

A BGP confederation divides our AS into sub-ASes to reduce the number of required IBGP peerings. Within a sub-AS
we still require full-mesh IBGP but between these sub-ASes we use something that looks like EBGP but behaves like
IBGP (called confederation BGP). Confederation mechanism is described in RFC 5065
set protocols bgp parameters confederation identifier <asn>
This command specifies a BGP confederation identifier. <asn> is the number of the autonomous system that
internally includes multiple sub-autonomous systems (a confederation).
set protocols bgp parameters confederation peers <nsubasn>
This command sets other confederations <nsubasn> as members of autonomous system specified by
confederation identifier <asn>.

8.9. Protocols 789

 VyOS Documentation, Release 1.5.x (circinus)

Operational Mode Commands

Show

show bgp <ipv4|ipv6>

This command displays all entries in BGP routing table.

BGP table version is 10, local router ID is 10.0.35.3, vrf id 0

Default local pref 100, local AS 65000
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

Network Next Hop Metric LocPrf Weight Path

*> 198.51.100.0/24 10.0.34.4 0 0 65004 i
*> 203.0.113.0/24 10.0.35.5 0 0 65005 i

Displayed 2 routes and 2 total paths

show bgp <ipv4|ipv6> <address|prefix>

This command displays information about the particular entry in the BGP routing table.

BGP routing table entry for 198.51.100.0/24

Paths: (1 available, best #1, table default)
Advertised to non peer-group peers:
10.0.13.1 10.0.23.2 10.0.34.4 10.0.35.5
65004
10.0.34.4 from 10.0.34.4 (10.0.34.4)
Origin IGP, metric 0, valid, external, best (First path received)
Last update: Wed Jan 6 12:18:53 2021

show ip bgp cidr-only

This command displays routes with classless interdomain routing (CIDR).
show bgp <ipv4|ipv6> community <value>
This command displays routes that belong to specified BGP communities. Valid value is a community number
in the range from 1 to 4294967200, or AA:NN (autonomous system-community number/2-byte number), no-
export, local-as, or no-advertise.
show bgp <ipv4|ipv6> community-list <name>
This command displays routes that are permitted by the BGP community list.
show bgp <ipv4|ipv6> dampening dampened-paths
This command displays BGP dampened routes.
show bgp <ipv4|ipv6> dampening flap-statistics
This command displays information about flapping BGP routes.
show bgp <ipv4|ipv6> filter-list <name>
This command displays BGP routes allowed by the specified AS Path access list.

8.9. Protocols 790

 VyOS Documentation, Release 1.5.x (circinus)

show bgp <ipv4|ipv6> neighbors <address> advertised-routes

This command displays BGP routes advertised to a neighbor.
show bgp <ipv4|ipv6> neighbors <address> received-routes
This command displays BGP routes originating from the specified BGP neighbor before inbound policy is
applied. To use this command inbound soft reconfiguration must be enabled.
show bgp <ipv4|ipv6> neighbors <address> routes
This command displays BGP received-routes that are accepted after filtering.
show bgp <ipv4|ipv6> neighbors <address> dampened-routes
This command displays dampened routes received from BGP neighbor.
show bgp <ipv4|ipv6> regexp <text>
This command displays information about BGP routes whose AS path matches the specified regular expression.
show bgp <ipv4|ipv6> summary
This command displays the status of all BGP connections.

IPv4 Unicast Summary:

BGP router identifier 10.0.35.3, local AS number 65000 vrf-id 0
BGP table version 11
RIB entries 5, using 920 bytes of memory
Peers 4, using 82 KiB of memory

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

10.0.13.1 4 65000 148 159 0 0 0 02:16:01 0
10.0.23.2 4 65000 136 143 0 0 0 02:13:21 0
10.0.34.4 4 65004 161 163 0 0 0 02:16:01 1
10.0.35.5 4 65005 162 166 0 0 0 02:16:01 1

Total number of neighbors 4

Reset

reset <ip|ipv6> bgp <address> [soft [in|out]]

This command resets BGP connections to the specified neighbor IP address. With argument soft this command
initiates a soft reset. If you do not specify the in or out options, both inbound and outbound soft reconfiguration
are triggered.
reset ip bgp all
This command resets all BGP connections of given router.
reset ip bgp dampening
This command uses to clear BGP route dampening information and to unsuppress suppressed routes.
reset ip bgp external
This command resets all external BGP peers of given router.
reset ip bgp peer-group <name> [soft [in|out]]

8.9. Protocols 791

 VyOS Documentation, Release 1.5.x (circinus)

This command resets BGP connections to the specified peer group. With argument soft this command initiates
a soft reset. If you do not specify the in or out options, both inbound and outbound soft reconfiguration are
triggered.

Examples

IPv4 peering

A simple eBGP configuration:

Node 1:

set protocols bgp system-as 65534

set protocols bgp neighbor 192.168.0.2 ebgp-multihop '2'
set protocols bgp neighbor 192.168.0.2 remote-as '65535'
set protocols bgp neighbor 192.168.0.2 update-source '192.168.0.1'
set protocols bgp address-family ipv4-unicast network '172.16.0.0/16'
set protocols bgp parameters router-id '192.168.0.1'

Node 2:

set protocols bgp system-as 65535

set protocols bgp neighbor 192.168.0.1 ebgp-multihop '2'
set protocols bgp neighbor 192.168.0.1 remote-as '65534'
set protocols bgp neighbor 192.168.0.1 update-source '192.168.0.2'
set protocols bgp address-family ipv4-unicast network '172.17.0.0/16'
set protocols bgp parameters router-id '192.168.0.2'

Don’t forget, the CIDR declared in the network statement MUST exist in your routing table (dynamic or static), the
best way to make sure that is true is creating a static route:
Node 1:

set protocols static route 172.16.0.0/16 blackhole distance '254'

Node 2:

set protocols static route 172.17.0.0/16 blackhole distance '254'

IPv6 peering

A simple BGP configuration via IPv6.

Node 1:

set protocols bgp system-as 65534

set protocols bgp neighbor 2001:db8::2 ebgp-multihop '2'
set protocols bgp neighbor 2001:db8::2 remote-as '65535'
set protocols bgp neighbor 2001:db8::2 update-source '2001:db8::1'
set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast
set protocols bgp address-family ipv6-unicast network '2001:db8:1::/48'
set protocols bgp parameters router-id '10.1.1.1'

Node 2:

8.9. Protocols 792

 VyOS Documentation, Release 1.5.x (circinus)

set protocols bgp system-as 65535

set protocols bgp neighbor 2001:db8::1 ebgp-multihop '2'
set protocols bgp neighbor 2001:db8::1 remote-as '65534'
set protocols bgp neighbor 2001:db8::1 update-source '2001:db8::2'
set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast
set protocols bgp address-family ipv6-unicast network '2001:db8:2::/48'
set protocols bgp parameters router-id '10.1.1.2'

Don’t forget, the CIDR declared in the network statement MUST exist in your routing table (dynamic or static), the
best way to make sure that is true is creating a static route:
Node 1:

set protocols static route6 2001:db8:1::/48 blackhole distance '254'

Node 2:

set protocols static route6 2001:db8:2::/48 blackhole distance '254'

Route Filtering

Route filter can be applied using a route-map:

Node1:

set policy prefix-list AS65535-IN rule 10 action 'permit'

set policy prefix-list AS65535-IN rule 10 prefix '172.16.0.0/16'
set policy prefix-list AS65535-OUT rule 10 action 'deny'
set policy prefix-list AS65535-OUT rule 10 prefix '172.16.0.0/16'
set policy prefix-list6 AS65535-IN rule 10 action 'permit'
set policy prefix-list6 AS65535-IN rule 10 prefix '2001:db8:2::/48'
set policy prefix-list6 AS65535-OUT rule 10 action 'deny'
set policy prefix-list6 AS65535-OUT rule 10 prefix '2001:db8:2::/48'

set policy route-map AS65535-IN rule 10 action 'permit'

set policy route-map AS65535-IN rule 10 match ip address prefix-list 'AS65535-IN'
set policy route-map AS65535-IN rule 10 match ipv6 address prefix-list 'AS65535-IN'
set policy route-map AS65535-IN rule 20 action 'deny'
set policy route-map AS65535-OUT rule 10 action 'deny'
set policy route-map AS65535-OUT rule 10 match ip address prefix-list 'AS65535-OUT'
set policy route-map AS65535-OUT rule 10 match ipv6 address prefix-list 'AS65535-OUT'
set policy route-map AS65535-OUT rule 20 action 'permit'

set protocols bgp system-as 65534

set protocols bgp neighbor 2001:db8::2 address-family ipv4-unicast route-map export
˓→'AS65535-OUT'

set protocols bgp neighbor 2001:db8::2 address-family ipv4-unicast route-map import

˓→'AS65535-IN'

set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast route-map export

˓→'AS65535-OUT'

set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast route-map import

˓→'AS65535-IN'

Node2:

8.9. Protocols 793

 VyOS Documentation, Release 1.5.x (circinus)

set policy prefix-list AS65534-IN rule 10 action 'permit'

set policy prefix-list AS65534-IN rule 10 prefix '172.17.0.0/16'
set policy prefix-list AS65534-OUT rule 10 action 'deny'
set policy prefix-list AS65534-OUT rule 10 prefix '172.17.0.0/16'
set policy prefix-list6 AS65534-IN rule 10 action 'permit'
set policy prefix-list6 AS65534-IN rule 10 prefix '2001:db8:1::/48'
set policy prefix-list6 AS65534-OUT rule 10 action 'deny'
set policy prefix-list6 AS65534-OUT rule 10 prefix '2001:db8:1::/48'

set policy route-map AS65534-IN rule 10 action 'permit'

set policy route-map AS65534-IN rule 10 match ip address prefix-list 'AS65534-IN'
set policy route-map AS65534-IN rule 10 match ipv6 address prefix-list 'AS65534-IN'
set policy route-map AS65534-IN rule 20 action 'deny'
set policy route-map AS65534-OUT rule 10 action 'deny'
set policy route-map AS65534-OUT rule 10 match ip address prefix-list 'AS65534-OUT'
set policy route-map AS65534-OUT rule 10 match ipv6 address prefix-list 'AS65534-OUT'
set policy route-map AS65534-OUT rule 20 action 'permit'

set protocols bgp system-as 65535

set protocols bgp neighbor 2001:db8::1 address-family ipv4-unicast route-map export
˓→'AS65534-OUT'

set protocols bgp neighbor 2001:db8::1 address-family ipv4-unicast route-map import

˓→'AS65534-IN'

set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast route-map export

˓→'AS65534-OUT'

set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast route-map import

˓→'AS65534-IN'

We could expand on this and also deny link local and multicast in the rule 20 action deny.

8.9.4 Failover

Failover routes are manually configured routes, but they only install to the routing table if the health-check target is
alive. If the target is not alive the route is removed from the routing table until the target becomes available.

Failover Routes

set protocols failover route <subnet> next-hop <address> check target <target-address>
Configure next-hop <address> and <target-address> for an IPv4 static route. Specify the target IPv4 address
for health checking.
set protocols failover route <subnet> next-hop <address> check timeout <timeout>
Timeout in seconds between health target checks.
Range is 1 to 300, default is 10.
set protocols failover route <subnet> next-hop <address> check type <protocol>
Defines protocols for checking ARP, ICMP, TCP
Default is icmp.
set protocols failover route <subnet> next-hop <address> check policy <policy>

8.9. Protocols 794

 VyOS Documentation, Release 1.5.x (circinus)

Policy for checking targets

• all-available all checking target addresses must be available to pass this check
• any-available any of the checking target addresses must be available to pass this check
Default is any-available.
set protocols failover route <subnet> next-hop <address> interface <interface>
Next-hop interface for the route
set protocols failover route <subnet> next-hop <address> metric <metric>
Route metric
Default 1.

Example

One gateway:

set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check target '192.0.2.1'
set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check timeout '5'
set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check type 'icmp'
set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 interface 'eth0'
set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 metric '10'

Show the route

vyos@vyos:~$ show ip route 203.0.113.1

Routing entry for 203.0.113.1/32
Known via "kernel", distance 0, metric 10, best
Last update 00:00:39 ago
* 192.0.2.1, via eth0

Two gateways and different metrics:

set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check target '192.0.2.1'
set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check timeout '5'
set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check type 'icmp'
set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 interface 'eth0'
set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 metric '10'

set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check target '198.51.
˓→100.99'

set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check timeout '5'
set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check type 'icmp'
set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 interface 'eth2'
set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 metric '20'

Show the route

vyos@vyos:~$ show ip route 203.0.113.1

Routing entry for 203.0.113.1/32
Known via "kernel", distance 0, metric 10, best
Last update 00:08:06 ago
(continues on next page)

8.9. Protocols 795

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

* 192.0.2.1, via eth0

Routing entry for 203.0.113.1/32

Known via "kernel", distance 0, metric 20
Last update 00:08:14 ago
* 198.51.100.1, via eth2

8.9.5 IGMP Proxy

IGMP (Internet Group Management Protocol) proxy sends IGMP host messages on behalf of a connected client. The
configuration must define one, and only one upstream interface, and one or more downstream interfaces.

Configuration

set protocols igmp-proxy interface <interface> role <upstream | downstream>

• upstream: The upstream network interface is the outgoing interface which is responsible for communicat-
ing to available multicast data sources. There can only be one upstream interface.
• downstream: Downstream network interfaces are the distribution interfaces to the destination networks,
where multicast clients can join groups and receive multicast data. One or more downstream interfaces
must be configured.
set protocols igmp-proxy interface <interface> alt-subnet <network>
Defines alternate sources for multicasting and IGMP data. The network address must be on the following for-
mat ‘a.b.c.d/n’. By default, the router will accept data from sources on the same network as configured on
an interface. If the multicast source lies on a remote network, one must define from where traffic should be
accepted.
This is especially useful for the upstream interface, since the source for multicast traffic is often from a remote
location.
This option can be supplied multiple times.
set protocols igmp-proxy disable-quickleave
Disables quickleave mode. In this mode the daemon will not send a Leave IGMP message upstream as soon as
it receives a Leave message for any downstream interface. The daemon will not ask for Membership reports on
the downstream interfaces, and if a report is received the group is not joined again the upstream.
If it’s vital that the daemon should act exactly like a real multicast client on the upstream interface, this function
should be enabled.
Enabling this function increases the risk of bandwidth saturation.
set protocols igmp-proxy disable
Disable this service.

8.9. Protocols 796

 VyOS Documentation, Release 1.5.x (circinus)

Example

Interface eth1 LAN is behind NAT. In order to subscribe 10.0.0.0/23 subnet multicast which is in eth0 WAN we need
to configure igmp-proxy.

set protocols igmp-proxy interface eth0 role upstream

set protocols igmp-proxy interface eth0 alt-subnet 10.0.0.0/23
set protocols igmp-proxy interface eth1 role downstream

Operation

restart igmp-proxy
Restart the IGMP proxy process.

8.9.6 IS-IS

IS-IS (Intermediate System to Intermediate System) is a link-state interior gateway protocol (IGP) which is described
in ISO10589, RFC 1195, RFC 5308. IS-IS runs the Dijkstra shortest-path first (SPF) algorithm to create a database
of the network’s topology, and from that database to determine the best (that is, lowest cost) path to a destination. The
intermediate systems (the name for routers) exchange topology information with their directly connected neighbors.
IS-IS runs directly on the data link layer (Layer 2). IS-IS addresses are called NETs (Network Entity Titles) and can
be 8 to 20 bytes long, but are generally 10 bytes long. The tree database that is created with IS-IS is similar to the one
that is created with OSPF in that the paths chosen should be similar. Comparisons to OSPF are inevitable and often
are reasonable ones to make in regards to the way a network will respond with either IGP.

General

Configuration

Mandatory Settings

For IS-IS top operate correctly, one must do the equivalent of a Router ID in CLNS. This Router ID is called the NET
(Network Entity Title). This must be unique for each and every router that is operating in IS-IS. It also must not be
duplicated otherwise the same issues that occur within OSPF will occur within IS-IS when it comes to said duplication.
set protocols isis net <network-entity-title>
This command sets network entity title (NET) provided in ISO format.
Here is an example NET value:

49.0001.1921.6800.1002.00

The CLNS address consists of the following parts:

• AFI (Address family authority identifier) - 49 The AFI value 49 is what IS-IS uses for private addressing.
• Area identifier: 0001 IS-IS area number (numerical area 1)
• System identifier: 1921.6800.1002 - for system identifiers we recommend to use IP address or MAC
address of the router itself. The way to construct this is to keep all of the zeroes of the router IP address,
and then change the periods from being every three numbers to every four numbers. The address that is

8.9. Protocols 797

 VyOS Documentation, Release 1.5.x (circinus)

listed here is 192.168.1.2, which if expanded will turn into 192.168.001.002. Then all one has to do
is move the dots to have four numbers instead of three. This gives us 1921.6800.1002.
• NET selector: 00 Must always be 00. This setting indicates “this system” or “local system.”
set protocols isis interface <interface>
This command enables IS-IS on this interface, and allows for adjacency to occur. Note that the name of IS-IS
instance must be the same as the one used to configure the IS-IS process.

IS-IS Global Configuration

set protocols isis dynamic-hostname

This command enables support for dynamic hostname TLV. Dynamic hostname mapping determined as de-
scribed in RFC 2763, Dynamic Hostname Exchange Mechanism for IS-IS.
set protocols isis level <level-1|level-1-2|level-2>
This command defines the IS-IS router behavior:
• level-1 - Act as a station (Level 1) router only.
• level-1-2 - Act as a station (Level 1) router and area (Level 2) router.
• level-2-only - Act as an area (Level 2) router only.
set protocols isis lsp-mtu <size>
This command configures the maximum size of generated LSPs (Link State PDUs), in bytes. The size range is
128 to 4352.
set protocols isis metric-style <narrow|transition|wide>
This command sets old-style (ISO 10589) or new style packet formats:
• narrow - Use old style of TLVs with narrow metric.
• transition - Send and accept both styles of TLVs during transition.
• wide - Use new style of TLVs to carry wider metric.
set protocols isis purge-originator
This command enables RFC 6232 purge originator identification. Enable purge originator identification (POI)
by adding the type, length and value (TLV) with the Intermediate System (IS) identification to the LSPs that do
not contain POI information. If an IS generates a purge, VyOS adds this TLV with the system ID of the IS to
the purge.
set protocols isis set-attached-bit
This command sets ATT bit to 1 in Level1 LSPs. It is described in RFC 3787.
set protocols isis set-overload-bit
This command sets overload bit to avoid any transit traffic through this router. It is described in RFC 3787.
set protocols isis name default-information originate <ipv4|ipv6> level-1
This command will generate a default-route in L1 database.
set protocols isis name default-information originate <ipv4|ipv6> level-2
This command will generate a default-route in L2 database.
set protocols isis ldp-sync

8.9. Protocols 798

 VyOS Documentation, Release 1.5.x (circinus)

This command will enable IGP-LDP synchronization globally for ISIS. This requires for LDP to be functional.
This is described in RFC 5443. By default all interfaces operational in IS-IS are enabled for synchronization.
Loopbacks are exempt.
set protocols isis ldp-sync holddown <seconds>
This command will change the hold down value globally for IGP-LDP synchronization during conver-
gence/interface flap events.

Interface Configuration

set protocols isis interface <interface> circuit-type <level-1|level-1-2|level-2-only>

This command specifies circuit type for interface:
• level-1 - Level-1 only adjacencies are formed.
• level-1-2 - Level-1-2 adjacencies are formed
• level-2-only - Level-2 only adjacencies are formed
set protocols isis interface <interface> hello-interval <seconds>
This command sets hello interval in seconds on a given interface. The range is 1 to 600.
set protocols isis interface <interface> hello-multiplier <seconds>
This command sets multiplier for hello holding time on a given interface. The range is 2 to 100.
set protocols isis interface <interface> hello-padding
This command configures padding on hello packets to accommodate asymmetrical maximum transfer units
(MTUs) from different hosts as described in RFC 3719. This helps to prevent a premature adjacency Up state
when one routing devices MTU does not meet the requirements to establish the adjacency.
set protocols isis interface <interface> metric <metric>
This command set default metric for circuit.
The metric range is 1 to 16777215 (Max value depend if metric support narrow or wide value).
set protocols isis interface <interface> network point-to-point
This command specifies network type to Point-to-Point. The default network type is broadcast.
set protocols isis interface <interface> passive
This command configures the passive mode for this interface.
set protocols isis interface <interface> password plaintext-password <text>
This command configures the authentication password for the interface.
set protocols isis interface <interface> priority <number>
This command sets priority for the interface for DIS (Designated Intermediate System) election. The priority
range is 0 to 127.
set protocols isis interface <interface> psnp-interval <number>
This command sets PSNP interval in seconds. The interval range is 0 to 127.
set protocols isis interface <interface> no-three-way-handshake
This command disables Three-Way Handshake for P2P adjacencies which described in RFC 5303. Three-Way
Handshake is enabled by default.

8.9. Protocols 799

 VyOS Documentation, Release 1.5.x (circinus)

set protocols isis interface <interface> ldp-sync disable

This command disables IGP-LDP sync for this specific interface.
set protocols isis interface <interface> ldp-sync holddown <seconds>
This command will change the hold down value for IGP-LDP synchronization during convergence/interface flap
events, but for this interface only.

Route Redistribution

set protocols isis redistribute ipv4 <route source> level-1

This command redistributes routing information from the given route source into the ISIS database as Level-1.
There are six modes available for route source: bgp, connected, kernel, ospf, rip, static.
set protocols isis redistribute ipv4 <route source> level-2
This command redistributes routing information from the given route source into the ISIS database as Level-2.
There are six modes available for route source: bgp, connected, kernel, ospf, rip, static.
set protocols isis redistribute ipv4 <route source> <level-1|level-2> metric <number>
This command specifies metric for redistributed routes from the given route source. There are six modes avail-
able for route source: bgp, connected, kernel, ospf, rip, static. The metric range is 1 to 16777215.
set protocols isis redistribute ipv4 <route source> <level-1|level-2> route-map <name>
This command allows to use route map to filter redistributed routes from the given route source. There are six
modes available for route source: bgp, connected, kernel, ospf, rip, static.

Timers

set protocols isis lsp-gen-interval <seconds>

This command sets minimum interval in seconds between regenerating same LSP. The interval range is 1 to
120.
set protocols isis lsp-refresh-interval <seconds>
This command sets LSP refresh interval in seconds. IS-IS generates LSPs when the state of a link changes.
However, to ensure that routing databases on all routers remain converged, LSPs in stable networks are generated
on a regular basis even though there has been no change to the state of the links. The interval range is 1 to 65235.
The default value is 900 seconds.
set protocols isis max-lsp-lifetime <seconds>
This command sets LSP maximum LSP lifetime in seconds. The interval range is 350 to 65535. LSPs remain in
a database for 1200 seconds by default. If they are not refreshed by that time, they are deleted. You can change
the LSP refresh interval or the LSP lifetime. The LSP refresh interval should be less than the LSP lifetime or
else LSPs will time out before they are refreshed.
set protocols isis spf-interval <seconds>
This command sets minimum interval between consecutive SPF calculations in seconds.The interval range is 1
to 120.
set protocols isis spf-delay-ietf holddown <milliseconds>
set protocols isis spf-delay-ietf init-delay <milliseconds>
set protocols isis spf-delay-ietf long-delay <milliseconds>

8.9. Protocols 800

 VyOS Documentation, Release 1.5.x (circinus)

set protocols isis spf-delay-ietf short-delay <milliseconds>

set protocols isis spf-delay-ietf time-to-learn <milliseconds>
This commands specifies the Finite State Machine (FSM) intended to control the timing of the execution of SPF
calculations in response to IGP events. The process described in RFC 8405.

Loop Free Alternate (LFA)

set protocols isis fast-reroute lfa remote prefix-list <name> <level-1|level-2>

This command enables IP fast re-routing that is part of RFC 5286. Specifically this is a prefix list which
references a prefix in which will select eligible PQ nodes for remote LFA backups.
set protocols isis fast-reroute lfa local load-sharing disable <level-1|level-2>
This command disables the load sharing across multiple LFA backups.
set protocols isis fast-reroute lfa local tiebreaker <downstream|lowest-backup-metric|node-protecting>
index <number> <level-1|level-2>
This command will configure a tie-breaker for multiple local LFA backups. The lower index numbers will be
processed first.
set protocols isis fast-reroute lfa local priority-limit <medium|high|critical>
<level-1|level-2>
This command will limit LFA backup computation up to the specified prefix priority.

Examples

Enable IS-IS

Node 1:

set interfaces loopback lo address '192.168.255.255/32'

set interfaces ethernet eth1 address '192.0.2.1/24'

set protocols isis interface eth1

set protocols isis interface lo
set protocols isis net '49.0001.1921.6825.5255.00'

Node 2:

set interfaces ethernet eth1 address '192.0.2.2/24'

set interfaces loopback lo address '192.168.255.254/32'

set interfaces ethernet eth1 address '192.0.2.2/24'

set protocols isis interface eth1

set protocols isis interface lo
set protocols isis net '49.0001.1921.6825.5254.00'

This gives us the following neighborships, Level 1 and Level 2:

8.9. Protocols 801

 VyOS Documentation, Release 1.5.x (circinus)

Node-1@vyos:~$ show isis neighbor

Area VyOS:
System Id Interface L State Holdtime SNPA
vyos eth1 1 Up 28 0c87.6c09.0001
vyos eth1 2 Up 28 0c87.6c09.0001

Node-2@vyos:~$ show isis neighbor

Area VyOS:
System Id Interface L State Holdtime SNPA
vyos eth1 1 Up 29 0c33.0280.0001
vyos eth1 2 Up 28 0c33.0280.0001

Here’s the IP routes that are populated. Just the loopback:

Node-1@vyos:~$ show ip route isis

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure

I 192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:02:22

I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, weight 1, 00:02:22

Node-2@vyos:~$ show ip route isis

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure

I 192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:02:21

I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, weight 1, 00:02:21

Enable IS-IS and redistribute routes not natively in IS-IS

Node 1:

set interfaces dummy dum0 address '203.0.113.1/24'

set interfaces ethernet eth1 address '192.0.2.1/24'

set policy prefix-list EXPORT-ISIS rule 10 action 'permit'

set policy prefix-list EXPORT-ISIS rule 10 prefix '203.0.113.0/24'
set policy route-map EXPORT-ISIS rule 10 action 'permit'
set policy route-map EXPORT-ISIS rule 10 match ip address prefix-list 'EXPORT-ISIS'

set protocols isis interface eth1

set protocols isis net '49.0001.1921.6800.1002.00'
set protocols isis redistribute ipv4 connected level-2 route-map 'EXPORT-ISIS'

8.9. Protocols 802

 VyOS Documentation, Release 1.5.x (circinus)

Node 2:

set interfaces ethernet eth1 address '192.0.2.2/24'

set protocols isis interface eth1

set protocols isis net '49.0001.1921.6800.2002.00'

Routes on Node 2:

Node-2@r2:~$ show ip route isis

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
F - PBR, f - OpenFabric,
> - selected route, * - FIB route, q - queued route, r - rejected route

I 203.0.113.0/24 [115/10] via 192.0.2.1, eth1, 00:03:42

Enable IS-IS and IGP-LDP synchronization

Node 1:

set interfaces loopback lo address 192.168.255.255/32

set interfaces ethernet eth0 address 192.0.2.1/24

set protocols isis interface eth0

set protocols isis interface lo passive
set protocols isis ldp-sync
set protocols isis net 49.0001.1921.6825.5255.00

set protocols mpls interface eth0

set protocols mpls ldp discovery transport-ipv4-address 192.168.255.255
set protocols mpls ldp interface lo
set protocols mpls ldp interface eth0
set protocols mpls ldp parameters transport-prefer-ipv4
set protocols mpls ldp router-id 192.168.255.255

This gives us IGP-LDP synchronization for all non-loopback interfaces with a holddown timer of zero seconds:

Node-1@vyos:~$ show isis mpls ldp-sync

eth0
LDP-IGP Synchronization enabled: yes
holddown timer in seconds: 0
State: Sync achieved

8.9. Protocols 803

 VyOS Documentation, Release 1.5.x (circinus)

Enable IS-IS with Segment Routing (Experimental)

Node 1:

set interfaces loopback lo address '192.168.255.255/32'

set interfaces ethernet eth1 address '192.0.2.1/24'

set protocols isis interface eth1

set protocols isis interface lo
set protocols isis net '49.0001.1921.6825.5255.00'
set protocols isis segment-routing global-block high-label-value '599'
set protocols isis segment-routing global-block low-label-value '550'
set protocols isis segment-routing prefix 192.168.255.255/32 index value '1'
set protocols isis segment-routing prefix 192.168.255.255/32 index explicit-null
set protocols mpls interface 'eth1'

Node 2:

set interfaces loopback lo address '192.168.255.254/32'

set interfaces ethernet eth1 address '192.0.2.2/24'

set protocols isis interface eth1

set protocols isis interface lo
set protocols isis net '49.0001.1921.6825.5254.00'
set protocols isis segment-routing global-block high-label-value '599'
set protocols isis segment-routing global-block low-label-value '550'
set protocols isis segment-routing prefix 192.168.255.254/32 index value '2'
set protocols isis segment-routing prefix 192.168.255.254/32 index explicit-null
set protocols mpls interface 'eth1'

This gives us MPLS segment routing enabled and labels for far end loopbacks:

Node-1@vyos:~$ show mpls table

Inbound Label Type Nexthop Outbound Label
----------------------------------------------------------------------
552 SR (IS-IS) 192.0.2.2 IPv4 Explicit Null <-- Node-2␣
˓→loopback learned on Node-1

15000 SR (IS-IS) 192.0.2.2 implicit-null

15001 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null
15002 SR (IS-IS) 192.0.2.2 implicit-null
15003 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null

Node-2@vyos:~$ show mpls table

Inbound Label Type Nexthop Outbound Label
---------------------------------------------------------------------
551 SR (IS-IS) 192.0.2.1 IPv4 Explicit Null <-- Node-1 loopback␣
˓→learned on Node-2

15000 SR (IS-IS) 192.0.2.1 implicit-null

15001 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null
15002 SR (IS-IS) 192.0.2.1 implicit-null
15003 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null

Here is the routing tables showing the MPLS segment routing label operations:

8.9. Protocols 804

 VyOS Documentation, Release 1.5.x (circinus)

Node-1@vyos:~$ show ip route isis

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure

I 192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:07:48

I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, label IPv4 Explicit Null, weight 1,␣
˓→00:03:39

Node-2@vyos:~$ show ip route isis

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure

I 192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:07:46

I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, label IPv4 Explicit Null, weight 1,␣
˓→00:03:43

8.9.7 MPLS

MPLS (Multi-Protocol Label Switching) is a packet forwarding paradigm which differs from regular IP forwarding.
Instead of IP addresses being used to make the decision on finding the exit interface, a router will instead use an exact
match on a 32 bit/4 byte header called the MPLS label. This label is inserted between the ethernet (layer 2) header
and the IP (layer 3) header. One can statically or dynamically assign label allocations, but we will focus on dynamic
allocation of labels using some sort of label distribution protocol (such as the aptly named Label Distribution Protocol
/ LDP, Resource Reservation Protocol / RSVP, or Segment Routing through OSPF/ISIS). These protocols allow for
the creation of a unidirectional/unicast path called a labeled switched path (initialized as LSP) throughout the network
that operates very much like a tunnel through the network. An easy way of thinking about how an MPLS LSP actually
forwards traffic throughout a network is to think of a GRE tunnel. They are not the same in how they operate, but they
are the same in how they handle the tunneled packet. It would be good to think of MPLS as a tunneling technology
that can be used to transport many different types of packets, to aid in traffic engineering by allowing one to specify
paths throughout the network (using RSVP or SR), and to generally allow for easier intra/inter network transport of
data packets.
For more information on how MPLS label switching works, please go visit Wikipedia (MPLS).

Note: MPLS support in VyOS is not finished yet, and therefore its functionality is limited. Currently there is no support
for MPLS enabled VPN services such as L2VPNs and mVPNs. RSVP support is also not present as the underlying
routing stack (FRR) does not implement it. Currently VyOS implements LDP as described in RFC 5036; other LDP
standard are the following ones: RFC 6720, RFC 6667, RFC 5919, RFC 5561, RFC 7552, RFC 4447. Because MPLS
is already available (FRR also supports RFC 3031).

8.9. Protocols 805

 VyOS Documentation, Release 1.5.x (circinus)

Label Distribution Protocol

The MPLS architecture does not assume a single protocol to create MPLS paths. VyOS supports the Label Distribution
Protocol (LDP) as implemented by FRR, based on RFC 5036.
LDP (Label Distribution Protocol) is a TCP based MPLS signaling protocol that distributes labels creating MPLS label
switched paths in a dynamic manner. LDP is not a routing protocol, as it relies on other routing protocols for forwarding
decisions. LDP cannot bootstrap itself, and therefore relies on said routing protocols for communication with other
routers that use LDP.
In order to allow for LDP on the local router to exchange label advertisements with other routers, a TCP session will be
established between automatically discovered and statically assigned routers. LDP will try to establish a TCP session to
the transport address of other routers. Therefore for LDP to function properly please make sure the transport address
is shown in the routing table and reachable to traffic at all times.
It is highly recommended to use the same address for both the LDP router-id and the discovery transport address, but
for VyOS MPLS LDP to work both parameters must be explicitly set in the configuration.
Another thing to keep in mind with LDP is that much like BGP, it is a protocol that runs on top of TCP. It however does
not have an ability to do something like a refresh capability like BGPs route refresh capability. Therefore one might
have to reset the neighbor for a capability change or a configuration change to work.

Configuration Options

set protocols mpls interface <interface>

Use this command to enable MPLS processing on the interface you define.
set protocols mpls ldp interface <interface>
Use this command to enable LDP on the interface you define.
set protocols mpls ldp router-id <address>
Use this command to configure the IP address used as the LDP router-id of the local device.
set protocols mpls ldp discovery transport-ipv4-address <address>
set protocols mpls ldp discovery transport-ipv6-address <address>
Use this command to set the IPv4 or IPv6 transport-address used by LDP.
set protocols mpls ldp neighbor <address> password <password>
Use this command to configure authentication for LDP peers. Set the IP address of the LDP peer and a password
that should be shared in order to become neighbors.
set protocols mpls ldp neighbor <address> session-holdtime <seconds>
Use this command to configure a specific session hold time for LDP peers. Set the IP address of the LDP peer
and a session hold time that should be configured for it. You may have to reset the neighbor for this to work.
set protocols mpls ldp neighbor <address> ttl-security <disable | hop count>
Use this command to enable, disable, or specify hop count for TTL security for LDP peers. By default the value
is set to 255 (or max TTL).
set protocols mpls ldp discovery hello-ipv4-interval <seconds>
set protocols mpls ldp discovery hello-ipv4-holdtime <seconds>
set protocols mpls ldp discovery hello-ipv6-interval <seconds>
set protocols mpls ldp discovery hello-ipv6-holdtime <seconds>

8.9. Protocols 806

 VyOS Documentation, Release 1.5.x (circinus)

Use these commands if you would like to set the discovery hello and hold time parameters.
set protocols mpls ldp discovery session-ipv4-holdtime <seconds>
set protocols mpls ldp discovery session-ipv6-holdtime <seconds>
Use this command if you would like to set the TCP session hold time intervals.
set protocols mpls ldp import ipv4 import-filter filter-access-list <access list number>
set protocols mpls ldp import ipv6 import-filter filter-access-list6 <access list number>
Use these commands to control the importing of forwarding equivalence classes (FECs) for LDP from neighbors.
This would be useful for example on only accepting the labeled routes that are needed and not ones that are not
needed, such as accepting loopback interfaces and rejecting all others.
set protocols mpls ldp export ipv4 export-filter filter-access-list <access list number>
set protocols mpls ldp export ipv6 export-filter filter-access-list6 <access list number>
Use these commands to control the exporting of forwarding equivalence classes (FECs) for LDP to neighbors.
This would be useful for example on only announcing the labeled routes that are needed and not ones that are
not needed, such as announcing loopback interfaces and no others.
set protocols mpls ldp export ipv4 explicit-null
set protocols mpls ldp export ipv6 explicit-null
Use this command if you would like for the router to advertise FECs with a label of 0 for explicit null operations.
set protocols mpls ldp allocation ipv4 access-list <access list number>
set protocols mpls ldp allocation ipv6 access-list6 <access list number>
Use this command if you would like to control the local FEC allocations for LDP. A good example would be for
your local router to not allocate a label for everything. Just a label for what it’s useful. A good example would
be just a loopback label.
set protocols mpls ldp parameters cisco-interop-tlv
Use this command to use a Cisco non-compliant format to send and interpret the Dual-Stack capability TLV for
IPv6 LDP communications. This is related to RFC 7552.
set protocols mpls ldp parameters ordered-control
Use this command to use ordered label distribution control mode. FRR by default uses independent label dis-
tribution control mode for label distribution. This is related to RFC 5036.
set protocols mpls ldp parameters transport-prefer-ipv4
Use this command to prefer IPv4 for TCP peer transport connection for LDP when both an IPv4 and IPv6 LDP
address are configured on the same interface.
set protocols mpls ldp targeted-neighbor ipv4 enable
set protocols mpls ldp targeted-neighbor ipv6 enable
Use this command to enable targeted LDP sessions to the local router. The router will then respond to any
sessions that are trying to connect to it that are not a link local type of TCP connection.
set protocols mpls ldp targeted-neighbor ipv4 address <address>
set protocols mpls ldp targeted-neighbor ipv6 address <address>
Use this command to enable the local router to try and connect with a targeted LDP session to another router.
set protocols mpls ldp targeted-neighbor ipv4 hello-holdtime <seconds>

8.9. Protocols 807

 VyOS Documentation, Release 1.5.x (circinus)

set protocols mpls ldp targeted-neighbor ipv4 hello-interval <seconds>

set protocols mpls ldp targeted-neighbor ipv6 hello-holdtime <seconds>
set protocols mpls ldp targeted-neighbor ipv6 hello-interval <seconds>
Use these commands if you would like to set the discovery hello and hold time parameters for the targeted LDP
neighbors.

Sample configuration to setup LDP on VyOS

set protocols ospf area 0 network '192.168.255.252/32' <--- Routing␣

˓→for loopback

set protocols ospf area 0 network '192.168.0.5/32' <--- Routing␣

˓→for an interface connecting to the network

set protocols ospf parameters router-id '192.168.255.252' <--- Router␣

˓→ID setting for OSPF

set protocols mpls interface 'eth1' <--- Enable␣

˓→MPLS for an interface connecting to network

set protocols mpls ldp discovery transport-ipv4-address '192.168.255.252' <---␣

˓→Transport address for LDP for TCP sessions to connect to

set protocols mpls ldp interface 'eth1' <--- Enable␣

˓→LDP for an interface connecting to network

set protocols mpls ldp interface 'lo' <--- Enable␣

˓→LDP on loopback for future services connectivity

set protocols mpls ldp router-id '192.168.255.252' <--- Router␣

˓→ID setting for LDP

set interfaces ethernet eth1 address '192.168.0.5/31' <---␣

˓→Interface IP for connecting to network

set interfaces loopback lo address '192.168.255.252/32' <---␣

˓→Interface loopback IP for router ID and other uses

Operational Mode Commands

When LDP is working, you will be able to see label information in the outcome of show ip route. Besides that
information, there are also specific show commands for LDP:

Show

show mpls ldp binding

Use this command to see the Label Information Base.
show mpls ldp discovery
Use this command to see discovery hello information
show mpls ldp interface
Use this command to see LDP interface information
show mpls ldp neighbor
Use this command to see LDP neighbor information
show mpls ldp neighbor detail

8.9. Protocols 808

 VyOS Documentation, Release 1.5.x (circinus)

Use this command to see detailed LDP neighbor information

Reset

reset mpls ldp neighbor <IPv4 or IPv6 address>

Use this command to reset an LDP neighbor/TCP session that is established

8.9.8 Segment Routing

Segment Routing (SR) is a network architecture that is similar to source-routing . In this architecture, the ingress
router adds a list of segments, known as SIDs, to the packet as it enters the network. These segments represent different
portions of the network path that the packet will take.
The SR segments are portions of the network path taken by the packet, and are called SIDs. At each node, the first SID
of the list is read, executed as a forwarding function, and may be popped to let the next node read the next SID of the
list. The SID list completely determines the path where the packet is forwarded.
Segment Routing can be applied to an existing MPLS-based data plane and defines a control plane network architecture.
In MPLS networks, segments are encoded as MPLS labels and are added at the ingress router. These MPLS labels are
then exchanged and populated by Interior Gateway Protocols (IGPs) like IS-IS or OSPF which are running on most
ISPs.

Note: Segment routing defines a control plane network architecture and can be applied to an existing MPLS based
dataplane. In the MPLS networks, segments are encoded as MPLS labels and are imposed at the ingress router. MPLS
labels are exchanged and populated by IGPs like IS-IS.Segment Routing as per RFC8667 for MPLS dataplane. It
supports IPv4, IPv6 and ECMP and has been tested against Cisco & Juniper routers.however,this deployment is still
EXPERIMENTAL for FRR.

IS-IS SR Configuration

Segment routing (SR) is used by the IGP protocols to interconnect network devices, below configuration shows how to
enable SR on IS-IS:

Note: Known limitations:

No support for level redistribution (L1 to L2 or L2 to L1)
No support for binding SID
No support for SRLB
Only one SRGB and default SPF Algorithm is supported

set protocols isis segment-routing global-block high-label-value <label-value>

Set the Segment Routing Global Block i.e. the label range used by MPLS to store label in the MPLS FIB for
Prefix SID. Note that the block size may not exceed 65535.
set protocols isis segment-routing global-block low-label-value <label-value>
Set the Segment Routing Global Block i.e. the low label range used by MPLS to store label in the MPLS FIB
for Prefix SID. Note that the block size may not exceed 65535.

8.9. Protocols 809

 VyOS Documentation, Release 1.5.x (circinus)

set protocols isis segment-routing local-block high-label-value <label-value>

Set the Segment Routing Local Block i.e. the label range used by MPLS to store label in the MPLS FIB for Prefix
SID. Note that the block size may not exceed 65535.Segment Routing Local Block, The negative command
always unsets both.
set protocols isis segment-routing local-block <low-label-value <label-value>
Set the Segment Routing Local Block i.e. the low label range used by MPLS to store label in the MPLS FIB
for Prefix SID. Note that the block size may not exceed 65535.Segment Routing Local Block, The negative
command always unsets both.
set protocols isis segment-routing maximum-label-depth <1-16>
Set the Maximum Stack Depth supported by the router. The value depend of the MPLS dataplane.
set protocols isis segment-routing prefix <address> index value <0-65535>
A segment ID that contains an IP address prefix calculated by an IGP in the service provider core network.
Prefix SIDs are globally unique, this value indentify it
set protocols isis segment-routing prefix <address> index <no-php-flag | explicit-null|
n-flag-clear>
this option allows to configure prefix-sid on SR. The ‘no-php-flag’ means NO Penultimate Hop Popping that
allows SR node to request to its neighbor to not pop the label. The ‘explicit-null’ flag allows SR node to request
to its neighbor to send IP packet with the EXPLICIT-NULL label. The ‘n-flag-clear’ option can be used to
explicitly clear the Node flag that is set by default for Prefix-SIDs associated to loopback addresses. This option
is necessary to configure Anycast-SIDs.
show isis segment-routing node
Show detailed information about all learned Segment Routing Nodes
show isis route prefix-sid
Show detailed information about prefix-sid and label learned

Note: more information related IGP - IS-IS

OSPF SR Configuration

Segment routing (SR) is used by the IGP protocols to interconnect network devices, below configuration shows how to
enable SR on OSPF:
set protocols ospf parameters opaque-lsa
Enable the Opaque-LSA capability (rfc2370), necessary to transport label on IGP
set protocols ospf segment-routing global-block high-label-value <label-value>
Set the Segment Routing Global Block i.e. the label range used by MPLS to store label in the MPLS FIB for
Prefix SID. Note that the block size may not exceed 65535.
set protocols ospf segment-routing global-block low-label-value <label-value>
Set the Segment Routing Global Block i.e. the low label range used by MPLS to store label in the MPLS FIB
for Prefix SID. Note that the block size may not exceed 65535.
set protocols ospf segment-routing local-block high-label-value <label-value>

8.9. Protocols 810

 VyOS Documentation, Release 1.5.x (circinus)

Set the Segment Routing Local Block i.e. the label range used by MPLS to store label in the MPLS FIB for Prefix
SID. Note that the block size may not exceed 65535.Segment Routing Local Block, The negative command
always unsets both.
set protocols ospf segment-routing local-block <low-label-value <label-value>
Set the Segment Routing Local Block i.e. the low label range used by MPLS to store label in the MPLS FIB
for Prefix SID. Note that the block size may not exceed 65535.Segment Routing Local Block, The negative
command always unsets both.
set protocols ospf segment-routing maximum-label-depth <1-16>
Set the Maximum Stack Depth supported by the router. The value depend of the MPLS dataplane.
set protocols ospf segment-routing prefix <address> index value <0-65535>
A segment ID that contains an IP address prefix calculated by an IGP in the service provider core network.
Prefix SIDs are globally unique, this value indentify it
set protocols ospf segment-routing prefix <address> index <no-php-flag | explicit-null|
n-flag-clear>
this option allows to configure prefix-sid on SR. The ‘no-php-flag’ means NO Penultimate Hop Popping that
allows SR node to request to its neighbor to not pop the label. The ‘explicit-null’ flag allows SR node to request
to its neighbor to send IP packet with the EXPLICIT-NULL label. The ‘n-flag-clear’ option can be used to
explicitly clear the Node flag that is set by default for Prefix-SIDs associated to loopback addresses. This option
is necessary to configure Anycast-SIDs.

Note: more information related IGP - OSPF

Configuration Example

we described the configuration SR ISIS / SR OSPF using 2 connected with them to share label information.

Enable IS-IS with Segment Routing (Experimental)

Node 1:

set interfaces loopback lo address '192.168.255.255/32'

set interfaces ethernet eth1 address '192.0.2.1/24'

set protocols isis interface eth1

set protocols isis interface lo
set protocols isis net '49.0001.1921.6825.5255.00'
set protocols isis segment-routing global-block high-label-value '599'
set protocols isis segment-routing global-block low-label-value '550'
set protocols isis segment-routing prefix 192.168.255.255/32 index value '1'
set protocols isis segment-routing prefix 192.168.255.255/32 index explicit-null
set protocols mpls interface 'eth1'

Node 2:

set interfaces loopback lo address '192.168.255.254/32'

set interfaces ethernet eth1 address '192.0.2.2/24'
(continues on next page)

8.9. Protocols 811

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set protocols isis interface eth1

set protocols isis interface lo
set protocols isis net '49.0001.1921.6825.5254.00'
set protocols isis segment-routing global-block high-label-value '599'
set protocols isis segment-routing global-block low-label-value '550'
set protocols isis segment-routing prefix 192.168.255.254/32 index value '2'
set protocols isis segment-routing prefix 192.168.255.254/32 index explicit-null
set protocols mpls interface 'eth1'

This gives us MPLS segment routing enabled and labels for far end loopbacks:

Node-1@vyos:~$ show mpls table

Inbound Label Type Nexthop Outbound Label
----------------------------------------------------------------------
552 SR (IS-IS) 192.0.2.2 IPv4 Explicit Null <-- Node-2␣
˓→loopback learned on Node-1

15000 SR (IS-IS) 192.0.2.2 implicit-null

15001 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null
15002 SR (IS-IS) 192.0.2.2 implicit-null
15003 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null

Node-2@vyos:~$ show mpls table

Inbound Label Type Nexthop Outbound Label
---------------------------------------------------------------------
551 SR (IS-IS) 192.0.2.1 IPv4 Explicit Null <-- Node-1 loopback␣
˓→learned on Node-2

15000 SR (IS-IS) 192.0.2.1 implicit-null

15001 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null
15002 SR (IS-IS) 192.0.2.1 implicit-null
15003 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null

Here is the routing tables showing the MPLS segment routing label operations:

Node-1@vyos:~$ show ip route isis

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure

I 192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:07:48

I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, label IPv4 Explicit Null, weight 1,␣
˓→00:03:39

Node-2@vyos:~$ show ip route isis

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
(continues on next page)

8.9. Protocols 812

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

t - trapped, o - offload failure

I 192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:07:46

I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, label IPv4 Explicit Null, weight 1,␣
˓→00:03:43

Enable OSPF with Segment Routing (Experimental):

Node 1

set interfaces loopback lo address 10.1.1.1/32

set interfaces ethernet eth0 address 192.168.0.1/24
set protocols ospf area 0 network '192.168.0.0/24'
set protocols ospf area 0 network '10.1.1.1/32'
set protocols ospf parameters opaque-lsa
set protocols ospf parameters router-id '10.1.1.1'
set protocols ospf segment-routing global-block high-label-value '1100'
set protocols ospf segment-routing global-block low-label-value '1000'
set protocols ospf segment-routing prefix 10.1.1.1/32 index explicit-null
set protocols ospf segment-routing prefix 10.1.1.1/32 index value '1'

Node 2

set interfaces loopback lo address 10.1.1.2/32

set interfaces ethernet eth0 address 192.168.0.2/24
set protocols ospf area 0 network '192.168.0.0/24'
set protocols ospf area 0 network '10.1.1.2/32'
set protocols ospf parameters opaque-lsa
set protocols ospf parameters router-id '10.1.1.2'
set protocols ospf segment-routing global-block high-label-value '1100'
set protocols ospf segment-routing global-block low-label-value '1000'
set protocols ospf segment-routing prefix 10.1.1.2/32 index explicit-null
set protocols ospf segment-routing prefix 10.1.1.2/32 index value '2'

This gives us MPLS segment routing enabled and labels for far end loopbacks:

Node-1@vyos:~$ show mpls table

Inbound Label Type Nexthop Outbound Label
-----------------------------------------------------------
1002 SR (OSPF) 192.168.0.2 IPv4 Explicit Null <-- Node-2 loopback learned␣
˓→on Node-1

15000 SR (OSPF) 192.168.0.2 implicit-null

15001 SR (OSPF) 192.168.0.2 implicit-null

Node-2@vyos:~$ show mpls table

Inbound Label Type Nexthop Outbound Label
-----------------------------------------------------------
1001 SR (OSPF) 192.168.0.1 IPv4 Explicit Null <-- Node-1 loopback learned␣
˓→on Node-2

15000 SR (OSPF) 192.168.0.1 implicit-null

15001 SR (OSPF) 192.168.0.1 implicit-null

8.9. Protocols 813

 VyOS Documentation, Release 1.5.x (circinus)

Here is the routing tables showing the MPLS segment routing label operations:
Node-1@vyos:~$ show ip route ospf
Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure

O 10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:03:43

O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, label IPv4 Explicit Null, weight 1,␣
˓→00:03:32

O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:43

Node-2@vyos:~$ show ip route ospf

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure

O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, label IPv4 Explicit Null, weight 1,␣
˓→00:03:36

O 10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:03:51

O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:51

8.9.9 OSPF

OSPF (Open Shortest Path First) is a routing protocol for Internet Protocol (IP) networks. It uses a link state routing
(LSR) algorithm and falls into the group of interior gateway protocols (IGPs), operating within a single autonomous
system (AS). It is defined as OSPF Version 2 in RFC 2328 (1998) for IPv4. Updates for IPv6 are specified as OSPF
Version 3 in RFC 5340 (2008). OSPF supports the CIDR (Classless Inter-Domain Routing) addressing model.
OSPF is a widely used IGP in large enterprise networks.

OSPFv2 (IPv4)

Configuration

General

VyOS does not have a special command to start the OSPF process. The OSPF process starts when the first ospf enabled
interface is configured.
set protocols ospf area <number> network <A.B.C.D/M>
This command specifies the OSPF enabled interface(s). If the interface has an address from defined range then
the command enables OSPF on this interface so router can provide network information to the other ospf routers
via this interface.
This command is also used to enable the OSPF process. The area number can be specified in decimal notation
in the range from 0 to 4294967295. Or it can be specified in dotted decimal notation similar to ip address.

8.9. Protocols 814

 VyOS Documentation, Release 1.5.x (circinus)

Prefix length in interface must be equal or bigger (i.e. smaller network) than prefix length in network state-
ment. For example statement above doesn’t enable ospf on interface with address 192.168.1.1/23, but it does on
interface with address 192.168.1.129/25.
In some cases it may be more convenient to enable OSPF on a per interface/subnet basis set protocols ospf
interface <interface> area <x.x.x.x | x>
set protocols ospf auto-cost reference-bandwidth <number>
This command sets the reference bandwidth for cost calculations, where bandwidth can be in range from 1 to
4294967, specified in Mbits/s. The default is 100Mbit/s (i.e. a link of bandwidth 100Mbit/s or higher will have
a cost of 1. Cost of lower bandwidth links will be scaled with reference to this cost).
set protocols ospf parameters router-id <rid>
This command sets the router-ID of the OSPF process. The router-ID may be an IP address of the router, but
need not be – it can be any arbitrary 32bit number. However it MUST be unique within the entire OSPF domain
to the OSPF speaker – bad things will happen if multiple OSPF speakers are configured with the same router-ID!

Optional

set protocols ospf default-information originate [always] [metric <number>] [metric-type

<1|2>] [route-map <name>]
Originate an AS-External (type-5) LSA describing a default route into all external-routing capable areas, of the
specified metric and metric type. If the always keyword is given then the default is always advertised, even
when there is no default present in the routing table. The argument route-map specifies to advertise the default
route if the route map is satisfied.
set protocols ospf distance global <distance>
This command change distance value of OSPF globally. The distance range is 1 to 255.
set protocols ospf distance ospf <external|inter-area|intra-area> <distance>
This command change distance value of OSPF. The arguments are the distance values for external routes, inter-
area routes and intra-area routes respectively. The distance range is 1 to 255.

Note: Routes with a distance of 255 are effectively disabled and not installed into the kernel.

set protocols ospf log-adjacency-changes [detail]

This command allows to log changes in adjacency. With the optional detail argument, all changes in adjacency
status are shown. Without detail, only changes to full or regressions are shown.
set protocols ospf max-metric router-lsa <administrative|on-shutdown <seconds>|on-startup
<seconds>>
This enables RFC 3137 support, where the OSPF process describes its transit links in its router-LSA as having
infinite distance so that other routers will avoid calculating transit paths through the router while still being able
to reach networks through the router.
This support may be enabled administratively (and indefinitely) with the administrative command. It may
also be enabled conditionally. Conditional enabling of max-metric router-lsas can be for a period of seconds
after startup with the on-startup <seconds> command and/or for a period of seconds prior to shutdown with
the on-shutdown <seconds> command. The time range is 5 to 86400.
set protocols ospf parameters abr-type <cisco|ibm|shortcut|standard>

8.9. Protocols 815

 VyOS Documentation, Release 1.5.x (circinus)

This command selects ABR model. OSPF router supports four ABR models:
cisco – a router will be considered as ABR if it has several configured links to the networks in different areas
one of which is a backbone area. Moreover, the link to the backbone area should be active (working). ibm –
identical to “cisco” model but in this case a backbone area link may not be active. standard – router has several
active links to different areas. shortcut – identical to “standard” but in this model a router is allowed to use a
connected areas topology without involving a backbone area for inter-area connections.
Detailed information about “cisco” and “ibm” models differences can be found in RFC 3509. A “shortcut”
model allows ABR to create routes between areas based on the topology of the areas connected to this router
but not using a backbone area in case if non-backbone route will be cheaper. For more information about
“shortcut” model, see ospf-shortcut-abr-02.txt
set protocols ospf parameters rfc1583-compatibility
RFC 2328, the successor to RFC 1583, suggests according to section G.2 (changes) in section 16.4.1 a change
to the path preference algorithm that prevents possible routing loops that were possible in the old version of
OSPFv2. More specifically it demands that inter-area paths and intra-area backbone path are now of equal
preference but still both preferred to external paths.
This command should NOT be set normally.
set protocols ospf interface <interface> passive [disable]
This command specifies interface as passive. Passive interface advertises its address, but does not run the OSPF
protocol (adjacencies are not formed and hello packets are not generated).
The optional disable option allows to exclude interface from passive state. This command is used if the command
passive-interface default was configured.
set protocols ospf passive-interface default
This command specifies all interfaces as passive by default. Because this command changes the configuration
logic to a default passive; therefore, interfaces where router adjacencies are expected need to be configured with
the passive-interface-exclude command.
set protocols ospf maximum-paths <1-64>
Use this command to control the maximum number of equal cost paths to reach a specific destination. The upper
limit may differ if you change the value of MULTIPATH_NUM during compilation. The default is MULTI-
PATH_NUM (64).
set protocols ospf refresh timers <seconds>
The router automatically updates link-state information with its neighbors. Only an obsolete information is
updated which age has exceeded a specific threshold. This parameter changes a threshold value, which by
default is 1800 seconds (half an hour). The value is applied to the whole OSPF router. The timer range is 10 to
1800.
set protocols ospf timers throttle spf <delay|initial-holdtime|max-holdtime> <seconds>
This command sets the initial delay, the initial-holdtime and the maximum-holdtime between when SPF is
calculated and the event which triggered the calculation. The times are specified in milliseconds and must be in
the range of 0 to 600000 milliseconds. delay sets the initial SPF schedule delay in milliseconds. The default
value is 200 ms. initial-holdtime sets the minimum hold time between two consecutive SPF calculations.
The default value is 1000 ms. max-holdtime sets the maximum wait time between two consecutive SPF
calculations. The default value is 10000 ms.
set protocols ospf ldp-sync
This command will enable IGP-LDP synchronization globally for OSPF. This requires for LDP to be functional.
This is described in RFC 5443. By default all interfaces operational in OSPF are enabled for synchronization.
Loopbacks are exempt.

8.9. Protocols 816

 VyOS Documentation, Release 1.5.x (circinus)

set protocols ospf ldp-sync holddown <seconds>

This command will change the hold down value globally for IGP-LDP synchronization during conver-
gence/interface flap events.
set protocols ospf capability opaque
ospfd supports Opaque LSA RFC 2370 as partial support for MPLS Traffic Engineering LSAs. The opaque-lsa
capability must be enabled in the configuration.
An alternate command could be “mpls-te on” (Traffic Engineering)

Note: FRR offers only partial support for some of the routing protocol extensions that are used with MPLS-TE;
it does not support a complete RSVP-TE solution.

Area Configuration

set protocols ospf area <number> area-type stub

This command specifies the area to be a Stub Area. That is, an area where no router originates routes external
to OSPF and hence an area where all external routes are via the ABR(s). Hence, ABRs for such an area do not
need to pass AS-External LSAs (type-5) or ASBR-Summary LSAs (type-4) into the area. They need only pass
Network-Summary (type-3) LSAs into such an area, along with a default-route summary.
set protocols ospf area <number> area-type stub no-summary
This command specifies the area to be a Totally Stub Area. In addition to stub area limitations this area type
prevents an ABR from injecting Network-Summary (type-3) LSAs into the specified stub area. Only default
summary route is allowed.
set protocols ospf area <number> area-type stub default-cost <number>
This command sets the cost of default-summary LSAs announced to stubby areas. The cost range is 0 to
16777215.
set protocols ospf area <number> area-type nssa
This command specifies the area to be a Not So Stubby Area. External routing information is imported into
an NSSA in Type-7 LSAs. Type-7 LSAs are similar to Type-5 AS-external LSAs, except that they can only be
flooded into the NSSA. In order to further propagate the NSSA external information, the Type-7 LSA must be
translated to a Type-5 AS-external-LSA by the NSSA ABR.
set protocols ospf area <number> area-type nssa no-summary
This command specifies the area to be a NSSA Totally Stub Area. ABRs for such an area do not need to pass
Network-Summary (type-3) LSAs (except the default summary route), ASBR-Summary LSAs (type-4) and AS-
External LSAs (type-5) into the area. But Type-7 LSAs that convert to Type-5 at the NSSA ABR are allowed.
set protocols ospf area <number> area-type nssa default-cost <number>
This command sets the default cost of LSAs announced to NSSA areas. The cost range is 0 to 16777215.
set protocols ospf area <number> area-type nssa translate <always|candidate|never>
Specifies whether this NSSA border router will unconditionally translate Type-7 LSAs into Type-5 LSAs. When
role is Always, Type-7 LSAs are translated into Type-5 LSAs regardless of the translator state of other NSSA
border routers. When role is Candidate, this router participates in the translator election to determine if it will
perform the translations duties. When role is Never, this router will never translate Type-7 LSAs into Type-5
LSAs.

8.9. Protocols 817

 VyOS Documentation, Release 1.5.x (circinus)

set protocols ospf area <number> authentication plaintext-password

This command specifies that simple password authentication should be used for the given area. The password
must also be configured on a per-interface basis.
set protocols ospf area <number> authentication md5
This command specify that OSPF packets must be authenticated with MD5 HMACs within the given area.
Keying material must also be configured on a per-interface basis.
set protocols ospf area <number> range <A.B.C.D/M> [cost <number>]
This command summarizes intra area paths from specified area into one summary-LSA (Type-3) announced
to other areas. This command can be used only in ABR and ONLY router-LSAs (Type-1) and network-LSAs
(Type-2) (i.e. LSAs with scope area) can be summarized. AS-external-LSAs (Type-5) can’t be summarized -
their scope is AS. The optional argument cost specifies the aggregated link metric. The metric range is 0 to
16777215.
set protocols ospf area <number> range <A.B.C.D/M> not-advertise
This command instead of summarizing intra area paths filter them - i.e. intra area paths from this range are not
advertised into other areas. This command makes sense in ABR only.
set protocols ospf area <number> export-list <acl_number>
Filter Type-3 summary-LSAs announced to other areas originated from intra- area paths from specified area.
This command makes sense in ABR only.
set protocols ospf area <number> import-list <acl_number>
Same as export-list, but it applies to paths announced into specified area as Type-3 summary-LSAs. This com-
mand makes sense in ABR only.
set protocols ospf area <number> range <A.B.C.D/M> substitute <E.F.G.H/M>
One Type-3 summary-LSA with routing info <E.F.G.H/M> is announced into backbone area if defined area con-
tains at least one intra-area network (i.e. described with router-LSA or network-LSA) from range <A.B.C.D/M>.
This command makes sense in ABR only.
set protocols ospf area <number> shortcut <default|disable|enable>
This parameter allows to “shortcut” routes (non-backbone) for inter-area routes. There are three modes available
for routes shortcutting:
default – this area will be used for shortcutting only if ABR does not have a link to the backbone area or this
link was lost. enable – the area will be used for shortcutting every time the route that goes through it is cheaper.
disable – this area is never used by ABR for routes shortcutting.
set protocols ospf area <number> virtual-link <A.B.C.D>
Provides a backbone area coherence by virtual link establishment.
In general, OSPF protocol requires a backbone area (area 0) to be coherent and fully connected. I.e. any
backbone area router must have a route to any other backbone area router. Moreover, every ABR must have a
link to backbone area. However, it is not always possible to have a physical link to a backbone area. In this
case between two ABR (one of them has a link to the backbone area) in the area (not stub area) a virtual link is
organized.
<number> – area identifier through which a virtual link goes. <A.B.C.D> – ABR router-id with which a virtual
link is established. Virtual link must be configured on both routers.
Formally, a virtual link looks like a point-to-point network connecting two ABR from one area one of which
physically connected to a backbone area. This pseudo-network is considered to belong to a backbone area.

8.9. Protocols 818

 VyOS Documentation, Release 1.5.x (circinus)

Interface Configuration

set protocols ospf interface <interface> area <x.x.x.x | x>

Enable ospf on an interface and set associated area.
If you have a lot of interfaces, and/or a lot of subnets, then enabling OSPF via this command may result in a
slight performance improvement.
set protocols ospf interface <interface> authentication plaintext-password <text>
This command sets OSPF authentication key to a simple password. After setting, all OSPF packets are authen-
ticated. Key has length up to 8 chars.
Simple text password authentication is insecure and deprecated in favour of MD5 HMAC authentication.
set protocols ospf interface <interface> authentication md5 key-id <id> md5-key <text>
This command specifys that MD5 HMAC authentication must be used on this interface. It sets OSPF authen-
tication key to a cryptographic password. Key-id identifies secret key used to create the message digest. This
ID is part of the protocol and must be consistent across routers on a link. The key can be long up to 16 chars
(larger strings will be truncated), and is associated with the given key-id.
set protocols ospf interface <interface> bandwidth <number>
This command sets the interface bandwidth for cost calculations, where bandwidth can be in range from 1 to
100000, specified in Mbits/s.
set protocols ospf interface <interface> cost <number>
This command sets link cost for the specified interface. The cost value is set to router-LSA’s metric field and
used for SPF calculation. The cost range is 1 to 65535.
set protocols ospf interface <interface> dead-interval <number>
Set number of seconds for router Dead Interval timer value used for Wait Timer and Inactivity Timer. This value
must be the same for all routers attached to a common network. The default value is 40 seconds. The interval
range is 1 to 65535.
set protocols ospf interface <interface> hello-multiplier <number>
The hello-multiplier specifies how many Hellos to send per second, from 1 (every second) to 10 (every 100ms).
Thus one can have 1s convergence time for OSPF. If this form is specified, then the hello-interval advertised in
Hello packets is set to 0 and the hello-interval on received Hello packets is not checked, thus the hello-multiplier
need NOT be the same across multiple routers on a common link.
set protocols ospf interface <interface> hello-interval <number>
Set number of seconds for Hello Interval timer value. Setting this value, Hello packet will be sent every timer
value seconds on the specified interface. This value must be the same for all routers attached to a common
network. The default value is 10 seconds. The interval range is 1 to 65535.
set protocols ospf interface <interface> bfd
This command enables BFD on this OSPF link interface.
set protocols ospf interface <interface> mtu-ignore
This command disables check of the MTU value in the OSPF DBD packets. Thus, use of this command allows
the OSPF adjacency to reach the FULL state even though there is an interface MTU mismatch between two
OSPF routers.
set protocols ospf interface <interface> network <type>

8.9. Protocols 819

 VyOS Documentation, Release 1.5.x (circinus)

This command allows to specify the distribution type for the network connected to this interface:
broadcast – broadcast IP addresses distribution. non-broadcast – address distribution in NBMA networks
topology. point-to-multipoint – address distribution in point-to-multipoint networks. point-to-point – address
distribution in point-to-point networks.
set protocols ospf interface <interface> priority <number>
This command sets Router Priority integer value. The router with the highest priority will be more eligible to
become Designated Router. Setting the value to 0, makes the router ineligible to become Designated Router.
The default value is 1. The interval range is 0 to 255.
set protocols ospf interface <interface> retransmit-interval <number>
This command sets number of seconds for RxmtInterval timer value. This value is used when retransmitting
Database Description and Link State Request packets if acknowledge was not received. The default value is 5
seconds. The interval range is 3 to 65535.
set protocols ospf interface <interface> transmit-delay <number>
This command sets number of seconds for InfTransDelay value. It allows to set and adjust for each interface the
delay interval before starting the synchronizing process of the router’s database with all neighbors. The default
value is 1 seconds. The interval range is 3 to 65535.
set protocols ospf interface <interface> ldp-sync disable
This command disables IGP-LDP sync for this specific interface.
set protocols ospf interface <interface> ldp-sync holddown <seconds>
This command will change the hold down value for IGP-LDP synchronization during convergence/interface flap
events, but for this interface only.

External Route Summarisation

This feature summarises originated external LSAs (Type-5 and Type-7). Summary Route will be originated on-behalf
of all matched external LSAs.
set protocols ospf aggregation timer <seconds>
Configure aggregation delay timer interval.
Summarisation starts only after this delay timer expiry.
set protocols ospf summary-address x.x.x.x/y [tag (1-4294967295)]
This command enable/disables summarisation for the configured address range.
Tag is the optional parameter. If tag configured Summary route will be originated with the configured tag.
set protocols ospf summary-address x.x.x.x/y no-advertise
This command to ensure not advertise the summary lsa for the matched external LSAs.

8.9. Protocols 820

 VyOS Documentation, Release 1.5.x (circinus)

Graceful Restart

set protocols ospf graceful-restart [grace-period (1-1800)]

Configure Graceful Restart RFC 3623 restarting support. When enabled, the default grace period is 120 sec-
onds.
To perform a graceful shutdown, the FRR graceful-restart prepare ip ospf EXEC-level command
needs to be issued before restarting the ospfd daemon.
set protocols ospf graceful-restart helper enable [router-id A.B.C.D]
Configure Graceful Restart RFC 3623 helper support. By default, helper support is disabled for all neighbours.
This config enables/disables helper support on this router for all neighbours.
To enable/disable helper support for a specific neighbour, the router-id (A.B.C.D) has to be specified.
set protocols ospf graceful-restart helper no-strict-lsa-checking
By default strict-lsa-checking is configured then the helper will abort the Graceful Restart when a LSA change
occurs which affects the restarting router.
This command disables it.
set protocols ospf graceful-restart helper supported-grace-time
Supports as HELPER for configured grace period.
set protocols ospf graceful-restart helper planned-only
It helps to support as HELPER only for planned restarts.
By default, it supports both planned and unplanned outages.

Manual Neighbor Configuration

OSPF routing devices normally discover their neighbors dynamically by listening to the broadcast or multicast hello
packets on the network. Because an NBMA network does not support broadcast (or multicast), the device cannot
discover its neighbors dynamically, so you must configure all the neighbors statically.
set protocols ospf neighbor <A.B.C.D>
This command specifies the IP address of the neighboring device.
set protocols ospf neighbor <A.B.C.D> poll-interval <seconds>
This command specifies the length of time, in seconds, before the routing device sends hello packets out of the
interface before it establishes adjacency with a neighbor. The range is 1 to 65535 seconds. The default value is
60 seconds.
set protocols ospf neighbor <A.B.C.D> priority <number>
This command specifies the router priority value of the nonbroadcast neighbor associated with the IP address
specified. The default is 0. This keyword does not apply to point-to-multipoint interfaces.

8.9. Protocols 821

 VyOS Documentation, Release 1.5.x (circinus)

Redistribution Configuration

set protocols ospf redistribute <route source>

This command redistributes routing information from the given route source to the OSPF process. There are
five modes available for route source: bgp, connected, kernel, rip, static.
set protocols ospf default-metric <number>
This command specifies the default metric value of redistributed routes. The metric range is 0 to 16777214.
set protocols ospf redistribute <route source> metric <number>
This command specifies metric for redistributed routes from the given route source. There are five modes
available for route source: bgp, connected, kernel, rip, static. The metric range is 1 to 16777214.
set protocols ospf redistribute <route source> metric-type <1|2>
This command specifies metric type for redistributed routes. Difference between two metric types that metric
type 1 is a metric which is “commensurable” with inner OSPF links. When calculating a metric to the external
destination, the full path metric is calculated as a metric sum path of a router which had advertised this link plus
the link metric. Thus, a route with the least summary metric will be selected. If external link is advertised with
metric type 2 the path is selected which lies through the router which advertised this link with the least metric
despite of the fact that internal path to this router is longer (with more cost). However, if two routers advertised
an external link and with metric type 2 the preference is given to the path which lies through the router with
a shorter internal path. If two different routers advertised two links to the same external destimation but with
different metric type, metric type 1 is preferred. If type of a metric left undefined the router will consider these
external links to have a default metric type 2.
set protocols ospf redistribute <route source> route-map <name>
This command allows to use route map to filter redistributed routes from the given route source. There are five
modes available for route source: bgp, connected, kernel, rip, static.

Operational Mode Commands

show ip ospf neighbor

This command displays the neighbors status.

Neighbor ID Pri State Dead Time Address Interface ␣

˓→ RXmtL RqstL DBsmL
10.0.13.1 1 Full/DR 38.365s 10.0.13.1 eth0:10.0.13.3 ␣
˓→ 0 0 0
10.0.23.2 1 Full/Backup 39.175s 10.0.23.2 eth1:10.0.23.3 ␣
˓→ 0 0 0

show ip ospf neighbor detail

This command displays the neighbors information in a detailed form, not just a summary table.

Neighbor 10.0.13.1, interface address 10.0.13.1

In the area 0.0.0.0 via interface eth0
Neighbor priority is 1, State is Full, 5 state changes
Most recent state change statistics:
Progressive change 11m55s ago
DR is 10.0.13.1, BDR is 10.0.13.3
Options 2 *|-|-|-|-|-|E|-
(continues on next page)

8.9. Protocols 822

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Dead timer due in 34.854s
Database Summary List 0
Link State Request List 0
Link State Retransmission List 0
Thread Inactivity Timer on
Thread Database Description Retransmision off
Thread Link State Request Retransmission on
Thread Link State Update Retransmission on

Neighbor 10.0.23.2, interface address 10.0.23.2

In the area 0.0.0.1 via interface eth1
Neighbor priority is 1, State is Full, 4 state changes
Most recent state change statistics:
Progressive change 41.193s ago
DR is 10.0.23.3, BDR is 10.0.23.2
Options 2 *|-|-|-|-|-|E|-
Dead timer due in 35.661s
Database Summary List 0
Link State Request List 0
Link State Retransmission List 0
Thread Inactivity Timer on
Thread Database Description Retransmision off
Thread Link State Request Retransmission on
Thread Link State Update Retransmission on

show ip ospf neighbor <A.B.C.D>

This command displays the neighbors information in a detailed form for a neighbor whose IP address is specified.
show ip ospf neighbor <interface>
This command displays the neighbors status for a neighbor on the specified interface.
show ip ospf interface [<interface>]
This command displays state and configuration of OSPF the specified interface, or all interfaces if no interface
is given.
eth0 is up
ifindex 2, MTU 1500 bytes, BW 4294967295 Mbit <UP,BROADCAST,RUNNING,MULTICAST>
Internet Address 10.0.13.3/24, Broadcast 10.0.13.255, Area 0.0.0.0
MTU mismatch detection: enabled
Router ID 10.0.23.3, Network Type BROADCAST, Cost: 1
Transmit Delay is 1 sec, State Backup, Priority 1
Backup Designated Router (ID) 10.0.23.3, Interface Address 10.0.13.3
Multicast group memberships: OSPFAllRouters OSPFDesignatedRouters
Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5
Hello due in 4.470s
Neighbor Count is 1, Adjacent neighbor count is 1
eth1 is up
ifindex 3, MTU 1500 bytes, BW 4294967295 Mbit <UP,BROADCAST,RUNNING,MULTICAST>
Internet Address 10.0.23.3/24, Broadcast 10.0.23.255, Area 0.0.0.1
MTU mismatch detection: enabled
Router ID 10.0.23.3, Network Type BROADCAST, Cost: 1
Transmit Delay is 1 sec, State DR, Priority 1
(continues on next page)

8.9. Protocols 823

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Backup Designated Router (ID) 10.0.23.2, Interface Address 10.0.23.2
Saved Network-LSA sequence number 0x80000002
Multicast group memberships: OSPFAllRouters OSPFDesignatedRouters
Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5
Hello due in 4.563s
Neighbor Count is 1, Adjacent neighbor count is 1

show ip ospf route [detail]

This command displays the OSPF routing table, as determined by the most recent SPF calculation. With the
optional detail argument, each route item’s advertiser router and network attribute will be shown.

============ OSPF network routing table ============

N IA 10.0.12.0/24 [3] area: 0.0.0.0
via 10.0.13.3, eth0
N 10.0.13.0/24 [1] area: 0.0.0.0
directly attached to eth0
N IA 10.0.23.0/24 [2] area: 0.0.0.0
via 10.0.13.3, eth0
N 10.0.34.0/24 [2] area: 0.0.0.0
via 10.0.13.3, eth0

============ OSPF router routing table =============

R 10.0.23.3 [1] area: 0.0.0.0, ABR
via 10.0.13.3, eth0
R 10.0.34.4 [2] area: 0.0.0.0, ASBR
via 10.0.13.3, eth0

============ OSPF external routing table ===========

N E2 172.16.0.0/24 [2/20] tag: 0
via 10.0.13.3, eth0

The table consists of following data:

OSPF network routing table – includes a list of acquired routes for all accessible networks (or aggregated area ranges)
of OSPF system. “IA” flag means that route destination is in the area to which the router is not connected, i.e. it’s an
inter-area path. In square brackets a summary metric for all links through which a path lies to this network is specified.
“via” prefix defines a router-gateway, i.e. the first router on the way to the destination (next hop). OSPF router routing
table – includes a list of acquired routes to all accessible ABRs and ASBRs. OSPF external routing table – includes
a list of acquired routes that are external to the OSPF process. “E” flag points to the external link metric type (E1 –
metric type 1, E2 – metric type 2). External link metric is printed in the “<metric of the router which advertised the
link>/<link metric>” format.
show ip ospf border-routers
This command displays a table of paths to area boundary and autonomous system boundary routers.
show ip ospf database
This command displays a summary table with a database contents (LSA).

OSPF Router with ID (10.0.13.1)

Router Link States (Area 0.0.0.0)

(continues on next page)

8.9. Protocols 824

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Link ID ADV Router Age Seq# CkSum Link count
10.0.13.1 10.0.13.1 984 0x80000005 0xd915 1
10.0.23.3 10.0.23.3 1186 0x80000008 0xfe62 2
10.0.34.4 10.0.34.4 1063 0x80000004 0x4e3f 1

Net Link States (Area 0.0.0.0)

Link ID ADV Router Age Seq# CkSum

10.0.13.1 10.0.13.1 994 0x80000003 0x30bb
10.0.34.4 10.0.34.4 1188 0x80000001 0x9411

Summary Link States (Area 0.0.0.0)

Link ID ADV Router Age Seq# CkSum Route

10.0.12.0 10.0.23.3 1608 0x80000001 0x6ab6 10.0.12.0/24
10.0.23.0 10.0.23.3 981 0x80000003 0xe232 10.0.23.0/24

AS External Link States

Link ID ADV Router Age Seq# CkSum Route

172.16.0.0 10.0.34.4 1063 0x80000001 0xc40d E2 172.16.0.0/24 [0x0]

show ip ospf database <type> [A.B.C.D] [adv-router <A.B.C.D>|self-originate]

This command displays a database contents for a specific link advertisement type.
The type can be the following: asbr-summary, external, network, nssa-external, opaque-area, opaque-
as, opaque-link, router, summary.
[A.B.C.D] – link-state-id. With this specified the command displays portion of the network environ-
ment that is being described by the advertisement. The value entered depends on the advertisement’s
LS type. It must be entered in the form of an IP address.
adv-router <A.B.C.D> – router id, which link advertisements need to be reviewed.
self-originate displays only self-originated LSAs from the local router.
OSPF Router with ID (10.0.13.1)

Router Link States (Area 0.0.0.0)

LS age: 1213
Options: 0x2 : *|-|-|-|-|-|E|-
LS Flags: 0x3
Flags: 0x0
LS Type: router-LSA
Link State ID: 10.0.13.1
Advertising Router: 10.0.13.1
LS Seq Number: 80000009
Checksum: 0xd119
Length: 36

Number of Links: 1

Link connected to: a Transit Network

(continues on next page)

8.9. Protocols 825

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

(Link ID) Designated Router address: 10.0.13.1
(Link Data) Router Interface address: 10.0.13.1
Number of TOS metrics: 0
TOS 0 Metric: 1

show ip ospf database max-age

This command displays LSAs in MaxAge list.

Examples

Enable OSPF

Node 1

set interfaces loopback lo address 10.1.1.1/32

set interfaces ethernet eth0 address 192.168.0.1/24
set protocols ospf area 0 network 192.168.0.0/24
set protocols ospf area 0 network 10.1.1.1/32
set protocols ospf parameters router-id 10.1.1.1

Node 2

set interfaces loopback lo address 10.1.1.2/32

set interfaces ethernet eth0 address 192.168.0.2/24
set protocols ospf area 0 network 192.168.0.0/24
set protocols ospf area 0 network 10.1.1.2/32
set protocols ospf parameters router-id 10.1.1.2

Here’s the neighbors up:

Node-1@vyos:~$ show ip ospf neighbor

Neighbor ID Pri State Up Time Dead Time Address Interface ␣

˓→ RXmtL RqstL DBsmL
10.1.1.2 1 Full/DR 3m43s 36.094s 192.168.0.2 eth0:192.
˓→168.0.1 0 0 0

Node-2@vyos:~$ show ip ospf neighbor

Neighbor ID Pri State Up Time Dead Time Address Interface ␣

˓→ RXmtL RqstL DBsmL
10.1.1.1 1 Full/Backup 3m47s 31.736s 192.168.0.1 eth0:192.
˓→168.0.2 0 0 0

Here’s the routes:

Node-1@vyos:~$ show ip route ospf

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
(continues on next page)

8.9. Protocols 826

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure

O 10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:00:14

O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, weight 1, 00:00:07
O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:32

Node-2@vyos:~$ show ip route ospf

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure

O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, weight 1, 00:00:11

O 10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:00:04
O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:18

Enable OSPF with route redistribution of the loopback and default originate:

Node 1

set interfaces loopback lo address 10.1.1.1/32

set protocols ospf area 0 network 192.168.0.0/24
set protocols ospf default-information originate always
set protocols ospf default-information originate metric 10
set protocols ospf default-information originate metric-type 2
set protocols ospf log-adjacency-changes
set protocols ospf parameters router-id 10.1.1.1
set protocols ospf redistribute connected metric-type 2
set protocols ospf redistribute connected route-map CONNECT

set policy route-map CONNECT rule 10 action permit

set policy route-map CONNECT rule 10 match interface lo

Node 2

set interfaces loopback lo address 10.2.2.2/32

set protocols ospf area 0 network 192.168.0.0/24
set protocols ospf log-adjacency-changes
set protocols ospf parameters router-id 10.2.2.2
set protocols ospf redistribute connected metric-type 2
set protocols ospf redistribute connected route-map CONNECT

set policy route-map CONNECT rule 10 action permit

set policy route-map CONNECT rule 10 match interface lo

8.9. Protocols 827

 VyOS Documentation, Release 1.5.x (circinus)

Enable OSPF and IGP-LDP synchronization:

Node 1:

set interfaces loopback lo address 10.1.1.1/32

set interfaces ethernet eth0 address 192.168.0.1/24

set protocols ospf area 0 network '192.168.0.0/24'

set protocols ospf area 0 network '10.1.1.1/32'
set protocols ospf parameters router-id '10.1.1.1'
set protocols ospf ldp-sync

set protocols mpls interface eth0

set protocols mpls ldp discovery transport-ipv4-address 10.1.1.1
set protocols mpls ldp interface lo
set protocols mpls ldp interface eth0
set protocols mpls ldp parameters transport-prefer-ipv4
set protocols mpls ldp router-id 10.1.1.1

This gives us IGP-LDP synchronization for all non-loopback interfaces with a holddown timer of zero seconds:

Node-1@vyos:~$ show ip ospf mpls ldp-sync

eth0
LDP-IGP Synchronization enabled: yes
Holddown timer in seconds: 0
State: Sync achieved

Enable OSPF with Segment Routing (Experimental):

Node 1

set interfaces loopback lo address 10.1.1.1/32

set interfaces ethernet eth0 address 192.168.0.1/24

set protocols ospf area 0 network '192.168.0.0/24'

set protocols ospf area 0 network '10.1.1.1/32'
set protocols ospf parameters opaque-lsa
set protocols ospf parameters router-id '10.1.1.1'
set protocols ospf segment-routing global-block high-label-value '1100'
set protocols ospf segment-routing global-block low-label-value '1000'
set protocols ospf segment-routing prefix 10.1.1.1/32 index explicit-null
set protocols ospf segment-routing prefix 10.1.1.1/32 index value '1'

Node 2

set interfaces loopback lo address 10.1.1.2/32

set interfaces ethernet eth0 address 192.168.0.2/24

set protocols ospf area 0 network '192.168.0.0/24'

set protocols ospf area 0 network '10.1.1.2/32'
set protocols ospf parameters opaque-lsa
set protocols ospf parameters router-id '10.1.1.2'
(continues on next page)

8.9. Protocols 828

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set protocols ospf segment-routing global-block high-label-value '1100'
set protocols ospf segment-routing global-block low-label-value '1000'
set protocols ospf segment-routing prefix 10.1.1.2/32 index explicit-null
set protocols ospf segment-routing prefix 10.1.1.2/32 index value '2'

This gives us MPLS segment routing enabled and labels for far end loopbacks:

Node-1@vyos:~$ show mpls table

Inbound Label Type Nexthop Outbound Label
-----------------------------------------------------------
1002 SR (OSPF) 192.168.0.2 IPv4 Explicit Null <-- Node-2 loopback learned␣
˓→on Node-1

15000 SR (OSPF) 192.168.0.2 implicit-null

15001 SR (OSPF) 192.168.0.2 implicit-null

Node-2@vyos:~$ show mpls table

Inbound Label Type Nexthop Outbound Label
-----------------------------------------------------------
1001 SR (OSPF) 192.168.0.1 IPv4 Explicit Null <-- Node-1 loopback learned␣
˓→on Node-2

15000 SR (OSPF) 192.168.0.1 implicit-null

15001 SR (OSPF) 192.168.0.1 implicit-null

Here is the routing tables showing the MPLS segment routing label operations:

Node-1@vyos:~$ show ip route ospf

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure

O 10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:03:43

O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, label IPv4 Explicit Null, weight 1,␣
˓→00:03:32

O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:43

Node-2@vyos:~$ show ip route ospf

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure

O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, label IPv4 Explicit Null, weight 1,␣
˓→00:03:36

O 10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:03:51

O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:51

8.9. Protocols 829

 VyOS Documentation, Release 1.5.x (circinus)

OSPFv3 (IPv6)

Configuration

General

VyOS does not have a special command to start the OSPFv3 process. The OSPFv3 process starts when the first ospf
enabled interface is configured.
set protocols ospfv3 interface <interface> area <number>
This command specifies the OSPFv3 enabled interface. This command is also used to enable the OSPF process.
The area number can be specified in decimal notation in the range from 0 to 4294967295. Or it can be specified
in dotted decimal notation similar to ip address.
set protocols ospfv3 parameters router-id <rid>
This command sets the router-ID of the OSPFv3 process. The router-ID may be an IP address of the router,
but need not be – it can be any arbitrary 32bit number. However it MUST be unique within the entire OSPFv3
domain to the OSPFv3 speaker – bad things will happen if multiple OSPFv3 speakers are configured with the
same router-ID!

Optional

set protocols ospfv3 distance global <distance>

This command change distance value of OSPFv3 globally. The distance range is 1 to 255.
set protocols ospfv3 distance ospfv3 <external|inter-area|intra-area> <distance>
This command change distance value of OSPFv3. The arguments are the distance values for external routes,
inter-area routes and intra-area routes respectively. The distance range is 1 to 255.

Area Configuration

set protocols ospfv3 area <number> range <prefix>

This command summarizes intra area paths from specified area into one Type-3 Inter-Area Prefix LSA an-
nounced to other areas. This command can be used only in ABR.
set protocols ospfv3 area <number> range <prefix> not-advertise
This command instead of summarizing intra area paths filter them - i.e. intra area paths from this range are not
advertised into other areas. This command makes sense in ABR only.

Interface Configuration

set protocols ospfv3 interface <interface> ipv6 cost <number>

This command sets link cost for the specified interface. The cost value is set to router-LSA’s metric field and
used for SPF calculation. The cost range is 1 to 65535.
set protocols ospfv3 interface <interface> dead-interval <number>
Set number of seconds for router Dead Interval timer value used for Wait Timer and Inactivity Timer. This value
must be the same for all routers attached to a common network. The default value is 40 seconds. The interval
range is 1 to 65535.

8.9. Protocols 830

 VyOS Documentation, Release 1.5.x (circinus)

set protocols ospfv3 interface <interface> hello-interval <number>

Set number of seconds for Hello Interval timer value. Setting this value, Hello packet will be sent every timer
value seconds on the specified interface. This value must be the same for all routers attached to a common
network. The default value is 10 seconds. The interval range is 1 to 65535.
set protocols ospfv3 interface <interface> mtu-ignore
This command disables check of the MTU value in the OSPF DBD packets. Thus, use of this command allows
the OSPF adjacency to reach the FULL state even though there is an interface MTU mismatch between two
OSPF routers.
set protocols ospfv3 interface <interface> network <type>
This command allows to specify the distribution type for the network connected to this interface:
broadcast – broadcast IP addresses distribution. point-to-point – address distribution in point-to-point net-
works.
set protocols ospfv3 interface <interface> priority <number>
This command sets Router Priority integer value. The router with the highest priority will be more eligible to
become Designated Router. Setting the value to 0, makes the router ineligible to become Designated Router.
The default value is 1. The interval range is 0 to 255.
set protocols ospfv3 interface <interface> passive
This command specifies interface as passive. Passive interface advertises its address, but does not run the OSPF
protocol (adjacencies are not formed and hello packets are not generated).
set protocols ospfv3 interface <interface> retransmit-interval <number>
This command sets number of seconds for RxmtInterval timer value. This value is used when retransmitting
Database Description and Link State Request packets if acknowledge was not received. The default value is 5
seconds. The interval range is 3 to 65535.
set protocols ospfv3 interface <interface> transmit-delay <number>
This command sets number of seconds for InfTransDelay value. It allows to set and adjust for each interface the
delay interval before starting the synchronizing process of the router’s database with all neighbors. The default
value is 1 seconds. The interval range is 3 to 65535.

Graceful Restart

set protocols ospfv3 graceful-restart [grace-period (1-1800)]

Configure Graceful Restart RFC 3623 restarting support. When enabled, the default grace period is 120 sec-
onds.
To perform a graceful shutdown, the FRR graceful-restart prepare ip ospf EXEC-level command
needs to be issued before restarting the ospfd daemon.
set protocols ospfv3 graceful-restart helper enable [router-id A.B.C.D]
Configure Graceful Restart RFC 3623 helper support. By default, helper support is disabled for all neighbours.
This config enables/disables helper support on this router for all neighbours.
To enable/disable helper support for a specific neighbour, the router-id (A.B.C.D) has to be specified.
set protocols ospfv3 graceful-restart helper lsa-check-disable
By default strict-lsa-checking is configured then the helper will abort the Graceful Restart when a LSA change
occurs which affects the restarting router.

8.9. Protocols 831

 VyOS Documentation, Release 1.5.x (circinus)

This command disables it.

set protocols ospfv3 graceful-restart helper supported-grace-time
Supports as HELPER for configured grace period.
set protocols ospfv3 graceful-restart helper planned-only
It helps to support as HELPER only for planned restarts.
By default, it supports both planned and unplanned outages.

Redistribution Configuration

set protocols ospfv3 redistribute <route source>

This command redistributes routing information from the given route source to the OSPFv3 process. There are
five modes available for route source: bgp, connected, kernel, ripng, static.
set protocols ospf redistribute <route source> route-map <name>
This command allows to use route map to filter redistributed routes from given route source. There are five
modes available for route source: bgp, connected, kernel, ripng, static.

Operational Mode Commands

show ipv6 ospfv3 neighbor

This command displays the neighbors status.
show ipv6 ospfv3 neighbor detail
This command displays the neighbors information in a detailed form, not just a summary table.
show ipv6 ospfv3 neighbor drchoice
This command displays the neighbor DR choice information.
show ipv6 ospfv3 interface [prefix]|[<interface> [prefix]]
This command displays state and configuration of OSPF the specified interface, or all interfaces if no interface
is given. Whith the argument prefix this command shows connected prefixes to advertise.
show ipv6 ospfv3 route
This command displays the OSPF routing table, as determined by the most recent SPF calculation.
show ipv6 ospfv3 border-routers
This command displays a table of paths to area boundary and autonomous system boundary routers.
show ipv6 ospfv3 database
This command displays a summary table with a database contents (LSA).
show ipv6 ospfv3 database <type> [A.B.C.D] [adv-router <A.B.C.D>|self-originate]
This command displays a database contents for a specific link advertisement type.
show ipv6 ospfv3 redistribute
This command displays external information redistributed into OSPFv3

8.9. Protocols 832

 VyOS Documentation, Release 1.5.x (circinus)

Configuration Example

A typical configuration using 2 nodes.

Node 1:

set protocols ospfv3 interface eth1 area 0.0.0.0

set protocols ospfv3 area 0.0.0.0 range 2001:db8:1::/64
set protocols ospfv3 parameters router-id 192.168.1.1
set protocols ospfv3 redistribute connected

Node 2:

set protocols ospfv3 interface eth1 area 0.0.0.0

set protocols ospfv3 area 0.0.0.0 range 2001:db8:2::/64
set protocols ospfv3 parameters router-id 192.168.2.1
set protocols ospfv3 redistribute connected

To see the redistributed routes:

show ipv6 ospfv3 redistribute

Note: You cannot easily redistribute IPv6 routes via OSPFv3 on a WireGuard interface link. This requires you to
configure link-local addresses manually on the WireGuard interfaces, see T1483.

Example configuration for WireGuard interfaces:

Node 1

set interfaces wireguard wg01 address 'fe80::216:3eff:fe51:fd8c/64'

set interfaces wireguard wg01 address '192.168.0.1/24'
set interfaces wireguard wg01 peer ospf02 allowed-ips '::/0'
set interfaces wireguard wg01 peer ospf02 allowed-ips '0.0.0.0/0'
set interfaces wireguard wg01 peer ospf02 endpoint '10.1.1.101:12345'
set interfaces wireguard wg01 peer ospf02 pubkey 'ie3...='
set interfaces wireguard wg01 port '12345'
set protocols ospfv3 parameters router-id 192.168.1.1
set protocols ospfv3 interface 'wg01' area 0.0.0.0
set protocols ospfv3 interface 'lo' area 0.0.0.0

Node 2

set interfaces wireguard wg01 address 'fe80::216:3eff:fe0a:7ada/64'

set interfaces wireguard wg01 address '192.168.0.2/24'
set interfaces wireguard wg01 peer ospf01 allowed-ips '::/0'
set interfaces wireguard wg01 peer ospf01 allowed-ips '0.0.0.0/0'
set interfaces wireguard wg01 peer ospf01 endpoint '10.1.1.100:12345'
set interfaces wireguard wg01 peer ospf01 pubkey 'NHI...='
set interfaces wireguard wg01 port '12345'
set protocols ospfv3 parameters router-id 192.168.1.2
set protocols ospfv3 interface 'wg01' area 0.0.0.0
set protocols ospfv3 interface 'lo' area 0.0.0.0

Status

8.9. Protocols 833

 VyOS Documentation, Release 1.5.x (circinus)

vyos@ospf01:~$ sh ipv6 ospfv3 neighbor

Neighbor ID Pri DeadTime State/IfState Duration I/F[State]
192.168.0.2 1 00:00:37 Full/PointToPoint 00:18:03 wg01[PointToPoint]

vyos@ospf02# run sh ipv6 ospfv3 neighbor

Neighbor ID Pri DeadTime State/IfState Duration I/F[State]
192.168.0.1 1 00:00:39 Full/PointToPoint 00:19:44 wg01[PointToPoint]

8.9.10 PIM – Protocol Independent Multicast

VyOS supports PIM-SM (PIM Sparse Mode) as well as IGMP v2 and v3

PIM (Protocol Independent Multicast) must be configured in every interface of every participating router. Every router
must also have the location of the Rendevouz Point manually configured. Then, unidirectional shared trees rooted at
the Rendevouz Point will automatically be built for multicast distribution.
Traffic from multicast sources will go to the Rendezvous Point, and receivers will pull it from a shared tree using IGMP.
Multicast receivers will talk IGMP to their local router, so, besides having PIM configured in every router, IGMP must
also be configured in any router where there could be a multicast receiver locally connected.
VyOS supports both IGMP version 2 and version 3 (which allows source-specific multicast).

PIM-SM - PIM Sparse Mode

set protocols pim ecmp

If PIM has the a choice of ECMP nexthops for a particular RPF (Reverse Path Forwarding), PIM will cause S,G
flows to be spread out amongst the nexthops. If this command is not specified then the first nexthop found will
be used.
set protocols pim ecmp rebalance
If PIM is using ECMP and an interface goes down, cause PIM to rebalance all S,G flows across the remaining
nexthops. If this command is not configured PIM only modifies those S,G flows that were using the interface
that went down.
set protocols pim join-prune-interval <n>
Modify the join/prune interval that PIM uses to the new value. Time is specified in seconds.
The default time is 60 seconds.
If you enter a value smaller than 60 seconds be aware that this can and will affect convergence at scale.
set protocols pim keep-alive-timer <n>
Modify the time out value for a S,G flow from 1-65535 seconds. If choosing a value below 31 seconds be aware
that some hardware platforms cannot see data flowing in better than 30 second chunks.
set protocols pim packets <n>
When processing packets from a neighbor process the number of packets incoming at one time before moving
on to the next task.
The default value is 3 packets.
This command is only useful at scale when you can possibly have a large number of PIM control packets flowing.
set protocols pim register-accept-list <prefix-list>

8.9. Protocols 834

 VyOS Documentation, Release 1.5.x (circinus)

When PIM receives a register packet the source of the packet will be compared to the prefix-list specified, and
if a permit is received normal processing continues. If a deny is returned for the source address of the register
packet a register stop message is sent to the source.
set protocols pim register-suppress-time <n>
Modify the time that pim will register suppress a FHR will send register notifications to the kernel.
set protocols pim rp <address> group <group>
In order to use PIM, it is necessary to configure a RP (Rendezvous Point) for join messages to be sent to.
Currently the only methodology to do this is via static rendezvous point commands.
All routers in the PIM network must agree on these values.
The first ip address is the RP’s address and the second value is the matching prefix of group ranges covered.
set protocols pim rp keep-alive-timer <n>
Modify the time out value for a S,G flow from 1-65535 seconds at RP. The normal keepalive period for the
KAT(S,G) defaults to 210 seconds. However, at the RP, the keepalive period must be at least the Regis-
ter_Suppression_Time, or the RP may time out the (S,G) state before the next Null-Register arrives. Thus,
the KAT(S,G) is set to max(Keepalive_Period, RP_Keepalive_Period) when a Register-Stop is sent.
If choosing a value below 31 seconds be aware that some hardware platforms cannot see data flowing in better
than 30 second chunks.
See RFC 7761#section-4.1 for details.
set protocols pim no-v6-secondary
When sending PIM hello packets tell PIM to not send any v6 secondary addresses on the interface. This infor-
mation is used to allow PIM to use v6 nexthops in it’s decision for RPF lookup if this option is not set (default).
set protocols pim spt-switchover infinity-and-beyond [prefix-list <list>]
On the last hop router if it is desired to not switch over to the SPT tree configure this command.
Optional parameter prefix-list can be use to control which groups to switch or not switch. If a group is PERMIT
as per the prefix-list, then the SPT switchover does not happen for it and if it is DENY, then the SPT switchover
happens.
set protocols pim ssm prefix-list <list>
Specify a range of group addresses via a prefix-list that forces PIM to never do SSM over.

Interface specific commands

set protocols pim interface <interface> bfd [profile <name>]

Automatically create BFD session for each RIP peer discovered in this interface. When the BFD session monitor
signalize that the link is down the RIP peer is removed and all the learned routes associated with that peer are
removed.
If optional profile parameter is used, select a BFD profile for the BFD sessions created via this interface.
set protocols pim interface <interface> dr-priority <n>
Set the DR (Designated Router) Priority for the interface. This command is useful to allow the user to influence
what node becomes the DR for a LAN segment.
set protocols pim interface <interface> hello <n>
Set the PIM hello and hold interval for a interface.

8.9. Protocols 835

 VyOS Documentation, Release 1.5.x (circinus)

set protocols pim interface <interface> no-bsm

Tell PIM that we would not like to use this interface to process bootstrap messages.
set protocols pim interface <interface> no-unicast-bsm
Tell PIM that we would not like to use this interface to process unicast bootstrap messages.
set protocols pim interface <interface> passive
Disable sending and receiving PIM control packets on the interface.
set protocols pim interface <interface> source-address <ip-address>
If you have multiple addresses configured on a particular interface and would like PIM to use a specific
source address associated with that interface.

IGMP - Internet Group Management Protocol)

set protocols pim igmp watermark-warning <n>

Configure watermark warning generation for an IGMP group limit. Generates warning once the configured
group limit is reached while adding new groups.

Interface specific commands

set protocols pim interface <interface> igmp join <multicast-address> source-address

<IP-address>
Use this command to allow the selected interface to join a multicast group defining the multicast address you
want to join and the source IP address too.
set protocols pim interface <interface> igmp query-interval <seconds>
Use this command to configure in the selected interface the IGMP host query interval (1-1800) in seconds that
PIM will use.
set protocols pim interface <interface> igmp query-max-response-time <n>
Use this command to configure in the selected interface the IGMP query response timeout value (10-250) in
deciseconds. If a report is not returned in the specified time, it will be assumed the (S,G) or (*,G) state RFC
7761#section-4.1 has timed out.
set protocols pim interface <interface> igmp version <version-number>
Use this command to define in the selected interface whether you choose IGMP version 2 or 3.
The default value is 3.

Example

In the following example we can see a basic multicast setup:

8.9. Protocols 836

 VyOS Documentation, Release 1.5.x (circinus)

Router 1

set interfaces ethernet eth2 address '172.16.0.2/24'

set interfaces ethernet eth1 address '100.64.0.1/24'
set protocols ospf area 0 network '172.16.0.0/24'
set protocols ospf area 0 network '100.64.0.0/24'
set protocols igmp interface eth1
set protocols pim interface eth1
set protocols pim interface eth2
set protocols pim rp address 172.16.255.1 group '224.0.0.0/4'

Router 3

set interfaces dummy dum0 address '172.16.255.1/24'

set interfaces ethernet eth0 address '172.16.0.1/24'
set interfaces ethernet eth1 address '172.16.1.1/24'
set protocols ospf area 0 network '172.16.0.0/24'
set protocols ospf area 0 network '172.16.255.0/24'
set protocols ospf area 0 network '172.16.1.0/24'
set protocols pim interface dum0
set protocols pim interface eth0
set protocols pim interface eth1
set protocols pim rp address 172.16.255.1 group '224.0.0.0/4'

Router 2

set interfaces ethernet eth1 address '10.0.0.1/24'

set interfaces ethernet eth2 address '172.16.1.2/24'
set protocols ospf area 0 network '10.0.0.0/24'
set protocols ospf area 0 network '172.16.1.0/24'
set protocols pim interface eth1
set protocols pim interface eth2
set protocols pim rp address 172.16.255.1 group '224.0.0.0/4'

8.9. Protocols 837

 VyOS Documentation, Release 1.5.x (circinus)

8.9.11 PIM6 - Protocol Independent Multicast for IPv6

VyOS facilitates IPv6 Multicast by supporting PIMv6 and MLD.

PIMv6 (Protocol Independent Multicast for IPv6) must be configured in every interface of every participating router.
Every router must also have the location of the Rendevouz Point manually configured. Then, unidirectional shared
trees rooted at the Rendevouz Point will automatically be built for multicast distribution.
Traffic from multicast sources will go to the Rendezvous Point, and receivers will pull it from a shared tree using MLD
(Multicast Listener Discovery).
Multicast receivers will talk MLD to their local router, so, besides having PIMv6 configured in every router, MLD must
also be configured in any router where there could be a multicast receiver locally connected.
VyOS supports both MLD version 1 and version 2 (which allows source-specific multicast).

Basic commands

These are the commands for a basic setup.

set protocols pim6 interface <interface-name>
Use this command to enable PIMv6 in the selected interface so that it can communicate with PIMv6 neighbors.
This command also enables MLD reports and query on the interface unless mld disable is configured.
set protocols pim6 interface <interface-name> mld disable
Disable MLD reports and query on the interface.

Tuning commands

You can also tune multicast with the following commands.

set protocols pim6 interface <interface-name> mld interval <seconds>
Use this command to configure in the selected interface the MLD host query interval (1-65535) in seconds that
PIM will use. The default value is 125 seconds.
set protocols pim6 interface <interface-name> mld join <multicast-address>
Use this command to allow the selected interface to join a multicast group.
set protocols pim6 interface <interface-name> mld join <multicast-address> source
<source-address>
Use this command to allow the selected interface to join a source-specific multicast group.
set protocols pim6 interface <interface-name> mld last-member-query-count <count>
Set the MLD last member query count. The default value is 2.
set protocols pim6 interface <interface-name> mld last-member-query-interval
<milliseconds>
Set the MLD last member query interval in milliseconds (100-6553500). The default value is 1000 milliseconds.
set protocols pim6 interface <interface-name> mld max-response-time <milliseconds>
Set the MLD query response timeout in milliseconds (100-6553500). The default value is 10000 milliseconds.
set protocols pim6 interface <interface-name> mld version <version-number>
Set the MLD version used on this interface. The default value is 2.

8.9. Protocols 838

 VyOS Documentation, Release 1.5.x (circinus)

Configuration Example

To enable MLD reports and query on interfaces eth0 and eth1:

set protocols pim6 interface eth0

set protocols pim6 interface eth1

The following configuration explicitly joins multicast group ff15::1234 on interface eth1 and source-specific multicast
group ff15::5678 with source address 2001:db8::1 on interface eth1:

set protocols pim6 interface eth0 mld join ff15::1234

set protocols pim6 interface eth1 mld join ff15::5678 source 2001:db8::1

8.9.12 RIP

RIP (Routing Information Protocol) is a widely deployed interior gateway protocol. RIP was developed in the 1970s
at Xerox Labs as part of the XNS routing protocol. RIP is a distance-vector protocol and is based on the Bellman-
Ford algorithms. As a distance-vector protocol, RIP router send updates to its neighbors periodically, thus allowing the
convergence to a known topology. In each update, the distance to any given network will be broadcast to its neighboring
router.
Supported versions of RIP are:
• RIPv1 as described in RFC 1058
• RIPv2 as described in RFC 2453

General Configuration

set protocols rip network <A.B.C.D/M>

This command enables RIP and sets the RIP enable interface by NETWORK. The interfaces which have ad-
dresses matching with NETWORK are enabled.
set protocols rip interface <interface>
This command specifies a RIP enabled interface by interface name. Both the sending and receiving of RIP
packets will be enabled on the port specified in this command.
set protocols rip neighbor <A.B.C.D>
This command specifies a RIP neighbor. When a neighbor doesn’t understand multicast, this command is used
to specify neighbors. In some cases, not all routers will be able to understand multicasting, where packets are
sent to a network or a group of addresses. In a situation where a neighbor cannot process multicast packets, it
is necessary to establish a direct link between routers.
set protocols rip passive-interface interface <interface>
This command sets the specified interface to passive mode. On passive mode interface, all receiving packets are
processed as normal and VyOS does not send either multicast or unicast RIP packets except to RIP neighbors
specified with neighbor command.
set protocols rip passive-interface interface default
This command specifies all interfaces to passive mode.

8.9. Protocols 839

 VyOS Documentation, Release 1.5.x (circinus)

Optional Configuration

set protocols rip default-distance <distance>

This command change the distance value of RIP. The distance range is 1 to 255.

Note: Routes with a distance of 255 are effectively disabled and not installed into the kernel.

set protocols rip network-distance <A.B.C.D/M> distance <distance>

This command sets default RIP distance to a specified value when the routes source IP address matches the
specified prefix.
set protocols rip network-distance <A.B.C.D/M> access-list <name>
This command can be used with previous command to sets default RIP distance to specified value when the
route source IP address matches the specified prefix and the specified access-list.
set protocols rip default-information originate
This command generate a default route into the RIP.
set protocols rip distribute-list access-list <in|out> <number>
This command can be used to filter the RIP path using access lists. in and out this is the direction in which the
access lists are applied.
set protocols rip distribute-list interface <interface> access-list <in|out> <number>
This command allows you apply access lists to a chosen interface to filter the RIP path.
set protocols rip distribute-list prefix-list <in|out> <name>
This command can be used to filter the RIP path using prefix lists. in and out this is the direction in which the
prefix lists are applied.
set protocols rip distribute-list interface <interface> prefix-list <in|out> <name>
This command allows you apply prefix lists to a chosen interface to filter the RIP path.
set protocols rip route <A.B.C.D/M>
This command is specific to FRR and VyOS. The route command makes a static route only inside RIP. This
command should be used only by advanced users who are particularly knowledgeable about the RIP protocol.
In most cases, we recommend creating a static route in VyOS and redistributing it in RIP using redistribute
static.
set protocols rip timers update <seconds>
This command specifies the update timer. Every update timer seconds, the RIP process is awakened to send an
unsolicited response message containing the complete routing table to all neighboring RIP routers. The time
range is 5 to 2147483647. The default value is 30 seconds.
set protocols rip timers timeout <seconds>
This command specifies the timeout timer. Upon expiration of the timeout, the route is no longer valid; however,
it is retained in the routing table for a short time so that neighbors can be notified that the route has been dropped.
The time range is 5 to 2147483647. The default value is 180 seconds.
set protocols rip timers garbage-collection <seconds>
This command specifies the garbage-collection timer. Upon expiration of the garbage-collection timer, the route
is finally removed from the routing table. The time range is 5 to 2147483647. The default value is 120 seconds.

8.9. Protocols 840

 VyOS Documentation, Release 1.5.x (circinus)

Redistribution Configuration

set protocols rip redistribute <route source>

This command redistributes routing information from the given route source into the RIP tables. There are five
modes available for route source: bgp, connected, kernel, ospf, static.
set protocols rip redistribute <route source> metric <metric>
This command specifies metric for redistributed routes from the given route source. There are five modes
available for route source: bgp, connected, kernel, ospf, static. The metric range is 1 to 16.
set protocols rip redistribute <route source> route-map <name>
This command allows to use route map to filter redistributed routes from the given route source. There are five
modes available for route source: bgp, connected, kernel, ospf, static.
set protocols rip default-metric <metric>
This command modifies the default metric (hop count) value for redistributed routes. The metric range
is 1 to 16. The default value is 1. This command does not affect connected route even if it is redis-
tributed by redistribute connected. To modify connected routes metric value, please use redistribute
connected metric.

Interfaces Configuration

set interfaces <inttype> <intname> ip rip authentication plaintext-password <text>

This command sets the interface with RIP simple password authentication. This command also sets authenti-
cation string. The string must be shorter than 16 characters.
set interfaces <inttype> <intname> ip rip authentication md5 <id> password <text>
This command sets the interface with RIP MD5 authentication. This command also sets MD5 Key. The key
must be shorter than 16 characters.
set interfaces <inttype> <intname> ip rip split-horizon disable
This command disables split-horizon on the interface. By default, VyOS does not advertise RIP routes out the
interface over which they were learned (split horizon).3
set interfaces <inttype> <intname> ip rip split-horizon poison-reverse
This command enables poison-reverse on the interface. If both poison reverse and split horizon are enabled,
then VyOS advertises the learned routes as unreachable over the interface on which the route was learned.

Operational Mode Commands

show ip rip
This command displays RIP routes.

Codes: R - RIP, C - connected, S - Static, O - OSPF, B - BGP

Sub-codes:
(n) - normal, (s) - static, (d) - default, (r) - redistribute,
(i) - interface

Network Next Hop Metric From Tag Time

C(i) 10.0.12.0/24 0.0.0.0 1 self 0
(continues on next page)

8.9. Protocols 841

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

C(i) 10.0.13.0/24 0.0.0.0 1 self 0
R(n) 10.0.23.0/24 10.0.12.2 2 10.0.12.2 0 02:53

show ip rip status

The command displays current RIP status. It includes RIP timer, filtering, version, RIP enabled interface and
RIP peer information.

Routing Protocol is "rip"

Sending updates every 30 seconds with +/-50%, next due in 11 seconds
Timeout after 180 seconds, garbage collect after 120 seconds
Outgoing update filter list for all interface is not set
Incoming update filter list for all interface is not set
Default redistribution metric is 1
Redistributing:
Default version control: send version 2, receive any version
Interface Send Recv Key-chain
eth0 2 1 2
eth2 2 1 2
Routing for Networks:
10.0.12.0/24
eth0
Routing Information Sources:
Gateway BadPackets BadRoutes Distance Last Update
10.0.12.2 0 0 120 00:00:11
Distance: (default is 120)

Configuration Example

Simple RIP configuration using 2 nodes and redistributing connected interfaces.

Node 1:

set interfaces loopback address 10.1.1.1/32

set protocols rip network 192.168.0.0/24
set protocols rip redistribute connected

Node 2:

set interfaces loopback address 10.2.2.2/32

set protocols rip network 192.168.0.0/24
set protocols rip redistribute connected

8.9. Protocols 842

 VyOS Documentation, Release 1.5.x (circinus)

8.9.13 RPKI

There are two types of Network Admins who deal with BGP, those who have created an international
incident and/or outage, and those who are lying
—tweet by EvilMog, 2020-02-21
RPKI (Resource Public Key Infrastructure) is a framework designed to secure the Internet routing infrastructure. It
associates BGP route announcements with the correct originating ASN which BGP routers can then use to check each
route against the corresponding ROA (Route Origin Authorisation) for validity. RPKI is described in RFC 6480.
A BGP-speaking router like VyOS can retrieve ROA information from RPKI “Relying Party software” (often just
called an “RPKI server” or “RPKI validator”) by using RTR (RPKI to Router) protocol. There are several open source
implementations to choose from, such as NLNetLabs’ Routinator (written in Rust), OpenBSD’s rpki-client (written in
C), and StayRTR (written in Go). The RTR protocol is described in RFC 8210.

Tip: If you are new to these routing security technologies then there is an excellent guide to RPKI by NLnet Labs
which will get you up to speed very quickly. Their documentation explains everything from what RPKI is to deploying
it in production. It also has some help and operational guidance including “What can I do about my route having an
Invalid state?”

Getting started

First you will need to deploy an RPKI validator for your routers to use. NLnet Labs provides a collection of software
you can compare and settle on one. Once your server is running you can start validating announcements.
Imported prefixes during the validation may have values:
valid
The prefix and ASN that originated it match a signed ROA. These are probably trustworthy route
announcements.
invalid
The prefix or prefix length and ASN that originated it doesn’t match any existing ROA. This could
be the result of a prefix hijack, or merely a misconfiguration, but should probably be treated as un-
trustworthy route announcements.
notfound
No ROA exists which covers that prefix. Unfortunately this is the case for about 40%-50% of the
prefixes which were announced to the DFZ (default-free zone) at the start of 2024.

Note: If you are responsible for the global addresses assigned to your network, please make sure that your prefixes
have ROAs associated with them to avoid being notfound by RPKI. For most ASNs this will involve publishing ROAs
via your RIR (Regional Internet Registry) (RIPE NCC, APNIC, ARIN, LACNIC, or AFRINIC), and is something you
are encouraged to do whenever you plan to announce addresses into the DFZ.
Particularly large networks may wish to run their own RPKI certificate authority and publication server instead of
publishing ROAs via their RIR. This is a subject far beyond the scope of VyOS’ documentation. Consider reading
about Krill if this is a rabbit hole you need or especially want to dive down.

8.9. Protocols 843

 VyOS Documentation, Release 1.5.x (circinus)

Features of the Current Implementation

In a nutshell, the current implementation provides the following features:

• The BGP router can connect to one or more RPKI cache servers to receive validated prefix to origin AS mappings.
Advanced failover can be implemented by server sockets with different preference values.
• If no connection to an RPKI cache server can be established after a pre-defined timeout, the router will process
routes without prefix origin validation. It still will try to establish a connection to an RPKI cache server in the
background.
• By default, enabling RPKI does not change best path selection. In particular, invalid prefixes will still be con-
sidered during best path selection. However, the router can be configured to ignore all invalid prefixes.
• Route maps can be configured to match a specific RPKI validation state. This allows the creation of local policies,
which handle BGP routes based on the outcome of the Prefix Origin Validation.
• Updates from the RPKI cache servers are directly applied and path selection is updated accordingly. (Soft re-
configuration must be enabled for this to work).

Configuration

set protocols rpki polling-period <1-86400>

Define the time interval to update the local cache
The default value is 300 seconds.
set protocols rpki expire-interval <600-172800>
Set the number of seconds the router waits until the router expires the cache.
The default value is 7200 seconds.
set protocols rpki retry-interval <1-7200>
Set the number of seconds the router waits until retrying to connect to the cache server.
The default value is 600 seconds.
set protocols rpki cache <address> port <port>
Defined the IPv4, IPv6 or FQDN and port number of the caching RPKI caching instance which is used.
This is a mandatory setting.
set protocols rpki cache <address> preference <preference>
Multiple RPKI caching instances can be supplied and they need a preference in which their result sets are used.
This is a mandatory setting.

8.9. Protocols 844

 VyOS Documentation, Release 1.5.x (circinus)

SSH

Connections to the RPKI caching server can not only be established by TCP using the RTR protocol but you can also
rely on a secure SSH session to the server. This provides transport integrity and confidentiality and it is a good idea
if your validation software supports it. To enable SSH, first you need to create an SSH client keypair using generate
ssh client-key /config/auth/id_rsa_rpki. Once your key is created you can setup the connection.
set protocols rpki cache <address> ssh username <user>
SSH username to establish an SSH connection to the cache server.
set protocols rpki cache <address> ssh private-key-file <filepath>
Local path that includes the private key file of the router.
set protocols rpki cache <address> ssh public-key-file <filepath>
Local path that includes the public key file of the router.

Note: When using SSH, private-key-file and public-key-file are mandatory options.

Example

We can build route-maps for import based on these states. Here is a simple RPKI configuration, where routinator is
the RPKI-validating “cache” server with ip 192.0.2.1:

set protocols rpki cache 192.0.2.1 port '3323'

set protocols rpki cache 192.0.2.1 preference '1'

Here is an example route-map to apply to routes learned at import. In this filter we reject prefixes with the state invalid,
and set a higher local-preference if the prefix is RPKI valid rather than merely notfound.

set policy route-map ROUTES-IN rule 10 action 'permit'

set policy route-map ROUTES-IN rule 10 match rpki 'valid'
set policy route-map ROUTES-IN rule 10 set local-preference '300'
set policy route-map ROUTES-IN rule 20 action 'permit'
set policy route-map ROUTES-IN rule 20 match rpki 'notfound'
set policy route-map ROUTES-IN rule 20 set local-preference '125'
set policy route-map ROUTES-IN rule 30 action 'deny'
set policy route-map ROUTES-IN rule 30 match rpki 'invalid'

Once your routers are configured to reject RPKI-invalid prefixes, you can test whether the configuration is working
correctly using Cloudflare’s test website. Keep in mind that in order for this to work, you need to have no default routes
or anything else that would still send traffic to RPKI-invalid destinations.

8.9. Protocols 845

 VyOS Documentation, Release 1.5.x (circinus)

8.9.14 Static

Static routes are manually configured routes, which, in general, cannot be updated dynamically from information VyOS
learns about the network topology from other routing protocols. However, if a link fails, the router will remove routes,
including static routes, from the RIPB (Routing Information Base) that used this interface to reach the next hop. In
general, static routes should only be used for very simple network topologies, or to override the behavior of a dynamic
routing protocol for a small number of routes. The collection of all routes the router has learned from its configuration
or from its dynamic routing protocols is stored in the RIB. Unicast routes are directly used to determine the forwarding
table used for unicast packet forwarding.

Static Routes

set protocols static route <subnet> next-hop <address>

Configure next-hop <address> for an IPv4 static route. Multiple static routes can be created.
set protocols static route <subnet> next-hop <address> disable
Disable this IPv4 static route entry.
set protocols static route <subnet> next-hop <address> distance <distance>
Defines next-hop distance for this route, routes with smaller administrative distance are elected prior to those
with a higher distance.
Range is 1 to 255, default is 1.

Note: Routes with a distance of 255 are effectively disabled and not installed into the kernel.

set protocols static route6 <subnet> next-hop <address>

Configure next-hop <address> for an IPv6 static route. Multiple static routes can be created.
set protocols static route6 <subnet> next-hop <address> disable
Disable this IPv6 static route entry.
set protocols static route6 <subnet> next-hop <address> distance <distance>
Defines next-hop distance for this route, routes with smaller administrative distance are elected prior to those
with a higher distance.
Range is 1 to 255, default is 1.

Note: Routes with a distance of 255 are effectively disabled and not installed into the kernel.

set protocols static route6 <subnet> next-hop <address> segments <segments>

It is possible to specify a static route for ipv6 prefixes using an SRv6 segments instruction. The / separator can
be used to specify multiple segment instructions.
Example:

set protocols static route6 2001:db8:1000::/36 next-hop 2001:db8:201::ffff segments

˓→'2001:db8:aaaa::7/2002::4/2002::3/2002::2'

8.9. Protocols 846

 VyOS Documentation, Release 1.5.x (circinus)

vyos@vyos:~$ show ipv6 route

Codes: K - kernel route, C - connected, S - static, R - RIPng,
O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table,
v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure
C>* 2001:db8:201::/64 is directly connected, eth0.201, 00:00:46
S>* 2001:db8:1000::/36 [1/0] via 2001:db8:201::ffff, eth0.201, seg6␣
˓→2001:db8:aaaa::7,2002::4,2002::3,2002::2, weight 1, 00:00:08

Interface Routes

set protocols static route <subnet> interface <interface>

Allows you to configure the next-hop interface for an interface-based IPv4 static route. <interface> will be the
next-hop interface where traffic is routed for the given <subnet>.
set protocols static route <subnet> interface <interface> disable
Disables interface-based IPv4 static route.
set protocols static route <subnet> interface <interface> distance <distance>
Defines next-hop distance for this route, routes with smaller administrative distance are elected prior to those
with a higher distance.
Range is 1 to 255, default is 1.
set protocols static route6 <subnet> interface <interface>
Allows you to configure the next-hop interface for an interface-based IPv6 static route. <interface> will be the
next-hop interface where traffic is routed for the given <subnet>.
set protocols static route6 <subnet> interface <interface> disable
Disables interface-based IPv6 static route.
set protocols static route6 <subnet> interface <interface> distance <distance>
Defines next-hop distance for this route, routes with smaller administrative distance are elected prior to those
with a higher distance.
Range is 1 to 255, default is 1.
set protocols static route6 <subnet> interface <interface> segments <segments>
It is possible to specify a static route for ipv6 prefixes using an SRv6 segments instruction. The / separator can
be used to specify multiple segment instructions.
Example:

set protocols static route6 2001:db8:1000::/36 interface eth0 segments

˓→'2001:db8:aaaa::7/2002::4/2002::3/2002::2'

8.9. Protocols 847

 VyOS Documentation, Release 1.5.x (circinus)

Blackhole

set protocols static route <subnet> blackhole

Use this command to configure a “black-hole” route on the router. A black-hole route is a route for which the
system silently discard packets that are matched. This prevents networks leaking out public interfaces, but it
does not prevent them from being used as a more specific route inside your network.
set protocols static route <subnet> blackhole distance <distance>
Defines blackhole distance for this route, routes with smaller administrative distance are elected prior to those
with a higher distance.
set protocols static route6 <subnet> blackhole
Use this command to configure a “black-hole” route on the router. A black-hole route is a route for which the
system silently discard packets that are matched. This prevents networks leaking out public interfaces, but it
does not prevent them from being used as a more specific route inside your network.
set protocols static route6 <subnet> blackhole distance <distance>
Defines blackhole distance for this route, routes with smaller administrative distance are elected prior to those
with a higher distance.

Alternate Routing Tables

TBD
Alternate routing tables are used with policy based routing by utilizing VRF.

8.9.15 ARP

ARP (Address Resolution Protocol) is a communication protocol used for discovering the link layer address, such as
a MAC address, associated with a given internet layer address, typically an IPv4 address. This mapping is a critical
function in the Internet protocol suite. ARP was defined in 1982 by RFC 826 which is Internet Standard STD 37.
In Internet Protocol Version 6 (IPv6) networks, the functionality of ARP is provided by the Neighbor Discovery Protocol
(NDP).
To manipulate or display ARP table entries, the following commands are implemented.

Configure

set protocols static arp interface <interface> address <host> mac <mac>
This will configure a static ARP entry always resolving <address> to <mac> for interface <interface>.
Example:

set protocols static arp interface eth0 address 192.0.2.1 mac 01:23:45:67:89:01

8.9. Protocols 848

 VyOS Documentation, Release 1.5.x (circinus)

Operation

show protocols static arp

Display all known ARP table entries spanning across all interfaces

vyos@vyos:~$ show protocols static arp

Address HWtype HWaddress Flags Mask Iface
10.1.1.1 ether 00:53:00:de:23:2e C eth1
10.1.1.100 ether 00:53:00:de:23:aa CM eth1

show protocols static arp interface eth1

Display all known ARP table entries on a given interface only (eth1):

vyos@vyos:~$ show protocols static arp interface eth1

Address HWtype HWaddress Flags Mask Iface
10.1.1.1 ether 00:53:00:de:23:2e C eth1
10.1.1.100 ether 00:53:00:de:23:aa CM eth1

8.10 Service

8.10.1 UDP Broadcast Relay

Certain vendors use broadcasts to identify their equipment within one ethernet segment. Unfortunately if you split your
network with multiple VLANs you loose the ability of identifying your equipment.
This is where “UDP broadcast relay” comes into play! It will forward received broadcasts to other configured networks.
Every UDP port which will be forward requires one unique ID. Currently we support 99 IDs!

Configuration

set service broadcast-relay id <n> description <description>

A description can be added for each and every unique relay ID. This is useful to distinguish between multiple
different ports/applications.
set service broadcast-relay id <n> interface <interface>
The interface used to receive and relay individual broadcast packets. If you want to receive/relay packets on
both eth1 and eth2 both interfaces need to be added.
set service broadcast-relay id <n> address <ipv4-address>
Set the source IP of forwarded packets, otherwise original senders address is used.
set service broadcast-relay id <n> port <port>
The UDP port number used by your application. It is mandatory for this kind of operation.
set service broadcast-relay id <n> disable
Each broadcast relay instance can be individually disabled without deleting the configured node by using the
following command:
set service broadcast-relay disable
In addition you can also disable the whole service without the need to remove it from the current configuration.

8.10. Service 849

 VyOS Documentation, Release 1.5.x (circinus)

Note: You can run the UDP broadcast relay service on multiple routers connected to a subnet. There is NO UDP
broadcast relay packet storm!

Example

To forward all broadcast packets received on UDP port 1900 on eth3, eth4 or eth5 to all other interfaces in this config-
uration.

set service broadcast-relay id 1 description 'SONOS'

set service broadcast-relay id 1 interface 'eth3'
set service broadcast-relay id 1 interface 'eth4'
set service broadcast-relay id 1 interface 'eth5'
set service broadcast-relay id 1 port '1900'

8.10.2 Config Sync

Configuration synchronization (config sync) is a feature of VyOS that permits synchronization of the configuration of
one VyOS router to another in a network.
The main benefit to configuration synchronization is that it eliminates having to manually replicate configuration
changes made on the primary router to the secondary (replica) router.
The writing of the configuration to the secondary router is performed through the VyOS HTTP API. The user can
specify which portion(s) of the configuration will be synchronized and the mode to use - whether to replace or add.
To prevent issues with divergent configurations between the pair of routers, synchronization is strictly unidirectional
from primary to replica. Both routers should be online and run the same version of VyOS.

Configuration

set service config-sync secondary <address|key|timeout|port>

Specify the address, API key, timeout and port of the secondary router. You need to enable and configure the
HTTP API service on the secondary router for config sync to operate.
set service config-sync section <section>
Specify the section of the configuration to synchronize. If more than one section is to be synchronized, repeat
the command to add additional sections as required.
set service config-sync mode <load|set>
Two options are available for mode: either load and replace or set the configuration section.

Supported options for <section> include:

firewall
interfaces <interface>
nat
nat66
pki
policy
protocols <protocol>
qos <interface|policy>
(continues on next page)

8.10. Service 850

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

service <service>
system <conntrack|
flow-accounting|option|sflow|static-host-mapping|sysctl|time-zone>
vpn
vrf

Example

• Synchronize the time-zone and OSPF configuration from Router A to Router B

• The address of Router B is 10.0.20.112 and the port used is 8443
Configure the HTTP API service on Router B

set service https listen-address '10.0.20.112'

set service https port '8443'
set service https api keys id KID key 'foo'

Configure the config-sync service on Router A

set service config-sync mode 'load'

set service config-sync secondary address '10.0.20.112'
set service config-sync secondary port '8443'
set service config-sync secondary key 'foo'
set service config-sync section protocols 'ospf'
set service config-sync section system 'time-zone'

Make config-sync relevant changes to Router A’s configuration

vyos@vyos-A# set system time-zone 'America/Los_Angeles'

vyos@vyos-A# commit
INFO:vyos_config_sync:Config synchronization: Mode=load,
Secondary=10.0.20.112
vyos@vyos-A# save

vyos@vyos-A# set protocols ospf area 0 network '10.0.48.0/30'

vyos@vyos-A# commit
INFO:vyos_config_sync:Config synchronization: Mode=load,
Secondary=10.0.20.112
yos@vyos-A# save

Verify configuration changes have been replicated to Router B

vyos@vyos-B:~$ show configuration commands | match time-zone

set system time-zone 'America/Los_Angeles'

vyos@vyos-B:~$ show configuration commands | match ospf

set protocols ospf area 0 network '10.0.48.0/30'

8.10. Service 851

 VyOS Documentation, Release 1.5.x (circinus)

Known issues

Configuration resynchronization. With the current implementation of service config-sync, the secondary node must be
online.

8.10.3 Conntrack Sync

One of the important features built on top of the Netfilter framework is connection tracking. Connection tracking allows
the kernel to keep track of all logical network connections or sessions, and thereby relate all of the packets which may
make up that connection. NAT relies on this information to translate all related packets in the same way, and iptables
can use this information to act as a stateful firewall.
The connection state however is completely independent of any upper-level state, such as TCP’s or SCTP’s state. Part
of the reason for this is that when merely forwarding packets, i.e. no local delivery, the TCP engine may not necessarily
be invoked at all. Even connectionless-mode transmissions such as UDP, IPsec (AH/ESP), GRE and other tunneling
protocols have, at least, a pseudo connection state. The heuristic for such protocols is often based upon a preset timeout
value for inactivity, after whose expiration a Netfilter connection is dropped.
Each Netfilter connection is uniquely identified by a (layer-3 protocol, source address, destination address, layer-4
protocol, layer-4 key) tuple. The layer-4 key depends on the transport protocol; for TCP/UDP it is the port numbers,
for tunnels it can be their tunnel ID, but otherwise is just zero, as if it were not part of the tuple. To be able to inspect
the TCP port in all cases, packets will be mandatorily defragmented.
It is possible to use either Multicast or Unicast to sync conntrack traffic. Most examples below show Multicast, but
unicast can be specified by using the “peer” keywork after the specified interface, as in the following example:
set service conntrack-sync interface eth0 peer 192.168.0.250

Configuration

set service conntrack-sync accept-protocol

Accept only certain protocols: You may want to replicate the state of flows depending on their layer 4 protocol.
Protocols are: tcp, sctp, dccp, udp, icmp and ipv6-icmp.
set service conntrack-sync event-listen-queue-size <size>
The daemon doubles the size of the netlink event socket buffer size if it detects netlink event message dropping.
This clause sets the maximum buffer size growth that can be reached.
Queue size for listening to local conntrack events in MB.
set service conntrack-sync expect-sync <all|ftp|h323|nfs|sip|sqlnet>
Protocol for which expect entries need to be synchronized.
set service conntrack-sync failover-mechanism vrrp sync-group <group>
Failover mechanism to use for conntrack-sync.
Only VRRP is supported. Required option.
set service conntrack-sync ignore-address <x.x.x.x>
IP addresses or networks for which local conntrack entries will not be synced
set service conntrack-sync interface <name>
Interface to use for syncing conntrack entries.
set service conntrack-sync interface <name> port <port>

8.10. Service 852

 VyOS Documentation, Release 1.5.x (circinus)

Port number used by connection.

set service conntrack-sync listen-address <ipv4address>
Local IPv4 addresses for service to listen on.
set service conntrack-sync mcast-group <x.x.x.x>
Multicast group to use for syncing conntrack entries.
Defaults to 225.0.0.50.
set service conntrack-sync interface <name> peer <address>
Peer to send unicast UDP conntrack sync entires to, if not using Multicast configuration from above above.
set service conntrack-sync sync-queue-size <size>
Queue size for syncing conntrack entries in MB.
set service conntrack-sync disable-external-cache
This diable the external cache and directly injects the flow-states into the in-kernel Connection Tracking System
of the backup firewall.
set service conntrack-sync disable-syslog
Disable connection logging via Syslog.
set service conntrack-sync startup-resync
Order conntrackd to request a complete conntrack table resync against the other node at startup.

Operation

show conntrack table ipv4

Make sure conntrack is enabled by running and show connection tracking table.

vyos@vyos:~$ show conntrack table ipv4

TCP state codes: SS - SYN SENT, SR - SYN RECEIVED, ES - ESTABLISHED,
FW - FIN WAIT, CW - CLOSE WAIT, LA - LAST ACK,
TW - TIME WAIT, CL - CLOSE, LI - LISTEN

CONN ID Source Destination Protocol TIMEOUT

1015736576 10.35.100.87:58172 172.31.20.12:22 tcp [6] ES 430279
1006235648 10.35.101.221:57483 172.31.120.21:22 tcp [6] ES 413310
1006237088 10.100.68.100 172.31.120.21 icmp [1] 29
1015734848 10.35.100.87:56282 172.31.20.12:22 tcp [6] ES 300
1015734272 172.31.20.12:60286 239.10.10.14:694 udp [17] 29
1006239392 10.35.101.221 172.31.120.21 icmp [1] 29

Note: If the table is empty and you have a warning message, it means conntrack is not enabled. To enable con-
ntrack, just create a NAT or a firewall rule. set firewall state-policy established action accept

show conntrack-sync cache external

Show connection syncing external cache entries
show conntrack-sync cache internal

8.10. Service 853

 VyOS Documentation, Release 1.5.x (circinus)

Show connection syncing internal cache entries

show conntrack-sync statistics
Retrieve current statistics of connection tracking subsystem.

vyos@vyos:~$ show conntrack-sync statistics

Main Table Statistics:

cache internal:
current active connections: 19606
connections created: 6298470 failed: 0
connections updated: 3786793 failed: 0
connections destroyed: 6278864 failed: 0

cache external:
current active connections: 15771
connections created: 1660193 failed: 0
connections updated: 77204 failed: 0
connections destroyed: 1644422 failed: 0

traffic processed:
0 Bytes 0 Pckts

multicast traffic (active device=eth0.5):

976826240 Bytes sent 212898000 Bytes recv
8302333 Pckts sent 2009929 Pckts recv
0 Error send 0 Error recv

message tracking:
0 Malformed msgs 263 Lost msgs

show conntrack-sync status

Retrieve current status of connection tracking subsystem.

vyos@vyos:~$ show conntrack-sync status

sync-interface : eth0.5
failover-mechanism : vrrp [sync-group GEFOEKOM]
last state transition : no transition yet!
ExpectationSync : disabled

Example

The next example is a simple configuration of conntrack-sync.

Now configure conntrack-sync service on router1 and router2

set high-availability vrrp group internal virtual-address ... etc ...

set high-availability vrrp sync-group syncgrp member 'internal'
set service conntrack-sync accept-protocol 'tcp'
set service conntrack-sync accept-protocol 'udp'
set service conntrack-sync accept-protocol 'icmp'
set service conntrack-sync failover-mechanism vrrp sync-group 'syncgrp'
(continues on next page)

8.10. Service 854

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set service conntrack-sync interface 'eth0'
set service conntrack-sync mcast-group '225.0.0.50'

On the active router, you should have information in the internal-cache of conntrack-sync. The same current active
connections number should be shown in the external-cache of the standby router
On active router run:

$ show conntrack-sync statistics

Main Table Statistics:

cache internal:
current active connections: 10
connections created: 8517 failed: 0
connections updated: 127 failed: 0
connections destroyed: 8507 failed: 0

cache external:
current active connections: 0
connections created: 0 failed: 0
connections updated: 0 failed: 0
connections destroyed: 0 failed: 0

traffic processed:
0 Bytes 0 Pckts
(continues on next page)

8.10. Service 855

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

multicast traffic (active device=eth0):

868780 Bytes sent 224136 Bytes recv
20595 Pckts sent 14034 Pckts recv
0 Error send 0 Error recv

message tracking:
0 Malformed msgs 0 Lost msgs

On standby router run:

$ show conntrack-sync statistics

Main Table Statistics:

cache internal:
current active connections: 0
connections created: 0 failed: 0
connections updated: 0 failed: 0
connections destroyed: 0 failed: 0

cache external:
current active connections: 10
connections created: 888 failed: 0
connections updated: 134 failed: 0
connections destroyed: 878 failed: 0

traffic processed:
0 Bytes 0 Pckts

multicast traffic (active device=eth0):

234184 Bytes sent 907504 Bytes recv
14663 Pckts sent 21495 Pckts recv
0 Error send 0 Error recv

message tracking:
0 Malformed msgs 0 Lost msgs

8.10.4 Console Server

Starting of with VyOS 1.3 (equuleus) we added support for running VyOS as an Out-of-Band Management device
which provides remote access by means of SSH to directly attached serial interfaces.
Serial interfaces can be any interface which is directly connected to the CPU or chipset (mostly known as a ttyS interface
in Linux) or any other USB to serial converter (Prolific PL2303 or FTDI FT232/FT4232 based chips).
If you happened to use a Cisco NM-16A - Sixteen Port Async Network Module or NM-32A - Thirty-two Port Async
Network Module - this is your VyOS replacement.
For USB port information please refor to: USB.

8.10. Service 856

 VyOS Documentation, Release 1.5.x (circinus)

Configuration

Between computers, the most common configuration used was “8N1”: eight bit characters, with one start bit, one stop
bit, and no parity bit. Thus 10 Baud times are used to send a single character, and so dividing the signalling bit-rate by
ten results in the overall transmission speed in characters per second. This is also the default setting if none of those
options are defined.
set service console-server device <device> data-bits [7 | 8]
Configure either seven or eight data bits. This defaults to eight data bits if left unconfigured.
set service console-server device <device> description <string>
A user friendly description identifying the connected peripheral.
set service console-server device <device> alias <string>
A user friendly alias for this connection. Can be used instead of the device name when connecting.
set service console-server device <device> parity [even | odd | none]
Set the parity option for the console. If unset this will default to none.
set service console-server device <device> stop-bits [1 | 2]
Configure either one or two stop bits. This defaults to one stop bits if left unconfigured.
set service console-server device <device> speed [ 300 | 1200 | 2400 | 4800 | 9600 |
19200 | 38400 | 57600 | 115200 ]

Note: USB to serial converters will handle most of their work in software so you should be carefull with the
selected baudrate as some times they can’t cope with the expected speed.

Remote Access

Each individual configured console-server device can be directly exposed to the outside world. A user can directly
connect via SSH to the configured port.
set service console-server device <device> ssh port <port>
Accept SSH connections for the given <device> on TCP port <port>. After successfull authentication the user
will be directly dropped to the connected serial device.

Hint: Multiple users can connect to the same serial device but only one is allowed to write to the console port.

Operation

show console-server ports

Show configured serial ports and their respective interface configuration.

vyos@vyos:~$ show console-server ports

usb0b2.4p1.0 on /dev/serial/by-bus/usb0b2.4p1.0@ at 9600n

show console-server user

Show currently connected users.

8.10. Service 857

 VyOS Documentation, Release 1.5.x (circinus)

vyos@vyos:~$ show console-server user

usb0b2.4p1.0 up vyos@localhost

connect console <device>

Locally connect to serial port identified by <device>.

vyos@vyos-r1:~$ connect console usb0b2.4p1.0

[Enter `^Ec?' for help]
[-- MOTD -- VyOS Console Server]

vyos-r2 login:

Hint: Multiple users can connect to the same serial device but only one is allowed to write to the console port.

Hint: The sequence ^Ec? translates to: Ctrl+E c ?. To quit the session use: Ctrl+E c .

Hint: If alias is set, it can be used instead of the device when connecting.

show log console-server

Show the console server log.

8.10.5 DHCP Relay

If you want your router to forward DHCP requests to an external DHCP server you can configure the system to act as
a DHCP relay agent. The DHCP relay agent works with IPv4 and IPv6 addresses.
All interfaces used for the DHCP relay must be configured. This includes the uplink to the DHCP server.

IPv4 relay

Configuration

set service dhcp-relay interface <interface>

Interfaces that participate in the DHCP relay process. If this command is used, at least two entries of it are
required: one for the interface that captures the dhcp-requests, and one for the interface to forward such re-
quests. A warning message will be shown if this command is used, since new implementations should use
listen-interface and upstream-interface.
set service dhcp-relay listen-interface <interface>
Interface for DHCP Relay Agent to listen for requests.
set service dhcp-relay upstream-interface <interface>
Interface for DHCP Relay Agent to forward requests out.
set service dhcp-relay server <server>
Configure IP address of the DHCP <server> which will handle the relayed packets.

8.10. Service 858

 VyOS Documentation, Release 1.5.x (circinus)

set service dhcp-relay relay-options relay-agents-packets discard

The router should discard DHCP packages already containing relay agent information to ensure that only re-
quests from DHCP clients are forwarded.
set service dhcp-relay disable
Disable dhcp-relay service.

Options

set service dhcp-relay relay-options hop-count <count>

Set the maximum hop <count> before packets are discarded. Range 0. . . 255, default 10.
set service dhcp-relay relay-options max-size <size>
Set maximum <size> of DHCP packets including relay agent information. If a DHCP packet size surpasses this
value it will be forwarded without appending relay agent information. Range 64. . . 1400, default 576.
set service dhcp-relay relay-options relay-agents-packets <append | discard | forward |
replace>
Four policies for reforwarding DHCP packets exist:
• append: The relay agent is allowed to append its own relay information to a received DHCP packet, disre-
garding relay information already present in the packet.
• discard: Received packets which already contain relay information will be discarded.
• forward: All packets are forwarded, relay information already present will be ignored.
• replace: Relay information already present in a packet is stripped and replaced with the router’s own relay
information set.

Example

• Listen for DHCP requests on interface eth1.

• DHCP server is located at IPv4 address 10.0.1.4 on eth2.
• Router receives DHCP client requests on eth1 and relays them to the server at 10.0.1.4 on eth2.

Fig. 3: DHCP relay example

The generated configuration will look like:

8.10. Service 859

 VyOS Documentation, Release 1.5.x (circinus)

show service dhcp-relay

listen-interface eth1
upstrem-interface eth2
server 10.0.1.4
relay-options {
relay-agents-packets discard
}

Also, for backwards compatibility this configuration, which uses generic interface definition, is still valid:

show service dhcp-relay

interface eth1
interface eth2
server 10.0.1.4
relay-options {
relay-agents-packets discard
}

Operation

restart dhcp relay-agent

Restart DHCP relay service

IPv6 relay

Configuration

set service dhcpv6-relay listen-interface <interface>

Set eth1 to be the listening interface for the DHCPv6 relay.
Multiple interfaces may be specified.
set service dhcpv6-relay upstream-interface <interface> address <server>
Specifies an upstream network <interface> from which replies from <server> and other relay agents will be
accepted.
set service dhcpv6-relay disable
Disable dhcpv6-relay service.

Options

set service dhcpv6-relay max-hop-count <count>

Set maximum hop count before packets are discarded, default: 10
set service dhcpv6-relay use-interface-id-option
If this is set the relay agent will insert the interface ID. This option is set automatically if more than one listening
interfaces are in use.

8.10. Service 860

 VyOS Documentation, Release 1.5.x (circinus)

Example

• DHCPv6 requests are received by the router on listening interface eth1

• Requests are forwarded through eth2 as the upstream interface
• External DHCPv6 server is at 2001:db8::4

Fig. 4: DHCPv6 relay example

The generated configuration will look like:

commit
show service dhcpv6-relay
listen-interface eth1 {
}
upstream-interface eth2 {
address 2001:db8::4
}

Operation

restart dhcpv6 relay-agent

Restart DHCPv6 relay agent immediately.

8.10.6 DHCP Server

VyOS uses Kea DHCP server for both IPv4 and IPv6 address assignment.

IPv4 server

The network topology is declared by shared-network-name and the subnet declarations. The DHCP service can serve
multiple shared networks, with each shared network having 1 or more subnets. Each subnet must be present on an
interface. A range can be declared inside a subnet to define a pool of dynamic addresses. Multiple ranges can be
defined and can contain holes. Static mappings can be set to assign “static” addresses to clients based on their MAC
address.

8.10. Service 861

 VyOS Documentation, Release 1.5.x (circinus)

Configuration

set service dhcp-server hostfile-update

Create DNS record per client lease, by adding clients to /etc/hosts file. Entry will have format: <shared-network-
name>_<hostname>.<domain-name>
set service dhcp-server shared-network-name <name> option domain-name <domain-name>
The domain-name parameter should be the domain name that will be appended to the client’s hostname to form
a fully-qualified domain-name (FQDN) (DHCP Option 015).
This is the configuration parameter for the entire shared network definition. All subnets will inherit this config-
uration item if not specified locally.
set service dhcp-server shared-network-name <name> option domain-search <domain-name>
The domain-name parameter should be the domain name used when completing DNS request where no full
FQDN is passed. This option can be given multiple times if you need multiple search domains (DHCP Option
119).
This is the configuration parameter for the entire shared network definition. All subnets will inherit this config-
uration item if not specified locally.
set service dhcp-server shared-network-name <name> option name-server <address>
Inform client that the DNS server can be found at <address>.
This is the configuration parameter for the entire shared network definition. All subnets will inherit this config-
uration item if not specified locally. Multiple DNS servers can be defined.
set service dhcp-server shared-network-name <name> option vendor-option <option-name>
This configuration parameter lets you specify a vendor-option for the entire shared network definition. All
subnets will inherit this configuration item if not specified locally. An example for Ubiquiti is shown below:
Example:
Pass address of Unifi controller at 172.16.100.1 to all clients of NET1

set service dhcp-server shared-network-name 'NET1' option vendor-option

ubiquiti '172.16.100.1'

set service dhcp-server listen-address <address>

This configuration parameter lets the DHCP server to listen for DHCP requests sent to the specified address,
it is only realistically useful for a server whose only clients are reached via unicasts, such as via DHCP relay
agents.

Individual Client Subnet

set service dhcp-server shared-network-name <name> authoritative

This says that this device is the only DHCP server for this network. If other devices are trying to offer DHCP
leases, this machine will send ‘DHCPNAK’ to any device trying to request an IP address that is not valid for
this network.
set service dhcp-server shared-network-name <name> subnet <subnet> subnet-id <id>
This configuration parameter is required and must be unique to each subnet. It is required to map subnets to
lease file entries.

8.10. Service 862

 VyOS Documentation, Release 1.5.x (circinus)

set service dhcp-server shared-network-name <name> subnet <subnet> option default-router

<address>
This is a configuration parameter for the <subnet>, saying that as part of the response, tell the client that the
default gateway can be reached at <address>.
set service dhcp-server shared-network-name <name> subnet <subnet> option name-server
<address>
This is a configuration parameter for the subnet, saying that as part of the response, tell the client that the DNS
server can be found at <address>.
Multiple DNS servers can be defined.
set service dhcp-server shared-network-name <name> subnet <subnet> lease <time>
Assign the IP address to this machine for <time> seconds.
The default value is 86400 seconds which corresponds to one day.
set service dhcp-server shared-network-name <name> subnet <subnet> range <n> start
<address>
Create DHCP address range with a range id of <n>. DHCP leases are taken from this pool. The pool starts at
address <address>.
set service dhcp-server shared-network-name <name> subnet <subnet> range <n> stop
<address>
Create DHCP address range with a range id of <n>. DHCP leases are taken from this pool. The pool stops with
address <address>.
set service dhcp-server shared-network-name <name> subnet <subnet> exclude <address>
Always exclude this address from any defined range. This address will never be assigned by the DHCP server.
This option can be specified multiple times.
set service dhcp-server shared-network-name <name> subnet <subnet> option domain-name
<domain-name>
The domain-name parameter should be the domain name that will be appended to the client’s hostname to form
a fully-qualified domain-name (FQDN) (DHCP Option 015).
set service dhcp-server shared-network-name <name> subnet <subnet> option domain-search
<domain-name>
The domain-name parameter should be the domain name used when completing DNS request where no full
FQDN is passed. This option can be given multiple times if you need multiple search domains (DHCP Option
119).
set service dhcp-server shared-network-name <name> subnet <subnet> option vendor-option
<option-name>
This configuration parameter lets you specify a vendor-option for the subnet specified within the shared network
definition. An example for Ubiquiti is shown below:
Example:
Create 172.18.201.0/24 as a subnet within NET1 and pass address of Unifi controller at 172.16.100.1 to clients
of that subnet.

set service dhcp-server shared-network-name 'NET1' subnet

'172.18.201.0/24' option vendor-option ubiquiti '172.16.100.1'

8.10. Service 863

 VyOS Documentation, Release 1.5.x (circinus)

High Availability

VyOS provides High Availability support for DHCP server. DHCP High Availability can act in two different modes:
• Active-active: both DHCP servers will respond to DHCP requests. If mode is not defined, this is the default
behavior.
• Active-passive: only primary server will respond to DHCP requests. If this server goes offline, then secondary
server will take place.
DHCP High Availability must be configured explicitly by the following statements on both servers:
set service dhcp-server high-availability mode [active-active | active-passive]
Define operation mode of High Availability feature. Default value if command is not specified is active-active
set service dhcp-server high-availability source-address <address>
Local IP <address> used when communicating to the HA peer.
set service dhcp-server high-availability remote <address>
Remote peer IP <address> of the second DHCP server in this HA cluster.
set service dhcp-server high-availability name <name>
A generic <name> referencing this sync service.

Note: <name> must be identical on both sides!

set service dhcp-server high-availability status <primary | secondary>

The primary and secondary statements determines whether the server is primary or secondary.

Note: In order for the primary and the secondary DHCP server to keep their lease tables in sync, they must be
able to reach each other on TCP port 647. If you have firewall rules in effect, adjust them accordingly.

Hint: The dialogue between HA partners is neither encrypted nor authenticated. Since most DHCP servers
exist within an organisation’s own secure Intranet, this would be an unnecessary overhead. However, if you have
DHCP HA peers whose communications traverse insecure networks, then we recommend that you consider the
use of VPN tunneling between them to ensure that the HA partnership is immune to disruption (accidental or
otherwise) via third parties.

Static mappings

You can specify a static DHCP assignment on a per host basis. You will need the MAC address of the station and your
desired IP address. The address must be inside the subnet definition but can be outside of the range statement.
set service dhcp-server shared-network-name <name> subnet <subnet> static-mapping
<description> mac <address>
Create a new DHCP static mapping named <description> which is valid for the host identified by its MAC
<address>.
set service dhcp-server shared-network-name <name> subnet <subnet> static-mapping
<description> duid <identifier>

8.10. Service 864

 VyOS Documentation, Release 1.5.x (circinus)

Create a new DHCP static mapping named <description> which is valid for the host identified by its DHCP
unique identifier (DUID) <identifier>.
set service dhcp-server shared-network-name <name> subnet <subnet> static-mapping
<description> ip-address <address>
Static DHCP IP address assign to host identified by <description>. IP address must be inside the <sub-
net> which is defined but can be outside the dynamic range created with set service dhcp-server
shared-network-name <name> subnet <subnet> range <n>. If no ip-address is specified, an IP from
the dynamic pool is used.
This is useful, for example, in combination with hostfile update.

Hint: This is the equivalent of the host block in dhcpd.conf of isc-dhcpd.

Example:
• IP address 192.168.1.100 shall be statically mapped to client named client1

set service dhcp-server shared-network-name 'NET1' subnet 192.168.1.0/24 subnet-id 1

set service dhcp-server shared-network-name 'NET1' subnet 192.168.1.0/24 static-mapping␣
˓→client1 ip-address 192.168.1.100

set service dhcp-server shared-network-name 'NET1' subnet 192.168.1.0/24 static-mapping␣

˓→client1 mac aa:bb:11:22:33:00

The configuration will look as follows:

show service dhcp-server shared-network-name NET1

subnet 192.168.1.0/24 {
static-mapping client1 {
ip-address 192.168.1.100
mac aa:bb:11:22:33:00
}
subnet-id 1
}

8.10. Service 865

 VyOS Documentation, Release 1.5.x (circinus)

Options

Setting Op- ISC-DHCP Option Option description Multi

name tion name
num-
ber
client- 1 subnet-mask Specifies the clients subnet mask as per N
prefix- RFC 950. If unset, subnet declaration is
length used.
time-offset 2 time-offset Offset of the client’s subnet in seconds from N
Coordinated Universal Time (UTC)
default- 3 routers IPv4 address of router on the client’s subnet N
router
time- 4 time-servers RFC 868 time server IPv4 address Y
server
name- 6 domain-name-servers DNS server IPv4 address Y
server
domain- 15 domain-name Client domain name Y
name
ip- 19 ip-forwarding Enable IP forwarding on client N
forwarding
ntp-server 42 ntp-servers IP address of NTP server Y
wins- 44 netbios-name-servers NetBIOS over TCP/IP name server Y
server
server- 54 dhcp-server-identifier IP address for DHCP server identifier N
identifier
bootfile- siaddr next-server IPv4 address of next bootstrap server N
server
tftp- 66 tftp-server-name Name or IPv4 address of TFTP server N
server-
name
bootfile- 67 bootfile-name, file- Bootstrap file name N
name name
bootfile- 13 boot-size Boot image length in 512-octet blocks N
size
smtp- 69 smtp-server IP address of SMTP server Y
server
pop-server 70 pop-server IP address of POP3 server Y
domain- 119 domain-search Client domain search Y
search
static- 121, rfc3442-static-route, Classless static route N
route 249 windows-static-route
wpad-url 252 wpad-url, wpad-url Web Proxy Autodiscovery (WPAD) URL N
code 252 = text
lease default-lease-time, Lease timeout in seconds (default: 86400) N
max-lease-time
range range DHCP lease range Y
exclude IP address to exclude from DHCP lease Y
range
failover DHCP failover parameters
static- Name of static mapping Y
mapping

8.10. Service 866

 VyOS Documentation, Release 1.5.x (circinus)

Multi: can be specified multiple times.

Example

Please see the DHCP/DNS quick-start configuration.

High Availability

Configuration of a DHCP HA pair:

• Setup DHCP HA for network 192.0.2.0/24
• Use active-active HA mode.
• Default gateway and DNS server is at 192.0.2.254
• The primary DHCP server uses address 192.168.189.252
• The secondary DHCP server uses address 192.168.189.253
• DHCP range spans from 192.168.189.10 - 192.168.189.250
Common configuration, valid for both primary and secondary node.

set service dhcp-server shared-network-name NET-VYOS subnet 192.0.2.0/24 option default-

˓→router '192.0.2.254'

set service dhcp-server shared-network-name NET-VYOS subnet 192.0.2.0/24 option name-

˓→server '192.0.2.254'

set service dhcp-server shared-network-name NET-VYOS subnet 192.0.2.0/24 option domain-

˓→name 'vyos.net'

set service dhcp-server shared-network-name NET-VYOS subnet 192.0.2.0/24 range 0 start

˓→'192.0.2.10'

set service dhcp-server shared-network-name NET-VYOS subnet 192.0.2.0/24 range 0 stop

˓→'192.0.2.250'

set service dhcp-server shared-network-name NET-VYOS subnet 192.0.2.0/24 subnet-id '1'

Primary

set service dhcp-server high-availability mode 'active-active'

set service dhcp-server high-availability source-address '192.168.189.252'
set service dhcp-server high-availability name 'NET-VYOS'
set service dhcp-server high-availability remote '192.168.189.253'
set service dhcp-server high-availability status 'primary'

Secondary

set service dhcp-server high-availability mode 'active-active'

set service dhcp-server high-availability source-address '192.168.189.253'
set service dhcp-server high-availability name 'NET-VYOS'
set service dhcp-server high-availability remote '192.168.189.252'
set service dhcp-server high-availability status 'secondary'

8.10. Service 867

 VyOS Documentation, Release 1.5.x (circinus)

Operation Mode

show log dhcp server

Show DHCP server daemon log file
show log dhcp client
Show logs from all DHCP client processes.
show log dhcp client interface <interface>
Show logs from specific interface DHCP client process.
restart dhcp server
Restart the DHCP server
show dhcp server statistics
Show the DHCP server statistics:

vyos@vyos:~$ show dhcp server statistics

Pool Size Leases Available Usage
----------- ------ -------- ----------- -------
dhcpexample 99 2 97 2%

show dhcp server statistics pool <pool>

Show the DHCP server statistics for the specified pool.
show dhcp server leases
Show statuses of all active leases:

vyos@vyos:~$ show dhcp server leases

IP Address MAC address State Lease start Lease expiration ␣
˓→Remaining Pool Hostname Origin
-------------- ----------------- ------- ------------------- ------------------- ---
˓→-------- -------- ---------- --------
192.168.11.134 00:50:79:66:68:09 active 2023/11/29 09:51:05 2023/11/29 10:21:05 ␣
˓→0:24:10 LAN VPCS1 local
192.168.11.133 50:00:00:06:00:00 active 2023/11/29 09:51:38 2023/11/29 10:21:38 ␣
˓→0:24:43 LAN VYOS-6 local
10.11.11.108 50:00:00:05:00:00 active 2023/11/29 09:51:43 2023/11/29 10:21:43 ␣
˓→0:24:48 VIF-1001 VYOS5 local
192.168.11.135 00:50:79:66:68:07 active 2023/11/29 09:55:16 2023/11/29 09:59:16 ␣
˓→0:02:21 remote
vyos@vyos:~$

Hint: Static mappings aren’t shown. To show all states, use show dhcp server leases state all.

show dhcp server leases origin [local | remote]

Show statuses of all active leases granted by local (this server) or remote (failover server):

vyos@vyos:~$ show dhcp server leases origin remote

IP Address MAC address State Lease start Lease expiration ␣
(continues on next page)

8.10. Service 868

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

˓→ Remaining Pool Hostname Origin
-------------- ----------------- ------- ------------------- ------------------- ---
˓→-------- -------- ---------- --------
192.168.11.135 00:50:79:66:68:07 active 2023/11/29 09:55:16 2023/11/29 09:59:16 ␣
˓→0:02:21 remote
vyos@vyos:~$

show dhcp server leases pool <pool>

Show only leases in the specified pool.

vyos@vyos:~$ show dhcp server leases pool LAN

IP Address MAC address State Lease start Lease expiration ␣
˓→Remaining Pool Hostname Origin
-------------- ----------------- ------- ------------------- ------------------- ---
˓→-------- ------ ---------- --------
192.168.11.134 00:50:79:66:68:09 active 2023/11/29 09:51:05 2023/11/29 10:21:05 ␣
˓→0:23:55 LAN VPCS1 local
192.168.11.133 50:00:00:06:00:00 active 2023/11/29 09:51:38 2023/11/29 10:21:38 ␣
˓→0:24:28 LAN VYOS-6 local
vyos@vyos:~$

show dhcp server leases sort <key>

Sort the output by the specified key. Possible keys: ip, hardware_address, state, start, end, remaining, pool,
hostname (default = ip)
show dhcp server leases state <state>
Show only leases with the specified state. Possible states: all, active, free, expired, released, abandoned, reset,
backup (default = active)

IPv6 server

VyOS also provides DHCPv6 server functionality which is described in this section.

Configuration

set service dhcpv6-server preference <preference value>

Clients receiving advertise messages from multiple servers choose the server with the highest preference value.
The range for this value is 0...255.
set service dhcpv6-server shared-network-name <name> subnet <subnet> subnet-id <id>
This configuration parameter is required and must be unique to each subnet. It is required to map subnets to
lease file entries.
set service dhcpv6-server shared-network-name <name> subnet <prefix> lease-time {default
| maximum | minimum}
The default lease time for DHCPv6 leases is 24 hours. This can be changed by supplying a default-time,
maximum-time and minimum-time. All values need to be supplied in seconds.
set service dhcpv6-server shared-network-name <name> subnet <prefix> option nis-domain
<domain-name>

8.10. Service 869

 VyOS Documentation, Release 1.5.x (circinus)

A NIS (Network Information Service) domain can be set to be used for DHCPv6 clients.
set service dhcpv6-server shared-network-name <name> subnet <prefix> option
nisplus-domain <domain-name>
The procedure to specify a NIS+ (Network Information Service Plus) domain is similar to the NIS domain one:
set service dhcpv6-server shared-network-name <name> subnet <prefix> option nis-server
<address>
Specify a NIS server address for DHCPv6 clients.
set service dhcpv6-server shared-network-name <name> subnet <prefix> option
nisplus-server <address>
Specify a NIS+ server address for DHCPv6 clients.
set service dhcpv6-server shared-network-name <name> subnet <prefix> option sip-server
<address | fqdn>
Specify a SIP (Session Initiation Protocol) server by IPv6 address of Fully Qualified Domain Name for all
DHCPv6 clients.
set service dhcpv6-server shared-network-name <name> subnet <prefix> option
sntp-server-address <address>
A SNTP server address can be specified for DHCPv6 clients.

Prefix Delegation

To hand out individual prefixes to your clients the following configuration is used:
set service dhcpv6-server shared-network-name <name> subnet <prefix> prefix-delegation
start <address> prefix-length <length>
Hand out prefixes of size <length> to clients in subnet <prefix> when they request for prefix delegation.
set service dhcpv6-server shared-network-name <name> subnet <prefix> prefix-delegation
start <address> stop <address>
Delegate prefixes from the range indicated by the start and stop qualifier.

Address pools

DHCPv6 address pools must be configured for the system to act as a DHCPv6 server. The following example describes
a common scenario.
Example:
• A shared network named NET1 serves subnet 2001:db8::/64
• It is connected to eth1
• DNS server is located at 2001:db8::ffff
• Address pool shall be 2001:db8::100 through 2001:db8::199.
• Lease time will be left at the default value which is 24 hours

8.10. Service 870

 VyOS Documentation, Release 1.5.x (circinus)

set service dhcpv6-server shared-network-name 'NET1' subnet 2001:db8::/64 range 1 start␣

˓→2001:db8::100 stop 2001:db8::199

set service dhcpv6-server shared-network-name 'NET1' subnet 2001:db8::/64 range 1 stop␣

˓→2001:db8::199

set service dhcpv6-server shared-network-name 'NET1' subnet 2001:db8::/64 option name-

˓→server 2001:db8::ffff

set service dhcpv6-server shared-network-name 'NET1' subnet 2001:db8::/64 subnet-id 1

The configuration will look as follows:

show service dhcpv6-server

shared-network-name NET1 {
subnet 2001:db8::/64 {
range 1 {
start 2001:db8::100
stop 2001:db8::199
}
option {
name-server 2001:db8::ffff
}
subnet-id 1
}
}

Static mappings

In order to map specific IPv6 addresses to specific hosts static mappings can be created. The following example explains
the process.
Example:
• IPv6 address 2001:db8::101 shall be statically mapped
• IPv6 prefix 2001:db8:0:101::/64 shall be statically mapped
• Host specific mapping shall be named client1

Hint: The identifier is the device’s DUID: colon-separated hex list (as used by isc-dhcp option dhcpv6.client-id). If
the device already has a dynamic lease from the DHCPv6 server, its DUID can be found with show service dhcpv6
server leases. The DUID begins at the 5th octet (after the 4th colon) of IAID_DUID.

set service dhcpv6-server shared-network-name 'NET1' subnet 2001:db8::/64 static-mapping␣

˓→client1 ipv6-address 2001:db8::101

set service dhcpv6-server shared-network-name 'NET1' subnet 2001:db8::/64 static-mapping␣

˓→client1 ipv6-prefix 2001:db8:0:101::/64

set service dhcpv6-server shared-network-name 'NET1' subnet 2001:db8::/64 static-mapping␣

˓→client1 duid 00:01:00:01:12:34:56:78:aa:bb:cc:dd:ee:ff

The configuration will look as follows:

show service dhcpv6-server shared-network-name NET1

subnet 2001:db8::/64 {
(continues on next page)

8.10. Service 871

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

static-mapping client1 {
duid 00:01:00:01:12:34:56:78:aa:bb:cc:dd:ee:ff
ipv6-address 2001:db8::101
ipv6-prefix 2001:db8:0:101::/64
}
}

Operation Mode

show log dhcpv6 server

Show DHCPv6 server daemon log file
show log dhcpv6 client
Show logs from all DHCPv6 client processes.
show log dhcpv6 client interface <interface>
Show logs from specific interface DHCPv6 client process.
restart dhcpv6 server
To restart the DHCPv6 server
show dhcpv6 server leases
Shows status of all assigned leases:

vyos@vyos:~$ show dhcpv6 server leases

IPv6 address State Last communication Lease expiration Remaining Type ␣
˓→ Pool IAID_DUID
------------- ------- -------------------- ------------------- ----------- ---------
˓→---- ----- --------------------------------------------
2001:db8::101 active 2019/12/05 19:40:10 2019/12/06 07:40:10 11:45:21 non-
˓→temporary NET1 98:76:54:32:00:01:00:01:12:34:56:78:aa:bb:cc:dd:ee:ff
2001:db8::102 active 2019/12/05 14:01:23 2019/12/06 02:01:23 6:06:34 non-
˓→temporary NET1 87:65:43:21:00:01:00:01:11:22:33:44:fa:fb:fc:fd:fe:ff

Hint: Static mappings aren’t shown. To show all states, use show dhcp server leases state all.

show dhcpv6 server leases pool <pool>

Show only leases in the specified pool.
show dhcpv6 server leases sort <key>
Sort the output by the specified key. Possible keys: expires, iaid_duid, ip, last_comm, pool, remaining, state,
type (default = ip)
show dhcpv6 server leases state <state>
Show only leases with the specified state. Possible states: abandoned, active, all, backup, expired, free, released,
reset (default = active)

8.10. Service 872

 VyOS Documentation, Release 1.5.x (circinus)

8.10.7 DNS Forwarding

Configuration

VyOS provides DNS infrastructure for small networks. It is designed to be lightweight and have a small footprint,
suitable for resource constrained routers and firewalls. For this we utilize PowerDNS recursor.
The VyOS DNS forwarder does not require an upstream DNS server. It can serve as a full recursive DNS server - but
it can also forward queries to configurable upstream DNS servers. By not configuring any upstream DNS servers you
also avoid being tracked by the provider of your upstream DNS server.
set service dns forwarding system
Forward incoming DNS queries to the DNS servers configured under the system name-server nodes.
set service dns forwarding dhcp <interface>
Interfaces whose DHCP client nameservers to forward requests to.
set service dns forwarding name-server <address> port <port>
Send all DNS queries to the IPv4/IPv6 DNS server specified under <address> on optional port specified under
<port>. The port defaults to 53. You can configure multiple nameservers here.
set service dns forwarding domain <domain-name> name-server <address>
Forward received queries for a particular domain (specified via domain-name) to a given nameserver. Multiple
nameservers can be specified. You can use this feature for a DNS split-horizon configuration.

Note: This also works for reverse-lookup zones (18.172.in-addr.arpa).

set service dns forwarding domain <domain-name> addnta

Add NTA (negative trust anchor) for this domain. This must be set if the domain does not support DNSSEC.
set service dns forwarding domain <domain-name> recursion-desired
Set the “recursion desired” bit in requests to the upstream nameserver.
set service dns forwarding allow-from <network>
Given the fact that open DNS recursors could be used on DDoS amplification attacks, you must configure the
networks which are allowed to use this recursor. A network of 0.0.0.0/0 or ::/0 would allow all IPv4 and
IPv6 networks to query this server. This is generally a bad idea.
set service dns forwarding dnssec <off | process-no-validate | process | log-fail |
validate>
The PowerDNS recursor has 5 different levels of DNSSEC processing, which can be set with the dnssec setting.
In order from least to most processing, these are:
• off In this mode, no DNSSEC processing takes place. The recursor will not set the DNSSEC OK (DO) bit
in the outgoing queries and will ignore the DO and AD bits in queries.
• process-no-validate In this mode the recursor acts as a “security aware, non-validating” nameserver, mean-
ing it will set the DO-bit on outgoing queries and will provide DNSSEC related RRsets (NSEC, RRSIG)
to clients that ask for them (by means of a DO-bit in the query), except for zones provided through the
auth-zones setting. It will not do any validation in this mode, not even when requested by the client.
• process When dnssec is set to process the behavior is similar to process-no-validate. However, the recursor
will try to validate the data if at least one of the DO or AD bits is set in the query; in that case, it will set

8.10. Service 873

 VyOS Documentation, Release 1.5.x (circinus)

the AD-bit in the response when the data is validated successfully, or send SERVFAIL when the validation
comes up bogus.
• log-fail In this mode, the recursor will attempt to validate all data it retrieves from authoritative servers,
regardless of the client’s DNSSEC desires, and will log the validation result. This mode can be used to
determine the extra load and amount of possibly bogus answers before turning on full-blown validation.
Responses to client queries are the same as with process.
• validate The highest mode of DNSSEC processing. In this mode, all queries will be validated and will be
answered with a SERVFAIL in case of bogus data, regardless of the client’s request.

Note: The popular Unix/Linux dig tool sets the AD-bit in the query. This might lead to unexpected query
results when testing. Set +noad on the dig command line when this is the case.

Note: The CD-bit is honored correctly for process and validate. For log-fail, failures will be logged too.

set service dns forwarding ignore-hosts-file

Do not use the local /etc/hosts file in name resolution. VyOS DHCP server will use this file to add resolvers
to assigned addresses.
set service dns forwarding cache-size <0-2147483647>
Maximum number of DNS cache entries. 1 million per CPU core will generally suffice for most installations.
This defaults to 10000.
set service dns forwarding negative-ttl <0-7200>
A query for which there is authoritatively no answer is cached to quickly deny a record’s existence later on,
without putting a heavy load on the remote server. In practice, caches can become saturated with hundreds of
thousands of hosts which are tried only once.
This setting, which defaults to 3600 seconds, puts a maximum on the amount of time negative entries are cached.
set service dns forwarding timeout <10-60000>
The number of milliseconds to wait for a remote authoritative server to respond before timing out and responding
with SERVFAIL.
This setting defaults to 1500 and is valid between 10 and 60000.
set service dns forwarding listen-address <address>
The local IPv4 or IPv6 addresses to bind the DNS forwarder to. The forwarder will listen on this address for
incoming connections.
set service dns forwarding source-address <address>
The local IPv4 or IPv6 addresses to use as a source address for sending queries. The forwarder will send
forwarded outbound DNS requests from this address.
set service dns forwarding no-serve-rfc1918
This makes the server authoritatively not aware of: 10.in-addr.arpa, 168.192.in-addr.arpa, 16-31.172.in-
addr.arpa, which enabling upstream DNS server(s) to be used for reverse lookups of these zones.

8.10. Service 874

 VyOS Documentation, Release 1.5.x (circinus)

Authoritative zones

The VyOS DNS forwarder can also be configured to host authoritative records for a domain.
set service dns forwarding authoritative-domain <domain-name> disable
Disable hosting authoritative zone for <domain-name> without deleting from configuration.
set service dns forwarding authoritative-domain <domain-name> records <type> <name>
disable
Disable specific record without deleting it from configuration.
set service dns forwarding authoritative-domain <domain-name> records <type> <name> ttl
<seconds>
Set the TTL (Time-to-live) for the record in seconds. Default is 300 seconds.

Record types

Below are a list of record types available to be configured within VyOS. Some records support special <name> key-
words:
• @ Use @ as record name to set the record for the root domain.
• any Use any as record name to configure the record as a wildcard.
set service dns forwarding authoritative-domain <domain-name> records a <name> address
<x.x.x.x>
Set an A (Address) record. Supports @ and any keywords.
set service dns forwarding authoritative-domain <domain-name> records aaaa <name> address
<h:h:h:h:h:h:h:h>
Set an AAAA (IPv6 Address) record. Supports @ and any keywords.
set service dns forwarding authoritative-domain <domain-name> records cname <name> target
<target-domain-name>
Set an CNAME (Canonical name) record. Supports @ keyword.
set service dns forwarding authoritative-domain <domain-name> records naptr <name> rule
<rule-number> <option> <value>
Set an NAPTR (Naming authority pointer) record. Supports @ keyword. NAPTR records support the following
options:
• lookup-a A Flag.
• lookup-srv S flag.
• order Rule order. Requires <value>.
• preference Rule preference. Requires <value>. Defaults to 0 if not set.
• protocol-specific P flag.
• regexp Regular expression. Requires <value>.
• replacement Replacement DNS name.
• resolve-uri U flag.
• service Service type. Requires <value>.

8.10. Service 875

 VyOS Documentation, Release 1.5.x (circinus)

set service dns forwarding authoritative-domain <domain-name> records ns <name> target

<target-name>
Set an NS (Nameserver) record.
set service dns forwarding authoritative-domain <domain-name> records ptr <name> target
<target-name>
Set an PTR (Pointer record) record. Supports @ keyword.
set service dns forwarding authoritative-domain <domain-name> records spf <name> value
<value>
Set an SPF (Sender policy framework) record. Supports @ keyword.
set service dns forwarding authoritative-domain <domain-name> records srv <name> entry
<entry-number> [hostname | port | priority | weight] <value>
Set an SRV (Service) record. Supports @ keyword.
set service dns forwarding authoritative-domain <domain-name> records txt <name> value
<value>
Set an TXT (Text) record. Supports @ keyword.

Example

A VyOS router with two interfaces - eth0 (WAN) and eth1 (LAN) - is required to implement a split-horizon DNS
configuration for example.com.
In this scenario:
• All DNS requests for example.com must be forwarded to a DNS server at 192.0.2.254 and 2001:db8:cafe::1
• All other DNS requests will be forwarded to a different set of DNS servers at 192.0.2.1, 192.0.2.2, 2001:db8::1:ffff
and 2001:db8::2:ffff
• The VyOS DNS forwarder will only listen for requests on the eth1 (LAN) interface addresses - 192.168.1.254
for IPv4 and 2001:db8::ffff for IPv6
• The VyOS DNS forwarder will only accept lookup requests from the LAN subnets - 192.168.1.0/24 and
2001:db8::/64
• The VyOS DNS forwarder will pass reverse lookups for 10.in-addr.arpa, 168.192.in-addr.arpa, 16-31.172.in-
addr.arpa zones to upstream server.

set service dns forwarding domain example.com name-server 192.0.2.254

set service dns forwarding domain example.com name-server 2001:db8:cafe::1
set service dns forwarding name-server 192.0.2.1
set service dns forwarding name-server 192.0.2.2
set service dns forwarding name-server 192.0.2.3 port 853
set service dns forwarding name-server 2001:db8::1:ffff
set service dns forwarding name-server 2001:db8::2:ffff
set service dns forwarding name-server 2001:db8::3:ffff port 8053
set service dns forwarding listen-address 192.168.1.254
set service dns forwarding listen-address 2001:db8::ffff
set service dns forwarding allow-from 192.168.1.0/24
set service dns forwarding allow-from 2001:db8::/64
set service dns forwarding no-serve-rfc1918

8.10. Service 876

 VyOS Documentation, Release 1.5.x (circinus)

Operation

reset dns forwarding <all | domain>

Resets the local DNS forwarding cache database. You can reset the cache for all entries or only for entries to a
specific domain.
restart dns forwarding
Restarts the DNS recursor process. This also invalidates the local DNS forwarding cache.

8.10.8 Dynamic DNS

VyOS is able to update a remote DNS record when an interface gets a new IP address. In order to do so, VyOS includes
ddclient, a Perl script written for this only one purpose.
ddclient uses two methods to update a DNS record. The first one will send updates directly to the DNS daemon, in
compliance with RFC 2136. The second one involves a third party service, like DynDNS.com or any other such service
provider. This method uses HTTP requests to transmit the new IP address. You can configure both in VyOS.

Configuration

RFC 2136 Based

set service dns dynamic name <service-name> address interface <interface>

Create new dynamic DNS update configuration which will update the IP address assigned to <interface> on
the service you configured under <service-name>.
set service dns dynamic name <service-name> description <text>
Set description <text> for dynamic DNS service being configured.
set service dns dynamic name <service-name> key <filename>
File identified by <filename> containing the TSIG authentication key for RFC2136 nsupdate on remote DNS
server.
set service dns dynamic name <service-name> server <server>
Configure the DNS <server> IP/FQDN used when updating this dynamic assignment.
set service dns dynamic name <service-name> zone <zone>
Configure DNS <zone> to be updated.
set service dns dynamic name <service-name> host-name <record>
Configure DNS <record> which should be updated. This can be set multiple times.
set service dns dynamic name <service-name> ttl <ttl>
Configure optional TTL value on the given resource record. This defaults to 600 seconds.
set service dns dynamic interval <60-3600>
Specify interval in seconds to wait between Dynamic DNS updates. The default is 300 seconds.

8.10. Service 877

 VyOS Documentation, Release 1.5.x (circinus)

Example

• Register DNS record example.vyos.io on DNS server ns1.vyos.io

• Use auth key file at /config/auth/my.key
• Set TTL to 300 seconds

# Configuration commands entered:

#
set service dns dynamic name 'VyOS-DNS' address interface 'eth0'
set service dns dynamic name 'VyOS-DNS' description 'RFC 2136 dynamic dns service'
set service dns dynamic name 'VyOS-DNS' key '/config/auth/my.key'
set service dns dynamic name 'VyOS-DNS' server 'ns1.vyos.io'
set service dns dynamic name 'VyOS-DNS' zone 'vyos.io'
set service dns dynamic name 'VyOS-DNS' host-name 'example.vyos.io'
set service dns dynamic name 'VyOS-DNS' protocol 'nsupdate'
set service dns dynamic name 'VyOS-DNS' ttl '300'

# Resulting config:
#
vyos@vyos# show service dns dynamic
name VyOS-DNS {
address {
interface eth0
}
description "RFC 2136 dynamic dns service"
host-name example.vyos.io
key /config/auth/my.key
protocol nsupdate
server ns1.vyos.io
ttl 300
zone vyos.io
}

This will render the following ddclient configuration entry:

# ddclient configuration for interface "eth0":

#

# Web service dynamic DNS configuration for VyOS-DNS: [nsupdate, example.vyos.io]

use=if, \
if=eth0, \
protocol=nsupdate, \
server=ns1.vyos.io, \
zone=vyos.io, \
password='/config/auth/my.key', \
ttl=300 \
example.vyos.io

Note: You can also keep different DNS zone updated. Just create a new config node: set service dns dynamic
interface <interface> rfc2136 <other-service-name>

8.10. Service 878

 VyOS Documentation, Release 1.5.x (circinus)

HTTP based services

VyOS is also able to use any service relying on protocols supported by ddclient.
To use such a service, one must define a login, password, one or multiple hostnames, protocol and server.
set service dns dynamic name <service-name> address interface <interface>
Create new dynamic DNS update configuration which will update the IP address assigned to <interface> on
the service you configured under <service-name>.
set service dns dynamic name <service-name> description <text>
Set description <text> for dynamic DNS service being configured.
set service dns dynamic name <service-name> host-name <hostname>
Setup the dynamic DNS hostname <hostname> associated with the DynDNS provider identified by <service-
name>.
set service dns dynamic name <service-name> username <username>
Configure <username> used when authenticating the update request for DynDNS service identified by
<service-name>.
set service dns dynamic name <service-name> password <password>
Configure <password> used when authenticating the update request for DynDNS service identified by <service-
name>.
set service dns dynamic name <service-name> protocol <protocol>
When a custom DynDNS provider is used, the protocol used for communicating to the provider must be spec-
ified under <protocol>. See the embedded completion helper when entering above command for available
protocols.
set service dns dynamic name <service-name> server <server>
When a custom DynDNS provider is used the <server> where update requests are being sent to must be spec-
ified.
set service dns dynamic name <service-name> ip-version ‘ipv6’
Allow explicit IPv6 address for the interface.

Example:

Use deSEC (dedyn.io) as your preferred provider:

set service dns dynamic name dedyn description 'deSEC dynamic dns service'
set service dns dynamic name dedyn username 'myusername'
set service dns dynamic name dedyn password 'mypassword'
set service dns dynamic name dedyn host-name 'myhostname.dedyn.io'
set service dns dynamic name dedyn protocol 'dyndns2'
set service dns dynamic name dedyn server 'update.dedyn.io'
set service dns dynamic name dedyn address interface 'eth0'

Note: Multiple services can be used per interface. Just specify as many services per interface as you like!

8.10. Service 879

 VyOS Documentation, Release 1.5.x (circinus)

Example IPv6 only:

set service dns dynamic name dedyn description 'deSEC ipv6 dynamic dns service'
set service dns dynamic name dedyn username 'myusername'
set service dns dynamic name dedyn password 'mypassword'
set service dns dynamic name dedyn host-name 'myhostname.dedyn.io'
set service dns dynamic name dedyn protocol 'dyndns2'
set service dns dynamic name dedyn ip-version 'ipv6'
set service dns dynamic name dedyn server 'update6.dedyn.io'
set service dns dynamic name dedyn address interface 'eth0'

Running Behind NAT

By default, ddclient will update a dynamic dns record using the IP address directly attached to the interface. If your
VyOS instance is behind NAT, your record will be updated to point to your internal IP.
ddclient has another way to determine the WAN IP address. This is controlled by:
set service dns dynamic name <service-name> address web <url>
Use configured <url> to determine your IP address. ddclient will load <url> and tries to extract your IP address
from the response.
set service dns dynamic name <service-name> address web skip <pattern>
ddclient will skip any address located before the string set in <pattern>.

8.10.9 Event Handler

Event Handler Technology Overview

Event handler allows you to execute scripts when a string that matches a regex or a regex with a service name appears
in journald logs. You can pass variables, arguments, and a full matching string to the script.

How to configure Event Handler

1. Create an event handler

2. Add regex to the script
3. Add a full path to the script
4. Add optional parameters

8.10. Service 880

 VyOS Documentation, Release 1.5.x (circinus)

Event Handler Configuration Steps

1. Create an event handler

set service event-handler event <event-handler name>

This is an optional command because the event handler will be automatically created after any of the next
commands.

2. Add regex to the script

set service event-handler event <event-handler name> filter pattern <regex>

This is a mandatory command. Sets regular expression to match against log string message.

Note: The regular expression matches if and only if the entire string matches the pattern.

3. Add a full path to the script

set service event-handler event <event-handler name> script path <path to

script>
This is a mandatory command. Sets the full path to the script. The script file must be executable.

4. Add optional parameters

set service event-handler event <event-handler name> filter syslog-identifier

<sylogid name>
This is an optional command. Filters log messages by syslog-identifier.
set service event-handler event <event-handler name> script environment <env
name> value <env value>
This is an optional command. Adds environment and its value to the script. Use separate commands for
each environment.
One implicit environment exists.
• message: Full message that has triggered the script.
set service event-handler event <event-handler name> script arguments
<arguments>
This is an optional command. Adds arguments to the script. Arguments must be separated by spaces.

Note: We don’t recomend to use arguments. Using environments is more preffereble.

8.10. Service 881

 VyOS Documentation, Release 1.5.x (circinus)

Example

Event handler that monitors the state of interface eth0.

set service event-handler event INTERFACE_STATE_DOWN filter pattern '.*eth0.*,

˓→RUNNING,.*->.*'

set service event-handler event INTERFACE_STATE_DOWN filter syslog-identifier

˓→'netplugd'

set service event-handler event INTERFACE_STATE_DOWN script environment␣

˓→interface_action value 'down'

set service event-handler event INTERFACE_STATE_DOWN script environment␣

˓→interface_name value 'eth2'

set service event-handler event INTERFACE_STATE_DOWN script path '/config/

˓→scripts/eventhandler.py'

Event handler script

#!/usr/bin/env python3
#
# VyOS event-handler script example
from os import environ
import subprocess
from sys import exit

# Perform actions according to requirements

def process_event() -> None:
# Get variables
message_text = environ.get('message')
interface_name = environ.get('interface_name')
interface_action = environ.get('interface_action')
# Print the message that triggered this script
print(f'Logged message: {message_text}')
# Prepare a command to run
command = f'sudo ip link set {interface_name} {interface_action}'.split()
# Execute a command
subprocess.run(command)

if __name__ == '__main__':
try:
# Run script actions and exit
process_event()
exit(0)
except Exception as err:
# Exit properly in case if something in the script goes wrong
print(f'Error running script: {err}')
exit(1)

8.10. Service 882

 VyOS Documentation, Release 1.5.x (circinus)

8.10.10 HTTP API

VyOS provide an HTTP API. You can use it to execute op-mode commands, update VyOS, set or delete config.
Please take a look at the VyOS API page for an detailed how-to.

Configuration

set service https allow-client address <address>

Only allow certain IP addresses or prefixes to access the https webserver.
set service https certificates ca-certificate <name>
Use CA certificate from PKI subsystem
set service https certificates certificate <name>
Use certificate from PKI subsystem
set service https certificates dh-params <name>
Use DH parameters from PKI subsystem. Must be at least 2048 bits in length.
set service https listen-address <address>
Webserver should only listen on specified IP address
set service https port <number>
Webserver should listen on specified port.
Default: 443
set service https enable-http-redirect
Enable automatic redirect from http to https.
set service https tls-version <1.2 | 1.3>
Select TLS version used.
This defaults to both 1.2 and 1.3.
set service https vrf <name>
Start Webserver in given VRF.
set service https request-body-size-limit <size>
Set the maximum request body size in megabytes. Default is 1MB.

API

set service https api keys id <name> key <apikey>

Set a named api key. Every key has the same, full permissions on the system.
set service https api debug
To enable debug messages. Available via show log or monitor log
set service https api strict
Enforce strict path checking.

8.10. Service 883

 VyOS Documentation, Release 1.5.x (circinus)

set service https api cors allow-origin <origin>

Allow cross-origin requests from <origin>.

GraphQL

set service https api graphql introspection

Enable GraphQL Schema introspection.

Note: Do not leave introspection enabled in production, it is a security risk.

set service https api graphql authentication type <key | token>

Set the authentication type for GraphQL, default option is key. Available options are:
• key use API keys configured in service https api keys
• token use JWT tokens.
set service https api graphql authentication expiration
Set the lifetime for JWT tokens in seconds. Default is 3600 seconds.
set service https api graphql authentication secret-length
Set the byte length of the JWT secret. Default is 32.

Example Configuration

Set an API-KEY is the minimal configuration to get a working API Endpoint.

set service https api keys id MY-HTTPS-API-ID key MY-HTTPS-API-PLAINTEXT-KEY

8.10.11 DDoS Protection

FastNetMon

FastNetMon is a high-performance DDoS detector/sensor built on top of multiple packet capture engines: NetFlow,
IPFIX, sFlow, AF_PACKET (port mirror). It can detect hosts in the deployed network sending or receiving large
volumes of traffic, packets/bytes/flows per second and perform a configurable action to handle that event, such as
calling a custom script.
VyOS includes the FastNetMon Community Edition.

8.10. Service 884

 VyOS Documentation, Release 1.5.x (circinus)

Configuration

set service ids ddos-protection alert-script <text>

Configure alert script that will be executed when an attack is detected.
set service ids ddos-protection ban-time <1-4294967294>
Configure how long an IP (attacker) should be kept in blocked state. Default value is 1900.
set service ids ddos-protection direction [in | out]
Configure direction for processing traffic.
set service ids ddos-protection exclude-network <x.x.x.x/x>
set service ids ddos-protection exclude-network <h:h:h:h:h:h:h:h/x>
Specify IPv4 and/or IPv6 networks which are going to be excluded.
set service ids ddos-protection listen-interface <text>
Configure listen interface for mirroring traffic.
set service ids ddos-protection mode [mirror | sflow]
Configure traffic capture mode.
set service ids ddos-protection network <x.x.x.x/x>
set service ids ddos-protection network <h:h:h:h:h:h:h:h/x>
Specify IPv4 and/or IPv6 networks that should be protected/monitored.
set service ids ddos-protection sflow listen-address <x.x.x.x>
Configure local IPv4 address to listen for sflow.
set service ids ddos-protection sflow port <1-65535>
Configure port number to be used for sflow connection. Default port is 6343.
set service ids ddos-protection threshold general [fps | mbps | pps] <0-4294967294>
Configure general threshold parameters.
set service ids ddos-protection threshold icmp [fps | mbps | pps] <0-4294967294>
Configure ICMP threshold parameters.
set service ids ddos-protection threshold tcp [fps | mbps | pps] <0-4294967294>
Configure TCP threshold parameters
set service ids ddos-protection threshold udp [fps | mbps | pps] <0-4294967294>
Configure UDP threshold parameters

8.10. Service 885

 VyOS Documentation, Release 1.5.x (circinus)

Example

A configuration example can be found in this section. In this simplified scenario, main things to be considered are:
• Network to be protected: 192.0.2.0/24 (public IPs use by customers)
• ban-time and threshold: these values are kept very low in order to easily identify and generate and attack.
• Direction: in and out. Protect public network from external attacks, and identify internal attacks towards internet.
• Interface eth0 used to connect to upstream.
Since we are analyzing attacks to and from our internal network, two types of attacks can be identified, and different
actions are needed:
• External attack: an attack from the internet towards an internal IP is identify. In this case, all connections towards
such IP will be blocked
• Internal attack: an attack from the internal network (generated by a customer) towards the internet is identify. In
this case, all connections from this particular IP/Customer will be blocked.
So, firewall configuration needed for this setup:

set firewall group address-group FNMS-DST-Block

set firewall group address-group FNMS-SRC-Block

set firewall ipv4 forward filter rule 10 action 'drop'

set firewall ipv4 forward filter rule 10 description 'FNMS - block destination'
set firewall ipv4 forward filter rule 10 destination group address-group 'FNMS-DST-Block'

set firewall ipv4 forward filter rule 20 action 'drop'

set firewall ipv4 forward filter rule 20 description 'FNMS - Block source'
set firewall ipv4 forward filter rule 20 source group address-group 'FNMS-SRC-Block'

Then, FastNetMon configuration:

set service ids ddos-protection alert-script '/config/scripts/fnm-alert.sh'

set service ids ddos-protection ban-time '10'
set service ids ddos-protection direction 'in'
set service ids ddos-protection direction 'out'
set service ids ddos-protection listen-interface 'eth0'
set service ids ddos-protection mode 'mirror'
set service ids ddos-protection network '192.0.2.0/24'
set service ids ddos-protection threshold general pps '100'

And content of the script:

#!/bin/bash

# alert-script is called twice.

# When an attack occurs, the program calls a bash script twice:
# 1st time when threshold exceed
# 2nd when we collect 100 packets for detailed audit of what happened.

# Do nothing if “attack_details” is passed as an argument

if [ "${4}" == "attack_details" ]; then
# Do nothing
(continues on next page)

8.10. Service 886

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

exit
fi
# Arguments:
ip=$1
direction=$2
pps_rate=$3
action=$4

logger -t FNMS "** Start - Running alert script **"

if [ "${direction}" == "incoming" ] ; then

group="FNMS-DST-Block"
origin="external"
else
group="FNMS-SRC-Block"
origin="internal"
fi

if [ "${action}" == "ban" ] ; then

logger -t FNMS "Attack detected for IP ${ip} and ${direction} direction from $
˓→{origin} network. Need to block IP address."

logger -t FNMS "Adding IP address ${ip} to firewall group ${group}."

sudo nft add element ip vyos_filter A_${group} { ${ip} }
else
logger -t FNMS "Timeout for IP ${ip}, removing it from group ${group}."
sudo nft delete element ip vyos_filter A_${group} { ${ip} }
fi
logger -t FNMS "** End - Running alert script **"
exit

8.10.12 IPoE Server

VyOS utilizes accel-ppp to provide IPoE (Internet Protocol over Ethernet) server functionality. It can be used with
local authentication (mac-address) or a connected RADIUS server.
IPoE is a method of delivering an IP payload over an Ethernet-based access network or an access network using bridged
Ethernet over Asynchronous Transfer Mode (ATM) without using PPPoE. It directly encapsulates the IP datagrams in
Ethernet frames, using the standard RFC 894 encapsulation.
The use of IPoE addresses the disadvantage that PPP is unsuited for multicast delivery to multiple users. Typically, IPoE
uses Dynamic Host Configuration Protocol and Extensible Authentication Protocol to provide the same functionality
as PPPoE, but in a less robust manner.

Note: Please be aware, due to an upstream bug, config changes/commits will restart the ppp daemon and will reset
existing IPoE sessions, in order to become effective.

8.10. Service 887

 VyOS Documentation, Release 1.5.x (circinus)

Configuring IPoE Server

IPoE can be configured on different interfaces, it will depend on each specific situation which interface will provide
IPoE to clients. The client’s mac address and the incoming interface is being used as control parameter, to authenticate
a client.
The example configuration below will assign an IP to the client on the incoming interface eth1 with the client mac
address 00:50:79:66:68:00. Other DHCP discovery requests will be ignored, unless the client mac has been enabled in
the configuration.

set interfaces ethernet eth1 address '192.168.0.1/24'

set service ipoe-server authentication interface eth1.100 mac 00:50:79:66:68:00
set service ipoe-server authentication interface eth1.101 mac 00:50:79:66:68:01
set service ipoe-server authentication mode 'local'
set service ipoe-server client-ip-pool IPOE-POOL range '192.168.0.2-192.168.0.254'
set service ipoe-server default-pool 'IPOE-POOL'
set service ipoe-server gateway-address '192.168.0.1/24'
set service ipoe-server interface eth1 mode 'l2'
set service ipoe-server interface eth1 network 'vlan'
set service ipoe-server interface eth1 vlan '100-200'

set service ipoe-server authentication interface <interface> mac <MAC>

Creates local IPoE user with username=**<interface>** and password=**<MAC>** (mac-address)
set service ipoe-server authentication mode <local | radius>
Set authentication backend. The configured authentication backend is used for all queries.
• radius: All authentication queries are handled by a configured RADIUS server.
• local: All authentication queries are handled locally.
• noauth: Authentication disabled
set service ipoe-server client-ip-pool <POOL-NAME> range <x.x.x.x-x.x.x.x | x.x.x.x/x>
Use this command to define the first IP address of a pool of addresses to be given to IPoE clients. If notation
x.x.x.x-x.x.x.x, it must be within a /24 subnet. If notation x.x.x.x/x is used there is possibility to set
host/netmask.
set service ipoe-server default-pool <POOL-NAME>
Use this command to define default address pool name.
set service ipoe-server gateway-address <x.x.x.x/x>
Specifies address to be used as server ip address if radius can assign only client address. In such case if client
address is matched network and mask then specified address and mask will be used. You can specify multiple
such options.
set service ipoe-server interface <interface> mode <l2 | l3>
Specifies the client connectivity mode.
• l2: It means that clients are on same network where interface is.**(default)**
• l3: It means that client are behind some router.
set service ipoe-server interface <interface> network <shared | vlan>
Specify where interface is shared by multiple users or it is vlan-per-user.
• shared: Multiple clients share the same network. (default)

8.10. Service 888

 VyOS Documentation, Release 1.5.x (circinus)

• vlan: One VLAN per client.

vyos@vyos:~$ show ipoe-server sessions

ifname | username | calling-sid | ip | rate-limit | type | comp | state ␣

˓→ | uptime
--------+----------+-------------------+-------------+------------+------+------+--------
˓→+----------

ipoe0 | eth1.100 | 00:50:79:66:68:00 | 192.168.0.2 | | ipoe | | active␣

˓→| 00:04:55

ipoe1 | eth1.101 | 00:50:79:66:68:01 | 192.168.0.3 | | ipoe | | active␣

˓→| 00:04:44

Configuring RADIUS authentication

To enable RADIUS based authentication, the authentication mode needs to be changed within the configuration. Pre-
vious settings like the local users, still exists within the configuration, however they are not used if the mode has been
changed from local to radius. Once changed back to local, it will use all local accounts again.

set service ipoe-server authentication mode radius

set service ipoe-server authentication radius server <server> key <secret>

Configure RADIUS <server> and its required shared <secret> for communicating with the RADIUS server.
Since the RADIUS server would be a single point of failure, multiple RADIUS servers can be setup and will be used
subsequentially. For example:

set service ipoe-server authentication radius server 10.0.0.1 key 'foo'

set service ipoe-server authentication radius server 10.0.0.2 key 'foo'

Note: Some RADIUS severs use an access control list which allows or denies queries, make sure to add your VyOS
router to the allowed client list.

RADIUS source address

If you are using OSPF as IGP, always the closest interface connected to the RADIUS server is used. With VyOS 1.2
you can bind all outgoing RADIUS requests to a single source IP e.g. the loopback interface.
set service ipoe-server authentication radius source-address <address>
Source IPv4 address used in all RADIUS server queires.

Note: The source-address must be configured on one of VyOS interface. Best practice would be a loopback or
dummy interface.

8.10. Service 889

 VyOS Documentation, Release 1.5.x (circinus)

RADIUS advanced options

set service ipoe-server authentication radius server <server> port <port>

Configure RADIUS <server> and its required port for authentication requests.
set service ipoe-server authentication radius server <server> fail-time <time>
Mark RADIUS server as offline for this given <time> in seconds.
set service ipoe-server authentication radius server <server> disable
Temporary disable this RADIUS server.
set service ipoe-server authentication radius acct-timeout <timeout>
Timeout to wait reply for Interim-Update packets. (default 3 seconds)
set service ipoe-server authentication radius dynamic-author server <address>
Specifies IP address for Dynamic Authorization Extension server (DM/CoA)
set service ipoe-server authentication radius dynamic-author port <port>
Port for Dynamic Authorization Extension server (DM/CoA)
set service ipoe-server authentication radius dynamic-author key <secret>
Secret for Dynamic Authorization Extension server (DM/CoA)
set service ipoe-server authentication radius max-try <number>
Maximum number of tries to send Access-Request/Accounting-Request queries
set service ipoe-server authentication radius timeout <timeout>
Timeout to wait response from server (seconds)
set service ipoe-server authentication radius nas-identifier <identifier>
Value to send to RADIUS server in NAS-Identifier attribute and to be matched in DM/CoA requests.
set service ipoe-server authentication radius nas-ip-address <address>
Value to send to RADIUS server in NAS-IP-Address attribute and to be matched in DM/CoA requests. Also
DM/CoA server will bind to that address.
set service ipoe-server authentication radius source-address <address>
Source IPv4 address used in all RADIUS server queires.
set service ipoe-server authentication radius rate-limit attribute <attribute>
Specifies which RADIUS server attribute contains the rate limit information. The default attribute is Filter-Id.

Note: If you set a custom RADIUS attribute you must define it on both dictionaries at RADIUS server and client.

set service ipoe-server authentication radius rate-limit enable

Enables bandwidth shaping via RADIUS.
set service ipoe-server authentication radius rate-limit vendor
Specifies the vendor dictionary, dictionary needs to be in /usr/share/accel-ppp/radius.
Received RADIUS attributes have a higher priority than parameters defined within the CLI configuration, refer to the
explanation below.

8.10. Service 890

 VyOS Documentation, Release 1.5.x (circinus)

Allocation clients ip addresses by RADIUS

If the RADIUS server sends the attribute Framed-IP-Address then this IP address will be allocated to the client and
the option default-pool within the CLI config is being ignored.
If the RADIUS server sends the attribute Framed-Pool, IP address will be allocated from a predefined IP pool whose
name equals the attribute value.
If the RADIUS server sends the attribute Stateful-IPv6-Address-Pool, IPv6 address will be allocated from a
predefined IPv6 pool prefix whose name equals the attribute value.
If the RADIUS server sends the attribute Delegated-IPv6-Prefix-Pool, IPv6 delegation pefix will be allocated
from a predefined IPv6 pool delegate whose name equals the attribute value.

Note: Stateful-IPv6-Address-Pool and Delegated-IPv6-Prefix-Pool are defined in RFC6911. If they are

not defined in your RADIUS server, add new dictionary.

User interface can be put to VRF context via RADIUS Access-Accept packet, or change it via RADIUS CoA.
Accel-VRF-Name is used from these purposes. It is custom ACCEL-PPP attribute. Define it in your RADIUS server.

IPv6

set service ipoe-server client-ipv6-pool <IPv6-POOL-NAME> prefix <address> mask

<number-of-bits>
Use this comand to set the IPv6 address pool from which an IPoE client will get an IPv6 prefix of your defined
length (mask) to terminate the IPoE endpoint at their side. The mask length can be set from 48 to 128 bit long,
the default value is 64.
set service ipoe-server client-ipv6-pool <IPv6-POOL-NAME> delegate <address>
delegation-prefix <number-of-bits>
Use this command to configure DHCPv6 Prefix Delegation (RFC3633) on IPoE. You will have to set your IPv6
pool and the length of the delegation prefix. From the defined IPv6 pool you will be handing out networks of
the defined length (delegation-prefix). The length of the delegation prefix can be set from 32 to 64 bit long.
set service ipoe-server default-ipv6-pool <IPv6-POOL-NAME>
Use this command to define default IPv6 address pool name.

set service ipoe-server client-ipv6-pool IPv6-POOL delegate '2001:db8:8003::/48'␣

˓→delegation-prefix '56'

set service ipoe-server client-ipv6-pool IPv6-POOL prefix '2001:db8:8002::/48' mask '64'

set service ipoe-server default-ipv6-pool IPv6-POOL

Scripting

set service ipoe-server extended-scripts on-change <path_to_script>

Script to run when session interface changed by RADIUS CoA handling
set service ipoe-server extended-scripts on-down <path_to_script>
Script to run when session interface going to terminate
set service ipoe-server extended-scripts on-pre-up <path_to_script>

8.10. Service 891

 VyOS Documentation, Release 1.5.x (circinus)

Script to run before session interface comes up

set service ipoe-server extended-scripts on-up <path_to_script>
Script to run when session interface is completely configured and started

Advanced Options

Authentication Advanced Options

set service ipoe-server authentication interface <interface> mac <MAC> vlan <vlan-id>
VLAN monitor for automatic creation of VLAN interfaces for specific user on specific <interface>
set service ipoe-server authentication interface <interface> mac <MAC> rate-limit
download <bandwidth>
Download bandwidth limit in kbit/s for user on interface <interface>.
set service ipoe-server authentication interface <interface> mac <MAC> rate-limit upload
<bandwidth>
Upload bandwidth limit in kbit/s for for user on interface <interface>.

Client IP Pool Advanced Options

set service ipoe-server client-ip-pool <POOL-NAME> next-pool <NEXT-POOL-NAME>

Use this command to define the next address pool name.

Advanced Interface Options

set service ipoe-server interface <interface> client-subnet <x.x.x.x/x>

Specify local range of ip address to give to dhcp clients. First IP in range is router IP. If you need more cus-
tomization use client-ip-pool
set service ipoe-server interface <interface> external-dhcp dhcp-relay <x.x.x.x>
Specify DHCPv4 relay IP address to pass requests to. If specified giaddr is also needed.
set service ipoe-server interface <interface> external-dhcp giaddr <x.x.x.x>
Specifies relay agent IP addre

Global Advanced options

set service ipoe-server description <description>

Set description.
set service ipoe-server limits burst <value>
Burst count
set service ipoe-server limits connection-limit <value>
Acceptable rate of connections (e.g. 1/min, 60/sec)

8.10. Service 892

 VyOS Documentation, Release 1.5.x (circinus)

set service ipoe-server limits timeout <value>

Timeout in seconds
set service ipoe-server max-concurrent-sessions
Maximum number of concurrent session start attempts
set service ipoe-server name-server <address>
Connected client should use <address> as their DNS server. This command accepts both IPv4 and IPv6 ad-
dresses. Up to two nameservers can be configured for IPv4, up to three for IPv6.
set service ipoe-server shaper fwmark <1-2147483647>
Match firewall mark value
set service ipoe-server snmp master-agent
Enable SNMP

Monitoring

show ipoe-server sessions

Use this command to locally check the active sessions in the IPoE server.

vyos@vyos:~$ show ipoe-server sessions

ifname | username | calling-sid | ip | rate-limit | type | comp | state ␣
˓→| uptime
----------+----------+-------------------+-------------+------------+------+------+------
˓→--+----------

eth1.100 | eth1.100 | 0c:98:bd:b8:00:01 | 192.168.0.3 | | ipoe | |␣

˓→active | 03:03:58

vyos@vyos:~$ show ipoe-server statistics

uptime: 0.03:31:36
cpu: 0%
mem(rss/virt): 6044/101360 kB
core:
mempool_allocated: 148628
mempool_available: 144748
thread_count: 1
thread_active: 1
context_count: 10
context_sleeping: 0
context_pending: 0
md_handler_count: 6
md_handler_pending: 0
timer_count: 1
timer_pending: 0
sessions:
starting: 0
active: 1
finishing: 0
ipoe:
starting: 0
(continues on next page)

8.10. Service 893

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

active: 1
delayed: 0

Toubleshooting

vyos@vyos:~$ show log ipoe-server

Feb 27 14:29:27 vyos accel-ipoe[2262]: eth1.100:: recv [DHCPv4 Discover xid=55df9228␣

˓→chaddr=0c:98:bd:b8:00:01 <Message-Type Discover> <Request-IP 192.168.0.3> <Host-Name␣

˓→vyos> <Request-List Subnet,Broadcast,Router,DNS,Classless-Route,Domain-Name,MTU>]

Feb 27 14:29:27 vyos accel-ipoe[2262]: eth1.100:eth1.100: eth1.100: authentication␣

˓→succeeded

Feb 27 14:29:27 vyos accel-ipoe[2262]: eth1.100:eth1.100: send [DHCPv4 Offer␣

˓→xid=55df9228 yiaddr=192.168.0.4 chaddr=0c:98:bd:b8:00:01 <Message-Type Offer> <Server-

˓→ID 192.168.0.1> <Lease-Time 600> <T1 300> <T2 525> <Router 192.168.0.1> <Subnet 255.

˓→255.255.0>]

Feb 27 14:29:27 vyos accel-ipoe[2262]: eth1.100:eth1.100: recv [DHCPv4 Request␣

˓→xid=55df9228 chaddr=0c:98:bd:b8:00:01 <Message-Type Request> <Server-ID 192.168.0.1>

˓→<Request-IP 192.168.0.4> <Host-Name vyos> <Request-List Subnet,Broadcast,Router,DNS,

˓→Classless-Route,Domain-Name,MTU>]

Feb 27 14:29:27 vyos accel-ipoe[2262]: eth1.100:eth1.100: ipoe: activate session

Feb 27 14:29:27 vyos accel-ipoe[2262]: eth1.100:eth1.100: ipoe: no free IPv6 address
Feb 27 14:29:27 vyos accel-ipoe[2262]: eth1.100:eth1.100: ipoe: session started
Feb 27 14:29:27 vyos accel-ipoe[2262]: eth1.100:eth1.100: send [DHCPv4 Ack xid=55df9228␣
˓→yiaddr=192.168.0.4 chaddr=0c:98:bd:b8:00:01 <Message-Type Ack> <Server-ID 192.168.0.1>

˓→<Lease-Time 600> <T1 300> <T2 525> <Router 192.168.0.1> <Subnet 255.255.255.0>]

8.10.13 LLDP

LLDP (Link Layer Discovery Protocol) is a vendor-neutral link layer protocol in the Internet Protocol Suite used by
network devices for advertising their identity, capabilities, and neighbors on an IEEE 802 local area network, principally
wired Ethernet. The protocol is formally referred to by the IEEE as Station and Media Access Control Connectivity
Discovery specified in IEEE 802.1AB and IEEE 802.3-2012 section 6 clause 79.
LLDP performs functions similar to several proprietary protocols, such as CDP (Cisco Discovery Protocol), FDP
(Foundry Discovery Protocol), NDP (Nortel Discovery Protocol) and LLTD (Link Layer Topology Discovery).
Information gathered with LLDP is stored in the device as a MIB (Management Information Database) and can be
queried with SNMP (Simple Network Management Protocol) as specified in RFC 2922. The topology of an LLDP-
enabled network can be discovered by crawling the hosts and querying this database. Information that may be retrieved
include:
• System Name and Description
• Port name and description
• VLAN name
• IP management address
• System capabilities (switching, routing, etc.)
• MAC/PHY information

8.10. Service 894

 VyOS Documentation, Release 1.5.x (circinus)

• MDI power
• Link aggregation

Configuration

set service lldp

Enable LLDP service
set service lldp management-address <address>
Define IPv4/IPv6 management address transmitted via LLDP. Multiple addresses can be defined. Only addresses
connected to the system will be transmitted.
set service lldp interface <interface>
Enable transmission of LLDP information on given <interface>. You can also say all here so LLDP is turned
on on every interface.
set service lldp interface <interface> disable
Disable transmit of LLDP frames on given <interface>. Useful to exclude certain interfaces from LLDP when
all have been enabled.
set service lldp snmp
Enable SNMP queries of the LLDP database
set service lldp legacy-protocols <cdp|edp|fdp|sonmp>
Enable given legacy protocol on this LLDP instance. Legacy protocols include:
• cdp - Listen for CDP for Cisco routers/switches
• edp - Listen for EDP for Extreme routers/switches
• fdp - Listen for FDP for Foundry routers/switches
• sonmp - Listen for SONMP for Nortel routers/switches

Operation

show lldp neighbors

Displays information about all neighbors discovered via LLDP.

vyos@vyos:~$ show lldp neighbors

Capability Codes: R - Router, B - Bridge, W - Wlan r - Repeater, S - Station
D - Docsis, T - Telephone, O - Other

Device ID Local Proto Cap Platform Port ID

--------- ----- ----- --- -------- -------
BR2.vyos.net eth0 LLDP R VyOS 1.2.4 eth1
BR3.vyos.net eth0 LLDP RB VyOS 1.2.4 eth2
SW1.vyos.net eth0 LLDP B Cisco IOS Software ␣
˓→GigabitEthernet0/6

show lldp neighbors detail

Get detailed information about LLDP neighbors.

8.10. Service 895

 VyOS Documentation, Release 1.5.x (circinus)

vyos@vyos:~$ show lldp neighbors detail

-------------------------------------------------------------------------------
LLDP neighbors:
-------------------------------------------------------------------------------
Interface: eth0, via: LLDP, RID: 28, Time: 0 day, 00:24:33
Chassis:
ChassisID: mac 00:53:00:01:02:c9
SysName: BR2.vyos.net
SysDescr: VyOS 1.3-rolling-201912230217
MgmtIP: 192.0.2.1
MgmtIP: 2001:db8::ffff
Capability: Bridge, on
Capability: Router, on
Capability: Wlan, off
Capability: Station, off
Port:
PortID: mac 00:53:00:01:02:c9
PortDescr: eth0
TTL: 120
PMD autoneg: supported: no, enabled: no
MAU oper type: 10GigBaseCX4 - X copper over 8 pair 100-Ohm balanced cable
VLAN: 201 eth0.201
VLAN: 205 eth0.205
LLDP-MED:
Device Type: Network Connectivity Device
Capability: Capabilities, yes
Capability: Policy, yes
Capability: Location, yes
Capability: MDI/PSE, yes
Capability: MDI/PD, yes
Capability: Inventory, yes
Inventory:
Hardware Revision: None
Software Revision: 4.19.89-amd64-vyos
Firmware Revision: 6.00
Serial Number: VMware-42 1d 83 b9 fe c1 bd b2-7
Manufacturer: VMware, Inc.
Model: VMware Virtual Platform
Asset ID: No Asset Tag
-------------------------------------------------------------------------------

show lldp neighbors interface <interface>

Show LLDP neighbors connected via interface <interface>.
show log lldp
Used for troubleshooting.

8.10. Service 896

 VyOS Documentation, Release 1.5.x (circinus)

8.10.14 mDNS Repeater

Starting with VyOS 1.2 a mDNS (Multicast DNS) repeater functionality is provided. Additional information can be
obtained from https://en.wikipedia.org/wiki/Multicast_DNS.
Multicast DNS uses the reserved address 224.0.0.251, which is “administratively scoped” and does not leave the
subnet. mDNS repeater retransmits mDNS packets from one interface to other interfaces. This enables support for
devices using mDNS discovery (like network printers, Apple Airplay, Chromecast, various IP based home-automation
devices etc) across multiple VLANs.
Since the mDNS protocol sends the AA (Authoritative Answer) records in the packet itself, the repeater does not need
to forge the source address. Instead, the source address is of the interface that repeats the packet.

Configuration

set service mdns repeater interface <interface>

To enable mDNS repeater you need to configure at least two interfaces so that all incoming mDNS packets from
one interface configured here can be re-broadcasted to any other interface(s) configured under this section.
set service mdns repeater disable
mDNS repeater can be temporarily disabled without deleting the service using
set service mdns repeater ip-version <ipv4 | ipv6 | both>
mDNS repeater can be enabled either on IPv4 socket or on IPv6 socket or both to re-broadcast. By default,
mDNS repeater will listen on both IPv4 and IPv6.
set service mdns repeater allow-service <service>
mDNS repeater can be configured to re-broadcast only specific services. By default, all services are re-
broadcasted.
set service mdns repeater browse-domain <domain>
Allow listing additional custom domains to be browsed (in addition to the default local) so that they can be
reflected.

Note: You can not run this in a VRRP setup, if multiple mDNS repeaters are launched in a subnet you will experience
the mDNS packet storm death!

Example

To listen on both eth0 and eth1 mDNS packets and also repeat packets received on eth0 to eth1 (and vice-versa) use the
following commands:

set service mdns repeater interface 'eth0'

set service mdns repeater interface 'eth1'

To allow only specific services, for example _airplay._tcp or _ipp._tcp, (instead of all services) to be re-
broadcasted, use the following command:

set service mdns repeater allow-service '_airplay._tcp'

set service mdns repeater allow-service '_ipp._tcp'

8.10. Service 897

 VyOS Documentation, Release 1.5.x (circinus)

To allow listing additional custom domain, for example openthread.thread.home.arpa, so that it can reflected in
addition to the default local, use the following command:

set service mdns repeater browse-domain 'openthread.thread.home.arpa'

Operation

restart mdns repeater

Restart mDNS repeater service.
show log mdns repeater
Show logs for mDNS repeater service.
monitor log mdns repeater
Follow the logs for mDNS repeater service.

8.10.15 Monitoring

Azure-data-explorer

Telegraf output plugin azure-data-explorer

set service monitoring telegraf azure-data-explorer authentication client-id <client-id>
Authentication application client-id.
set service monitoring telegraf azure-data-explorer authentication client-secret
<client-secret>
Authentication application client-secret.
set service monitoring telegraf azure-data-explorer authentication tenant-id <tenant-id>
Authentication application tenant-id
set service monitoring telegraf azure-data-explorer database <name>
Remote database name.
set service monitoring telegraf azure-data-explorer group-metrics <single-table |
table-per-metric>
Type of metrics grouping when push to Azure Data Explorer. The default is table-per-metric.
set service monitoring telegraf azure-data-explorer table <name>
Name of the single table Only if set group-metrics single-table.
set service monitoring telegraf azure-data-explorer url <url>
Remote URL.

8.10. Service 898

 VyOS Documentation, Release 1.5.x (circinus)

Prometheus-client

Telegraf output plugin prometheus-client

set service monitoring telegraf prometheus-client
Output plugin Prometheus client
set service monitoring telegraf prometheus-client allow-from <prefix>
Networks allowed to query this server
set service monitoring telegraf prometheus-client authentication username <username>
HTTP basic authentication username
set service monitoring telegraf prometheus-client authentication password <password>
HTTP basic authentication username
set service monitoring telegraf prometheus-client listen-address <address>
Local IP addresses to listen on
set service monitoring telegraf prometheus-client metric-version <1 | 2>
Metris version, the default is 2
set service monitoring telegraf prometheus-client port <port>
Port number used by connection, default is 9273
Example:

set service monitoring telegraf prometheus-client

vyos@r14:~$ curl --silent localhost:9273/metrics | egrep -v "#" | grep cpu_usage_system

cpu_usage_system{cpu="cpu-total",host="r14"} 0.20040080160320556
cpu_usage_system{cpu="cpu0",host="r14"} 0.17182130584191915
cpu_usage_system{cpu="cpu1",host="r14"} 0.22896393817971655

Splunk

Telegraf output plugin splunk. HTTP Event Collector.

set service monitoring telegraf splunk authentication insecure
Use TLS but skip host validation
set service monitoring telegraf splunk authentication token <token>
Authorization token
set service monitoring telegraf splunk authentication url <url>
Remote URL to Splunk collector
Example:

set service monitoring telegraf splunk authentication insecure

set service monitoring telegraf splunk authentication token 'xxxxf5b8-xxxx-452a-xxxx-
˓→43828911xxxx'

set service monitoring telegraf splunk url 'https://192.0.2.10:8088/services/collector'

8.10. Service 899

 VyOS Documentation, Release 1.5.x (circinus)

Telegraf

Monitoring functionality with telegraf and InfluxDB 2 is provided. Telegraf is the open source server agent to
help you collect metrics, events and logs from your routers.
set service monitoring telegraf influxdb authentication organization <organization>
Authentication organization name
set service monitoring telegraf influxdb authentication token <token>
Authentication token
set service monitoring telegraf bucket <bucket>
Remote InfluxDB bucket name
set service monitoring telegraf influxdb port <port>
Remote port
set service monitoring telegraf influxdb url <url>
Remote URL

Loki

Telegraf can be used to send logs to Loki using tags as labels.

set service monitoring telegraf loki port <port>
Remote Loki port
Default is 3100
set service monitoring telegraf loki url <url>
Remote Loki url
set service monitoring telegraf loki authentication username <username>
set service monitoring telegraf loki authentication password <password>
HTTP basic authentication.
If either is set both must be set.
set service monitoring telegraf loki metric-name-label <label>
Label to use for the metric name when sending metrics.
If set to an empty string, the label will not be added. This is NOT recommended, as it makes it impossible to
differentiate between multiple metrics.

8.10. Service 900

 VyOS Documentation, Release 1.5.x (circinus)

Example

An example of a configuration that sends telegraf metrics to remote InfluxDB 2

set service monitoring telegraf influxdb authentication organization 'vyos'

set service monitoring telegraf influxdb authentication token 'ZAml9Uy5wrhA...=='
set service monitoring telegraf influxdb bucket 'bucket_vyos'
set service monitoring telegraf influxdb port '8086'
set service monitoring telegraf influxdb url 'http://r1.influxdb2.local'

8.10.16 NTP

NTP (Network Time Protocol) is a networking protocol for clock synchronization between computer systems over
packet-switched, variable-latency data networks. In operation since before 1985, NTP is one of the oldest Internet
protocols in current use.
NTP is intended to synchronize all participating computers to within a few milliseconds of UTC (Coordinated Universal
Time). It uses the intersection algorithm, a modified version of Marzullo’s algorithm, to select accurate time servers
and is designed to mitigate the effects of variable network latency. NTP can usually maintain time to within tens of
milliseconds over the public Internet, and can achieve better than one millisecond accuracy in local area networks under
ideal conditions. Asymmetric routes and network congestion can cause errors of 100 ms or more.
The protocol is usually described in terms of a client-server model, but can as easily be used in peer-to-peer relationships
where both peers consider the other to be a potential time source. Implementations send and receive timestamps using
UDP (User Datagram Protocol) on port number 123.
NTP supplies a warning of any impending leap second adjustment, but no information about local time zones or daylight
saving time is transmitted.
The current protocol is version 4 (NTPv4), which is a proposed standard as documented in RFC 5905. It is backward
compatible with version 3, specified in RFC 1305.

Note: VyOS 1.4 uses chrony instead of ntpd (see T3008) which will no longer accept anonymous NTP requests as in
VyOS 1.3. All configurations will be migrated to keep the anonymous functionality. For new setups if you have clients
using your VyOS installation as NTP server, you must specify the allow-client directive.

Configuration

set service ntp server <address>

Configure one or more servers for synchronisation. Server name can be either an IP address or FQDN (Fully
Qualified Domain Name).
There are 3 default NTP server set. You are able to change them.
• time1.vyos.net
• time2.vyos.net
• time3.vyos.net
set service ntp server <address> <noselect | nts | pool | prefer>
Configure one or more attributes to the given NTP server.
• noselect marks the server as unused, except for display purposes. The server is discarded by the selection
algorithm.

8.10. Service 901

 VyOS Documentation, Release 1.5.x (circinus)

• nts enables Network Time Security (NTS) for the server as specified in RFC 8915
• pool mobilizes persistent client mode association with a number of remote servers.
• prefer marks the server as preferred. All other things being equal, this host will be chosen for synchro-
nization among a set of correctly operating hosts.
set service ntp listen-address <address>
NTP process will only listen on the specified IP address. You must specify the <address> and optionally the
permitted clients. Multiple listen addresses can be configured.
set service ntp allow-client address <address>
List of networks or client addresses permitted to contact this NTP server.
Multiple networks/client IP addresses can be configured.
set service ntp vrf <name>
Specify name of the VRF (Virtual Routing and Forwarding) instance.
set service ntp leap-second [ignore|smear|system|timezone]
Define how to handle leap-seconds.
• ignore: No correction is applied to the clock for the leap second. The clock will be corrected later in normal
operation when new measurements are made and the estimated offset includes the one second error.
• smear: When smearing a leap second, the leap status is suppressed on the server and the served time is
corrected slowly by slewing instead of stepping. The clients do not need any special configuration as they
do not know there is any leap second and they follow the server time which eventually brings them back to
UTC. Care must be taken to ensure they use only NTP servers which smear the leap second in exactly the
same way for synchronisation.
• system: When inserting a leap second, the kernel steps the system clock backwards by one second when the
clock gets to 00:00:00 UTC. When deleting a leap second, it steps forward by one second when the clock
gets to 23:59:59 UTC.
• timezone: This directive specifies a timezone in the system timezone database which chronyd can use to
determine when will the next leap second occur and what is the current offset between TAI and UTC. It
will periodically check if 23:59:59 and 23:59:60 are valid times in the timezone. This normally works with
the right/UTC timezone which is the default

8.10.17 PPPoE Server

VyOS utilizes accel-ppp to provide PPPoE server functionality. It can be used with local authentication or a connected
RADIUS server.

Note: Please be aware, due to an upstream bug, config changes/commits will restart the ppp daemon and will reset
existing PPPoE connections from connected users, in order to become effective.

8.10. Service 902

 VyOS Documentation, Release 1.5.x (circinus)

Configuring PPPoE Server

set service pppoe-server access-concentrator PPPoE-Server

set service pppoe-server authentication mode local
set service pppoe-server authentication local-users username test password 'test'
set service pppoe-server client-ip-pool PPPOE-POOL range 192.168.255.2-192.168.255.254
set service pppoe-server default-pool 'PPPOE-POOL'
set service pppoe-server gateway-address 192.168.255.1
set service pppoe-server interface eth0

set service pppoe-server access-concentrator <name>

Use this command to set a name for this PPPoE-server access concentrator.
set service pppoe-server authentication mode <local | radius>
Set authentication backend. The configured authentication backend is used for all queries.
• radius: All authentication queries are handled by a configured RADIUS server.
• local: All authentication queries are handled locally.
• noauth: Authentication disabled.
set service pppoe-server authentication local-users username <name> password <password>
Create <user> for local authentication on this system. The users password will be set to <pass>.
set service pppoe-server client-ip-pool <POOL-NAME> range <x.x.x.x-x.x.x.x | x.x.x.x/x>
Use this command to define the first IP address of a pool of addresses to be given to pppoe clients. If notation
x.x.x.x-x.x.x.x, it must be within a /24 subnet. If notation x.x.x.x/x is used there is possibility to set
host/netmask.
set service pppoe-server default-pool <POOL-NAME>
Use this command to define default address pool name.
set service pppoe-server interface <interface>
Use this command to define the interface the PPPoE server will use to listen for PPPoE clients.
set service pppoe-server gateway-address <address>
Specifies single <gateway> IP address to be used as local address of PPP interfaces.

Configuring RADIUS authentication

To enable RADIUS based authentication, the authentication mode needs to be changed within the configuration. Pre-
vious settings like the local users, still exists within the configuration, however they are not used if the mode has been
changed from local to radius. Once changed back to local, it will use all local accounts again.

set service pppoe-server authentication mode radius

set service pppoe-server authentication radius server <server> key <secret>

Configure RADIUS <server> and its required shared <secret> for communicating with the RADIUS server.
Since the RADIUS server would be a single point of failure, multiple RADIUS servers can be setup and will be used
subsequentially. For example:

8.10. Service 903

 VyOS Documentation, Release 1.5.x (circinus)

set service pppoe-server authentication radius server 10.0.0.1 key 'foo'

set service pppoe-server authentication radius server 10.0.0.2 key 'foo'

Note: Some RADIUS severs use an access control list which allows or denies queries, make sure to add your VyOS
router to the allowed client list.

RADIUS source address

If you are using OSPF as IGP, always the closest interface connected to the RADIUS server is used. With VyOS 1.2
you can bind all outgoing RADIUS requests to a single source IP e.g. the loopback interface.
set service pppoe-server authentication radius source-address <address>
Source IPv4 address used in all RADIUS server queires.

Note: The source-address must be configured on one of VyOS interface. Best practice would be a loopback or
dummy interface.

RADIUS advanced options

set service pppoe-server authentication radius server <server> port <port>

Configure RADIUS <server> and its required port for authentication requests.
set service pppoe-server authentication radius server <server> fail-time <time>
Mark RADIUS server as offline for this given <time> in seconds.
set service pppoe-server authentication radius server <server> disable
Temporary disable this RADIUS server.
set service pppoe-server authentication radius acct-timeout <timeout>
Timeout to wait reply for Interim-Update packets. (default 3 seconds)
set service pppoe-server authentication radius dynamic-author server <address>
Specifies IP address for Dynamic Authorization Extension server (DM/CoA)
set service pppoe-server authentication radius dynamic-author port <port>
Port for Dynamic Authorization Extension server (DM/CoA)
set service pppoe-server authentication radius dynamic-author key <secret>
Secret for Dynamic Authorization Extension server (DM/CoA)
set service pppoe-server authentication radius max-try <number>
Maximum number of tries to send Access-Request/Accounting-Request queries
set service pppoe-server authentication radius timeout <timeout>
Timeout to wait response from server (seconds)
set service pppoe-server authentication radius nas-identifier <identifier>

8.10. Service 904

 VyOS Documentation, Release 1.5.x (circinus)

Value to send to RADIUS server in NAS-Identifier attribute and to be matched in DM/CoA requests.
set service pppoe-server authentication radius nas-ip-address <address>
Value to send to RADIUS server in NAS-IP-Address attribute and to be matched in DM/CoA requests. Also
DM/CoA server will bind to that address.
set service pppoe-server authentication radius source-address <address>
Source IPv4 address used in all RADIUS server queires.
set service pppoe-server authentication radius rate-limit attribute <attribute>
Specifies which RADIUS server attribute contains the rate limit information. The default attribute is
Filter-Id.

Note: If you set a custom RADIUS attribute you must define it on both dictionaries at RADIUS server and client.

set service pppoe-server authentication radius rate-limit enable

Enables bandwidth shaping via RADIUS.
set service pppoe-server authentication radius rate-limit vendor
Specifies the vendor dictionary, dictionary needs to be in /usr/share/accel-ppp/radius.
Received RADIUS attributes have a higher priority than parameters defined within the CLI configuration, refer to the
explanation below.

Allocation clients ip addresses by RADIUS

If the RADIUS server sends the attribute Framed-IP-Address then this IP address will be allocated to the client and
the option default-pool within the CLI config is being ignored.
If the RADIUS server sends the attribute Framed-Pool, IP address will be allocated from a predefined IP pool whose
name equals the attribute value.
If the RADIUS server sends the attribute Stateful-IPv6-Address-Pool, IPv6 address will be allocated from a
predefined IPv6 pool prefix whose name equals the attribute value.
If the RADIUS server sends the attribute Delegated-IPv6-Prefix-Pool, IPv6 delegation pefix will be allocated
from a predefined IPv6 pool delegate whose name equals the attribute value.

Note: Stateful-IPv6-Address-Pool and Delegated-IPv6-Prefix-Pool are defined in RFC6911. If they are

not defined in your RADIUS server, add new dictionary.

User interface can be put to VRF context via RADIUS Access-Accept packet, or change it via RADIUS CoA.
Accel-VRF-Name is used from these purposes. It is custom ACCEL-PPP attribute. Define it in your RADIUS server.

8.10. Service 905

 VyOS Documentation, Release 1.5.x (circinus)

Renaming clients interfaces by RADIUS

If the RADIUS server uses the attribute NAS-Port-Id, ppp tunnels will be renamed.

Note: The value of the attribute NAS-Port-Id must be less than 16 characters, otherwise the interface won’t be
renamed.

Automatic VLAN Creation

set service pppoe-server interface <interface> vlan <id | range>

VLAN’s can be created by Accel-ppp on the fly via the use of a Kernel module named vlan_mon, which is
monitoring incoming vlans and creates the necessary VLAN if required and allowed. VyOS supports the use of
either VLAN ID’s or entire ranges, both values can be defined at the same time for an interface.
When configured, PPPoE will create the necessary VLANs when required. Once the user session has been
cancelled and the VLAN is not needed anymore, VyOS will remove it again.

set service pppoe-server interface eth3 vlan 100

set service pppoe-server interface eth3 vlan 200
set service pppoe-server interface eth3 vlan 500-1000
set service pppoe-server interface eth3 vlan 2000-3000

Bandwidth Shaping

Bandwidth rate limits can be set for local users or RADIUS based attributes.

For Local Users

set service pppoe-server authentication local-users username <user> rate-limit download

<bandwidth>
Download bandwidth limit in kbit/s for <user>.
set service pppoe-server authentication local-users username <user> rate-limit upload
<bandwidth>
Upload bandwidth limit in kbit/s for <user>.

set service pppoe-server access-concentrator 'ACN'

set service pppoe-server authentication local-users username foo password 'bar'
set service pppoe-server authentication local-users username foo rate-limit download
˓→'20480'

set service pppoe-server authentication local-users username foo rate-limit upload '10240
˓→'

set service pppoe-server authentication mode 'local'

set service pppoe-server client-ip-pool IP-POOL range '10.1.1.100/24'
set service pppoe-server default-pool 'IP-POOL'
set service pppoe-server name-server '10.100.100.1'
set service pppoe-server name-server '10.100.200.1'
set service pppoe-server interface 'eth1'
set service pppoe-server gateway-address '10.1.1.2'

8.10. Service 906

 VyOS Documentation, Release 1.5.x (circinus)

Once the user is connected, the user session is using the set limits and can be displayed via show pppoe-server
sessions.

show pppoe-server sessions

ifname | username | ip | calling-sid | rate-limit | state | uptime |␣
˓→rx-bytes | tx-bytes

-------+----------+------------+-------------------+-------------+--------+----------+---
˓→-------+----------

ppp0 | foo | 10.1.1.100 | 00:53:00:ba:db:15 | 20480/10240 | active | 00:00:11 |␣

˓→214 B | 76 B

For RADIUS users

The current attribute Filter-Id is being used as default and can be setup within RADIUS:
Filter-Id=2000/3000 (means 2000Kbit down-stream rate and 3000Kbit up-stream rate)
The command below enables it, assuming the RADIUS connection has been setup and is working.
set service pppoe-server authentication radius rate-limit enable
Use this command to enable bandwidth shaping via RADIUS.
Other attributes can be used, but they have to be in one of the dictionaries in /usr/share/accel-ppp/radius.

Load Balancing

set service pppoe-server pado-delay <number-of-ms> sessions <number-of-sessions>

Use this command to enable the delay of PADO (PPPoE Active Discovery Offer) packets, which can be used as
a session balancing mechanism with other PPPoE servers.

set service pppoe-server pado-delay 50 sessions '500'

set service pppoe-server pado-delay 100 sessions '1000'
set service pppoe-server pado-delay 300 sessions '3000'

In the example above, the first 499 sessions connect without delay. PADO packets will be delayed 50 ms for connection
from 500 to 999, this trick allows other PPPoE servers send PADO faster and clients will connect to other servers. Last
command says that this PPPoE server can serve only 3000 clients.

IPv6

set service pppoe-server ppp-options ipv6 <require | prefer | allow | deny>

Specifies IPv6 negotiation preference.
• require - Require IPv6 negotiation
• prefer - Ask client for IPv6 negotiation, do not fail if it rejects
• allow - Negotiate IPv6 only if client requests
• deny - Do not negotiate IPv6 (default value)
set service pppoe-server client-ipv6-pool <IPv6-POOL-NAME> prefix <address> mask
<number-of-bits>

8.10. Service 907

 VyOS Documentation, Release 1.5.x (circinus)

Use this comand to set the IPv6 address pool from which an PPPoE client will get an IPv6 prefix of your defined
length (mask) to terminate the PPPoE endpoint at their side. The mask length can be set from 48 to 128 bit long,
the default value is 64.
set service pppoe-server client-ipv6-pool <IPv6-POOL-NAME> delegate <address>
delegation-prefix <number-of-bits>
Use this command to configure DHCPv6 Prefix Delegation (RFC3633) on PPPoE. You will have to set your
IPv6 pool and the length of the delegation prefix. From the defined IPv6 pool you will be handing out networks
of the defined length (delegation-prefix). The length of the delegation prefix can be set from 32 to 64 bit long.
set service pppoe-server default-ipv6-pool <IPv6-POOL-NAME>
Use this command to define default IPv6 address pool name.

set service pppoe-server ppp-options ipv6 allow

set service pppoe-server client-ipv6-pool IPv6-POOL delegate '2001:db8:8003::/48'␣
˓→delegation-prefix '56'

set service pppoe-server client-ipv6-pool IPv6-POOL prefix '2001:db8:8002::/48' mask '64'

set service pppoe-server default-ipv6-pool IPv6-POOL

IPv6 Advanced Options

set service pppoe-server ppp-options ipv6-accept-peer-interface-id

Accept peer interface identifier. By default is not defined.
set service pppoe-server ppp-options ipv6-interface-id <random | x:x:x:x>
Specifies fixed or random interface identifier for IPv6. By default is fixed.
• random - Random interface identifier for IPv6
• x:x:x:x - Specify interface identifier for IPv6
set service pppoe-server ppp-options ipv6-interface-id <random | x:x:x:x>
Specifies peer interface identifier for IPv6. By default is fixed.
• random - Random interface identifier for IPv6
• x:x:x:x - Specify interface identifier for IPv6
• ipv4-addr - Calculate interface identifier from IPv4 address.
• calling-sid - Calculate interface identifier from calling-station-id.

Scripting

set service pppoe-server extended-scripts on-change <path_to_script>

Script to run when session interface changed by RADIUS CoA handling
set service pppoe-server extended-scripts on-down <path_to_script>
Script to run when session interface going to terminate
set service pppoe-server extended-scripts on-pre-up <path_to_script>
Script to run before session interface comes up
set service pppoe-server extended-scripts on-up <path_to_script>

8.10. Service 908

 VyOS Documentation, Release 1.5.x (circinus)

Script to run when session interface is completely configured and started

Advanced Options

Authentication Advanced Options

set service pppoe-server authentication local-users username <user> disable

Disable <user> account.
set service pppoe-server authentication local-users username <user> static-ip <address>
Assign static IP address to <user> account.
set service pppoe-server authentication protocols <pap | chap | mschap | mschap-v2>
Require the peer to authenticate itself using one of the following protocols: pap, chap, mschap, mschap-v2.

Client IP Pool Advanced Options

set service pppoe-server client-ip-pool <POOL-NAME> next-pool <NEXT-POOL-NAME>

Use this command to define the next address pool name.

PPP Advanced Options

set service pppoe-server ppp-options disable-ccp

Disable Compression Control Protocol (CCP). CCP is enabled by default.
set service pppoe-server ppp-options interface-cache <number>
Specifies number of interfaces to keep in cache. It means that don’t destroy interface after corresponding session
is destroyed, instead place it to cache and use it later for new sessions repeatedly. This should reduce kernel-level
interface creation/deletion rate lack. Default value is 0.
set service pppoe-server ppp-options ipv4 <require | prefer | allow | deny>
Specifies IPv4 negotiation preference.
• require - Require IPv4 negotiation
• prefer - Ask client for IPv4 negotiation, do not fail if it rejects
• allow - Negotiate IPv4 only if client requests (Default value)
• deny - Do not negotiate IPv4
set service pppoe-server ppp-options lcp-echo-failure <number>
Defines the maximum <number> of unanswered echo requests. Upon reaching the value <number>, the session
will be reset. Default value is 3.
set service pppoe-server ppp-options lcp-echo-interval <interval>
If this option is specified and is greater than 0, then the PPP module will send LCP pings of the echo request
every <interval> seconds. Default value is 30.
set service pppoe-server ppp-options lcp-echo-timeout

8.10. Service 909

 VyOS Documentation, Release 1.5.x (circinus)

Specifies timeout in seconds to wait for any peer activity. If this option specified it turns on adaptive lcp echo
functionality and “lcp-echo-failure” is not used. Default value is 0.
set service pppoe-server ppp-options min-mtu <number>
Defines minimum acceptable MTU. If client will try to negotiate less then specified MTU then it will be NAKed
or disconnected if rejects greater MTU. Default value is 100.
set service pppoe-server ppp-options mppe <require | prefer | deny>
Specifies MPPE (Microsoft Point-to-Point Encryption) negotiation preference.
• require - ask client for mppe, if it rejects drop connection
• prefer - ask client for mppe, if it rejects don’t fail. (Default value)
• deny - deny mppe
Default behavior - don’t ask client for mppe, but allow it if client wants. Please note that RADIUS may override
this option by MS-MPPE-Encryption-Policy attribute.
set service pppoe-server ppp-options mru <number>
Defines preferred MRU. By default is not defined.

Global Advanced options

set service pppoe-server description <description>

Set description.
set service pppoe-server limits burst <value>
Burst count
set service pppoe-server limits connection-limit <value>
Acceptable rate of connections (e.g. 1/min, 60/sec)
set service pppoe-server limits timeout <value>
Timeout in seconds
set service pppoe-server mtu
Maximum Transmission Unit (MTU) (default: 1492)
set service pppoe-server max-concurrent-sessions
Maximum number of concurrent session start attempts
set service pppoe-server name-server <address>
Connected client should use <address> as their DNS server. This command accepts both IPv4 and IPv6 ad-
dresses. Up to two nameservers can be configured for IPv4, up to three for IPv6.
set service pppoe-server service-name <names>
Specifies Service-Name to respond. If absent any Service-Name is acceptable and client’s Service-Name will
be sent back. Also possible set multiple service-names: sn1,sn2,sn3
Per default the user session is being replaced if a second authentication request succeeds. Such session requests can be
either denied or allowed entirely, which would allow multiple sessions for a user in the latter case. If it is denied, the
second session is being rejected even if the authentication succeeds, the user has to terminate its first session and can
then authentication again.

8.10. Service 910

 VyOS Documentation, Release 1.5.x (circinus)

set service pppoe-server session-control

• disable: Disables session control.
• deny: Deny second session authorization.
• replace: Terminate first session when second is authorized (default)
set service pppoe-server shaper fwmark <1-2147483647>
Match firewall mark value
set service pppoe-server snmp master-agent
Enable SNMP
set service pppoe-server wins-server <address>
Windows Internet Name Service (WINS) servers propagated to client

Monitoring

show pppoe-server sessions

Use this command to locally check the active sessions in the PPPoE server.

show pppoe-server sessions

ifname | username | ip | calling-sid | rate-limit | state | uptime |␣
˓→rx-bytes | tx-bytes

-------+----------+------------+-------------------+-------------+--------+----------+---
˓→-------+----------

ppp0 | foo | 10.1.1.100 | 00:53:00:ba:db:15 | 20480/10240 | active | 00:00:11 |␣

˓→214 B | 76 B

Examples

IPv4

The example below uses ACN as access-concentrator name, assigns an address from the pool 10.1.1.100-111, termi-
nates at the local endpoint 10.1.1.1 and serves requests only on eth1.

set service pppoe-server access-concentrator 'ACN'

set service pppoe-server authentication local-users username foo password 'bar'
set service pppoe-server authentication mode 'local'
set service pppoe-server client-ip-pool IP-POOL range '10.1.1.100-10.1.1.111'
set service pppoe-server default-pool 'IP-POOL'
set service pppoe-server interface eth1
set service pppoe-server gateway-address '10.1.1.2'
set service pppoe-server name-server '10.100.100.1'
set service pppoe-server name-server '10.100.200.1'

8.10. Service 911

 VyOS Documentation, Release 1.5.x (circinus)

Dual-Stack IPv4/IPv6 provisioning with Prefix Delegation

The example below covers a dual-stack configuration.

set service pppoe-server authentication local-users username test password 'test'

set service pppoe-server authentication mode 'local'
set service pppoe-server client-ip-pool IP-POOL range '192.168.0.1/24'
set service pppoe-server default-pool 'IP-POOL'
set service pppoe-server client-ipv6-pool IPv6-POOL delegate '2001:db8:8003::/48'␣
˓→delegation-prefix '56'

set service pppoe-server client-ipv6-pool IPV6-POOL prefix '2001:db8:8002::/48' mask '64'

set service pppoe-server default-ipv6-pool IPv6-POOL
set service pppoe-server ppp-options ipv6 allow
set service pppoe-server name-server '10.1.1.1'
set service pppoe-server name-server '2001:db8:4860::8888'
set service pppoe-server interface 'eth2'
set service pppoe-server gateway-address '10.100.100.1'

The client, once successfully authenticated, will receive an IPv4 and an IPv6 /64 address to terminate the PPPoE
endpoint on the client side and a /56 subnet for the clients internal use.

vyos@pppoe-server:~$ sh pppoe-server sessions

ifname | username | ip | ip6 | ip6-dp | ␣
˓→calling-sid | rate-limit | state | uptime | rx-bytes | tx-bytes
--------+----------+-------------+--------------------------+---------------------+------
˓→-------------+------------+--------+----------+----------+----------

ppp0 | test | 192.168.0.1 | 2001:db8:8002:0:200::/64 | 2001:db8:8003::1/56 |␣

˓→00:53:00:12:42:eb | | active | 00:00:49 | 875 B | 2.1 KiB

8.10.18 Router Advertisements

RAs (Router advertisements) are described in RFC 4861#section-4.6.2. They are part of what is known as SLAAC.
Supported interface types:
• bonding
• bridge
• ethernet
• geneve
• l2tpv3
• openvpn
• pseudo-ethernet
• tunnel
• vxlan
• wireguard
• wireless
• wwan

8.10. Service 912

 VyOS Documentation, Release 1.5.x (circinus)

Configuration

set service router-advert interface <interface> ...

Field VyOS Option Description

Cur Hop Limit hop-limit Hop count field of the outgoing RA packets
“Managed address config- managed-flag Tell hosts to use the administered stateful protocol (i.e.
uration” flag DHCP) for autoconfiguration
“Other configuration” flag other-config-flag Tell hosts to use the administered (stateful) protocol (i.e.
DHCP) for autoconfiguration of other (non-address) in-
formation
MTU link-mtu Link MTU value placed in RAs, excluded in RAs if unset
Router Lifetime default-lifetime Lifetime associated with the default router in units of
seconds
Reachable Time reachable-time Time, in milliseconds, that a node assumes a neighbor is
reachable after having received a reachability confirma-
tion
Retransmit Timer retrans-timer Time in milliseconds between retransmitted Neighbor
Solicitation messages
Default Router Preference default-preference Preference associated with the default router
Interval interval Min and max intervals between unsolicited multicast
RAs
DNSSL dnssl DNS search list to advertise
Name Server name-server Advertise DNS server per https://tools.ietf.org/html/
rfc6106

Advertising a Prefix

set service router-advert interface <interface> prefix <prefix/mask>

Note: You can also opt for using ::/64 as prefix for your RAs. This will take the IPv6 GUA prefix assigned to
the interface, which comes in handy when using DHCPv6-PD.

VyOS Field Description

decrement-lifetime Lifetime is decremented by the number of seconds since the last RA - use in conjunc-
tion with a DHCPv6-PD prefix
deprecate-prefix Upon shutdown, this option will deprecate the prefix by announcing it in the shutdown
RA
no-autonomous-flag Prefix can not be used for stateless address auto-configuration
no-on-link-flag Prefix can not be used for on-link determination
preferred-lifetime Time in seconds that the prefix will remain preferred (default 4 hours)
valid-lifetime Time in seconds that the prefix will remain valid (default: 30 days)

8.10. Service 913

 VyOS Documentation, Release 1.5.x (circinus)

Advertising a NAT64 Prefix

set service router-advert interface <interface> nat64prefix <prefix/mask>

Enable PREF64 option as outlined in RFC 8781.
NAT64 prefix mask must be one of: /32, /40, /48, /56, /64 or 96.

Note: The well known NAT64 prefix is 64:ff9b::/96

VyOS Field Description

valid-lifetime Time in seconds that the prefix will remain valid (default: 65528 seconds)

Disabling Advertisements

To disable advertisements without deleting the configuration:

set service router-advert interface <interface> no-send-advert

Example

Your LAN connected on eth0 uses prefix 2001:db8:beef:2::/64 with the router beeing 2001:db8:beef:2::1

set interfaces ethernet eth0 address 2001:db8:beef:2::1/64

set service router-advert interface eth0 default-preference 'high'

set service router-advert interface eth0 name-server '2001:db8::1'
set service router-advert interface eth0 name-server '2001:db8::2'
set service router-advert interface eth0 other-config-flag
set service router-advert interface eth0 prefix 2001:db8:beef:2::/64

8.10.19 Salt-Minion

SaltStack is Python-based, open-source software for event-driven IT automation, remote task execution, and configura-
tion management. Supporting the “infrastructure as code” approach to data center system and network deployment and
management, configuration automation, SecOps orchestration, vulnerability remediation, and hybrid cloud control.

Requirements

To use the Salt-Minion, a running Salt-Master is required. You can find more in the Salt Project Documentation

8.10. Service 914

 VyOS Documentation, Release 1.5.x (circinus)

Configuration

set service salt-minion hash <type>

The hash type used when discovering file on master server (default: sha256)
set service salt-minion id <id>
Explicitly declare ID for this minion to use (default: hostname)
set service salt-minion interval <1-1440>
Interval in minutes between updates (default: 60)
set service salt-minion master <hostname | IP>
The hostname or IP address of the master
set service salt-minion master-key <key>
URL with signature of master for auth reply verification
Please take a look in the Automation section to find some usefull Examples.

8.10.20 SNMP

SNMP is an Internet Standard protocol for collecting and organizing information about managed devices on IP networks
and for modifying that information to change device behavior. Devices that typically support SNMP include cable
modems, routers, switches, servers, workstations, printers, and more.
SNMP is widely used in network management for network monitoring. SNMP exposes management data in the form
of variables on the managed systems organized in a management information base (MIB) which describe the system
status and configuration. These variables can then be remotely queried (and, in some circumstances, manipulated) by
managing applications.
Three significant versions of SNMP have been developed and deployed. SNMPv1 is the original version of the protocol.
More recent versions, SNMPv2c and SNMPv3, feature improvements in performance, flexibility and security.
SNMP is a component of the Internet Protocol Suite as defined by the Internet Engineering Task Force (IETF). It
consists of a set of standards for network management, including an application layer protocol, a database schema, and
a set of data objects.

Overview and basic concepts

In typical uses of SNMP, one or more administrative computers called managers have the task of monitoring or man-
aging a group of hosts or devices on a computer network. Each managed system executes a software component called
an agent which reports information via SNMP to the manager.
An SNMP-managed network consists of three key components:
• Managed devices
• Agent - software which runs on managed devices
• Network management station (NMS) - software which runs on the manager
A managed device is a network node that implements an SNMP interface that allows unidirectional (read-only) or bidi-
rectional (read and write) access to node-specific information. Managed devices exchange node-specific information
with the NMSs. Sometimes called network elements, the managed devices can be any type of device, including, but not
limited to, routers, access servers, switches, cable modems, bridges, hubs, IP telephones, IP video cameras, computer
hosts, and printers.

8.10. Service 915

 VyOS Documentation, Release 1.5.x (circinus)

An agent is a network-management software module that resides on a managed device. An agent has local knowledge
of management information and translates that information to or from an SNMP-specific form.
A network management station executes applications that monitor and control managed devices. NMSs provide the
bulk of the processing and memory resources required for network management. One or more NMSs may exist on any
managed network.

Fig. 5: Image thankfully borrowed from https://en.wikipedia.org/wiki/File:SNMP_communication_principles_

diagram.PNG which is under the GNU Free Documentation License

Note: VyOS SNMP supports both IPv4 and IPv6.

SNMP Protocol Versions

VyOS itself supports SNMPv2 (version 2) and SNMPv3 (version 3) where the later is recommended because of im-
proved security (optional authentication and encryption).

SNMPv2

SNMPv2 is the original and most commonly used version. For authorizing clients, SNMP uses the concept of commu-
nities. Communities may have authorization set to read only (this is most common) or to read and write (this option is
not actively used in VyOS).
SNMP can work synchronously or asynchronously. In synchronous communication, the monitoring system queries the
router periodically. In asynchronous, the router sends notification to the “trap” (the monitoring host).
SNMPv2 does not support any authentication mechanisms, other than client source address, so you should specify
addresses of clients allowed to monitor the router. Note that SNMPv2 also supports no encryption and always sends
data in plain text.

8.10. Service 916

 VyOS Documentation, Release 1.5.x (circinus)

Example

# Define a community
set service snmp community routers authorization ro

# Allow monitoring access from the entire network

set service snmp community routers network 192.0.2.0/24
set service snmp community routers network 2001::db8:ffff:eeee::/64

# Allow monitoring access from specific addresses

set service snmp community routers client 203.0.113.10
set service snmp community routers client 203.0.113.20

# Define optional router information

set service snmp location "UK, London"
set service snmp contact "[email protected]"

# Trap target if you want asynchronous communication

set service snmp trap-target 203.0.113.10

# Listen only on specific IP addresses (port defaults to 161)

set service snmp listen-address 172.16.254.36 port 161
set service snmp listen-address 2001:db8::f00::1

SNMPv3

SNMPv3 (version 3 of the SNMP protocol) introduced a whole slew of new security related features that have been
missing from the previous versions. Security was one of the biggest weakness of SNMP until v3. Authentication in
SNMP Versions 1 and 2 amounts to nothing more than a password (community string) sent in clear text between a
manager and agent. Each SNMPv3 message contains security parameters which are encoded as an octet string. The
meaning of these security parameters depends on the security model being used.
The security approach in SNMPv3 targets:
• Confidentiality – Encryption of packets to prevent snooping by an unauthorized source.
• Integrity – Message integrity to ensure that a packet has not been tampered while in transit including an optional
packet replay protection mechanism.
• Authentication – to verify that the message is from a valid source.

Example

• Let SNMP daemon listen only on IP address 192.0.2.1

• Configure new SNMP user named “vyos” with password “vyos12345678”
• New user will use SHA/AES for authentication and privacy

set service snmp listen-address 192.0.2.1

set service snmp location 'VyOS Datacenter'
set service snmp v3 engineid '000000000000000000000002'
set service snmp v3 group default mode 'ro'
(continues on next page)

8.10. Service 917

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set service snmp v3 group default view 'default'
set service snmp v3 user vyos auth plaintext-password 'vyos12345678'
set service snmp v3 user vyos auth type 'sha'
set service snmp v3 user vyos group 'default'
set service snmp v3 user vyos privacy plaintext-password 'vyos12345678'
set service snmp v3 user vyos privacy type 'aes'
set service snmp v3 view default oid 1

After commit the plaintext passwords will be hashed and stored in your configuration. The resulting CLI config will
look like:

vyos@vyos# show service snmp

listen-address 192.0.2.1 {
}
location "VyOS Datacenter"
v3 {
engineid 000000000000000000000002
group default {
mode ro
view default
}
user vyos {
auth {
encrypted-password 4e52fe55fd011c9c51ae2c65f4b78ca93dcafdfe
type sha
}
group default
privacy {
encrypted-password 4e52fe55fd011c9c51ae2c65f4b78ca93dcafdfe
type aes
}
}
view default {
oid 1 {
}
}
}

You can test the SNMPv3 functionality from any linux based system, just run the following command: snmpwalk -v
3 -u vyos -a SHA -A vyos12345678 -x AES -X vyos12345678 -l authPriv 192.0.2.1 .1

VyOS MIBs

All SNMP MIBs are located in each image of VyOS here: /usr/share/snmp/mibs/
You are be able to download the files using SCP, once the SSH service has been activated like so

scp -r vyos@your_router:/usr/share/snmp/mibs /your_folder/mibs

8.10. Service 918

 VyOS Documentation, Release 1.5.x (circinus)

SNMP Extensions

To extend SNMP agent functionality, custom scripts can be executed every time the agent is being called. This can be
achieved by using arbitrary extensioncommands. The first step is to create a functional script of course, then up-
load it to your VyOS instance via the command scp your_script.sh vyos@your_router:/config/user-data.
Once the script is uploaded, it needs to be configured via the command below.

set service snmp script-extensions extension-name my-extension script your_script.sh

commit

The OID .1.3.6.1.4.1.8072.1.3.2.3.1.1.4.116.101.115.116, once called, will contain the output of the ex-
tension.

root@vyos:/home/vyos# snmpwalk -v2c -c public 127.0.0.1 nsExtendOutput1

NET-SNMP-EXTEND-MIB::nsExtendOutput1Line."my-extension" = STRING: hello
NET-SNMP-EXTEND-MIB::nsExtendOutputFull."my-extension" = STRING: hello
NET-SNMP-EXTEND-MIB::nsExtendOutNumLines."my-extension" = INTEGER: 1
NET-SNMP-EXTEND-MIB::nsExtendResult."my-extension" = INTEGER: 0

SolarWinds

If you happen to use SolarWinds Orion as NMS you can also use the Device Templates Management. A template for
VyOS can be easily imported.
Create a file named VyOS-1.3.6.1.4.1.44641.ConfigMgmt-Commands using the following content:

<Configuration-Management Device="VyOS" SystemOID="1.3.6.1.4.1.44641">

<Commands>
<Command Name="Reset" Value="set terminal width 0${CRLF}set terminal length 0"/>
<Command Name="Reboot" Value="reboot${CRLF}Yes"/>
<Command Name="EnterConfigMode" Value="configure"/>
<Command Name="ExitConfigMode" Value="commit${CRLF}exit"/>
<Command Name="DownloadConfig" Value="show configuration commands"/>
<Command Name="SaveConfig" Value="commit${CRLF}save"/>
<Command Name="Version" Value="show version"/>
<Command Name="MenuBased" Value="False"/>
<Command Name="VirtualPrompt" Value=":~"/>
</Commands>
</Configuration-Management>

8.10.21 SSH

SSH (Secure Shell) is a cryptographic network protocol for operating network services securely over an unsecured
network. The standard TCP port for SSH is 22. The best known example application is for remote login to computer
systems by users.
SSH provides a secure channel over an unsecured network in a client-server architecture, connecting an SSH client
application with an SSH server. Common applications include remote command-line login and remote command
execution, but any network service can be secured with SSH. The protocol specification distinguishes between two
major versions, referred to as SSH-1 and SSH-2.
The most visible application of the protocol is for access to shell accounts on Unix-like operating systems, but it sees
some limited use on Windows as well. In 2015, Microsoft announced that they would include native support for SSH
in a future release.

8.10. Service 919

 VyOS Documentation, Release 1.5.x (circinus)

SSH was designed as a replacement for Telnet and for unsecured remote shell protocols such as the Berkeley rlogin, rsh,
and rexec protocols. Those protocols send information, notably passwords, in plaintext, rendering them susceptible to
interception and disclosure using packet analysis. The encryption used by SSH is intended to provide confidentiality
and integrity of data over an unsecured network, such as the Internet.

Note: VyOS 1.1 supported login as user root. This has been removed due to tighter security in VyOS 1.2.

See also:
SSH Key Based Authentication

Configuration

set service ssh port <port>

Enabling SSH only requires you to specify the port <port> you want SSH to listen on. By default, SSH runs
on port 22.
set service ssh listen-address <address>
Specify IPv4/IPv6 listen address of SSH server. Multiple addresses can be defined.
set service ssh ciphers <cipher>
Define allowed ciphers used for the SSH connection. A number of allowed ciphers can be specified, use multiple
occurrences to allow multiple ciphers.
List of supported ciphers: 3des-cbc, aes128-cbc, aes192-cbc, aes256-cbc, aes128-ctr, aes192-ctr,
aes256-ctr, arcfour128, arcfour256, arcfour, blowfish-cbc, cast128-cbc
set service ssh disable-password-authentication
Disable password based authentication. Login via SSH keys only. This hardens security!
set service ssh disable-host-validation
Disable the host validation through reverse DNS lookups - can speedup login time when reverse lookup is not
possible.
set service ssh macs <mac>
Specifies the available MAC algorithms. The MAC algorithm is used in protocol version 2 for data integrity
protection. Multiple algorithms can be provided.
List of supported MACs: hmac-md5, hmac-md5-96, hmac-ripemd160, hmac-sha1, hmac-sha1-96,
hmac-sha2-256, hmac-sha2-512, [email protected], [email protected],
[email protected], [email protected], [email protected],
[email protected], [email protected], hmac-sha2-256-etm@openssh.
com, [email protected], [email protected], [email protected]
set service ssh access-control <allow | deny> <group | user> <name>
Add access-control directive to allow or deny users and groups. Directives are processed in the following order
of precedence: deny-users, allow-users, deny-groups and allow-groups.
set service ssh client-keepalive-interval <interval>
Specify timeout interval for keepalive message in seconds.
set service ssh key-exchange <kex>

8.10. Service 920

 VyOS Documentation, Release 1.5.x (circinus)

Specify allowed KEX (Key Exchange) algorithms.

List of supported algorithms: diffie-hellman-group1-sha1, diffie-hellman-group14-sha1,
diffie-hellman-group14-sha256, diffie-hellman-group16-sha512,
diffie-hellman-group18-sha512, diffie-hellman-group-exchange-sha1,
diffie-hellman-group-exchange-sha256, ecdh-sha2-nistp256, ecdh-sha2-nistp384,
ecdh-sha2-nistp521, curve25519-sha256 and [email protected].
set service ssh loglevel <quiet | fatal | error | info | verbose>
Set the sshd log level. The default is info.
set service ssh vrf <name>
Specify name of the VRF instance.
set service ssh pubkey-accepted-algorithm <name>
Specifies the signature algorithms that will be accepted for public key authentication
List of supported algorithms: ssh-ed25519, ssh-ed25519-cert-v01@openssh.
com, [email protected], sk-ssh-ed25519-cert-v01@openssh.
com, ecdsa-sha2-nistp256, [email protected],
ecdsa-sha2-nistp384, [email protected], ecdsa-sha2-nistp521,
[email protected], [email protected],
[email protected], webauthn-sk-ecdsa-sha2-nistp256@openssh.
com, ssh-dss, [email protected], ssh-rsa, ssh-rsa-cert-v01@openssh.
com, rsa-sha2-256, [email protected], rsa-sha2-512,
[email protected]

Dynamic-protection

Protects host from brute-force attacks against SSH. Log messages are parsed, line-by-line, for recognized patterns. If
an attack, such as several login failures within a few seconds, is detected, the offending IP is blocked. Offenders are
unblocked after a set interval.
set service ssh dynamic-protection
Allow ssh dynamic-protection.
set service ssh dynamic-protection allow-from <address | prefix>
Whitelist of addresses and networks. Always allow inbound connections from these systems.
set service ssh dynamic-protection block-time <sec>
Block source IP in seconds. Subsequent blocks increase by a factor of 1.5 The default is 120.
set service ssh dynamic-protection detect-time <sec>
Remember source IP in seconds before reset their score. The default is 1800.
set service ssh dynamic-protection threshold <sec>
Block source IP when their cumulative attack score exceeds threshold. The default is 30.

8.10. Service 921

 VyOS Documentation, Release 1.5.x (circinus)

Operation

restart ssh
Restart the SSH daemon process, the current session is not affected, only the background daemon is restarted.
generate ssh server-key
Re-generated the public/private keyportion which SSH uses to secure connections.

Note: Already learned known_hosts files of clients need an update as the public key will change.

generate ssh client-key /path/to/private_key

Re-generated a known pub/private keyfile which can be used to connect to other services (e.g. RPKI cache).
Example:

vyos@vyos:~$ generate ssh client-key /config/auth/id_rsa_rpki

Generating public/private rsa key pair.
Your identification has been saved in /config/auth/id_rsa_rpki.
Your public key has been saved in /config/auth/id_rsa_rpki.pub.
The key fingerprint is:
SHA256:XGv2PpdOzVCzpmEzJZga8hTRq7B/ZYL3fXaioLFLS5Q vyos@vyos
The key's randomart image is:
+---[RSA 2048]----+
| oo |
| ..o |
| . o.o.. o.|
| o+ooo o.o|
| Eo* =.o |
| o = +.o*+ |
| = o *.o.o|
| o * +.o+.+|
| =.. o=.oo|
+----[SHA256]-----+

Two new files /config/auth/id_rsa_rpki and /config/auth/id_rsa_rpki.pub will be created.

generate public-key-command user <username> path <location>
Generate the configuration mode commands to add a public key for Key Based Authentication.
<location> can be a local path or a URL pointing at a remote file.
Supported remote protocols are FTP, FTPS, HTTP, HTTPS, SCP/SFTP and TFTP.
Example:

alyssa@vyos:~$ generate public-key-command user alyssa path sftp://example.net/home/

˓→alyssa/.ssh/id_rsa.pub

# To add this key as an embedded key, run the following commands:

configure
set system login user alyssa authentication public-keys [email protected] key AAA..
˓→.

set system login user alyssa authentication public-keys [email protected] type ssh-
˓→rsa

commit
(continues on next page)

8.10. Service 922

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

save
exit

ben@vyos:~$ generate public-key-command user ben path ~/.ssh/id_rsa.pub

# To add this key as an embedded key, run the following commands:
configure
set system login user ben authentication public-keys ben@vyos key AAA...
set system login user ben authentication public-keys ben@vyos type ssh-dss
commit
save
exit

show log ssh

Show SSH server log.
monitor log ssh
Follow the SSH server log.
show log ssh dynamic-protection
Show SSH dynamic-protection log.
monitor log ssh dynamic-protection
Follow the SSH dynamic-protection log.
show ssh dynamic-protection
Show list of IPs currently blocked by SSH dynamic-protection.
show ssh fingerprints
Show SSH server public key fingerprints.
show ssh fingerprints ascii
Show SSH server public key fingerprints, including a visual ASCII art representation.

8.10.22 TFTP Server

TFTP (Trivial File Transfer Protocol) is a simple, lockstep file transfer protocol which allows a client to get a file from
or put a file onto a remote host. One of its primary uses is in the early stages of nodes booting from a local area network.
TFTP has been used for this application because it is very simple to implement.

Configuration

set service tftp-server directory <directory>

Enable TFTP service by specifying the <directory> which will be used to serve files.

Hint: Choose your directory location carefully or you will loose the content on image upgrades. Any directory
under /config is save at this will be migrated.

set service tftp-server listen-address <address>

8.10. Service 923

 VyOS Documentation, Release 1.5.x (circinus)

Configure the IPv4 or IPv6 listen address of the TFTP server. Multiple IPv4 and IPv6 addresses can be given.
There will be one TFTP server instances listening on each IP address.
set service tftp-server listen-address <address> vrf <name>
Additional option to run TFTP server in the VRF context

Note: Configuring a listen-address is essential for the service to work.

set service tftp-server allow-upload

Optional, if you want to enable uploads, else TFTP server will act as a read-only server.

Example

Provide TFTP server listening on both IPv4 and IPv6 addresses 192.0.2.1 and 2001:db8::1 serving the content
from /config/tftpboot. Uploading via TFTP to this server is disabled.
The resulting configuration will look like:

vyos@vyos# show service

tftp-server {
directory /config/tftpboot
listen-address 2001:db8::1
listen-address 192.0.2.1
}

Verification

Client:

vyos@RTR2:~$ tftp -p -l /config/config.boot -r backup 192.0.2.1

backup1 100% |******************************| 723 0:00:00 ETA

Server:

vyos@RTR1# ls -ltr /config/tftpboot/

total 1
-rw-rw-rw- 1 tftp tftp 1995 May 19 16:02 backup

8.10.23 Webproxy

The proxy service in VyOS is based on Squid and some related modules.
Squid is a caching and forwarding HTTP web proxy. It has a wide variety of uses, including speeding up a web server
by caching repeated requests, caching web, DNS and other computer network lookups for a group of people sharing
network resources, and aiding security by filtering traffic. Although primarily used for HTTP and FTP, Squid includes
limited support for several other protocols including Internet Gopher, SSL,[6] TLS and HTTPS. Squid does not support
the SOCKS protocol.
URL Filtering is provided by SquidGuard.

8.10. Service 924

 VyOS Documentation, Release 1.5.x (circinus)

Configuration

set service webproxy append-domain <domain>

Use this command to specify a domain name to be appended to domain-names within URLs that do not include
a dot . the domain is appended.
Example: to be appended is set to vyos.net and the URL received is www/foo.html, the system will use the
generated, final URL of www.vyos.net/foo.html.

set service webproxy append-domain vyos.net

set service webproxy cache-size <size>

The size of the on-disk Proxy cache is user configurable. The Proxies default cache-size is configured to 100
MB.
Unit of this command is MB.

set service webproxy cache-size 1024

set service webproxy default-port <port>

Specify the port used on which the proxy service is listening for requests. This port is the default port used for
the specified listen-address.
Default port is 3128.

set service webproxy default-port 8080

set service webproxy domain-block <domain>

Used to block specific domains by the Proxy. Specifying “vyos.net” will block all access to vyos.net, and
specifying “.xxx” will block all access to URLs having an URL ending on .xxx.

set service webproxy domain-block vyos.net

set service webproxy domain-noncache <domain>

Allow access to sites in a domain without retrieving them from the Proxy cache. Specifying “vyos.net” will
allow access to vyos.net but the pages accessed will not be cached. It useful for working around problems with
“If-Modified-Since” checking at certain sites.

set service webproxy domain-noncache vyos.net

set service webproxy listen-address <address>

Specifies proxy service listening address. The listen address is the IP address on which the web proxy service
listens for client requests.
For security, the listen address should only be used on internal/trusted networks!

set service webproxy listen-address 192.0.2.1

set service webproxy listen-address <address> disable-transparent

Disables web proxy transparent mode at a listening address.
In transparent proxy mode, all traffic arriving on port 80 and destined for the Internet is automatically forwarded
through the proxy. This allows immediate proxy forwarding without configuring client browsers.

8.10. Service 925

 VyOS Documentation, Release 1.5.x (circinus)

Non-transparent proxying requires that the client browsers be configured with the proxy settings before requests
are redirected. The advantage of this is that the client web browser can detect that a proxy is in use and can
behave accordingly. In addition, web-transmitted malware can sometimes be blocked by a non-transparent web
proxy, since they are not aware of the proxy settings.

set service webproxy listen-address 192.0.2.1 disable-transparent

set service webproxy listen-address <address> port <port>

Sets the listening port for a listening address. This overrides the default port of 3128 on the specific listen
address.

set service webproxy listen-address 192.0.2.1 port 8080

set service webproxy reply-block-mime <mime>

Used to block a specific mime-type.

# block all PDFs

set service webproxy reply-block-mime application/pdf

set service webproxy reply-body-max-size <size>

Specifies the maximum size of a reply body in KB, used to limit the reply size.
All reply sizes are accepted by default.

set service webproxy reply-body-max-size 2048

set service webproxy safe-ports <port>

Add new port to Safe-ports acl. Ports included by default in Safe-ports acl: 21, 70, 80, 210, 280, 443, 488, 591,
777, 873, 1025-65535
set service webproxy ssl-safe-ports <port>
Add new port to SSL-ports acl. Ports included by default in SSL-ports acl: 443

Authentication

The embedded Squid proxy can use LDAP to authenticate users against a company wide directory. The following
configuration is an example of how to use Active Directory as authentication backend. Queries are done via LDAP.
set service webproxy authentication children <number>
Maximum number of authenticator processes to spawn. If you start too few Squid will have to wait for them
to process a backlog of credential verifications, slowing it down. When password verifications are done via a
(slow) network you are likely to need lots of authenticator processes.
This defaults to 5.

set service webproxy authentication children 10

set service webproxy authentication credentials-ttl <time>

Specifies how long squid assumes an externally validated username:password pair is valid for - in other words
how often the helper program is called for that user. Set this low to force revalidation with short lived passwords.
Time is in minutes and defaults to 60.

8.10. Service 926

 VyOS Documentation, Release 1.5.x (circinus)

set service webproxy authentication credentials-ttl 120

set service webproxy authentication method <ldap>

Proxy authentication method, currently only LDAP is supported.

set service webproxy authentication method ldap

set service webproxy authentication realm

Specifies the protection scope (aka realm name) which is to be reported to the client for the authentication
scheme. It is commonly part of the text the user will see when prompted for their username and password.

set service webproxy authentication realm "VyOS proxy auth"

LDAP

set service webproxy authentication ldap base-dn <base-dn>

Specifies the base DN under which the users are located.

set service webproxy authentication ldap base-dn DC=vyos,DC=net

set service webproxy authentication ldap bind-dn <bind-dn>

The DN and password to bind as while performing searches.

set service webproxy authentication ldap bind-dn CN=proxyuser,CN=Users,DC=vyos,

˓→DC=net

set service webproxy authentication ldap filter-expression <expr>

LDAP search filter to locate the user DN. Required if the users are in a hierarchy below the base DN, or if the
login name is not what builds the user specific part of the users DN.
The search filter can contain up to 15 occurrences of %s which will be replaced by the username, as in “uid=%s”
for RFC 2037 directories. For a detailed description of LDAP search filter syntax see RFC 2254.

set service webproxy authentication ldap filter-expression (cn=%s)

set service webproxy authentication ldap password <password>

The DN and password to bind as while performing searches. As the password needs to be printed in plain text in
your Squid configuration it is strongly recommended to use a account with minimal associated privileges. This
to limit the damage in case someone could get hold of a copy of your Squid configuration file.

set service webproxy authentication ldap password vyos

set service webproxy authentication ldap persistent-connection

Use a persistent LDAP connection. Normally the LDAP connection is only open while validating a username
to preserve resources at the LDAP server. This option causes the LDAP connection to be kept open, allowing it
to be reused for further user validations.
Recommended for larger installations.

set service webproxy authentication ldap persistent-connection

8.10. Service 927

 VyOS Documentation, Release 1.5.x (circinus)

set service webproxy authentication ldap port <port>

Specify an alternate TCP port where the ldap server is listening if other than the default LDAP port 389.

set service webproxy authentication ldap port 389

set service webproxy authentication ldap server <server>

Specify the LDAP server to connect to.

set service webproxy authentication ldap server ldap.vyos.net

set service webproxy authentication ldap use-ssl

Use TLS encryption.

set service webproxy authentication ldap use-ssl

set service webproxy authentication ldap username-attribute <attr>

Specifies the name of the DN attribute that contains the username/login. Combined with the base DN to con-
struct the users DN when no search filter is specified (filter-expression).
Defaults to ‘uid’

Note: This can only be done if all your users are located directly under the same position in the LDAP tree
and the login name is used for naming each user object. If your LDAP tree does not match these criterias
or if you want to filter who are valid users then you need to use a search filter to search for your users DN
(filter-expression).

set service webproxy authentication ldap username-attribute uid

set service webproxy authentication ldap version <2 | 3>

LDAP protocol version. Defaults to 3 if not specified.

set service webproxy authentication ldap version 2

URL filtering

set service webproxy url-filtering disable

Disables web filtering without discarding configuration.

set service webproxy url-filtering disable

8.10. Service 928

 VyOS Documentation, Release 1.5.x (circinus)

Operation

Filtering

Update

If you want to use existing blacklists you have to create/download a database first. Otherwise you will not be able to
commit the config changes.
update webproxy blacklists
Download/Update complete blacklist

vyos@vyos:~$ update webproxy blacklists

Warning: No url-filtering blacklist installed
Would you like to download a default blacklist? [confirm][y]
Connecting to ftp.univ-tlse1.fr (193.49.48.249:21)
blacklists.gz 100%␣
˓→|**************************************************************************************************

˓→17.0M 0:00:00 ETA

Uncompressing blacklist...
Checking permissions...
Skip link for [ads] -> [publicite]
Building DB for [adult/domains] - 2467177 entries
Building DB for [adult/urls] - 67798 entries
Skip link for [aggressive] -> [agressif]
Building DB for [agressif/domains] - 348 entries
Building DB for [agressif/urls] - 36 entries
Building DB for [arjel/domains] - 69 entries
...

Building DB for [webmail/domains] - 374 entries

Building DB for [webmail/urls] - 9 entries

The webproxy daemon must be restarted

Would you like to restart it now? [confirm][y]

[ ok ] Restarting squid (via systemctl): squid.service.

vyos@vyos:~$

update webproxy blacklists category <category>

Download/Update partial blacklist.
Use tab completion to get a list of categories.
• To auto update the blacklist files
set service webproxy url-filtering squidguard auto-update update-hour 23
• To configure blocking add the following to the configuration
set service webproxy url-filtering squidguard block-category ads
set service webproxy url-filtering squidguard block-category malware

8.10. Service 929

 VyOS Documentation, Release 1.5.x (circinus)

Bypassing the webproxy

Some services don’t work correctly when being handled via a web proxy. So sometimes it is useful to bypass a trans-
parent proxy:
• To bypass the proxy for every request that is directed to a specific destination:
set service webproxy whitelist destination-address 198.51.100.33
set service webproxy whitelist destination-address 192.0.2.0/24
• To bypass the proxy for every request that is coming from a specific source:
set service webproxy whitelist source-address 192.168.1.2
set service webproxy whitelist source-address 192.168.2.0/24
(This can be useful when a called service has many and/or often changing destination addresses - e.g. Netflix.)

Examples

vyos@vyos# show service webproxy

authentication {
children 5
credentials-ttl 60
ldap {
base-dn DC=example,DC=local
bind-dn CN=proxyuser,CN=Users,DC=example,DC=local
filter-expression (cn=%s)
password Qwert1234
server ldap.example.local
username-attribute cn
}
method ldap
realm "VyOS Webproxy"
}
cache-size 100
default-port 3128
listen-address 192.168.188.103 {
disable-transparent
}

8.11 System

8.11.1 Acceleration

In this command tree, all hardware acceleration options will be handled. At the moment only Intel® QAT is supported

8.11. System 930

 VyOS Documentation, Release 1.5.x (circinus)

Intel® QAT

show system acceleration qat

use this command to check if there is an Intel® QAT supported Processor in your system.

vyos@vyos:~$ show system acceleration qat

01:00.0 Co-processor [0b40]: Intel Corporation Atom Processor C3000 Series␣
˓→QuickAssist Technology [8086:19e2] (rev 11)

if there is non device the command will show `No QAT device found`
set system acceleration qat
if there is a supported device, enable Intel® QAT
show system acceleration qat status
Check if the Intel® QAT device is up and ready to do the job.

vyos@vyos:~$ show system acceleration qat status

Checking status of all devices.
There is 1 QAT acceleration device(s) in the system:
qat_dev0 - type: c3xxx, inst_id: 0, node_id: 0, bsf: 0000:01:00.0, #accel: 3
˓→#engines: 6 state: up

Operation Mode

show system acceleration qat device <device> config

Show the full config uploaded to the QAT device.
show system acceleration qat device <device> flows
Get an overview over the encryption counters.
show system acceleration qat interrupts
Show binded qat device interrupts to certain core.

Example

Let’s build a simple VPN between 2 Intel® QAT ready devices.

Side A:

set interfaces vti vti1 address '192.168.1.2/24'

set vpn ipsec authentication psk right id '10.10.10.2'
set vpn ipsec authentication psk right id '10.10.10.1'
set vpn ipsec authentication psk right secret 'Qwerty123'
set vpn ipsec esp-group MyESPGroup proposal 1 encryption 'aes256'
set vpn ipsec esp-group MyESPGroup proposal 1 hash 'sha256'
set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group '14'
set vpn ipsec ike-group MyIKEGroup proposal 1 encryption 'aes256'
set vpn ipsec ike-group MyIKEGroup proposal 1 hash 'sha256'
set vpn ipsec interface 'eth0'
set vpn ipsec site-to-site peer right authentication local-id '10.10.10.2'
(continues on next page)

8.11. System 931

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set vpn ipsec site-to-site peer right authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer right authentication remote-id '10.10.10.1'
set vpn ipsec site-to-site peer right connection-type 'initiate'
set vpn ipsec site-to-site peer right default-esp-group 'MyESPGroup'
set vpn ipsec site-to-site peer right ike-group 'MyIKEGroup'
set vpn ipsec site-to-site peer right local-address '10.10.10.2'
set vpn ipsec site-to-site peer right remote-address '10.10.10.1'
set vpn ipsec site-to-site peer right vti bind 'vti1'

Side B:

set interfaces vti vti1 address '192.168.1.1/24'

set vpn ipsec authentication psk left id '10.10.10.2'
set vpn ipsec authentication psk left id '10.10.10.1'
set vpn ipsec authentication psk left secret 'Qwerty123'
set vpn ipsec esp-group MyESPGroup proposal 1 encryption 'aes256'
set vpn ipsec esp-group MyESPGroup proposal 1 hash 'sha256'
set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group '14'
set vpn ipsec ike-group MyIKEGroup proposal 1 encryption 'aes256'
set vpn ipsec ike-group MyIKEGroup proposal 1 hash 'sha256'
set vpn ipsec interface 'eth0'
set vpn ipsec site-to-site peer left authentication local-id '10.10.10.1'
set vpn ipsec site-to-site peer left authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer left authentication remote-id '10.10.10.2'
set vpn ipsec site-to-site peer left connection-type 'initiate'
set vpn ipsec site-to-site peer left default-esp-group 'MyESPGroup'
set vpn ipsec site-to-site peer left ike-group 'MyIKEGroup'
set vpn ipsec site-to-site peer left local-address '10.10.10.1'
set vpn ipsec site-to-site peer left remote-address '10.10.10.2'
set vpn ipsec site-to-site peer left vti bind 'vti1'

a bandwidth test over the VPN got these results:

Connecting to host 192.168.1.2, port 5201

[ 9] local 192.168.1.1 port 51344 connected to 192.168.1.2 port 5201
[ ID] Interval Transfer Bitrate Retr Cwnd
[ 9] 0.00-1.01 sec 32.3 MBytes 268 Mbits/sec 0 196 KBytes
[ 9] 1.01-2.03 sec 32.5 MBytes 268 Mbits/sec 0 208 KBytes
[ 9] 2.03-3.03 sec 32.5 MBytes 271 Mbits/sec 0 208 KBytes
[ 9] 3.03-4.04 sec 32.5 MBytes 272 Mbits/sec 0 208 KBytes
[ 9] 4.04-5.00 sec 31.2 MBytes 272 Mbits/sec 0 208 KBytes
[ 9] 5.00-6.01 sec 32.5 MBytes 272 Mbits/sec 0 234 KBytes
[ 9] 6.01-7.04 sec 32.5 MBytes 265 Mbits/sec 0 234 KBytes
[ 9] 7.04-8.04 sec 32.5 MBytes 272 Mbits/sec 0 234 KBytes
[ 9] 8.04-9.04 sec 32.5 MBytes 273 Mbits/sec 0 336 KBytes
[ 9] 9.04-10.00 sec 31.2 MBytes 272 Mbits/sec 0 336 KBytes
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval Transfer Bitrate Retr
[ 9] 0.00-10.00 sec 322 MBytes 270 Mbits/sec 0 sender
[ 9] 0.00-10.00 sec 322 MBytes 270 Mbits/sec receiver

with set system acceleration qat on both systems the bandwidth increases.

8.11. System 932

 VyOS Documentation, Release 1.5.x (circinus)

Connecting to host 192.168.1.2, port 5201

[ 9] local 192.168.1.1 port 51340 connected to 192.168.1.2 port 5201
[ ID] Interval Transfer Bitrate Retr Cwnd
[ 9] 0.00-1.00 sec 97.3 MBytes 817 Mbits/sec 0 1000 KBytes
[ 9] 1.00-2.00 sec 92.5 MBytes 776 Mbits/sec 0 1.07 MBytes
[ 9] 2.00-3.00 sec 92.5 MBytes 776 Mbits/sec 0 820 KBytes
[ 9] 3.00-4.00 sec 92.5 MBytes 776 Mbits/sec 0 899 KBytes
[ 9] 4.00-5.00 sec 91.2 MBytes 765 Mbits/sec 0 972 KBytes
[ 9] 5.00-6.00 sec 92.5 MBytes 776 Mbits/sec 0 1.02 MBytes
[ 9] 6.00-7.00 sec 92.5 MBytes 776 Mbits/sec 0 1.08 MBytes
[ 9] 7.00-8.00 sec 92.5 MBytes 776 Mbits/sec 0 1.14 MBytes
[ 9] 8.00-9.00 sec 91.2 MBytes 765 Mbits/sec 0 915 KBytes
[ 9] 9.00-10.00 sec 92.5 MBytes 776 Mbits/sec 0 1000 KBytes
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval Transfer Bitrate Retr
[ 9] 0.00-10.00 sec 927 MBytes 778 Mbits/sec 0 sender
[ 9] 0.00-10.01 sec 925 MBytes 775 Mbits/sec receiver

8.11.2 Conntrack

VyOS can be configured to track connections using the connection tracking subsystem. Connection tracking becomes
operational once either stateful firewall or NAT is configured.

Configure

set system conntrack table-size <1-50000000> default: 262144

The connection tracking table contains one entry for each connection being tracked by the system.
set system conntrack expect-table-size <1-50000000> default: 2048
The connection tracking expect table contains one entry for each expected connection related to an existing
connection. These are generally used by “connection tracking helper” modules such as FTP. The default size of
the expect table is 2048 entries.
set system conntrack hash-size <1-50000000> default: 32768
Set the size of the hash table. The connection tracking hash table makes searching the connection tracking table
faster. The hash table uses “buckets” to record entries in the connection tracking table.
set system conntrack modules ftp
set system conntrack modules h323
set system conntrack modules nfs
set system conntrack modules pptp
set system conntrack modules sip
set system conntrack modules sqlnet
set system conntrack modules tftp
Configure the connection tracking protocol helper modules. All modules are enable by default.

Use delete system conntrack modules to deactive all modules.

8.11. System 933

 VyOS Documentation, Release 1.5.x (circinus)

Or, for example ftp, delete system conntrack modules ftp.

set system conntrack tcp half-open-connections <1-21474836> default: 512

Set the maximum number of TCP half-open connections.
set system conntrack tcp loose <enable | disable> default: enable
Policy to track previously established connections.
set system conntrack tcp max-retrans <1-2147483647> default: 3
Set the number of TCP maximum retransmit attempts.

Contrack Timeouts

You can define custom timeout values to apply to a specific subset of connections, based on a packet and flow selector.
To do this, you need to create a rule defining the packet and flow selector.
set system conntrack timeout custom [ipv4 | ipv6] rule <1-999999> description <test>
Set a rule description.
set system conntrack timeout custom [ipv4 | ipv6] rule <1-999999> destination address
<ip-address>
set system conntrack timeout custom [ipv4 | ipv6] rule <1-999999> source address
<ip-address>
Set a destination and/or source address. Accepted input for ipv4:

set system conntrack timeout custom ipv4 rule <1-999999> [source |␣

˓→destination] address

Possible completions:
<x.x.x.x> IPv4 address to match
<x.x.x.x/x> IPv4 prefix to match
<x.x.x.x>-<x.x.x.x> IPv4 address range to match
!<x.x.x.x> Match everything except the specified address
!<x.x.x.x/x> Match everything except the specified prefix
!<x.x.x.x>-<x.x.x.x> Match everything except the specified range

set system conntrack timeout custom ipv6 rule <1-999999> [source |␣

˓→destination] address

Possible completions:
<h:h:h:h:h:h:h:h> IP address to match
<h:h:h:h:h:h:h:h/x> Subnet to match
<h:h:h:h:h:h:h:h>-<h:h:h:h:h:h:h:h>
IP range to match
!<h:h:h:h:h:h:h:h> Match everything except the specified address
!<h:h:h:h:h:h:h:h/x> Match everything except the specified prefix
!<h:h:h:h:h:h:h:h>-<h:h:h:h:h:h:h:h>
Match everything except the specified range

set system conntrack timeout custom [ipv4 | ipv6] rule <1-999999> destination port
<value>
set system conntrack timeout custom [ipv4 | ipv6] rule <1-999999> source port <value>
Set a destination and/or source port. Accepted input:

8.11. System 934

 VyOS Documentation, Release 1.5.x (circinus)

<port name> Named port (any name in /etc/services, e.g., http)

<1-65535> Numbered port
<start>-<end> Numbered port range (e.g., 1001-1005)

Multiple destination ports can be specified as a comma-separated list. The whole list can also be
“negated” using ‘!’. For example: !22,telnet,http,123,1001-1005`
set system conntrack timeout custom [ipv4 | ipv6] rule <1-999999> protocol tcp close
<1-21474836>
set system conntrack timeout custom [ipv4 | ipv6] rule <1-999999> protocol tcp close-wait
<1-21474836>
set system conntrack timeout custom [ipv4 | ipv6] rule <1-999999> protocol tcp
established <1-21474836>
set system conntrack timeout custom [ipv4 | ipv6] rule <1-999999> protocol tcp fin-wait
<1-21474836>
set system conntrack timeout custom [ipv4 | ipv6] rule <1-999999> protocol tcp last-ack
<1-21474836>
set system conntrack timeout custom [ipv4 | ipv6] rule <1-999999> protocol tcp syn-recv
<1-21474836>
set system conntrack timeout custom [ipv4 | ipv6] rule <1-999999> protocol tcp syn-sent
<1-21474836>
set system conntrack timeout custom [ipv4 | ipv6] rule <1-999999> protocol tcp time-wait
<1-21474836>
set system conntrack timeout custom [ipv4 | ipv6] rule <1-999999> protocol udp replied
<1-21474836>
set system conntrack timeout custom [ipv4 | ipv6] rule <1-999999> protocol udp unreplied
<1-21474836>
Set the timeout in seconds for a protocol or state in a custom rule.

Conntrack ignore rules

Note: Important note about conntrack ignore rules: Starting from vyos-1.5-rolling-202406120020, ignore rules
can be defined in set firewall [ipv4 | ipv6] prerouting raw .... It’s expected that in the future the con-
ntrack ignore rules will be removed.
Customized ignore rules, based on a packet and flow selector.

set system conntrack ignore [ipv4 | ipv6] rule <1-999999> description <text>
set system conntrack ignore [ipv4 | ipv6] rule <1-999999> destination address
<ip-address>
set system conntrack ignore [ipv4 | ipv6] rule <1-999999> destination port <port>
set system conntrack ignore [ipv4 | ipv6] rule <1-999999> inbound-interface <interface>
set system conntrack ignore [ipv4 | ipv6] rule <1-999999> protocol <protocol>
set system conntrack ignore [ipv4 | ipv6] rule <1-999999> source address <ip-address>

8.11. System 935

 VyOS Documentation, Release 1.5.x (circinus)

set system conntrack ignore [ipv4 | ipv6] rule <1-999999> source port <port>
set system conntrack ignore [ipv4 | ipv6] rule <1-999999> tcp flags [not] <text>
Allowed values fpr TCP flags: ack, cwr, ecn, fin, psh, rst, syn and urg. Multiple values are supported, and
for inverted selection use not, as shown in the example.

Conntrack log

set system conntrack log icmp destroy

set system conntrack log icmp new
set system conntrack log icmp update
set system conntrack log other destroy
set system conntrack log other new
set system conntrack log other update
set system conntrack log tcp destroy
set system conntrack log tcp new
set system conntrack log tcp update close-wait
set system conntrack log tcp update established
set system conntrack log tcp update fin-wait
set system conntrack log tcp update last-ack
set system conntrack log tcp update syn-received
set system conntrack log tcp update time-wait
set system conntrack log udp destroy
set system conntrack log udp new
set system conntrack log udp update
Log the connection tracking events per protocol.

8.11.3 Serial Console

For the average user a serial console has no advantage over a console offered by a directly attached keyboard and screen.
Serial consoles are much slower, taking up to a second to fill a 80 column by 24 line screen. Serial consoles generally
only support non-proportional ASCII text, with limited support for languages other than English.
There are some scenarios where serial consoles are useful. System administration of remote computers is usually done
using SSH, but there are times when access to the console is the only way to diagnose and correct software failures.
Major upgrades to the installed distribution may also require console access.
set system console device <device>
Defines the specified device as a system console. Available console devices can be (see completion helper):
• ttySN - Serial device name
• ttyUSBX - USB Serial device name
• hvc0 - Xen console

8.11. System 936

 VyOS Documentation, Release 1.5.x (circinus)

set system console device <device> speed <speed>

The speed (baudrate) of the console device. Supported values are:
• 1200 - 1200 bps
• 2400 - 2400 bps
• 4800 - 4800 bps
• 9600 - 9600 bps
• 19200 - 19,200 bps
• 38400 - 38,400 bps (default for Xen console)
• 57600 - 57,600 bps
• 115200 - 115,200 bps (default for serial console)

Note: If you use USB to serial converters for connecting to your VyOS appliance please note that most of them
use software emulation without flow control. This means you should start with a common baud rate (most likely
9600 baud) as otherwise you probably can not connect to the device using high speed baud rates as your serial
converter simply can not process this data rate.

8.11.4 Flow Accounting

VyOS supports flow-accounting for both IPv4 and IPv6 traffic. The system acts as a flow exporter, and you are free to
use it with any compatible collector.
Flows can be exported via two different protocols: NetFlow (versions 5, 9 and 10/IPFIX) and sFlow. Additionally, you
may save flows to an in-memory table internally in a router.

Warning: You need to disable the in-memory table in production environments! Using IMT (In-Memory Table)
may lead to heavy CPU overloading and unstable flow-accounting behavior.

NetFlow / IPFIX

NetFlow is a feature that was introduced on Cisco routers around 1996 that provides the ability to collect IP network
traffic as it enters or exits an interface. By analyzing the data provided by NetFlow, a network administrator can
determine things such as the source and destination of traffic, class of service, and the causes of congestion. A typical
flow monitoring setup (using NetFlow) consists of three main components:
• exporter: aggregates packets into flows and exports flow records towards one or more flow collectors
• collector: responsible for reception, storage and pre-processing of flow data received from a flow exporter
• application: analyzes received flow data in the context of intrusion detection or traffic profiling, for example
For connectionless protocols as like ICMP and UDP, a flow is considered complete once no more packets for this flow
appear after configurable timeout.
NetFlow is usually enabled on a per-interface basis to limit load on the router components involved in NetFlow, or to
limit the amount of NetFlow records exported.

8.11. System 937

 VyOS Documentation, Release 1.5.x (circinus)

Configuration

In order for flow accounting information to be collected and displayed for an interface, the interface must be configured
for flow accounting.
set system flow-accounting interface <interface>
Configure and enable collection of flow information for the interface identified by <interface>.
You can configure multiple interfaces which would participate in flow accounting.

Note: Will be recorded only packets/flows on incoming direction in configured interfaces by default.

By default, recorded flows will be saved internally and can be listed with the CLI command. You may disable using
the local in-memory table with the command:
set system flow-accounting disable-imt
If you need to sample also egress traffic, you may want to configure egress flow-accounting:
set system flow-accounting enable-egress
Internally, in flow-accounting processes exist a buffer for data exchanging between core process and plugins
(each export target is a separated plugin). If you have high traffic levels or noted some problems with missed
records or stopping exporting, you may try to increase a default buffer size (10 MiB) with the next command:
set system flow-accounting buffer-size <buffer size>
In case, if you need to catch some logs from flow-accounting daemon, you may configure logging facility:
set system flow-accounting syslog-facility <facility>
TBD

Flow Export

In addition to displaying flow accounting information locally, one can also exported them to a collection server.

NetFlow

set system flow-accounting netflow version <version>

There are multiple versions available for the NetFlow data. The <version> used in the exported flow data can
be configured here. The following versions are supported:
• 5 - Most common version, but restricted to IPv4 flows only
• 9 - NetFlow version 9 (default)
• 10 - IPFIX (IP Flow Information Export) as per RFC 3917
set system flow-accounting netflow server <address>
Configure address of NetFlow collector. NetFlow server at <address> can be both listening on an IPv4 or IPv6
address.
set system flow-accounting netflow source-ip <address>
IPv4 or IPv6 source address of NetFlow packets
set system flow-accounting netflow engine-id <id>

8.11. System 938

 VyOS Documentation, Release 1.5.x (circinus)

NetFlow engine-id which will appear in NetFlow data. The range is 0 to 255.
set system flow-accounting netflow sampling-rate <rate>
Use this command to configure the sampling rate for flow accounting. The system samples one in every <rate>
packets, where <rate> is the value configured for the sampling-rate option. The advantage of sampling every n
packets, where n > 1, allows you to decrease the amount of processing resources required for flow accounting.
The disadvantage of not sampling every packet is that the statistics produced are estimates of actual data flows.
Per default every packet is sampled (that is, the sampling rate is 1).
set system flow-accounting netflow timeout expiry-interval <interval>
Specifies the interval at which Netflow data will be sent to a collector. As per default, Netflow data will be sent
every 60 seconds.
You may also additionally configure timeouts for different types of connections.
set system flow-accounting netflow max-flows <n>
If you want to change the maximum number of flows, which are tracking simultaneously, you may do this with
this command (default 8192).

sFlow

set system flow-accounting sflow server <address>

Configure address of sFlow collector. sFlow server at <address> can be an IPv4 or IPv6 address. But you
cannot export to both IPv4 and IPv6 collectors at the same time!
set system flow-accounting sflow sampling-rate <rate>
Enable sampling of packets, which will be transmitted to sFlow collectors.
set system flow-accounting sflow agent-address <address>
Configure a sFlow agent address. It can be IPv4 or IPv6 address, but you must set the same protocol, which is
used for sFlow collector addresses. By default, using router-id from BGP or OSPF protocol, or the primary IP
address from the first interface.

Example:

NetFlow v5 example:

set system flow-accounting netflow engine-id 100

set system flow-accounting netflow version 5
set system flow-accounting netflow server 192.168.2.10 port 2055

8.11. System 939

 VyOS Documentation, Release 1.5.x (circinus)

Operation

Once flow accounting is configured on an interfaces it provides the ability to display captured network traffic information
for all configured interfaces.
show flow-accounting interface <interface>
Show flow accounting information for given <interface>.

vyos@vyos:~$ show flow-accounting interface eth0

IN_IFACE SRC_MAC DST_MAC SRC_IP DST_IP␣
˓→ SRC_PORT DST_PORT PROTOCOL TOS PACKETS FLOWS BYTES
---------- ----------------- ----------------- ------------------------ --------
˓→------- ---------- ---------- ---------- ----- --------- ------- -------
eth0 00:53:01:a8:28:ac ff:ff:ff:ff:ff:ff 192.0.2.2 255.255.
˓→255.255 5678 5678 udp 0 1 1 178
eth0 00:53:01:b2:2f:34 33:33:ff:00:00:00 fe80::253:01ff:feb2:2f34 ␣
˓→ff02::1:ff00:0 0 0 ipv6-icmp 0 2 1 ␣
˓→ 144
eth0 00:53:01:1a:b4:53 33:33:ff:00:00:00 fe80::253:01ff:fe1a:b453 ␣
˓→ff02::1:ff00:0 0 0 ipv6-icmp 0 1 1 ␣
˓→ 72
eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.
˓→14 40152 22 tcp 16 39 1 2064
eth0 00:53:01:c8:33:af ff:ff:ff:ff:ff:ff 192.0.2.3 255.255.
˓→255.255 5678 5678 udp 0 1 1 154
eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.
˓→14 40006 22 tcp 16 146 1 9444
eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.
˓→14 0 0 icmp 192 27 1 4455

show flow-accounting interface <interface> host <address>

Show flow accounting information for given <interface> for a specific host only.

vyos@vyos:~$ show flow-accounting interface eth0 host 192.0.2.14

IN_IFACE SRC_MAC DST_MAC SRC_IP DST_IP SRC_
˓→PORT DST_PORT PROTOCOL TOS PACKETS FLOWS BYTES
---------- ----------------- ----------------- ----------- ---------- ---------
˓→- ---------- ---------- ----- --------- ------- -------
eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14 ␣
˓→40006 22 tcp 16 197 2 12940
eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14 ␣
˓→40152 22 tcp 16 94 1 4924
eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14 ␣
˓→0 0 icmp 192 36 1 5877

8.11. System 940

 VyOS Documentation, Release 1.5.x (circinus)

8.11.5 FRR

VyOS uses [FRRouting](https://frrouting.org/) as the control plane for dynamic and static routing. The routing daemon
behavior can be adjusted during runtime, but require either a restart of the routing daemon, or a reboot of the system.
set system frr bmp
Enable BMP (BGP Monitoring Protocol) support
set system frr descriptors <numer>
This allows the operator to control the number of open file descriptors each daemon is allowed to start with. If
the operator plans to run bgp with several thousands of peers then this is where we would modify FRR to allow
this to happen.
set system frr irdp
Enable ICMP Router Discovery Protocol support
set system frr snmp <daemon>
Enable SNMP support for an individual routing daemon.
Supported daemons:
• bgpd
• isisd
• ldpd
• ospf6d
• ospfd
• ripd
• zebra

8.11.6 Host Information

This section describes the system’s host information and how to configure them, it covers the following topics:
• Host name
• Domain
• IP address
• Aliases

Hostname

A hostname is the label (name) assigned to a network device (a host) on a network and is used to distinguish one device
from another on specific networks or over the internet. On the other hand this will be the name which appears on the
command line prompt.
set system host-name <hostname>
The hostname can be up to 63 characters. A hostname must start and end with a letter or digit, and have as
interior characters only letters, digits, or a hyphen.
The default hostname used is vyos.

8.11. System 941

 VyOS Documentation, Release 1.5.x (circinus)

Domain Name

A domain name is the label (name) assigned to a computer network and is thus unique. VyOS appends the domain
name as a suffix to any unqualified name. For example, if you set the domain name example.com, and you would ping
the unqualified name of crux, then VyOS qualifies the name to crux.example.com.
set system domain-name <domain>
Configure system domain name. A domain name must start and end with a letter or digit, and have as interior
characters only letters, digits, or a hyphen.

Static Hostname Mapping

How an IP address is assigned to an interface in Ethernet. This section shows how to statically map an IP address to
a hostname for local (meaning on this VyOS instance) name resolution. This is the VyOS equivalent to /etc/hosts file
entries.

Note: Do not manually edit /etc/hosts. This file will automatically be regenerated on boot based on the settings in this
section, which means you’ll lose all your manual edits. Instead, configure static host mappings as follows.

set system static-host-mapping host-name <hostname> inet <address>

Create a static hostname mapping which will always resolve the name <hostname> to IP address <address>.
set system static-host-mapping host-name <hostname> alias <alias>
Create named <alias> for the configured static mapping for <hostname>. Thus the address configured as set
system static-host-mapping host-name <hostname> inet <address> can be reached via multiple
names.
Multiple aliases can be specified per host-name.

8.11.7 IP

System configuration commands

set system ip disable-forwarding

Use this command to disable IPv4 forwarding on all interfaces.
set system ip disable-directed-broadcast
Use this command to disable IPv4 directed broadcast forwarding on all interfaces.
If set, IPv4 directed broadcast forwarding will be completely disabled regardless of whether per-interface di-
rected broadcast forwarding is enabled or not.
set system ip arp table-size <number>
Use this command to define the maximum number of entries to keep in the ARP cache (1024, 2048, 4096, 8192,
16384, 32768).
set system ip multipath layer4-hashing
Use this command to use Layer 4 information for IPv4 ECMP hashing.

8.11. System 942

 VyOS Documentation, Release 1.5.x (circinus)

Zebra/Kernel route filtering

Zebra supports prefix-lists and Route Maps to match routes received from other FRR components. The permit/deny
facilities provided by these commands can be used to filter which routes zebra will install in the kernel.
set system ip protocol <protocol> route-map <route-map>
Apply a route-map filter to routes for the specified protocol. The following protocols can be used: any, babel,
bgp, connected, eigrp, isis, kernel, ospf, rip, static, table

Note: If you choose any as the option that will cause all protocols that are sending routes to zebra.

Nexthop Tracking

Nexthop tracking resolve nexthops via the default route by default. This is enabled by default for a traditional profile
of FRR which we use. It and can be disabled if you do not want to e.g. allow BGP to peer across the default route.
set system ip nht no-resolve-via-default
Do not allow IPv4 nexthop tracking to resolve via the default route. This parameter is configured per-VRF, so
the command is also available in the VRF subnode.

Operational commands

show commands

See below the different parameters available for the IPv4 show command:

vyos@vyos:~$ show ip
Possible completions:
access-list Show all IP access-lists
as-path-access-list
Show all as-path-access-lists
bgp Show Border Gateway Protocol (BGP) information
community-list
Show IP community-lists
extcommunity-list
Show extended IP community-lists
forwarding Show IP forwarding status
groups Show IP multicast group membership
igmp Show IGMP (Internet Group Management Protocol) information
large-community-list
Show IP large-community-lists
multicast Show IP multicast
ospf Show IPv4 Open Shortest Path First (OSPF) routing information
pim Show PIM (Protocol Independent Multicast) information
ports Show IP ports in use by various system services
prefix-list Show all IP prefix-lists
protocol Show IP route-maps per protocol
rip Show Routing Information Protocol (RIP) information
route Show IP routes

8.11. System 943

 VyOS Documentation, Release 1.5.x (circinus)

reset commands

And the different IPv4 reset commands available:

vyos@vyos:~$ reset ip
Possible completions:
arp Reset Address Resolution Protocol (ARP) cache
bgp Clear Border Gateway Protocol (BGP) statistics or status
igmp IGMP clear commands
multicast IP multicast routing table
route Reset IP route

8.11.8 IPv6

System configuration commands

set system ipv6 disable-forwarding

Use this command to disable IPv6 forwarding on all interfaces.
set system ipv6 neighbor table-size <number>
Use this command to define the maximum number of entries to keep in the Neighbor cache (1024, 2048, 4096,
8192, 16384, 32768).
set system ipv6 strict-dad
Use this command to disable IPv6 operation on interface when Duplicate Address Detection fails on Link-Local
address.
set system ipv6 multipath layer4-hashing
Use this command to user Layer 4 information for ECMP hashing.

Zebra/Kernel route filtering

Zebra supports prefix-lists and Route Maps to match routes received from other FRR components. The permit/deny
facilities provided by these commands can be used to filter which routes zebra will install in the kernel.
set system ipv6 protocol <protocol> route-map <route-map>
Apply a route-map filter to routes for the specified protocol. The following protocols can be used: any, babel,
bgp, connected, isis, kernel, ospfv3, ripng, static, table

Note: If you choose any as the option that will cause all protocols that are sending routes to zebra.

8.11. System 944

 VyOS Documentation, Release 1.5.x (circinus)

Nexthop Tracking

Nexthop tracking resolve nexthops via the default route by default. This is enabled by default for a traditional profile
of FRR which we use. It and can be disabled if you do not want to e.g. allow BGP to peer across the default route.
set system ipv6 nht no-resolve-via-default
Do not allow IPv6 nexthop tracking to resolve via the default route. This parameter is configured per-VRF, so
the command is also available in the VRF subnode.

Operational commands

Show commands

show ipv6 neighbors

Use this command to show IPv6 Neighbor Discovery Protocol information.
show ipv6 groups
Use this command to show IPv6 multicast group membership.
show ipv6 forwarding
Use this command to show IPv6 forwarding status.
show ipv6 route
Use this command to show IPv6 routes.
Check the many parameters available for the show ipv6 route command:

vyos@vyos:~$ show ipv6 route

Possible completions:
<Enter> Execute the current command
<X:X::X:X> Show IPv6 routes of given address or prefix
<X:X::X:X/M>
bgp Show IPv6 BGP routes
cache Show kernel IPv6 route cache
connected Show IPv6 connected routes
forward Show kernel IPv6 route table
isis Show IPv6 ISIS routes
kernel Show IPv6 kernel routes
ospfv3 Show IPv6 OSPF6 routes
ripng Show IPv6 RIPNG routes
static Show IPv6 static routes
summary Show IPv6 routes summary
table Show IP routes in policy table
tag Show only routes with tag
vrf Show IPv6 routes in VRF

show ipv6 prefix-list

Use this command to show all IPv6 prefix lists
There are different parameters for getting prefix-list information:

8.11. System 945

 VyOS Documentation, Release 1.5.x (circinus)

vyos@vyos:~$ show ipv6 prefix-list

Possible completions:
<Enter> Execute the current command
<WORD> Show specified IPv6 prefix-list
detail Show detail of IPv6 prefix-lists
summary Show summary of IPv6 prefix-lists

show ipv6 access-list

Use this command to show all IPv6 access lists
You can also specify which IPv6 access-list should be shown:

vyos@vyos:~$ show ipv6 access-list

Possible completions:
<Enter> Execute the current command
<text> Show specified IPv6 access-list

show ipv6 ospfv3

Use this command to get information about OSPFv3.
You can get more specific OSPFv3 information by using the parameters shown below:

vyos@vyos:~$ show ipv6 ospfv3

Possible completions:
<Enter> Execute the current command
area Show OSPFv3 spf-tree information
border-routers
Show OSPFv3 border-router (ABR and ASBR) information
database Show OSPFv3 Link state database information
interface Show OSPFv3 interface information
linkstate Show OSPFv3 linkstate routing information
neighbor Show OSPFv3 neighbor information
redistribute Show OSPFv3 redistribute External information
route Show OSPFv3 routing table information

show ipv6 ripng

Use this command to get information about the RIPNG protocol
show ipv6 ripng status
Use this command to show the status of the RIPNG protocol

Reset commands

reset bgp ipv6 <address>

Use this command to clear Border Gateway Protocol statistics or status.
reset ipv6 neighbors <address | interface>
Use this command to reset IPv6 Neighbor Discovery Protocol cache for an address or interface.
reset ipv6 route cache
Use this command to flush the kernel IPv6 route cache. An address can be added to flush it only for that route.

8.11. System 946

 VyOS Documentation, Release 1.5.x (circinus)

8.11.9 System Display (LCD)

The system LCD LCD (Liquid-crystal display) option is for users running VyOS on hardware that features an LCD
display. This is typically a small display built in an 19 inch rack-mountable appliance. Those displays are used to show
runtime data.
To configure your LCD display you must first identify the used hardware, and connectivity of the display to your system.
This can be any serial port (ttySxx) or serial via USB or even old parallel port interfaces.

Configuration

set system lcd device <device>

This is the name of the physical interface used to connect to your LCD display. Tab completion is supported
and it will list you all available serial interface.
For serial via USB port information please refor to: USB.
set system lcd model <model>
This is the LCD model used in your system.
At the time of this writing the following displays are supported:
• Crystalfontz CFA-533
• Crystalfontz CFA-631
• Crystalfontz CFA-633
• Crystalfontz CFA-635

Note: We can’t support all displays from the beginning. If your display type is missing, please create a feature
request via Phabricator.

8.11.10 Login/User Management

The default VyOS user account (vyos), as well as newly created user accounts, have all capabilities to configure the
system. All accounts have sudo capabilities and therefore can operate as root on the system.
Both local administered and remote administered RADIUS (Remote Authentication Dial-In User Service) accounts are
supported.

Local

set system login user <name> full-name “<string>”

Create new system user with username <name> and real-name specified by <string>.
set system login user <name> authentication plaintext-password <password>
Specify the plaintext password user by user <name> on this system. The plaintext password will be automati-
cally transferred into a secure hashed password and not saved anywhere in plaintext.
set system login user <name> authentication encrypted-password <password>
Setup encrypted password for given username. This is useful for transferring a hashed password from system
to system.

8.11. System 947

 VyOS Documentation, Release 1.5.x (circinus)

set system login user <name> disable

Disable (lock) account. User will not be able to log in.

Key Based Authentication

It is highly recommended to use SSH key authentication. By default there is only one user (vyos), and you can assign
any number of keys to that user. You can generate a ssh key with the ssh-keygen command on your local machine,
which will (by default) save it as ~/.ssh/id_rsa.pub.
Every SSH key comes in three parts:
ssh-rsa AAAAB3NzaC1yc2EAAAABAA...VBD5lKwEWB [email protected]
Only the type (ssh-rsa) and the key (AAAB3N...) are used. Note that the key will usually be several hundred characters
long, and you will need to copy and paste it. Some terminal emulators may accidentally split this over several lines. Be
attentive when you paste it that it only pastes as a single line. The third part is simply an identifier, and is for your own
reference.
See also:
SSH Operation
set system login user <username> authentication public-keys <identifier> key <key>
Assign the SSH public key portion <key> identified by per-key <identifier> to the local user <username>.
set system login user <username> authentication public-keys <identifier> type <type>
Every SSH public key portion referenced by <identifier> requires the configuration of the <type> of public-key
used. This type can be any of:
• ecdsa-sha2-nistp256
• ecdsa-sha2-nistp384
• ecdsa-sha2-nistp521
• ssh-dss
• ssh-ed25519
• ssh-rsa

Note: You can assign multiple keys to the same user by using a unique identifier per SSH key.

set system login user <username> authentication public-keys <identifier> options

<options>
Set the options for this public key. See the ssh authorized_keys man page for details of what you can specify
here. To place a " character in the options field, use &quot;, for example from=&quot;10.0.0.0/24&quot;
to restrict where the user may connect from when using this key.

8.11. System 948

 VyOS Documentation, Release 1.5.x (circinus)

MFA/2FA authentication using OTP (one time passwords)

It is possible to enhance authentication security by using the 2FA (Two-factor authentication)/MFA (Multi-factor au-
thentication) feature together with OTP (One-Time-Pad) on VyOS. 2FA/MFA is configured independently per each
user. If an OTP key is configured for a user, 2FA/MFA is automatically enabled for that particular user. If a user does
not have an OTP key configured, there is no 2FA/MFA check for that user.
set system login user <username> authentication otp key <key>
Enable OTP 2FA for user username with default settings, using the BASE32 encoded 2FA/MFA key specified
by <key>.

Optional/default settings

set system login user <username> authentication otp rate-limit <limit> default: 3
Limit logins to <limit> per every rate-time seconds. Rate limit must be between 1 and 10 attempts.
set system login user <username> authentication otp rate-time <seconds> default: 30
Limit logins to rate-limit attemps per every <seconds>. Rate time must be between 15 and 600 seconds.
set system login user <username> authentication otp window-size <size> default: 3
Set window of concurrently valid codes.
By default, a new token is generated every 30 seconds by the mobile application. In order to compensate for
possible time-skew between the client and the server, an extra token before and after the current time is allowed.
This allows for a time skew of up to 30 seconds between authentication server and client.
For example, if problems with poor time synchronization are experienced, the window can be increased from its
default size of 3 permitted codes (one previous code, the current code, the next code) to 17 permitted codes (the
8 previous codes, the current code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
between client and server.
The window size must be between 1 and 21.

OTP-key generation

The following command can be used to generate the OTP key as well as the CLI commands to configure them:
generate system login username <username> otp-key hotp-time rate-limit <1-10> rate-time
<15-600> window-size <1-21>
An example of key generation:

vyos@vyos:~$ generate system login username otptester otp-key hotp-time rate-limit 2␣

˓→rate-time 20 window-size 5

# You can share it with the user, he just needs to scan the QR in his OTP app
# username: otptester
# OTP KEY: J5A64ERPMGJOZXY6FMHHLKXKANNI6TCY
# OTP URL: otpauth://totp/otptester@vyos?secret=J5A64ERPMGJOZXY6FMHHLKXKANNI6TCY&
˓→digits=6&period=30

(continues on next page)

8.11. System 949

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

# To add this OTP key to configuration, run the following commands:

set system login user otptester authentication otp key 'J5A64ERPMGJOZXY6FMHHLKXKANNI6TCY'
set system login user otptester authentication otp rate-limit '2'
set system login user otptester authentication otp rate-time '20'
set system login user otptester authentication otp window-size '5'

Display OTP key for user

To display the configured OTP user key, use the command:

sh system login authentication user <username> otp <full|key-b32|qrcode|uri>
An example:
vyos@vyos:~$ sh system login authentication user otptester otp full
# You can share it with the user, he just needs to scan the QR in his OTP app
# username: otptester
# OTP KEY: J5A64ERPMGJOZXY6FMHHLKXKANNI6TCY
# OTP URL: otpauth://totp/otptester@vyos?secret=J5A64ERPMGJOZXY6FMHHLKXKANNI6TCY&
˓→digits=6&period=30

(continues on next page)

8.11. System 950

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

# To add this OTP key to configuration, run the following commands:

set system login user otptester authentication otp key 'J5A64ERPMGJOZXY6FMHHLKXKANNI6TCY'
set system login user otptester authentication otp rate-limit '2'
set system login user otptester authentication otp rate-time '20'
set system login user otptester authentication otp window-size '5'

Once a user has 2FA/OTP configured against their account, they must login using their password with the OTP code
appended to it. For example: If the users password is vyosrocks and the OTP code is 817454 then they would enter
their password as vyosrocks817454

RADIUS

In large deployments it is not reasonable to configure each user individually on every system. VyOS supports using
RADIUS servers as backend for user authentication.

Configuration

set system login radius server <address> key <secret>

Specify the IP <address> of the RADIUS server user with the pre-shared-secret given in <secret>.
Multiple servers can be specified.
set system login radius server <address> port <port>
Configure the discrete port under which the RADIUS server can be reached.
This defaults to 1812.
set system login radius server <address> disable
Temporary disable this RADIUS server. It won’t be queried.
set system login radius server <address> timeout <timeout>
Setup the <timeout> in seconds when querying the RADIUS server.
set system login radius source-address <address>
RADIUS servers could be hardened by only allowing certain IP addresses to connect. As of this the source
address of each RADIUS query can be configured.
If unset, incoming connections to the RADIUS server will use the nearest interface address pointing towards
the server - making it error prone on e.g. OSPF networks when a link fails and a backup route is taken.
set system login radius vrf <name>
Source all connections to the RADIUS servers from given VRF <name>.

8.11. System 951

 VyOS Documentation, Release 1.5.x (circinus)

Configuration Example

set system login radius server 192.168.0.2 key 'test-vyos'

set system login radius server 192.168.0.2 port '1812'
set system login radius server 192.168.0.2 timeout '5'
set system login radius source-address '192.168.0.1'

If there is no communication between VyOS and RADIUS server users can

authenticate from local user accounts. During authentication from the local
accounts users can observe some timeouts. Timeout in seconds depends on
the configured timeout option.

Hint: If you want to have admin users to authenticate via RADIUS it is essential to sent the Cisco-AV-Pair
shell:priv-lvl=15 attribute. Without the attribute you will only get regular, non privilegued, system users.

TACACS+

In addition to RADIUS, TACACS (Terminal Access Controller Access Control System) can also be found in large
deployments.
TACACS is defined in RFC 8907.

Configuration

set system login tacas server <address> key <secret>

Specify the IP <address> of the TACACS server user with the pre-shared-secret given in <secret>.
Multiple servers can be specified.
set system login tacas server <address> port <port>
Configure the discrete port under which the TACACS server can be reached.
This defaults to 49.
set system login tacas server <address> disable
Temporary disable this TACACS server. It won’t be queried.
set system login tacas server <address> timeout <timeout>
Setup the <timeout> in seconds when querying the TACACS server.
set system login tacas source-address <address>
TACACS servers could be hardened by only allowing certain IP addresses to connect. As of this the source
address of each TACACS query can be configured.
If unset, incoming connections to the TACACS server will use the nearest interface address pointing towards
the server - making it error prone on e.g. OSPF networks when a link fails and a backup route is taken.
set system login tacas vrf <name>
Source all connections to the TACACS servers from given VRF <name>.

8.11. System 952

 VyOS Documentation, Release 1.5.x (circinus)

Configuration Example

set system login tacacs server 192.168.0.2 key 'test-vyos'

set system login tacacs server 192.168.0.2 port '49'
set system login tacacs source-address '192.168.0.1'

If there is no communication between VyOS and TACACS server users can

authenticate from local user accounts.

Login Banner

You are able to set post-login or pre-login banner messages to display certain information for this system.
set system login banner pre-login <message>
Configure <message> which is shown during SSH connect and before a user is logged in.
set system login banner post-login <message>
Configure <message> which is shown after user has logged in to the system.

Note: To create a new line in your login message you need to escape the new line character by using \\n.

Limits

Login limits
set system login max-login-session <number>
Set a limit on the maximum number of concurrent logged-in users on the system.
This option must be used with timeout option.
set system login timeout <timeout>
Configure session timeout after which the user will be logged out.

Example

In the following example, both User1 and User2 will be able to SSH into VyOS as user vyos using their very own keys.
User1 is restricted to only be able to connect from a single IP address. In addition if password base login is wanted for
the vyos user a 2FA/MFA keycode is required in addition to the password.

set system login user vyos authentication public-keys 'User1' key "AAAAB3Nz...KwEW"
set system login user vyos authentication public-keys 'User1' type ssh-rsa
set system login user vyos authentication public-keys 'User1' options "from=&quot;192.
˓→168.0.100&quot;"

set system login user vyos authentication public-keys 'User2' key "AAAAQ39x...fbV3"
set system login user vyos authentication public-keys 'User2' type ssh-rsa

set system login user vyos authentication otp key OHZ3OJ7U2N25BK4G7SOFFJTZDTCFUUE2

set system login user vyos authentication plaintext-password vyos

8.11. System 953

 VyOS Documentation, Release 1.5.x (circinus)

TACACS Example

We use a vontainer providing the TACACS serve rin this example.

Load the container image in op-mode.

add container image lfkeitel/tacacs_plus:latest

set container network tac-test prefix '100.64.0.0/24'

set container name tacacs1 image 'lfkeitel/tacacs_plus:latest'

set container name tacacs1 network tac-test address '100.64.0.11'

set container name tacacs2 image 'lfkeitel/tacacs_plus:latest'

set container name tacacs2 network tac-test address '100.64.0.12'

set system login tacacs server 100.64.0.11 key 'tac_plus_key'

set system login tacacs server 100.64.0.12 key 'tac_plus_key'

commit

You can now SSH into your system using admin/admin as a default user supplied from the lfkeitel/
tacacs_plus:latest container.

8.11.11 System DNS

Warning: If you are configuring a VRF for management purposes, there is currently no way to force system DNS
traffic via a specific VRF.

This section describes configuring DNS on the system, namely:

• DNS name servers
• Domain search order

DNS name servers

set system name-server <address>

Use this command to specify a DNS server for the system to be used for DNS lookups. More than one DNS
server can be added, configuring one at a time. Both IPv4 and IPv6 addresses are supported.

8.11. System 954

 VyOS Documentation, Release 1.5.x (circinus)

Example

In this example, some OpenNIC servers are used, two IPv4 addresses and two IPv6 addresses:

set system name-server 176.9.37.132

set system name-server 195.10.195.195
set system name-server 2a01:4f8:161:3441::1
set system name-server 2a00:f826:8:2::195

Domain search order

In order for the system to use and complete unqualified host names, a list can be defined which will be used for domain
searches.
set system domain-search <domain>
Use this command to define domains, one at a time, so that the system uses them to complete unqualified host
names. Maximum: 6 entries.

Note: Domain names can include letters, numbers, hyphens and periods with a maximum length of 253 characters.

Example

The system is configured to attempt domain completion in the following order: vyos.io (first), vyos.net (second) and
vyos.network (last):

set system domain-search vyos.io

set system domain-search vyos.net
set system domain-search vyos.network

8.11.12 Option

This chapter describe the possibilities of advanced system behavior.

General

set system option ctrl-alt-delete <ignore | reboot | poweroff>

Action which will be run once the ctrl-alt-del keystroke is received.
set system option reboot-on-panic
Automatically reboot system on kernel panic after 60 seconds.
set system option startup-beep
Play an audible beep to the system speaker when system is ready.
set system option root-partition-auto-resize
Enables the root partition auto-extension and resizes to the maximum available space on system boot.

8.11. System 955

 VyOS Documentation, Release 1.5.x (circinus)

Kernel

set system option kernel disable-mitigations

Disable all optional CPU mitigations. This improves system performance, but it may also expose users to several
CPU vulnerabilities.
This will add the following option to the Kernel commandline:
• mitigations=off

Note: Setting will only become active with the next reboot!

set system option kernel disable-power-saving

Disable CPU power saving mechanisms also known as C states.
This will add the following two options to the Kernel commandline:
• intel_idle.max_cstate=0 Disable intel_idle and fall back on acpi_idle
• processor.max_cstate=1 Limit processor to maximum C-state 1

Note: Setting will only become active with the next reboot!

HTTP client

set system option http-client source-address <address>

Several commands utilize cURL to initiate transfers. Configure the local source IPv4/IPv6 address used for all
cURL operations.
set system option http-client source-interface <interface>
Several commands utilize curl to initiate transfers. Configure the local source interface used for all CURL
operations.

Note: source-address and source-interface can not be used at the same time.

SSH client

set system option ssh-client source-address <address>

Use the specified address on the local machine as the source address of the connection. Only useful on systems
with more than one address.
set system option ssh-client source-interface <interface>
Use the address of the specified interface on the local machine as the source address of the connection.

8.11. System 956

 VyOS Documentation, Release 1.5.x (circinus)

Keyboard Layout

When starting a VyOS live system (the installation CD) the configured keyboard layout defaults to US. As this might
not suite everyone’s use case you can adjust the used keyboard layout on the system console.
set system option keyboard-layout <us | fr | de | fi | no | dk>
Change system keyboard layout to given language.
Defaults to us.

Note: Changing the keymap only has an effect on the system console, using SSH or Serial remote access to
the device is not affected as the keyboard layout here corresponds to your access system.

Performance

As more and more routers run on Hypervisors, expecially with a NOS (Network Operating System) as VyOS, it makes
fewer and fewer sense to use static resource bindings like smp-affinity as present in VyOS 1.2 and earlier to pin
certain interrupt handlers to specific CPUs.
We now utilize tuned for dynamic resource balancing based on profiles.
See also:
https://access.redhat.com/sites/default/files/attachments/201501-perf-brief-low-latency-tuning-rhel7-v2.1.pdf
set system option performance < throughput | latency >
Configure one of the predefined system performance profiles.
• throughput: A server profile focused on improving network throughput. This profile favors performance
over power savings by setting intel_pstate and max_perf_pct=100 and increasing kernel network
buffer sizes.
It enables transparent huge pages, and uses cpupower to set the performance cpufreq governor. It also sets
kernel.sched_min_granularity_ns to 10 us, kernel.sched_wakeup_granularity_ns to 15 uss,
and vm.dirty_ratio to 40%.
• latency: A server profile focused on lowering network latency. This profile favors performance over
power savings by setting intel_pstate and min_perf_pct=100.
It disables transparent huge pages, and automatic NUMA balancing. It also uses cpupower to set the perfor-
mance cpufreq governor, and requests a cpu_dma_latency value of 1. It also sets busy_read and busy_poll
times to 50 us, and tcp_fastopen to 3.

8.11.13 System Proxy

Some IT environments require the use of a proxy to connect to the Internet. Without this configuration VyOS updates
could not be installed directly by using the add system image command (Update VyOS).
set system proxy url <url>
Set proxy for all connections initiated by VyOS, including HTTP, HTTPS, and FTP (anonymous ftp).
set system proxy port <port>
Configure proxy port if it does not listen to the default port 80.
set system proxy username <username>

8.11. System 957

 VyOS Documentation, Release 1.5.x (circinus)

Some proxys require/support the “basic” HTTP authentication scheme as per RFC 7617, thus a username can
be configured.
set system proxy password <password>
Some proxys require/support the “basic” HTTP authentication scheme as per RFC 7617, thus a password can
be configured.

8.11.14 sFlow

VyOS supports sFlow accounting for both IPv4 and IPv6 traffic. The system acts as a flow exporter, and you are free
to use it with any compatible collector.
sFlow is a technology that enables monitoring of network traffic by sending sampled packets to a collector device.
The sFlow accounting based on hsflowd https://sflow.net/

Configuration

set system sflow agent-address <address>

Configure sFlow agent IPv4 or IPv6 address
set system sflow agent-interface <interface>
Configure agent IP address associated with this interface.
set system sflow drop-monitor-limit <limit>
Dropped packets reported on DROPMON Netlink channel by Linux kernel are exported via the standard sFlow
v5 extension for reporting dropped packets
set system sflow interface <interface>
Configure and enable collection of flow information for the interface identified by <interface>.
You can configure multiple interfaces which would participate in sflow accounting.
set system sflow polling <sec>
Configure schedule counter-polling in seconds (default: 30)
set system sflow sampling-rate <rate>
Use this command to configure the sampling rate for sFlow accounting (default: 1000)
set system sflow server <address> port <port>
Configure address of sFlow collector. sFlow server at <address> can be both listening on an IPv4 or IPv6
address.

Example

set system sflow agent-address '192.0.2.14'

set system sflow agent-interface 'eth0'
set system sflow drop-monitor-limit '50'
set system sflow interface 'eth0'
set system sflow interface 'eth1'
set system sflow polling '30'
set system sflow sampling-rate '1000'
(continues on next page)

8.11. System 958

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set system sflow server 192.0.2.1 port '6343'
set system sflow server 203.0.113.23 port '6343'

8.11.15 Syslog

Per default VyOSs has minimal syslog logging enabled which is stored and rotated locally. Errors will be always logged
to a local file, which includes local7 error messages, emergency messages will be sent to the console, too.
To configure syslog, you need to switch into configuration mode.

Logging

Syslog supports logging to multiple targets, those targets could be a plain file on your VyOS installation itself, a serial
console or a remote syslog server which is reached via IP (Internet Protocol) UDP/TCP.

Console

set system syslog console facility <keyword> level <keyword>

Log syslog messages to /dev/console, for an explanation on Facilities keywords and Severity Level keywords
see tables below.

Custom File

set system syslog file <filename> facility <keyword> level <keyword>

Log syslog messages to file specified via <filename>, for an explanation on Facilities keywords and Severity
Level keywords see tables below.
set system syslog file <filename> archive size <size>
Syslog will write <size> kilobytes into the file specified by <filename>. After this limit has been reached, the
custom file is “rotated” by logrotate and a new custom file is created.
set system syslog file <filename> archive file <number>
Syslog uses logrotate to rotate logfiles after a number of gives bytes. We keep as many as <number> rotated
file before they are deleted on the system.

Remote Host

Logging to a remote host leaves the local logging configuration intact, it can be configured in parallel to a custom file
or console logging. You can log to multiple hosts at the same time, using either TCP or UDP. The default is sending
the messages via port 514/UDP.
set system syslog host <address> facility <keyword> level <keyword>
Log syslog messages to remote host specified by <address>. The address can be specified by either FQDN or
IP address. For an explanation on Facilities keywords and Severity Level keywords see tables below.
set system syslog host <address> facility <keyword> protocol <udp|tcp>
Configure protocol used for communication to remote syslog host. This can be either UDP or TCP.

8.11. System 959

 VyOS Documentation, Release 1.5.x (circinus)

set system syslog vrf <name>

Specify name of the VRF instance.

Local User Account

set system syslog user <username> facility <keyword> level <keyword>

If logging to a local user account is configured, all defined log messages are display on the console if the local
user is logged in, if the user is not logged in, no messages are being displayed. For an explanation on Facilities
keywords and Severity Level keywords see tables below.

Facilities

List of facilities used by syslog. Most facilities names are self explanatory. Facilities local0 - local7 common usage is
f.e. as network logs facilities for nodes and network equipment. Generally it depends on the situation how to classify
logs and put them to facilities. See facilities more as a tool rather than a directive to follow.
Facilities can be adjusted to meet the needs of the user:

Facility Code Keyword Description

all All facilities
0 kern Kernel messages
1 user User-level messages
2 mail Mail system
3 daemon System daemons
4 auth Security/authentication messages
5 syslog Messages generated internally by syslogd
6 lpr Line printer subsystem
7 news Network news subsystem
8 uucp UUCP subsystem
9 cron Clock daemon
10 security Security/authentication messages
11 ftp FTP daemon
12 ntp NTP subsystem
13 logaudit Log audit
14 logalert Log alert
15 clock clock daemon (note 2)
16 local0 local use 0 (local0)
17 local1 local use 1 (local1)
18 local2 local use 2 (local2)
19 local3 local use 3 (local3)
20 local4 local use 4 (local4)
21 local5 local use 5 (local5)
22 local6 use 6 (local6)
23 local7 local use 7 (local7)

8.11. System 960

 VyOS Documentation, Release 1.5.x (circinus)

Severity Level

Value Severity Key- Description

word
all Log everything
0 Emer- emerg System is unusable - a panic condition
gency
1 Alert alert Action must be taken immediately - A condition that should be corrected immediately,
such as a corrupted system database.
2 Critical crit Critical conditions - e.g. hard drive errors.
3 Error err Error conditions
4 Warning warn- Warning conditions
ing
5 Notice notice Normal but significant conditions - conditions that are not error conditions, but that
may require special handling.
6 Informa- info Informational messages
tional
7 Debug debug Debug-level messages - Messages that contain information normally of use only when
debugging a program.

Display Logs

show log [all | authorization | cluster | conntrack-sync | ...]

Display log files of given category on the console. Use tab completion to get a list of available categories. Those
categories could be: all, authorization, cluster, conntrack-sync, dhcp, directory, dns, file, firewall, https, image
lldp, nat, openvpn, snmp, tail, vpn, vrrp
If no option is specified, this defaults to all.
show log image <name> [all | authorization | directory | file <file name> | tail <lines>]
Log messages from a specified image can be displayed on the console. Details of allowed parameters:

all Display contents of all master log files of the specified image
authorization Display all authorization attempts of the specified image
directory Display list of all user-defined log files of the specified image
file <file name> Display contents of a specified user-defined log file of the specified image
tail Display last lines of the system log of the specified image
<lines> Number of lines to be displayed, default 10

When no options/parameters are used, the contents of the main syslog file are displayed.

Hint: Use show log | strip-private if you want to hide private data when sharing your logs.

8.11. System 961

 VyOS Documentation, Release 1.5.x (circinus)

Delete Logs

delete log file <text>

Deletes the specified user-defined file <text> in the /var/log/user directory
Note that deleting the log file does not stop the system from logging events. If you use this command while the system
is logging events, old log events will be deleted, but events after the delete operation will be recorded in the new file.
To delete the file altogether, first delete logging to the file using system syslog Custom File command, and then delete
the file.

8.11.16 Sysctl

This chapeter describes how to configure kernel parameters at runtime.

sysctl is used to modify kernel parameters at runtime. The parameters available are those listed under /proc/sys/.
set system sysctl parameter <parameter> value <value>

8.11.17 Task Scheduler

The task scheduler allows you to execute tasks on a given schedule. It makes use of UNIX cron.

Note: All scripts executed this way are executed as root user - this may be dangerous. Together with Command
Scripting this can be used for automating (re-)configuration.

set system task-scheduler task <task> interval <interval>

Specify the time interval when <task> should be executed. The interval is specified as number with one of the
following suffixes:
• none - Execution interval in minutes
• m - Execution interval in minutes
• h - Execution interval in hours
• d - Execution interval in days

Note: If suffix is omitted, minutes are implied.

set system task-scheduler task <task> crontab-spec <spec>

Set execution time in common cron time format. A cron <spec> of 30 */6 * * * would execute the <task>
at minute 30 past every 6th hour.
set system task-scheduler task <task> executable path <path>
Specify absolute <path> to script which will be run when <task> is executed.
set system task-scheduler task <task> executable arguments <args>
Arguments which will be passed to the executable.

8.11. System 962

 VyOS Documentation, Release 1.5.x (circinus)

8.11.18 Time Zone

Time Zone setting is very important as e.g all your logfile entries will be based on the configured zone. Without proper
time zone configuration it will be very difficult to compare logfiles from different systems.
set system time-zone <timezone>
Specify the systems <timezone> as the Region/Location that best defines your location. For example, specifying
US/Pacific sets the time zone to US Pacific time.
Command completion can be used to list available time zones. The adjustment for daylight time will take place
automatically based on the time of year.

8.11.19 Updates

VyOS supports online checking for updates

Configuration

set system update-check auto-check

Configure auto-checking for new images
set system update-check url <url>
Configure a URL that contains information about images.

Example

set system update-check auto-check

set system update-check url 'https://raw.githubusercontent.com/vyos/vyos-rolling-nightly-
˓→builds/main/version.json'

Check:

vyos@r4:~$ show system updates

Current version: 1.5-rolling-202312220023

Update available: 1.5-rolling-202312250024

Update URL: https://github.com/vyos/vyos-rolling-nightly-builds/releases/download/1.5-
˓→rolling-202312250024/1.5-rolling-202312250024-amd64.iso

vyos@r4:~$

vyos@r4:~$ add system image latest

8.11. System 963

 VyOS Documentation, Release 1.5.x (circinus)

8.11.20 Default Gateway/Route

In the past (VyOS 1.1) used a gateway-address configured under the system tree (set system gateway-address
<address>), this is no longer supported and existing configurations are migrated to the new CLI command.

Configuration

set protocols static route 0.0.0.0/0 next-hop <address>

Specify static route into the routing table sending all non local traffic to the nexthop address <address>.
delete protocols static route 0.0.0.0/0
Delete default route from the system.

Operation

show ip route 0.0.0.0

Show routing table entry for the default route.

vyos@vyos:~$ show ip route 0.0.0.0

Routing entry for 0.0.0.0/0
Known via "static", distance 10, metric 0, best
Last update 09:46:30 ago
* 172.18.201.254, via eth0.201

See also:
Configuration of Static

8.12 Traffic Policy

8.12.1 QoS

The generic name of Quality of Service or Traffic Control involves things like shaping traffic, scheduling or dropping
packets, which are the kind of things you may want to play with when you have, for instance, a bandwidth bottleneck
in a link and you want to somehow prioritize some type of traffic over another.
tc is a powerful tool for Traffic Control found at the Linux kernel. However, its configuration is often considered a
cumbersome task. Fortunately, VyOS eases the job through its CLI, while using tc as backend.

How to make it work

In order to have VyOS Traffic Control working you need to follow 2 steps:
1. Create a traffic policy.
2. Apply the traffic policy to an interface ingress or egress.
But before learning to configure your policy, we will warn you about the different units you can use and also show you
what classes are and how they work, as some policies may require you to configure them.

8.12. Traffic Policy 964

 VyOS Documentation, Release 1.5.x (circinus)

Units

When configuring your traffic policy, you will have to set data rate values, watch out the units you are managing, it is
easy to get confused with the different prefixes and suffixes you can use. VyOS will always show you the different units
you can use.

Prefixes

They can be decimal prefixes.

kbit (10^3) kilobit per second

mbit (10^6) megabit per second
gbit (10^9) gigabit per second
tbit (10^12) terabit per second

kbps (8*10^3) kilobyte per second

mbps (8*10^6) megabyte per second
gbps (8*10^9) gigabyte per second
tbps (8*10^12) terabyte per second

Or binary prefixes.

kibit (2^10 = 1024) kibibit per second

mibit (2^20 = 1024^2) mebibit per second
gibit (2^30 = 1024^3) gibibit per second
tbit (2^40 = 1024^4) tebibit per second

kibps (1024*8) kibibyte (KiB) per second

mibps (1024^2*8) mebibyte (MiB) per second
gibps (1024^3*8) gibibyte (GiB) per second
tibps (1024^4*8) tebibyte (TiB) per second

Suffixes

A bit is written as bit,

kbit (kilobits per second)

mbit (megabits per second)
gbit (gigabits per second)
tbit (terabits per second)

while a byte is written as a single b.

kbps (kilobytes per second)

mbps (megabytes per second)
gbps (gigabytes per second)

8.12. Traffic Policy 965

 VyOS Documentation, Release 1.5.x (circinus)

Classes

In the Creating a traffic policy section you will see that some of the policies use classes. Those policies let you distribute
traffic into different classes according to different parameters you can choose. So, a class is just a specific type of traffic
you select.
The ultimate goal of classifying traffic is to give each class a different treatment.

Matching traffic

In order to define which traffic goes into which class, you define filters (that is, the matching criteria). Packets go
through these matching rules (as in the rules of a firewall) and, if a packet matches the filter, it is assigned to that class.
In VyOS, a class is identified by a number you can choose when configuring it.

Note: The meaning of the Class ID is not the same for every type of policy. Normally policies just need a meaningless
number to identify a class (Class ID), but that does not apply to every policy. The number of a class in a Priority Queue
it does not only identify it, it also defines its priority.

set qos policy <policy> <policy-name> class <class-ID> match <class-matching-rule-name>

In the command above, we set the type of policy we are going to work with and the name we choose for it; a class (so
that we can differentiate some traffic) and an identifiable number for that class; then we configure a matching rule (or
filter) and a name for it.
A class can have multiple match filters:

set qos policy shaper MY-SHAPER class 30 match HTTP

set qos policy shaper MY-SHAPER class 30 match HTTPs

A match filter can contain multiple criteria and will match traffic if all those criteria are true.
For example:

set qos policy shaper MY-SHAPER class 30 match HTTP ip protocol tcp
set qos policy shaper MY-SHAPER class 30 match HTTP ip source port 80

This will match TCP traffic with source port 80.

There are many parameters you will be able to use in order to match the traffic you want for a class:
• Ethernet (protocol, destination address or source address)
• Interface name
• IPv4 (DSCP value, maximum packet length, protocol, source address, destination address, source port,
destination port or TCP flags)
• IPv6 (DSCP value, maximum payload length, protocol, source address, destination address, source port,
destination port or TCP flags)
• Firewall mark
• VLAN ID
When configuring your filter, you can use the Tab key to see the many different parameters you can configure.

8.12. Traffic Policy 966

 VyOS Documentation, Release 1.5.x (circinus)

vyos@vyos# set qos policy shaper MY-SHAPER class 30 match MY-FIRST-FILTER

Possible completions:
description Description
> ether Ethernet header match
interface Interface to use
> ip Match IP protocol header
> ipv6 Match IPV6 protocol header
mark Match on mark applied by firewall
vif Virtual Local Area Network (VLAN) ID for this match

As shown in the example above, one of the possibilities to match packets is based on marks done by the firewall, that
can give you a great deal of flexibility.
You can also write a description for a filter:

set qos policy shaper MY-SHAPER class 30 match MY-FIRST-FILTER description "My filter␣
˓→description"

Note: An IPv4 TCP filter will only match packets with an IPv4 header length of 20 bytes (which is the majority of
IPv4 packets anyway).

Note: IPv6 TCP filters will only match IPv6 packets with no header extension, see https://en.wikipedia.org/wiki/
IPv6_packet#Extension_headers

Traffic Match Group

In some case where we need to have an organization of our matching selection, in order to be more flexible and organize
with our filter definition. We can apply traffic match groups, allowing us to create distinct filter groups within our policy
and define various parameters for each group:

set qos traffic-match-group <group_name> match <match_name>

Possible completions:
description Description
> ip Match IP protocol header
> ipv6 Match IPv6 protocol header
mark Match on mark applied by firewall
vif Virtual Local Area Network (VLAN) ID for this match

inherit matches from another group

set qos traffic-match-group <group_name> match-group <match_group_name>

A match group can contain multiple criteria and inherit them in the same policy.
For example:

set qos traffic-match-group Mission-Critical match AF31 ip dscp 'AF31'

set qos traffic-match-group Mission-Critical match AF32 ip dscp 'AF42'
set qos traffic-match-group Mission-Critical match CS3 ip dscp 'CS3'
set qos traffic-match-group Streaming-Video match AF11 ip dscp 'AF11'
(continues on next page)

8.12. Traffic Policy 967

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set qos traffic-match-group Streaming-Video match AF41 ip dscp 'AF41'
set qos traffic-match-group Streaming-Video match AF43 ip dscp 'AF43'
set qos policy shaper VyOS-HTB class 10 bandwidth '30%'
set qos policy shaper VyOS-HTB class 10 description 'Multimedia'
set qos policy shaper VyOS-HTB class 10 match CS4 ip dscp 'CS4'
set qos policy shaper VyOS-HTB class 10 match-group 'Streaming-Video'
set qos policy shaper VyOS-HTB class 10 priority '1'
set qos policy shaper VyOS-HTB class 10 queue-type 'fair-queue'
set qos policy shaper VyOS-HTB class 20 description 'MC'
set qos policy shaper VyOS-HTB class 20 match-group 'Mission-Critical'
set qos policy shaper VyOS-HTB class 20 priority '2'
set qos policy shaper VyOS-HTB class 20 queue-type 'fair-queue'
set qos policy shaper VyOS-HTB default bandwidth '20%'
set qos policy shaper VyOS-HTB default queue-type 'fq-codel'

In this example, we can observe that different DSCP criteria are defined based on our QoS configuration within the
same policy group.

Default

Often you will also have to configure your default traffic in the same way you do with a class. Default can be considered
a class as it behaves like that. It contains any traffic that did not match any of the defined classes, so it is like an open
class, a class without matching filters.

Class treatment

Once a class has a filter configured, you will also have to define what you want to do with the traffic of that class, what
specific Traffic-Control treatment you want to give it. You will have different possibilities depending on the Traffic
Policy you are configuring.

vyos@vyos# set qos policy shaper MY-SHAPER class 30

Possible completions:
bandwidth Available bandwidth for this policy (default: auto)
burst Burst size for this class (default: 15k)
ceiling Bandwidth limit for this class
codel-quantum
Deficit in the fair queuing algorithm (default 1514)
description Description
flows Number of flows into which the incoming packets are classified(default␣
˓→1024)

interval Interval used to measure the delay (default 100)

+> match Class matching rule name
priority Priority for rule evaluation
queue-limit Maximum queue size
queue-type Queue type for default traffic (default: fq-codel)
set-dscp Change the Differentiated Services (DiffServ) field in the IP header
target Acceptable minimum standing/persistent queue delay (default: 5)

For instance, with set qos policy shaper MY-SHAPER class 30 set-dscp EF you would be modifying the
DSCP field value of packets in that class to Expedite Forwarding.

8.12. Traffic Policy 968

 VyOS Documentation, Release 1.5.x (circinus)

DSCP values as per RFC 2474 and RFC 4595:

Binary value Configured value Drop rate Description

101110 46 • Expedited forwarding
(EF)
000000 0 • Best effort traffic, de-
fault
001010 10 Low Assured Forward-
ing(AF) 11
001100 12 Medium Assured Forward-
ing(AF) 12
001110 14 High Assured Forward-
ing(AF) 13
010010 18 Low Assured Forward-
ing(AF) 21
010100 20 Medium Assured Forward-
ing(AF) 22
010110 22 High Assured Forward-
ing(AF) 23
011010 26 Low Assured Forward-
ing(AF) 31
011100 28 Medium Assured Forward-
ing(AF) 32
011110 30 High Assured Forward-
ing(AF) 33
100010 34 Low Assured Forward-
ing(AF) 41
100100 36 Medium Assured Forward-
ing(AF) 42
100110 38 High Assured Forward-
ing(AF) 43

Embedding one policy into another one

Often we need to embed one policy into another one. It is possible to do so on classful policies, by attaching a new
policy into a class. For instance, you might want to apply different policies to the different classes of a Round-Robin
policy you have configured.
A common example is the case of some policies which, in order to be effective, they need to be applied to an interface
that is directly connected where the bottleneck is. If your router is not directly connected to the bottleneck, but some
hop before it, you can emulate the bottleneck by embedding your non-shaping policy into a classful shaping one so that
it takes effect.
You can configure a policy into a class through the queue-type setting.

set qos policy shaper FQ-SHAPER bandwidth 4gbit

set qos policy shaper FQ-SHAPER default bandwidth 100%
set qos policy shaper FQ-SHAPER default queue-type fq-codel

As shown in the last command of the example above, the queue-type setting allows these combinations. You will be
able to use it in many policies.

8.12. Traffic Policy 969

 VyOS Documentation, Release 1.5.x (circinus)

Note: Some policies already include other embedded policies inside. That is the case of Shaper: each of its classes
use fair-queue unless you change it.

Creating a traffic policy

VyOS lets you control traffic in many different ways, here we will cover every possibility. You can configure as many
policies as you want, but you will only be able to apply one policy per interface and direction (inbound or outbound).
Some policies can be combined, you will be able to embed a different policy that will be applied to a class of the main
policy.

Hint: If you are looking for a policy for your outbound traffic but you don’t know which one you need and you
don’t want to go through every possible policy shown here, our bet is that highly likely you are looking for a Shaper
policy and you want to set its queues as FQ-CoDel.

Drop Tail

Queueing discipline: PFIFO (Packet First In First Out).

Applies to: Outbound traffic.

This the simplest queue possible you can apply to your traffic. Traffic must go through a finite queue before it is actually
sent. You must define how many packets that queue can contain.
When a packet is to be sent, it will have to go through that queue, so the packet will be placed at the tail of it. When
the packet completely goes through it, it will be dequeued emptying its place in the queue and being eventually handed
to the NIC to be actually sent out.
Despite the Drop-Tail policy does not slow down packets, if many packets are to be sent, they could get dropped when
trying to get enqueued at the tail. This can happen if the queue has still not been able to release enough packets from
its head.
This is the policy that requires the lowest resources for the same amount of traffic. But very likely you do not need it
as you cannot get much from it. Sometimes it is used just to enable logging.
set qos policy drop-tail <policy-name> queue-limit <number-of-packets>
Use this command to configure a drop-tail policy (PFIFO). Choose a unique name for this policy and the size
of the queue by setting the number of packets it can contain (maximum 4294967295).

Fair Queue

Queueing discipline: SFQ (Stochastic Fairness Queuing).

Applies to: Outbound traffic.

Fair Queue is a work-conserving scheduler which schedules the transmission of packets based on flows, that is, it
balances traffic distributing it through different sub-queues in order to ensure fairness so that each flow is able to send
data in turn, preventing any single one from drowning out the rest.
set qos policy fair-queue <policy-name>

8.12. Traffic Policy 970

 VyOS Documentation, Release 1.5.x (circinus)

Use this command to create a Fair-Queue policy and give it a name. It is based on the Stochastic Fairness
Queueing and can be applied to outbound traffic.
In order to separate traffic, Fair Queue uses a classifier based on source address, destination address and source port.
The algorithm enqueues packets to hash buckets based on those tree parameters. Each of these buckets should represent
a unique flow. Because multiple flows may get hashed to the same bucket, the hashing algorithm is perturbed at con-
figurable intervals so that the unfairness lasts only for a short while. Perturbation may however cause some inadvertent
packet reordering to occur. An advisable value could be 10 seconds.
One of the uses of Fair Queue might be the mitigation of Denial of Service attacks.
set qos policy fair-queue <policy-name> hash-interval <seconds>
Use this command to define a Fair-Queue policy, based on the Stochastic Fairness Queueing, and set the number
of seconds at which a new queue algorithm perturbation will occur (maximum 4294967295).
When dequeuing, each hash-bucket with data is queried in a round robin fashion. You can configure the length of the
queue.
set qos policy fair-queue <policy-name> queue-limit <limit>
Use this command to define a Fair-Queue policy, based on the Stochastic Fairness Queueing, and set the number
of maximum packets allowed to wait in the queue. Any other packet will be dropped.

Note: Fair Queue is a non-shaping (work-conserving) policy, so it will only be useful if your outgoing interface is
really full. If it is not, VyOS will not own the queue and Fair Queue will have no effect. If there is bandwidth available
on the physical link, you can embed Fair-Queue into a classful shaping policy to make sure it owns the queue.

FQ-CoDel

Queueing discipline Fair/Flow Queue CoDel.

Applies to: Outbound Traffic.

The FQ-CoDel policy distributes the traffic into 1024 FIFO queues and tries to provide good service between all of
them. It also tries to keep the length of all the queues short.
FQ-CoDel fights bufferbloat and reduces latency without the need of complex configurations. It has become the new
default Queueing Discipline for the interfaces of some GNU/Linux distributions.
It uses a stochastic model to classify incoming packets into different flows and is used to provide a fair share of the
bandwidth to all the flows using the queue. Each flow is managed by the CoDel queuing discipline. Reordering within
a flow is avoided since Codel internally uses a FIFO queue.
FQ-CoDel is based on a modified Deficit Round Robin (DRR) queue scheduler with the CoDel Active Queue Manage-
ment (AQM) algorithm operating on each queue.

Note: FQ-Codel is a non-shaping (work-conserving) policy, so it will only be useful if your outgoing interface is really
full. If it is not, VyOS will not own the queue and FQ-Codel will have no effect. If there is bandwidth available on the
physical link, you can embed FQ-Codel into a classful shaping policy to make sure it owns the queue. If you are not
sure if you need to embed your FQ-CoDel policy into a Shaper, do it.

FQ-CoDel is tuned to run ok with its default parameters at 10Gbit speeds. It might work ok too at other speeds without
configuring anything, but here we will explain some cases when you might want to tune its parameters.

8.12. Traffic Policy 971

 VyOS Documentation, Release 1.5.x (circinus)

When running it at 1Gbit and lower, you may want to reduce the queue-limit to 1000 packets or less. In rates like
10Mbit, you may want to set it to 600 packets.
If you are using FQ-CoDel embedded into Shaper and you have large rates (100Mbit and above), you may consider
increasing quantum to 8000 or higher so that the scheduler saves CPU.
On low rates (below 40Mbit) you may want to tune quantum down to something like 300 bytes.
At very low rates (below 3Mbit), besides tuning quantum (300 keeps being ok) you may also want to increase target to
something like 15ms and increase interval to something around 150 ms.
set qos policy fq-codel <policy name> codel-quantum <bytes>
Use this command to configure an fq-codel policy, set its name and the maximum number of bytes (default:
1514) to be dequeued from a queue at once.
set qos policy fq-codel <policy name> flows <number-of-flows>
Use this command to configure an fq-codel policy, set its name and the number of sub-queues (default: 1024)
into which packets are classified.
set qos policy fq-codel <policy name> interval <milliseconds>
Use this command to configure an fq-codel policy, set its name and the time period used by the control loop
of CoDel to detect when a persistent queue is developing, ensuring that the measured minimum delay does not
become too stale (default: 100ms).
set qos policy fq-codel <policy-name> queue-limit <number-of-packets>
Use this command to configure an fq-codel policy, set its name, and define a hard limit on the real queue size.
When this limit is reached, new packets are dropped (default: 10240 packets).
set qos policy fq-codel <policy-name> target <milliseconds>
Use this command to configure an fq-codel policy, set its name, and define the acceptable minimum stand-
ing/persistent queue delay. This minimum delay is identified by tracking the local minimum queue delay that
packets experience (default: 5ms).

Example

A simple example of an FQ-CoDel policy working inside a Shaper one.

set qos policy shaper FQ-CODEL-SHAPER bandwidth 2gbit

set qos policy shaper FQ-CODEL-SHAPER default bandwidth 100%
set qos policy shaper FQ-CODEL-SHAPER default queue-type fq-codel

Limiter

Queueing discipline: Ingress policer.

Applies to: Inbound traffic.

Limiter is one of those policies that uses classes (Ingress qdisc is actually a classless policy but filters do work in it).
The limiter performs basic ingress policing of traffic flows. Multiple classes of traffic can be defined and traffic limits
can be applied to each class. Although the policer uses a token bucket mechanism internally, it does not have the
capability to delay a packet as a shaping mechanism does. Traffic exceeding the defined bandwidth limits is directly
dropped. A maximum allowed burst can be configured too.

8.12. Traffic Policy 972

 VyOS Documentation, Release 1.5.x (circinus)

You can configure classes (up to 4090) with different settings and a default policy which will be applied to any traffic
not matching any of the configured classes.

Note: In the case you want to apply some kind of shaping to your inbound traffic, check the ingress-shaping section.

set qos policy limiter <policy-name> class <class ID> match <match-name> description
<description>
Use this command to configure an Ingress Policer, defining its name, a class identifier (1-4090), a class matching
rule name and its description.
Once the matching rules are set for a class, you can start configuring how you want matching traffic to behave.
set qos policy limiter <policy-name> class <class-ID> bandwidth <rate>
Use this command to configure an Ingress Policer, defining its name, a class identifier (1-4090) and the maximum
allowed bandwidth for this class.
set qos policy limiter <policy-name> class <class-ID> burst <burst-size>
Use this command to configure an Ingress Policer, defining its name, a class identifier (1-4090) and the burst
size in bytes for this class (default: 15).
set qos policy limiter <policy-name> default bandwidth <rate>
Use this command to configure an Ingress Policer, defining its name and the maximum allowed bandwidth for
its default policy.
set qos policy limiter <policy-name> default burst <burst-size>
Use this command to configure an Ingress Policer, defining its name and the burst size in bytes (default: 15) for
its default policy.
set qos policy limiter <policy-name> class <class ID> priority <value>
Use this command to configure an Ingress Policer, defining its name, a class identifier (1-4090), and the priority
(0-20, default 20) in which the rule is evaluated (the lower the number, the higher the priority).

Network Emulator

Queueing discipline: netem (Network Emulator) + TBF (Token Bucket Filter).

Applies to: Outbound traffic.

VyOS Network Emulator policy emulates the conditions you can suffer in a real network. You will be able to configure
things like rate, burst, delay, packet loss, packet corruption or packet reordering.
This could be helpful if you want to test how an application behaves under certain network conditions.
set qos policy network-emulator <policy-name> bandwidth <rate>
Use this command to configure the maximum rate at which traffic will be shaped in a Network Emulator policy.
Define the name of the policy and the rate.
set qos policy network-emulator <policy-name> burst <burst-size>
Use this command to configure the burst size of the traffic in a Network Emulator policy. Define the name of the
Network Emulator policy and its traffic burst size (it will be configured through the Token Bucket Filter qdisc).
Default:15kb. It will only take effect if you have configured its bandwidth too.
set qos policy network-emulator <policy-name> delay <delay>

8.12. Traffic Policy 973

 VyOS Documentation, Release 1.5.x (circinus)

Use this command to configure a Network Emulator policy defining its name and the fixed amount of time you
want to add to all packet going out of the interface. The latency will be added through the Token Bucket Filter
qdisc. It will only take effect if you have configured its bandwidth too. You can use secs, ms and us. Default:
50ms.
set qos policy network-emulator <policy-name> corruption <percent>
Use this command to emulate noise in a Network Emulator policy. Set the policy name and the percentage of
corrupted packets you want. A random error will be introduced in a random position for the chosen percent of
packets.
set qos policy network-emulator <policy-name> loss <percent>
Use this command to emulate packet-loss conditions in a Network Emulator policy. Set the policy name and
the percentage of loss packets your traffic will suffer.
set traffic-policy network-emulator <policy-name> reordering <percent>
Use this command to emulate packet-reordering conditions in a Network Emulator policy. Set the policy name
and the percentage of reordered packets your traffic will suffer.
set traffic-policy network-emulator <policy-name> queue-limit <limit>
Use this command to define the length of the queue of your Network Emulator policy. Set the policy name and
the maximum number of packets (1-4294967295) the queue may hold queued at a time.

Priority Queue

Queueing discipline: PRIO.

Applies to: Outbound traffic.

The Priority Queue is a classful scheduling policy. It does not delay packets (Priority Queue is not a shaping policy),
it simply dequeues packets according to their priority.

Note: Priority Queue, as other non-shaping policies, is only useful if your outgoing interface is really full. If it is not,
VyOS will not own the queue and Priority Queue will have no effect. If there is bandwidth available on the physical
link, you can embed Priority Queue into a classful shaping policy to make sure it owns the queue. In that case packets
can be prioritized based on DSCP.

Up to seven queues -defined as classes with different priorities- can be configured. Packets are placed into queues
based on associated match criteria. Packets are transmitted from the queues in priority order. If classes with a higher
priority are being filled with packets continuously, packets from lower priority classes will only be transmitted after
traffic volume from higher priority classes decreases.

Note: In Priority Queue we do not define classes with a meaningless class ID number but with a class priority number
(1-7). The lower the number, the higher the priority.

As with other policies, you can define different type of matching rules for your classes:

vyos@vyos# set qos policy priority-queue MY-PRIO class 3 match MY-MATCH-RULE

Possible completions:
description Description
> ether Ethernet header match
(continues on next page)

8.12. Traffic Policy 974

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

interface Interface to use
> ip Match IP protocol header
> ipv6 Match IPV6 protocol header
mark Match on mark applied by firewall
vif Virtual Local Area Network (VLAN) ID for this match

As with other policies, you can embed other policies into the classes (and default) of your Priority Queue policy through
the queue-type setting:

vyos@vyos# set qos policy priority-queue MY-PRIO class 3 queue-type

Possible completions:
drop-tail First-In-First-Out (FIFO) (default)
fq-codel Fair Queue Codel
fair-queue Stochastic Fair Queue (SFQ)
priority Priority queueing
random-detect
Random Early Detection (RED)

set qos policy priority-queue <policy-name> class <class-ID> queue-limit <limit>

Use this command to configure a Priority Queue policy, set its name, set a class with a priority from 1 to 7 and
define a hard limit on the real queue size. When this limit is reached, new packets are dropped.

Random-Detect

Queueing discipline: Generalized Random Early Drop.

Applies to: Outbound traffic.

A simple Random Early Detection (RED) policy would start randomly dropping packets from a queue before it reaches
its queue limit thus avoiding congestion. That is good for TCP connections as the gradual dropping of packets acts as
a signal for the sender to decrease its transmission rate.
In contrast to simple RED, VyOS’ Random-Detect uses a Generalized Random Early Detect policy that provides dif-
ferent virtual queues based on the IP Precedence value so that some virtual queues can drop more packets than others.
This is achieved by using the first three bits of the ToS (Type of Service) field to categorize data streams and, in
accordance with the defined precedence parameters, a decision is made.
IP precedence as defined in RFC 791:

Precedence Priority
7 Network Control
6 Internetwork Control
5 CRITIC/ECP
4 Flash Override
3 Flash
2 Immediate
1 Priority
0 Routine

Random-Detect could be useful for heavy traffic. One use of this algorithm might be to prevent a backbone overload.
But only for TCP (because dropped packets could be retransmitted), not for UDP.

8.12. Traffic Policy 975

 VyOS Documentation, Release 1.5.x (circinus)

set qos policy random-detect <policy-name> bandwidth <bandwidth>

Use this command to configure a Random-Detect policy, set its name and set the available bandwidth for this
policy. It is used for calculating the average queue size after some idle time. It should be set to the bandwidth
of your interface. Random Detect is not a shaping policy, this command will not shape.
set qos policy random-detect <policy-name> precedence <IP-precedence-value>
average-packet <bytes>
Use this command to configure a Random-Detect policy and set its name, then state the IP Precedence for the
virtual queue you are configuring and what the size of its average-packet should be (in bytes, default: 1024).

Note: When configuring a Random-Detect policy: the higher the precedence number, the higher the priority.

set qos policy random-detect <policy-name> precedence <IP-precedence-value>

mark-probability <value>
Use this command to configure a Random-Detect policy and set its name, then state the IP Precedence for the
virtual queue you are configuring and what its mark (drop) probability will be. Set the probability by giving the
N value of the fraction 1/N (default: 10).
set qos policy random-detect <policy-name> precedence <IP-precedence-value>
maximum-threshold <packets>
Use this command to configure a Random-Detect policy and set its name, then state the IP Precedence for the
virtual queue you are configuring and what its maximum threshold for random detection will be (from 0 to 4096
packets, default: 18). At this size, the marking (drop) probability is maximal.
set qos policy random-detect <policy-name> precedence <IP-precedence-value>
minimum-threshold <packets>
Use this command to configure a Random-Detect policy and set its name, then state the IP Precedence for the
virtual queue you are configuring and what its minimum threshold for random detection will be (from 0 to 4096
packets). If this value is exceeded, packets start being eligible for being dropped.
The default values for the minimum-threshold depend on IP precedence:

Precedence default min-threshold

7 16
6 15
5 14
4 13
3 12
2 11
1 10
0 9

set qos policy random-detect <policy-name> precedence <IP-precedence-value> queue-limit

<packets>
Use this command to configure a Random-Detect policy and set its name, then name the IP Precedence for the
virtual queue you are configuring and what the maximum size of its queue will be (from 1 to 1-4294967295
packets). Packets are dropped when the current queue length reaches this value.
If the average queue size is lower than the min-threshold, an arriving packet will be placed in the queue.
In the case the average queue size is between min-threshold and max-threshold, then an arriving packet would be
either dropped or placed in the queue, it will depend on the defined mark-probability.

8.12. Traffic Policy 976

 VyOS Documentation, Release 1.5.x (circinus)

If the current queue size is larger than queue-limit, then packets will be dropped. The average queue size depends on
its former average size and its current one.
If max-threshold is set but min-threshold is not, then **min-threshold is scaled to 50% of max-threshold.
In principle, values must be min-threshold < max-threshold < queue-limit.

Rate Control

Queueing discipline: Token Bucket Filter.

Applies to: Outbound traffic.

Rate-Control is a classless policy that limits the packet flow to a set rate. It is a pure shaper, it does not schedule traffic.
Traffic is filtered based on the expenditure of tokens. Tokens roughly correspond to bytes.
Short bursts can be allowed to exceed the limit. On creation, the Rate-Control traffic is stocked with tokens which
correspond to the amount of traffic that can be burst in one go. Tokens arrive at a steady rate, until the bucket is full.
set qos policy rate-control <policy-name> bandwidth <rate>
Use this command to configure a Rate-Control policy, set its name and the rate limit you want to have.
set qos policy rate-control <policy-name> burst <burst-size>
Use this command to configure a Rate-Control policy, set its name and the size of the bucket in bytes which will
be available for burst.
As a reference: for 10mbit/s on Intel, you might need at least 10kbyte buffer if you want to reach your configured rate.
A very small buffer will soon start dropping packets.
set qos policy rate-control <policy-name> latency
Use this command to configure a Rate-Control policy, set its name and the maximum amount of time a packet
can be queued (default: 50 ms).
Rate-Control is a CPU-friendly policy. You might consider using it when you just simply want to slow traffic down.

Round Robin

Queueing discipline: Deficit Round Robin.

Applies to: Outbound traffic.

The round-robin policy is a classful scheduler that divides traffic in different classes you can configure (up to 4096).
You can embed a new policy into each of those classes (default included).
Each class is assigned a deficit counter (the number of bytes that a flow is allowed to transmit when it is its turn)
initialized to quantum. Quantum is a parameter you configure which acts like a credit of fix bytes the counter receives
on each round. Then the Round-Robin policy starts moving its Round Robin pointer through the queues. If the deficit
counter is greater than the packet’s size at the head of the queue, this packet will be sent and the value of the counter
will be decremented by the packet size. Then, the size of the next packet will be compared to the counter value again,
repeating the process. Once the queue is empty or the value of the counter is insufficient, the Round-Robin pointer will
move to the next queue. If the queue is empty, the value of the deficit counter is reset to 0.
At every round, the deficit counter adds the quantum so that even large packets will have their opportunity to be de-
queued.

8.12. Traffic Policy 977

 VyOS Documentation, Release 1.5.x (circinus)

set qos policy round-robin <policy name> class <class-ID> quantum <packets>
Use this command to configure a Round-Robin policy, set its name, set a class ID, and the quantum for that
class. The deficit counter will add that value each round.
set qos policy round-robin <policy name> class <class ID> queue-limit <packets>
Use this command to configure a Round-Robin policy, set its name, set a class ID, and the queue size in packets.
As with other policies, Round-Robin can embed another policy into a class through the queue-type setting.

vyos@vyos# set qos policy round-robin DRR class 10 queue-type

Possible completions:
drop-tail First-In-First-Out (FIFO) (default)
fq-codel Fair Queue Codel
fair-queue Stochastic Fair Queue (SFQ)
priority Priority queueing based
random-detect
Random Early Detection (RED)

Shaper

Queueing discipline: Hierarchical Token Bucket.

Applies to: Outbound traffic.

The Shaper policy does not guarantee a low delay, but it does guarantee bandwidth to different traffic classes and also
lets you decide how to allocate more traffic once the guarantees are met.
Each class can have a guaranteed part of the total bandwidth defined for the whole policy, so all those shares together
should not be higher than the policy’s whole bandwidth.
If guaranteed traffic for a class is met and there is room for more traffic, the ceiling parameter can be used to set how
much more bandwidth could be used. If guaranteed traffic is met and there are several classes willing to use their
ceilings, the priority parameter will establish the order in which that additional traffic will be allocated. Priority can be
any number from 0 to 7. The lower the number, the higher the priority.
set qos policy shaper <policy-name> bandwidth <rate>
Use this command to configure a Shaper policy, set its name and the maximum bandwidth for all combined
traffic.
set qos policy shaper <policy-name> class <class-ID> bandwidth <rate>
Use this command to configure a Shaper policy, set its name, define a class and set the guaranteed traffic you
want to allocate to that class.
set qos policy shaper <policy-name> class <class-ID> burst <bytes>
Use this command to configure a Shaper policy, set its name, define a class and set the size of the tocken bucket
in bytes, which will be available to be sent at ceiling speed (default: 15Kb).
set qos policy shaper <policy-name> class <class-ID> ceiling <bandwidth>
Use this command to configure a Shaper policy, set its name, define a class and set the maximum speed possible
for this class. The default ceiling value is the bandwidth value.
set qos policy shaper <policy-name> class <class-ID> priority <0-7>

8.12. Traffic Policy 978

 VyOS Documentation, Release 1.5.x (circinus)

Use this command to configure a Shaper policy, set its name, define a class and set the priority for usage of
available bandwidth once guarantees have been met. The lower the priority number, the higher the priority. The
default priority value is 0, the highest priority.
As with other policies, Shaper can embed other policies into its classes through the queue-type setting and then
configure their parameters.

vyos@vyos# set qos policy shaper HTB class 10 queue-type

Possible completions:
fq-codel Fair Queue Codel (default)
fair-queue Stochastic Fair Queue (SFQ)
drop-tail First-In-First-Out (FIFO)
priority Priority queueing
random-detect
Random Early Detection (RED)

vyos@vyos# set qos policy shaper HTB class 10

Possible completions:
bandwidth Available bandwidth for this policy (default: auto)
burst Burst size for this class (default: 15k)
ceiling Bandwidth limit for this class
codel-quantum
Deficit in the fair queuing algorithm (default 1514)
description Description
flows Number of flows into which the incoming packets are classified (default␣
˓→1024)

interval Interval used to measure the delay (default 100)

+> match Class matching rule name
priority Priority for rule evaluation
queue-limit Maximum queue size (packets)
queue-type Queue type for default traffic (default: fq-codel)
set-dscp Change the Differentiated Services (DiffServ) field in the IP header
target Acceptable minimum standing/persistent queue delay (default: 5)

Note: If you configure a class for VoIP traffic, don’t give it any ceiling, otherwise new VoIP calls could start when
the link is available and get suddenly dropped when other classes start using their assigned bandwidth share.

Example

A simple example of Shaper using priorities.

set qos policy shaper MY-HTB bandwidth '50mbit'

set qos policy shaper MY-HTB class 10 bandwidth '20%'
set qos policy shaper MY-HTB class 10 match DSCP ip dscp 'EF'
set qos policy shaper MY-HTB class 10 queue-type 'fq-codel'
set qos policy shaper MY-HTB class 20 bandwidth '10%'
set qos policy shaper MY-HTB class 20 ceiling '50%'
set qos policy shaper MY-HTB class 20 match PORT666 ip destination port '666'
set qos policy shaper MY-HTB class 20 priority '3'
set qos policy shaper MY-HTB class 20 queue-type 'fair-queue'
set qos policy shaper MY-HTB class 30 bandwidth '10%'
(continues on next page)

8.12. Traffic Policy 979

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set qos policy shaper MY-HTB class 30 ceiling '50%'
set qos policy shaper MY-HTB class 30 match ADDRESS30 ip source address '192.168.30.0/24'
set qos policy shaper MY-HTB class 30 priority '5'
set qos policy shaper MY-HTB class 30 queue-type 'fair-queue'
set qos policy shaper MY-HTB default bandwidth '10%'
set qos policy shaper MY-HTB default ceiling '100%'
set qos policy shaper MY-HTB default priority '7'
set qos policy shaper MY-HTB default queue-type 'fair-queue'

CAKE

Queueing discipline: Deficit mode.

Applies to: Outbound traffic.

Common Applications Kept Enhanced (CAKE) is a comprehensive queue management system, implemented as a queue
discipline (qdisc) for the Linux kernel. It is designed to replace and improve upon the complex hierarchy of simple
qdiscs presently required to effectively tackle the bufferbloat problem at the network edge.
set qos policy cake <text> bandwidth <value>
Set the shaper bandwidth, either as an explicit bitrate or a percentage of the interface bandwidth.
set qos policy cake <text> description
Set a description for the shaper.
set qos policy cake <text> flow-isolation blind
Disables flow isolation, all traffic passes through a single queue.
set qos policy cake <text> flow-isolation dst-host
Flows are defined only by destination address.
set qos policy cake <text> flow-isolation dual-dst-host
Flows are defined by the 5-tuple. Fairness is applied first over destination addresses, then over individual flows.
set qos policy cake <text> flow-isolation dual-src-host
Flows are defined by the 5-tuple. Fairness is applied first over source addresses, then over individual flows.
set qos policy cake <text> flow-isolation flow
Flows are defined by the entire 5-tuple (source IP address, source port, destination IP address, destination port,
transport protocol).
set qos policy cake <text> flow-isolation host
Flows are defined by source-destination host pairs.
set qos policy cake <text> flow-isolation nat
Perform NAT lookup before applying flow-isolation rules.
set qos policy cake <text> flow-isolation src-host
Flows are defined only by source address.
set qos policy cake <text> flow-isolation triple-isolate

8.12. Traffic Policy 980

 VyOS Documentation, Release 1.5.x (circinus)

(Default) Flows are defined by the 5-tuple, fairness is applied over source and destination addresses and also
over individual flows.
set qos policy cake <text> rtt
Defines the round-trip time used for active queue management (AQM) in milliseconds. The default value is 100.

Applying a traffic policy

Once a traffic-policy is created, you can apply it to an interface:

set qos interface eth0 egress WAN-OUT

You can only apply one policy per interface and direction, but you could reuse a policy on different interfaces and
directions:

set qos interface eth0 ingress WAN-IN

set qos interface eth0 egress WAN-OUT
set qos interface eth1 ingress LAN-IN
set qos interface eth1 egress LAN-OUT
set qos interface eth2 ingress LAN-IN
set qos interface eth2 egress LAN-OUT
set qos interface eth3 ingress TWO-WAY-POLICY
set qos interface eth3 egress TWO-WAY-POLICY
set qos interface eth4 ingress TWO-WAY-POLICY
set qos interface eth4 egress TWO-WAY-POLICY

The case of ingress shaping

Applies to: Inbound traffic.

For the ingress traffic of an interface, there is only one policy you can directly apply, a Limiter policy. You cannot
apply a shaping policy directly to the ingress traffic of any interface because shaping only works for outbound traffic.
This workaround lets you apply a shaping policy to the ingress traffic by first redirecting it to an in-between virtual
interface (Intermediate Functional Block). There, in that virtual interface, you will be able to apply any of the policies
that work for outbound traffic, for instance, a shaping one.
That is how it is possible to do the so-called “ingress shaping”.

set qos policy shaper MY-INGRESS-SHAPING bandwidth 1000kbit

set qos policy shaper MY-INGRESS-SHAPING default bandwidth 1000kbit
set qos policy shaper MY-INGRESS-SHAPING default queue-type fair-queue

set qos interface ifb0 egress MY-INGRESS-SHAPING

set interfaces ethernet eth0 redirect ifb0

set interfaces input ifb0

Warning: Do not configure IFB as the first step. First create everything else of your traffic-policy, and then you
can configure IFB. Otherwise you might get the RTNETLINK answer: File exists error, which can be solved
with sudo ip link delete ifb0.

8.12. Traffic Policy 981

 VyOS Documentation, Release 1.5.x (circinus)

8.13 VPN

8.13.1 IPsec

GRE (Generic Routing Encapsulation), GRE/IPsec (or IPIP/IPsec, SIT/IPsec, or any other stateless tunnel protocol
over IPsec) is the usual way to protect the traffic inside a tunnel.
An advantage of this scheme is that you get a real interface with its own address, which makes it easier to setup static
routes or use dynamic routing protocols without having to modify IPsec policies. The other advantage is that it greatly
simplifies router to router communication, which can be tricky with plain IPsec because the external outgoing address of
the router usually doesn’t match the IPsec policy of typical site-to-site setup and you need to add special configuration
for it, or adjust the source address for outgoing traffic of your applications. GRE/IPsec has no such problem and is
completely transparent for the applications.
GRE/IPIP/SIT and IPsec are widely accepted standards, which make this scheme easy to implement between VyOS
and virtually any other router.
For simplicity we’ll assume that the protocol is GRE, it’s not hard to guess what needs to be changed to make it work
with a different protocol. We assume that IPsec will use pre-shared secret authentication and will use AES128/SHA1
for the cipher and hash. Adjust this as necessary.

Note: VMware users should ensure that a VMXNET3 adapter is used. E1000 adapters have known issues with GRE
processing.

IKE (Internet Key Exchange) Attributes

IKE performs mutual authentication between two parties and establishes an IKE security association (SA) that includes
shared secret information that can be used to efficiently establish SAs for Encapsulating Security Payload (ESP) or
Authentication Header (AH) and a set of cryptographic algorithms to be used by the SAs to protect the traffic that they
carry. https://datatracker.ietf.org/doc/html/rfc5996
In VyOS, IKE attributes are specified through IKE groups. Multiple proposals can be specified in a single group.
VyOS IKE group has the next options:
• close-action defines the action to take if the remote peer unexpectedly closes a CHILD_SA:
• none set action to none (default);
• trap installs a trap policy for the CHILD_SA;
• start tries to immediately re-create the CHILD_SA;
• dead-peer-detection controls the use of the Dead Peer Detection protocol (DPD, RFC 3706) where
R_U_THERE notification messages (IKEv1) or empty INFORMATIONAL messages (IKEv2) are periodically
sent in order to check the liveliness of the IPsec peer:
• action keep-alive failure action:
• trap installs a trap policy, which will catch matching traffic and tries to re-negotiate the tunnel on-
demand;
• clear closes the CHILD_SA and does not take further action (default);
• restart immediately tries to re-negotiate the CHILD_SA under a fresh IKE_SA;
• interval keep-alive interval in seconds <2-86400> (default 30);
• timeout keep-alive timeout in seconds <2-86400> (default 120) IKEv1 only

8.13. VPN 982

 VyOS Documentation, Release 1.5.x (circinus)

• ikev2-reauth whether rekeying of an IKE_SA should also reauthenticate the peer. In IKEv1, reauthentication
is always done. Setting this parameter enables remote host re-authentication during an IKE rekey.
• key-exchange which protocol should be used to initialize the connection If not set both protocols are handled
and connections will use IKEv2 when initiating, but accept any protocol version when responding:
• ikev1 use IKEv1 for Key Exchange;
• ikev2 use IKEv2 for Key Exchange;
• lifetime IKE lifetime in seconds <0-86400> (default 28800);
• disable-mobike disables MOBIKE Support. MOBIKE is only available for IKEv2 and enabled by default.
• mode IKEv1 Phase 1 Mode Selection:
• main use Main mode for Key Exchanges in the IKEv1 Protocol (Recommended Default);
• aggressive use Aggressive mode for Key Exchanges in the IKEv1 protocol aggressive mode is much more
insecure compared to Main mode;
• proposal the list of proposals and their parameters:
• dh-group dh-group;
• encryption encryption algorithm;
• hash hash algorithm.
• prf pseudo-random function.

ESP (Encapsulating Security Payload) Attributes

ESP is used to provide confidentiality, data origin authentication, connectionless integrity, an anti-replay service (a form
of partial sequence integrity), and limited traffic flow confidentiality. https://datatracker.ietf.org/doc/html/rfc4303
In VyOS, ESP attributes are specified through ESP groups. Multiple proposals can be specified in a single group.
VyOS ESP group has the next options:
• compression Enables the IPComp(IP Payload Compression) protocol which allows compressing the content of
IP packets.
• life-bytes ESP life in bytes <1024-26843545600000>. Number of bytes transmitted over an IPsec SA before
it expires;
• life-packets ESP life in packets <1000-26843545600000>. Number of packets transmitted over an IPsec SA
before it expires;
• lifetime ESP lifetime in seconds <30-86400> (default 3600). How long a particular instance of a connection
(a set of encryption/authentication keys for user packets) should last, from successful negotiation to expiry;
• mode the type of the connection:
• tunnel tunnel mode (default);
• transport transport mode;
• pfs whether Perfect Forward Secrecy of keys is desired on the connection’s keying channel and defines a Diffie-
Hellman group for PFS:
• enable Inherit Diffie-Hellman group from IKE group (default);
• disable Disable PFS;
• < dh-group > defines a Diffie-Hellman group for PFS;

8.13. VPN 983

 VyOS Documentation, Release 1.5.x (circinus)

• proposal ESP-group proposal with number <1-65535>:

• encryption encryption algorithm (default 128 bit AES-CBC);
• hash hash algorithm (default sha1).

Options (Global IPsec settings) Attributes

• options
• disable-route-autoinstall Do not automatically install routes to remote networks;
• flexvpn Allows FlexVPN vendor ID payload (IKEv2 only). Send the Cisco FlexVPN vendor ID payload
(IKEv2 only), which is required in order to make Cisco brand devices allow negotiating a local traffic selec-
tor (from strongSwan’s point of view) that is not the assigned virtual IP address if such an address is requested by
strongSwan. Sending the Cisco FlexVPN vendor ID prevents the peer from narrowing the initiator’s local traffic
selector and allows it to e.g. negotiate a TS of 0.0.0.0/0 == 0.0.0.0/0 instead. This has been tested with a “tunnel
mode ipsec ipv4” Cisco template but should also work for GRE encapsulation;
• interface Interface Name to use. The name of the interface on which virtual IP addresses should be installed.
If not specified the addresses will be installed on the outbound interface;
• virtual-ip Allows to install virtual-ip addresses. Comma separated list of virtual IPs to request in IKEv2 con-
figuration payloads or IKEv1 Mode Config. The wildcard addresses 0.0.0.0 and :: request an arbitrary address,
specific addresses may be defined. The responder may return a different address, though, or none at all. Define
the virtual-address option to configure the IP address in site-to-site hierarchy.

IPsec policy matching GRE

The first and arguably cleaner option is to make your IPsec policy match GRE packets between external addresses of
your routers. This is the best option if both routers have static external addresses.
Suppose the LEFT router has external address 192.0.2.10 on its eth0 interface, and the RIGHT router is 203.0.113.45
On the LEFT:

# GRE tunnel
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 192.0.2.10
set interfaces tunnel tun0 remote 203.0.113.45
set interfaces tunnel tun0 address 10.10.10.1/30

## IPsec
set vpn ipsec interface eth0

# Pre-shared-secret
set vpn ipsec authentication psk vyos id 192.0.2.10
set vpn ipsec authentication psk vyos id 203.0.113.45
set vpn ipsec authentication psk vyos secret MYSECRETKEY

# IKE group
set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group '2'
set vpn ipsec ike-group MyIKEGroup proposal 1 encryption 'aes128'
set vpn ipsec ike-group MyIKEGroup proposal 1 hash 'sha1'

# ESP group
(continues on next page)

8.13. VPN 984

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set vpn ipsec esp-group MyESPGroup proposal 1 encryption 'aes128'
set vpn ipsec esp-group MyESPGroup proposal 1 hash 'sha1'

# IPsec tunnel
set vpn ipsec site-to-site peer right authentication mode pre-shared-secret
set vpn ipsec site-to-site peer right authentication remote-id 203.0.113.45

set vpn ipsec site-to-site peer right ike-group MyIKEGroup

set vpn ipsec site-to-site peer right default-esp-group MyESPGroup

set vpn ipsec site-to-site peer right local-address 192.0.2.10

set vpn ipsec site-to-site peer right remote-address 203.0.113.45

# This will match all GRE traffic to the peer

set vpn ipsec site-to-site peer right tunnel 1 protocol gre

On the RIGHT, setup by analogy and swap local and remote addresses.

Source tunnel from dummy interface

The scheme above doesn’t work when one of the routers has a dynamic external address though. The classic workaround
for this is to setup an address on a loopback interface and use it as a source address for the GRE tunnel, then setup an
IPsec policy to match those loopback addresses.
We assume that the LEFT router has static 192.0.2.10 address on eth0, and the RIGHT router has a dynamic address
on eth0.
The peer names RIGHT and LEFT are used as informational text.
Setting up the GRE tunnel
On the LEFT:

set interfaces dummy dum0 address 192.168.99.1/32

set interfaces tunnel tun0 encapsulation gre

set interfaces tunnel tun0 address 10.10.10.1/30
set interfaces tunnel tun0 source-address 192.168.99.1
set interfaces tunnel tun0 remote 192.168.99.2

On the RIGHT:

set interfaces dummy dum0 address 192.168.99.2/32

set interfaces tunnel tun0 encapsulation gre

set interfaces tunnel tun0 address 10.10.10.2/30
set interfaces tunnel tun0 source-address 192.168.99.2
set interfaces tunnel tun0 remote 192.168.99.1

Setting up IPSec
However, now you need to make IPsec work with dynamic address on one side. The tricky part is that pre-shared secret
authentication doesn’t work with dynamic address, so we’ll have to use RSA keys.

8.13. VPN 985

 VyOS Documentation, Release 1.5.x (circinus)

First, on both routers run the operational command “generate pki key-pair install <key-pair name>”. You may choose
different length than 2048 of course.

vyos@left# run generate pki key-pair install ipsec-LEFT

Enter private key type: [rsa, dsa, ec] (Default: rsa)
Enter private key bits: (Default: 2048)
Note: If you plan to use the generated key on this router, do not encrypt the private␣
˓→key.

Do you want to encrypt the private key with a passphrase? [y/N] N

Configure mode commands to install key pair:
Do you want to install the public key? [Y/n] Y
set pki key-pair ipsec-LEFT public key 'MIIBIjANBgkqh...'
Do you want to install the private key? [Y/n] Y
set pki key-pair ipsec-LEFT private key 'MIIEvgIBADAN...'
[edit]

Configuration commands for the private and public key will be displayed on the screen which needs to be set on the
router first. Note the command with the public key (set pki key-pair ipsec-LEFT public key ‘MIIBIjANBgkqh. . . ’).
Then do the same on the opposite router:

vyos@left# run generate pki key-pair install ipsec-RIGHT

Note the command with the public key (set pki key-pair ipsec-RIGHT public key ‘FAAOCAQ8AMII. . . ’).
Now the noted public keys should be entered on the opposite routers.
On the LEFT:

set pki key-pair ipsec-RIGHT public key 'FAAOCAQ8AMII...'

On the RIGHT:

set pki key-pair ipsec-LEFT public key 'MIIBIjANBgkqh...'

Now you are ready to setup IPsec. You’ll need to use an ID instead of address for the peer.
On the LEFT (static address):

set vpn ipsec interface eth0

set vpn ipsec esp-group MyESPGroup proposal 1 encryption aes128

set vpn ipsec esp-group MyESPGroup proposal 1 hash sha1

set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group 2

set vpn ipsec ike-group MyIKEGroup proposal 1 encryption aes128
set vpn ipsec ike-group MyIKEGroup proposal 1 hash sha1

set vpn ipsec site-to-site peer RIGHT authentication local-id LEFT

set vpn ipsec site-to-site peer RIGHT authentication mode rsa
set vpn ipsec site-to-site peer RIGHT authentication rsa local-key ipsec-LEFT
set vpn ipsec site-to-site peer RIGHT authentication rsa remote-key ipsec-RIGHT
set vpn ipsec site-to-site peer RIGHT authentication remote-id RIGHT
set vpn ipsec site-to-site peer RIGHT default-esp-group MyESPGroup
set vpn ipsec site-to-site peer RIGHT ike-group MyIKEGroup
set vpn ipsec site-to-site peer RIGHT local-address 192.0.2.10
set vpn ipsec site-to-site peer RIGHT connection-type respond
(continues on next page)

8.13. VPN 986

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set vpn ipsec site-to-site peer RIGHT tunnel 1 local prefix 192.168.99.1/32 #␣
˓→Additional loopback address on the local

set vpn ipsec site-to-site peer RIGHT tunnel 1 remote prefix 192.168.99.2/32 #␣
˓→Additional loopback address on the remote

On the RIGHT (dynamic address):

set vpn ipsec interface eth0

set vpn ipsec esp-group MyESPGroup proposal 1 encryption aes128

set vpn ipsec esp-group MyESPGroup proposal 1 hash sha1

set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group 2

set vpn ipsec ike-group MyIKEGroup proposal 1 encryption aes128
set vpn ipsec ike-group MyIKEGroup proposal 1 hash sha1

set vpn ipsec site-to-site peer LEFT authentication local-id RIGHT

set vpn ipsec site-to-site peer LEFT authentication mode rsa
set vpn ipsec site-to-site peer LEFT authentication rsa local-key ipsec-RIGHT
set vpn ipsec site-to-site peer LEFT authentication rsa remote-key ipsec-LEFT
set vpn ipsec site-to-site peer LEFT authentication remote-id LEFT
set vpn ipsec site-to-site peer LEFT connection-type initiate
set vpn ipsec site-to-site peer LEFT default-esp-group MyESPGroup
set vpn ipsec site-to-site peer LEFT ike-group MyIKEGroup
set vpn ipsec site-to-site peer LEFT local-address any
set vpn ipsec site-to-site peer LEFT remote-address 192.0.2.10
set vpn ipsec site-to-site peer LEFT tunnel 1 local prefix 192.168.99.2/32 # Additional␣
˓→loopback address on the local

set vpn ipsec site-to-site peer LEFT tunnel 1 remote prefix 192.168.99.1/32 # Additional␣
˓→loopback address on the remote

IKEv2 IPSec road-warriors remote-access VPN

Internet Key Exchange version 2, IKEv2 for short, is a request/response protocol developed by both Cisco and Mi-
crosoft. It is used to establish and secure IPv4/IPv6 connections, be it a site-to-site VPN or from a road-warrior
connecting to a hub site. IKEv2, when run in point-to-multipoint, or remote-access/road-warrior mode, secures the
server-side with another layer by using an x509 signed server certificate.
Key exchange and payload encryption is still done using IKE and ESP proposals as known from IKEv1 but the con-
nections are faster to establish, more reliable, and also support roaming from IP to IP (called MOBIKE which makes
sure your connection does not drop when changing networks from e.g. WIFI to LTE and back).
This feature closely works together with PKI subsystem as you required a x509 certificate.
This example uses CACert as certificate authority.
set pki ca CAcert_Class_3_Root certificate
˓→'MIIGPTCCBCWgAwIBAgIDFOIoMA0GCSqGSIb3DQEBDQUAMHkxEDAOBgNVBAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY

˓→UErEa4w75/

˓→ZI0QbCTzYZzA8pD6Ueb1aQFjww9W4kpCz+JEjCUoqMV5CX1GuYrz6fM0KQhF5Byfy5QEHIGoFLOYZcRD7E6CjQnRvapbjZLQ7N6QxX

˓→fRb0fEze5ig1JuLgiapNkVGJGmhZJHsK5I6223IeyFGmhyNav/

˓→8BBdwPSUp2rVO5J+TJAFfpPBLIukjmJ0FXFuC3ED6q8VOJrU0gVyb4z5K+taciX5OUbjchs+BMNkJyIQKopPWKcDrb60LhPtXapI19

˓→LP/

(continues on next page)

8.13. VPN 987

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

˓→ JaT4NsRNlRiNDiPDGCbO5dWOK3z0luLoFvqTpa4fNfVoIZwQNORKbeiPK31jLvPGpKK5DR7wNhsX+kKwsOnIJpa3yxdUly6R9Wb7yQ
˓→KcCyQQNokszgnMyXS0XvOhAKq3A6mJVwrTWx6oUrpByAITGprmB6gCZIALgBwJNjVSKRPFbnr9s6JfOPMVTqJouBWfmh0VMRxXudA/

˓→Z0EeBtsSw/LIaRmXGapneLNGDRFLQsrJ2vjBDTn8Rq+G8T/HNZ92ZCdB6K4/

˓→jc0m+YnMtHmJVABfvpAgMBAAGjgfIwge8wDwYDVR0TAQH/BAUwAwEB/

˓→zBhBggrBgEFBQcBAQRVMFMwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLkNBY2VydC5vcmcvMCwGCCsGAQUFBzAChiBodHRwOi8vd3d

˓→mARN+Yz5R3lzUvXs3zSX+z534NzRg4i6iHNHWqakFcQNcA0PnksTB37vGD75pQGqeSmx51L6UzrIpn+274mhsaFNL85jhX+lKuk71M

˓→vvoLNkh/L3iEQ5/

˓→LnmLMCYJNRALF7I7gsduAJNJrgKGMYvHkt1bo8uIXO8wgNV7qoU4JoaB1ML30QUqGcFr0TI06FFdgK2fwy5hulPxm6wuxW0v+iAtXY

˓→mRkwQpYbcVQtrIDvx1CT1k50cQxi+jIKjkcFWHw3kBoDnCos0/

˓→ukegPT7aQnk2AbL4c7nCkuAcEKw1BAlSETkfqi5btdlhh58MhewZv1LcL5zQyg8w1puclT3wXQvy8VwPGn0J/

˓→mGD4gLLZ9rGcHDUECokxFoWk+u5MCcVqmGbsyG4q5suS3CNslsHURfM8bQK4oLvHR8LCHEBMRcdFBn87cSvOK6eB1kdGKLA8ymXxZp

˓→'

set pki ca CAcert_Signing_Authority certificate

˓→'MIIG7jCCBNagAwIBAgIBDzANBgkqhkiG9w0BAQsFADB5MRAwDgYDVQQKEwdSb290IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY

˓→pnCujW0r8+55jE8Ez64AO7NV1sId6eINm6zWYyN3L69wj1x81YyY7nDl7qPv4coRQKFWyGhFtkZip6qUtTefWIonvuLwphK42yfk1W

˓→JHIJ6BVgrCFvzOKKrF11myZjXnhCLotLddJr3cQxyYN/

˓→Nb5gznZY0dj4kepKwDpUeb+agRThHqtdB7Uq3EvbXG4OKDy7YCbZZ16oE/

˓→9KTfWgu3YtLq1i6L43qlaegw1SJpfvbi1EinbLDvhG+LJGGi5Z4rSDTii8aP8bQUWWHIbEZAWV/

˓→RRyH9XzQQUxPKZgh/

˓→TMfdQwEUfoZd9vUFBzugcMd9Zi3aQaRIt0AUMyBMawSB3s42mhb5ivUfslfrejrckzzAeVLIL+aplfKkQABi6F1ITe1Yw1nPkZPcCB

˓→0PsmBsJUUtaWsJx8cTLc6nloQsCAwEAAaOCAX8wggF7MB0GA1UdDgQWBBQWtTIb1Mfz4OaO873SsDrusjkY0TAPBgNVHRMBAf8EBTA

˓→MDQGCWCGSAGG+EIBCAQnFiVodHRwOi8vd3d3LmNhY2VydC5vcmcvaW5kZXgucGhwP2lkPTEwMFYGCWCGSAGG+EIBDQRJFkdUbyBnZX

˓→1Xpgdw/+IP1GRwdg7xUpReUA482l4MH1kf0W0ad94SuIfNWQHcdLApmno/

˓→SUh1bpZyeWrMnlhkGNDKMxCCQXQ360TwFHc8dfEAaq5ry6cZzm1oetrkSviE2qofxvv1VFiQ+9TX3/zkECCsUB/

˓→EjPM0lxFBmu9T5Ih+Eqns9ivmrEIQDv9tNyJHuLsDNqbUBal7OoiPZnXk9LH+qb+pLf1ofv5noy5vX2a5OKebHe+0Ex/

˓→A7e+G/HuOjVNqhZ9j5Nispfq9zNyOHGWD8ofj8DHwB50L1Xh5H+EbIoga/

˓→hJCQnRtxWkHP699T1JpLFYwapgplivF4TFv4fqp0nHTKC1x9gGrIgvuYJl1txIKmxXdfJzgscMzqpabhtHOMXOiwQBpWzyJkofF/

˓→w55e0LttZDBkEsilV/

˓→vW0CJsPs3eNaQF+iMWscGOkgLFlWsAS3HwyiYLNJo26aqyWPaIdc8E4ck7Sk08WrFrHIK3EHr4n1FZwmLpFAvucKqgl0hr+2jypyh5

˓→'

After you obtained your server certificate you can import it from a file on the local filesystem, or paste it into the CLI.
Please note that when entering the certificate manually you need to strip the -----BEGIN KEY----- and -----END
KEY----- tags. Also, the certificate or key needs to be presented in a single line without line breaks (\n).
To import it from the filesystem use:

import pki certificate <name> file /path/to/cert.pem

In our example the certificate name is called vyos:

set pki certificate vyos certificate 'MIIE45s...'

set pki certificate vyos private key 'MIIEvgI...'

After the PKI certs are all set up we can start configuring our IPSec/IKE proposals used for key-exchange end data
encryption. The used encryption ciphers and integrity algorithms vary from operating system to operating system. The
ones used in this post are validated to work on both Windows 10 and iOS/iPadOS 14 to 17.

set vpn ipsec esp-group ESP-RW compression 'disable'

set vpn ipsec esp-group ESP-RW lifetime '3600'
set vpn ipsec esp-group ESP-RW pfs 'disable'
set vpn ipsec esp-group ESP-RW proposal 10 encryption 'aes128gcm128'
set vpn ipsec esp-group ESP-RW proposal 10 hash 'sha256'
(continues on next page)

8.13. VPN 988

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set vpn ipsec ike-group IKE-RW key-exchange 'ikev2'

set vpn ipsec ike-group IKE-RW lifetime '7200'
set vpn ipsec ike-group IKE-RW mobike 'enable'
set vpn ipsec ike-group IKE-RW proposal 10 dh-group '14'
set vpn ipsec ike-group IKE-RW proposal 10 encryption 'aes128gcm128'
set vpn ipsec ike-group IKE-RW proposal 10 hash 'sha256'

Every connection/remote-access pool we configure also needs a pool where we can draw our client IP addresses from.
We provide one IPv4 and IPv6 pool. Authorized clients will receive an IPv4 address from the 192.0.2.128/25 prefix
and an IPv6 address from the 2001:db8:2000::/64 prefix. We can also send some DNS nameservers down to our clients
used on their connection.

set vpn ipsec remote-access pool ra-rw-ipv4 name-server '192.0.2.1'

set vpn ipsec remote-access pool ra-rw-ipv4 prefix '192.0.2.128/25'
set vpn ipsec remote-access pool ra-rw-ipv6 name-server '2001:db8:1000::1'
set vpn ipsec remote-access pool ra-rw-ipv6 prefix '2001:db8:2000::/64'

VyOS supports multiple IKEv2 remote-access connections. Every connection can have its dedicated IKE/ESP ciphers,
certificates or local listen address for e.g. inbound load balancing.
We configure a new connection named rw for road-warrior, that identifies itself as 192.0.2.1 to the clients and uses
the vyos certificate signed by the CAcert_Class3_Root` intermediate CA. We select our previously specified IKE/ESP
groups and also link the IP address pool to draw addresses from.

set vpn ipsec remote-access connection rw authentication id '192.0.2.1'

set vpn ipsec remote-access connection rw authentication server-mode 'x509'
set vpn ipsec remote-access connection rw authentication x509 ca-certificate 'CAcert_
˓→Class_3_Root'

set vpn ipsec remote-access connection rw authentication x509 certificate 'vyos'

set vpn ipsec remote-access connection rw esp-group 'ESP-RW'
set vpn ipsec remote-access connection rw ike-group 'IKE-RW'
set vpn ipsec remote-access connection rw local-address '192.0.2.1'
set vpn ipsec remote-access connection rw pool 'ra-rw-ipv4'
set vpn ipsec remote-access connection rw pool 'ra-rw-ipv6'

VyOS also supports (currently) two different modes of authentication, local and RADIUS. To create a new local user
named vyos with password vyos use the following commands.

set vpn ipsec remote-access connection rw authentication client-mode 'eap-mschapv2'

set vpn ipsec remote-access connection rw authentication local-users username vyos␣
˓→password 'vyos'

If you feel better forwarding all authentication requests to your enterprises RADIUS server, use the commands below.

set vpn ipsec remote-access connection rw authentication client-mode 'eap-radius'

set vpn ipsec remote-access radius server 192.0.2.2 key 'secret'

Configuring VyOS to act as your IPSec access concentrator is one thing, but you probably need to setup your client
connecting to the server so they can talk to the IPSec gateway.
Windows 10 does not allow a user to choose the integrity and encryption ciphers using the GUI and it uses some older
proposals by default. A user can only change the proposals on the client side by configuring the IPSec connection
profile via PowerShell.

8.13. VPN 989

 VyOS Documentation, Release 1.5.x (circinus)

We generate a connection profile used by Windows clients that will connect to the “rw” connection on our VyOS server
on the VPN servers IP address/fqdn vpn.vyos.net.

Note: Microsoft Windows expects the server name to be also used in the server’s certificate common name, so it’s
best to use this DNS name for your VPN connection.

vyos@vyos:~$ generate ipsec profile windows-remote-access rw remote vpn.vyos.net

==== <snip> ====

Add-VpnConnection -Name "VyOS IKEv2 VPN" -ServerAddress "vpn.vyos.net" -TunnelType
˓→"Ikev2"

Set-VpnConnectionIPsecConfiguration -ConnectionName "VyOS IKEv2 VPN" -

˓→AuthenticationTransformConstants GCMAES128 -CipherTransformConstants GCMAES128 -

˓→EncryptionMethod GCMAES128 -IntegrityCheckMethod SHA256128 -PfsGroup None -DHGroup

˓→"Group14" -PassThru -Force

==== </snip> ====

As both Microsoft Windows and Apple iOS/iPadOS only support a certain set of encryption ciphers and integrity
algorithms we will validate the configured IKE/ESP proposals and only list the compatible ones to the user — if
multiple are defined. If there are no matching proposals found — we can not generate a profile for you.
When first connecting to the new VPN the user is prompted to enter proper credentials.
Like on Microsoft Windows, Apple iOS/iPadOS out of the box does not expose all available VPN options via the device
GUI.
If you want, need, and should use more advanced encryption ciphers (default is still 3DES) you need to provision your
device using a so-called “Device Profile”. A profile is a simple text file containing XML nodes with a .mobileconfig
file extension that can be sent and opened on any device from an E-Mail.
Profile generation happens from the operational level and is as simple as issuing the following command to create
a profile to connect to the IKEv2 access server at vpn.vyos.net with the configuration for the rw remote-access
connection group.

Note: Apple iOS/iPadOS expects the server name to be also used in the server’s certificate common name, so it’s best
to use this DNS name for your VPN connection.

vyos@vyos:~$ generate ipsec profile ios-remote-access rw remote vpn.vyos.net

==== <snip> ====

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/
˓→PropertyList-1.0.dtd">

<plist version="1.0">
...
</plist>
==== </snip> ====

In the end, an XML structure is generated which can be saved as vyos.mobileconfig and sent to the device by E-Mail
where it later can be imported.
During profile import, the user is asked to enter its IPSec credentials (username and password) which is stored on the
mobile.

8.13. VPN 990

 VyOS Documentation, Release 1.5.x (circinus)

8.13.2 L2TP

VyOS utilizes accel-ppp to provide L2TP server functionality. It can be used with local authentication or a connected
RADIUS server.

Configuring L2TP Server

set vpn l2tp remote-access authentication mode local

set vpn l2tp remote-access authentication local-users username test password 'test'
set vpn l2tp remote-access client-ip-pool L2TP-POOL range 192.168.255.2-192.168.255.254
set vpn l2tp remote-access default-pool 'L2TP-POOL'
set vpn l2tp remote-access outside-address 192.0.2.2
set vpn l2tp remote-access gateway-address 192.168.255.1

set vpn l2tp remote-access authentication mode <local | radius>

Set authentication backend. The configured authentication backend is used for all queries.
• radius: All authentication queries are handled by a configured RADIUS server.
• local: All authentication queries are handled locally.
set vpn l2tp remote-access authentication local-users username <user> password <pass>
Create <user> for local authentication on this system. The users password will be set to <pass>.
set vpn l2tp remote-access client-ip-pool <POOL-NAME> range <x.x.x.x-x.x.x.x | x.x.x.x/x>
Use this command to define the first IP address of a pool of addresses to be given to l2tp clients. If notation
x.x.x.x-x.x.x.x, it must be within a /24 subnet. If notation x.x.x.x/x is used there is possibility to set
host/netmask.
set vpn l2tp remote-access default-pool <POOL-NAME>
Use this command to define default address pool name.
set vpn l2tp remote-access gateway-address <gateway>
Specifies single <gateway> IP address to be used as local address of PPP interfaces.

Configuring IPsec

set vpn ipsec interface eth0

set vpn l2tp remote-access ipsec-settings authentication mode pre-shared-secret
set vpn l2tp remote-access ipsec-settings authentication pre-shared-secret <secret>

set vpn ipsec interface <INTERFACE>

Use this command to define IPsec interface.
set vpn l2tp remote-access ipsec-settings authentication mode <pre-shared-secret | x509>
Set mode for IPsec authentication between VyOS and L2TP clients.
set vpn l2tp remote-access ipsec-settings authentication mode <pre-shared-secret | x509>
Set predefined shared secret phrase.
If a local firewall policy is in place on your external interface you will need to allow the ports below:
• UDP port 500 (IKE)

8.13. VPN 991

 VyOS Documentation, Release 1.5.x (circinus)

• IP protocol number 50 (ESP)

• UDP port 1701 for IPsec
As well as the below to allow NAT-traversal (when NAT is detected by the VPN client, ESP is encapsulated in UDP
for NAT-traversal):
• UDP port 4500 (NAT-T)
Example:

set firewall name OUTSIDE-LOCAL rule 40 action 'accept'

set firewall name OUTSIDE-LOCAL rule 40 protocol 'esp'
set firewall name OUTSIDE-LOCAL rule 41 action 'accept'
set firewall name OUTSIDE-LOCAL rule 41 destination port '500'
set firewall name OUTSIDE-LOCAL rule 41 protocol 'udp'
set firewall name OUTSIDE-LOCAL rule 42 action 'accept'
set firewall name OUTSIDE-LOCAL rule 42 destination port '4500'
set firewall name OUTSIDE-LOCAL rule 42 protocol 'udp'
set firewall name OUTSIDE-LOCAL rule 43 action 'accept'
set firewall name OUTSIDE-LOCAL rule 43 destination port '1701'
set firewall name OUTSIDE-LOCAL rule 43 ipsec 'match-ipsec'
set firewall name OUTSIDE-LOCAL rule 43 protocol 'udp'

To allow VPN-clients access via your external address, a NAT rule is required:

set nat source rule 110 outbound-interface name 'eth0'

set nat source rule 110 source address '192.168.255.0/24'
set nat source rule 110 translation address masquerade

Configuring RADIUS authentication

To enable RADIUS based authentication, the authentication mode needs to be changed within the configuration. Pre-
vious settings like the local users, still exists within the configuration, however they are not used if the mode has been
changed from local to radius. Once changed back to local, it will use all local accounts again.

set vpn l2tp remote-access authentication mode radius

set vpn l2tp remote-access authentication radius server <server> key <secret>
Configure RADIUS <server> and its required shared <secret> for communicating with the RADIUS server.
Since the RADIUS server would be a single point of failure, multiple RADIUS servers can be setup and will be used
subsequentially. For example:

set vpn l2tp remote-access authentication radius server 10.0.0.1 key 'foo'
set vpn l2tp remote-access authentication radius server 10.0.0.2 key 'foo'

Note: Some RADIUS severs use an access control list which allows or denies queries, make sure to add your VyOS
router to the allowed client list.

8.13. VPN 992

 VyOS Documentation, Release 1.5.x (circinus)

RADIUS source address

If you are using OSPF as IGP, always the closest interface connected to the RADIUS server is used. With VyOS 1.2
you can bind all outgoing RADIUS requests to a single source IP e.g. the loopback interface.
set vpn l2tp remote-access authentication radius source-address <address>
Source IPv4 address used in all RADIUS server queires.

Note: The source-address must be configured on one of VyOS interface. Best practice would be a loopback or
dummy interface.

RADIUS advanced options

set vpn l2tp remote-access authentication radius server <server> port <port>
Configure RADIUS <server> and its required port for authentication requests.
set vpn l2tp remote-access authentication radius server <server> fail-time <time>
Mark RADIUS server as offline for this given <time> in seconds.
set vpn l2tp remote-access authentication radius server <server> disable
Temporary disable this RADIUS server.
set vpn l2tp remote-access authentication radius acct-timeout <timeout>
Timeout to wait reply for Interim-Update packets. (default 3 seconds)
set vpn l2tp remote-access authentication radius dynamic-author server <address>
Specifies IP address for Dynamic Authorization Extension server (DM/CoA)
set vpn l2tp remote-access authentication radius dynamic-author port <port>
Port for Dynamic Authorization Extension server (DM/CoA)
set vpn l2tp remote-access authentication radius dynamic-author key <secret>
Secret for Dynamic Authorization Extension server (DM/CoA)
set vpn l2tp remote-access authentication radius max-try <number>
Maximum number of tries to send Access-Request/Accounting-Request queries
set vpn l2tp remote-access authentication radius timeout <timeout>
Timeout to wait response from server (seconds)
set vpn l2tp remote-access authentication radius nas-identifier <identifier>
Value to send to RADIUS server in NAS-Identifier attribute and to be matched in DM/CoA requests.
set vpn l2tp remote-access authentication radius nas-ip-address <address>
Value to send to RADIUS server in NAS-IP-Address attribute and to be matched in DM/CoA requests. Also
DM/CoA server will bind to that address.
set vpn l2tp remote-access authentication radius source-address <address>
Source IPv4 address used in all RADIUS server queires.
set vpn l2tp remote-access authentication radius rate-limit attribute <attribute>

8.13. VPN 993

 VyOS Documentation, Release 1.5.x (circinus)

Specifies which RADIUS server attribute contains the rate limit information. The default attribute is Filter-Id.

Note: If you set a custom RADIUS attribute you must define it on both dictionaries at RADIUS server and client.

set vpn l2tp remote-access authentication radius rate-limit enable

Enables bandwidth shaping via RADIUS.
set vpn l2tp remote-access authentication radius rate-limit vendor
Specifies the vendor dictionary, dictionary needs to be in /usr/share/accel-ppp/radius.
Received RADIUS attributes have a higher priority than parameters defined within the CLI configuration, refer to the
explanation below.

Allocation clients ip addresses by RADIUS

If the RADIUS server sends the attribute Framed-IP-Address then this IP address will be allocated to the client and
the option default-pool within the CLI config is being ignored.
If the RADIUS server sends the attribute Framed-Pool, IP address will be allocated from a predefined IP pool whose
name equals the attribute value.
If the RADIUS server sends the attribute Stateful-IPv6-Address-Pool, IPv6 address will be allocated from a
predefined IPv6 pool prefix whose name equals the attribute value.
If the RADIUS server sends the attribute Delegated-IPv6-Prefix-Pool, IPv6 delegation pefix will be allocated
from a predefined IPv6 pool delegate whose name equals the attribute value.

Note: Stateful-IPv6-Address-Pool and Delegated-IPv6-Prefix-Pool are defined in RFC6911. If they are

not defined in your RADIUS server, add new dictionary.

User interface can be put to VRF context via RADIUS Access-Accept packet, or change it via RADIUS CoA.
Accel-VRF-Name is used from these purposes. It is custom ACCEL-PPP attribute. Define it in your RADIUS server.

Renaming clients interfaces by RADIUS

If the RADIUS server uses the attribute NAS-Port-Id, ppp tunnels will be renamed.

Note: The value of the attribute NAS-Port-Id must be less than 16 characters, otherwise the interface won’t be
renamed.

8.13. VPN 994

 VyOS Documentation, Release 1.5.x (circinus)

Configuring LNS (L2TP Network Server)

LNS are often used to connect to a LAC (L2TP Access Concentrator).

set vpn l2tp remote-access lns host-name <hostname>
Sent to the client (LAC) in the Host-Name attribute
set vpn l2tp remote-access lns shared-secret <secret>
Tunnel password used to authenticate the client (LAC)
To explain the usage of LNS follow our blueprint PPPoE over L2TP.

IPv6

set vpn l2tp remote-access ppp-options ipv6 <require | prefer | allow | deny>
Specifies IPv6 negotiation preference.
• require - Require IPv6 negotiation
• prefer - Ask client for IPv6 negotiation, do not fail if it rejects
• allow - Negotiate IPv6 only if client requests
• deny - Do not negotiate IPv6 (default value)
set vpn l2tp remote-access client-ipv6-pool <IPv6-POOL-NAME> prefix <address> mask
<number-of-bits>
Use this comand to set the IPv6 address pool from which an l2tp client will get an IPv6 prefix of your defined
length (mask) to terminate the l2tp endpoint at their side. The mask length can be set from 48 to 128 bit long,
the default value is 64.
set vpn l2tp remote-access client-ipv6-pool <IPv6-POOL-NAME> delegate <address>
delegation-prefix <number-of-bits>
Use this command to configure DHCPv6 Prefix Delegation (RFC3633) on l2tp. You will have to set your IPv6
pool and the length of the delegation prefix. From the defined IPv6 pool you will be handing out networks of
the defined length (delegation-prefix). The length of the delegation prefix can be set from 32 to 64 bit long.
set vpn l2tp remote-access default-ipv6-pool <IPv6-POOL-NAME>
Use this command to define default IPv6 address pool name.

set vpn l2tp remote-access ppp-options ipv6 allow

set vpn l2tp remote-access client-ipv6-pool IPv6-POOL delegate '2001:db8:8003::/48'␣
˓→delegation-prefix '56'

set vpn l2tp remote-access client-ipv6-pool IPv6-POOL prefix '2001:db8:8002::/48' mask

˓→'64'

set vpn l2tp remote-access default-ipv6-pool IPv6-POOL

8.13. VPN 995

 VyOS Documentation, Release 1.5.x (circinus)

IPv6 Advanced Options

set vpn l2tp remote-access ppp-options ipv6-accept-peer-interface-id

Accept peer interface identifier. By default is not defined.
set vpn l2tp remote-access ppp-options ipv6-interface-id <random | x:x:x:x>
Specifies fixed or random interface identifier for IPv6. By default is fixed.
• random - Random interface identifier for IPv6
• x:x:x:x - Specify interface identifier for IPv6
set vpn l2tp remote-access ppp-options ipv6-interface-id <random | x:x:x:x>
Specifies peer interface identifier for IPv6. By default is fixed.
• random - Random interface identifier for IPv6
• x:x:x:x - Specify interface identifier for IPv6
• ipv4-addr - Calculate interface identifier from IPv4 address.
• calling-sid - Calculate interface identifier from calling-station-id.

Scripting

set vpn l2tp remote-access extended-scripts on-change <path_to_script>

Script to run when session interface changed by RADIUS CoA handling
set vpn l2tp remote-access extended-scripts on-down <path_to_script>
Script to run when session interface going to terminate
set vpn l2tp remote-access extended-scripts on-pre-up <path_to_script>
Script to run before session interface comes up
set vpn l2tp remote-access extended-scripts on-up <path_to_script>
Script to run when session interface is completely configured and started

Advanced Options

Authentication Advanced Options

set vpn l2tp remote-access authentication local-users username <user> disable

Disable <user> account.
set vpn l2tp remote-access authentication local-users username <user> static-ip <address>
Assign static IP address to <user> account.
set vpn l2tp remote-access authentication local-users username <user> rate-limit download
<bandwidth>
Download bandwidth limit in kbit/s for <user>.
set vpn l2tp remote-access authentication local-users username <user> rate-limit upload
<bandwidth>

8.13. VPN 996

 VyOS Documentation, Release 1.5.x (circinus)

Upload bandwidth limit in kbit/s for <user>.

set vpn l2tp remote-access authentication protocols <pap | chap | mschap | mschap-v2>
Require the peer to authenticate itself using one of the following protocols: pap, chap, mschap, mschap-v2.

Client IP Pool Advanced Options

set vpn l2tp remote-access client-ip-pool <POOL-NAME> next-pool <NEXT-POOL-NAME>

Use this command to define the next address pool name.

PPP Advanced Options

set vpn l2tp remote-access ppp-options disable-ccp

Disable Compression Control Protocol (CCP). CCP is enabled by default.
set vpn l2tp remote-access ppp-options interface-cache <number>
Specifies number of interfaces to keep in cache. It means that don’t destroy interface after corresponding session
is destroyed, instead place it to cache and use it later for new sessions repeatedly. This should reduce kernel-level
interface creation/deletion rate lack. Default value is 0.
set vpn l2tp remote-access ppp-options ipv4 <require | prefer | allow | deny>
Specifies IPv4 negotiation preference.
• require - Require IPv4 negotiation
• prefer - Ask client for IPv4 negotiation, do not fail if it rejects
• allow - Negotiate IPv4 only if client requests (Default value)
• deny - Do not negotiate IPv4
set vpn l2tp remote-access ppp-options lcp-echo-failure <number>
Defines the maximum <number> of unanswered echo requests. Upon reaching the value <number>, the session
will be reset. Default value is 3.
set vpn l2tp remote-access ppp-options lcp-echo-interval <interval>
If this option is specified and is greater than 0, then the PPP module will send LCP pings of the echo request
every <interval> seconds. Default value is 30.
set vpn l2tp remote-access ppp-options lcp-echo-timeout
Specifies timeout in seconds to wait for any peer activity. If this option specified it turns on adaptive lcp echo
functionality and “lcp-echo-failure” is not used. Default value is 0.
set vpn l2tp remote-access ppp-options min-mtu <number>
Defines minimum acceptable MTU. If client will try to negotiate less then specified MTU then it will be NAKed
or disconnected if rejects greater MTU. Default value is 100.
set vpn l2tp remote-access ppp-options mppe <require | prefer | deny>
Specifies MPPE negotiation preference.
• require - ask client for mppe, if it rejects drop connection
• prefer - ask client for mppe, if it rejects don’t fail. (Default value)

8.13. VPN 997

 VyOS Documentation, Release 1.5.x (circinus)

• deny - deny mppe

Default behavior - don’t ask client for mppe, but allow it if client wants. Please note that RADIUS may override
this option by MS-MPPE-Encryption-Policy attribute.
set vpn l2tp remote-access ppp-options mru <number>
Defines preferred MRU. By default is not defined.

Global Advanced options

set vpn l2tp remote-access description <description>

Set description.
set vpn l2tp remote-access limits burst <value>
Burst count
set vpn l2tp remote-access limits connection-limit <value>
Acceptable rate of connections (e.g. 1/min, 60/sec)
set vpn l2tp remote-access limits timeout <value>
Timeout in seconds
set vpn l2tp remote-access mtu
Maximum Transmission Unit (MTU) (default: 1436)
set vpn l2tp remote-access max-concurrent-sessions
Maximum number of concurrent session start attempts
set vpn l2tp remote-access name-server <address>
Connected client should use <address> as their DNS server. This command accepts both IPv4 and IPv6 ad-
dresses. Up to two nameservers can be configured for IPv4, up to three for IPv6.
set vpn l2tp remote-access shaper fwmark <1-2147483647>
Match firewall mark value
set vpn l2tp remote-access snmp master-agent
Enable SNMP
set vpn l2tp remote-access wins-server <address>
Windows Internet Name Service (WINS) servers propagated to client

Monitoring

vyos@vyos:~$ show l2tp-server sessions

ifname | username | ip | ip6 | ip6-dp | calling-sid | rate-limit | state | ␣
˓→uptime | rx-bytes | tx-bytes
--------+----------+---------------+-----+--------+-------------+------------+--------+--
˓→--------+----------+----------

l2tp0 | test | 192.168.255.3 | | | 192.168.0.36 | | active |␣

˓→02:01:47 | 7.7 KiB | 1.2 KiB

8.13. VPN 998

 VyOS Documentation, Release 1.5.x (circinus)

vyos@vyos:~$ show l2tp-server statistics

uptime: 0.02:49:49
cpu: 0%
mem(rss/virt): 5920/100892 kB
core:
mempool_allocated: 133202
mempool_available: 131770
thread_count: 1
thread_active: 1
context_count: 5
context_sleeping: 0
context_pending: 0
md_handler_count: 3
md_handler_pending: 0
timer_count: 0
timer_pending: 0
sessions:
starting: 0
active: 0
finishing: 0
l2tp:
tunnels:
starting: 0
active: 0
finishing: 0
sessions (control channels):
starting: 0
active: 0
finishing: 0
sessions (data channels):
starting: 0
active: 0
finishing: 0

8.13.3 OpenConnect

OpenConnect-compatible server feature is available from this release. Openconnect VPN supports SSL connection
and offers full network access. SSL VPN network extension connects the end-user system to the corporate network
with access controls based only on network layer information, such as destination IP address and port number. So, it
provides safe communication for all types of device traffic across public networks and private networks, also encrypts
the traffic with SSL protocol.
The remote user will use the openconnect client to connect to the router and will receive an IP address from a VPN
pool, allowing full access to the network.

8.13. VPN 999

 VyOS Documentation, Release 1.5.x (circinus)

Configuration

SSL Certificates

We need to generate the certificate which authenticates users who attempt to access the network resource through the
SSL VPN tunnels. The following commands will create a self signed certificates and will be stored in configuration:

run generate pki ca install <CA name>

run generate pki certificate sign <CA name> install <Server name>

We can also create the certificates using Cerbort which is an easy-to-use client that fetches a certificate from Let’s
Encrypt an open certificate authority launched by the EFF, Mozilla, and others and deploys it to a web server.

sudo certbot certonly --standalone --preferred-challenges http -d <domain name>

Server Configuration

set vpn openconnect authentication local-users username <user> password <pass>

set vpn openconnect authentication mode <local password|radius>
set vpn openconnect network-settings client-ip-settings subnet <subnet>
set vpn openconnect network-settings name-server <address>
set vpn openconnect network-settings name-server <address>
set vpn openconnect ssl ca-certificate <pki-ca-name>
set vpn openconnect ssl certificate <pki-cert-name>
set vpn openconnect ssl passphrase <pki-password>

2FA OTP support

Instead of password only authentication, 2FA password authentication + OTP key can be used. Alternatively, OTP au-
thentication only, without a password, can be used. To do this, an OTP configuration must be added to the configuration
above:

set vpn openconnect authentication mode local <password-otp|otp>

set vpn openconnect authentication local-users username <user> otp <key>
set vpn openconnect authentication local-users username <user> interval <interval␣
˓→(optional)>

set vpn openconnect authentication local-users username <user> otp-length <otp-length␣

˓→(optional)>

set vpn openconnect authentication local-users username <user> token-type <token-type␣

˓→(optional)>

For generating an OTP key in VyOS, you can use the CLI command (operational mode):

generate openconnect username <user> otp-key hotp-time

8.13. VPN 1000

 VyOS Documentation, Release 1.5.x (circinus)

Verification

vyos@vyos:~$ sh openconnect-server sessions

interface username ip remote IP RX TX state ␣
˓→uptime

----------- ---------- ------------- ----------- ------- --------- --------- -----

˓→---

sslvpn0 tst 172.20.20.198 192.168.6.1 0 bytes 152 bytes connected 3s

Note: It is compatible with Cisco (R) AnyConnect (R) clients.

Example

SSL Certificates generation

Follow the instructions to generate CA cert (in configuration mode):

vyos@vyos# run generate pki ca install ca-ocserv

Enter private key type: [rsa, dsa, ec] (Default: rsa)
Enter private key bits: (Default: 2048)
Enter country code: (Default: GB) US
Enter state: (Default: Some-State) Delaware
Enter locality: (Default: Some-City) Mycity
Enter organization name: (Default: VyOS) MyORG
Enter common name: (Default: vyos.io) oc-ca
Enter how many days certificate will be valid: (Default: 1825) 3650
Note: If you plan to use the generated key on this router, do not encrypt the private␣
˓→key.

Do you want to encrypt the private key with a passphrase? [y/N] N

2 value(s) installed. Use "compare" to see the pending changes, and "commit" to apply.
[edit]

Follow the instructions to generate server cert (in configuration mode):

vyos@vyos# run generate pki certificate sign ca-ocserv install srv-ocserv

Do you already have a certificate request? [y/N] N
Enter private key type: [rsa, dsa, ec] (Default: rsa)
Enter private key bits: (Default: 2048)
Enter country code: (Default: GB) US
Enter state: (Default: Some-State) Delaware
Enter locality: (Default: Some-City) Mycity
Enter organization name: (Default: VyOS) MyORG
Enter common name: (Default: vyos.io) oc-srv
Do you want to configure Subject Alternative Names? [y/N] N
Enter how many days certificate will be valid: (Default: 365) 1830
Enter certificate type: (client, server) (Default: server)
Note: If you plan to use the generated key on this router, do not encrypt the private␣
˓→key.

Do you want to encrypt the private key with a passphrase? [y/N] N

2 value(s) installed. Use "compare" to see the pending changes, and "commit" to apply.
[edit]

8.13. VPN 1001

 VyOS Documentation, Release 1.5.x (circinus)

Each of the install command should be applied to the configuration and commited before using under the openconnect
configuration:

vyos@vyos# commit
[edit]
vyos@vyos# save
Saving configuration to '/config/config.boot'...
Done
[edit]

Openconnect Configuration

Simple setup with one user added and password authentication:

set vpn openconnect authentication local-users username tst password 'OC_bad_Secret'

set vpn openconnect authentication mode local password
set vpn openconnect network-settings client-ip-settings subnet '172.20.20.0/24'
set vpn openconnect network-settings name-server '10.1.1.1'
set vpn openconnect network-settings name-server '10.1.1.2'
set vpn openconnect ssl ca-certificate 'ca-ocserv'
set vpn openconnect ssl certificate 'srv-ocserv'

To enable the HTTP security headers in the configuration file, use the command:

set vpn openconnect http-security-headers

Adding a 2FA with an OTP-key

First the OTP keys must be generated and sent to the user and to the configuration:

vyos@vyos:~$ generate openconnect username tst otp-key hotp-time

# You can share it with the user, he just needs to scan the QR in his OTP app
# username: tst
# OTP KEY: 5PA4SGYTQSGOBO3H3EQSSNCUNZAYAPH2
# OTP URL: otpauth://totp/tst@vyos?secret=5PA4SGYTQSGOBO3H3EQSSNCUNZAYAPH2&digits=6&
˓→period=30

(continues on next page)

8.13. VPN 1002

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

# To add this OTP key to configuration, run the following commands:

set vpn openconnect authentication local-users username tst otp key
˓→'ebc1c91b13848ce0bb67d9212934546e41803cfa'

Next it is necessary to configure 2FA for OpenConnect:

set vpn openconnect authentication mode local password-otp

set vpn openconnect authentication local-users username tst otp key
˓→'ebc1c91b13848ce0bb67d9212934546e41803cfa'

Now when connecting the user will first be asked for the password and then the OTP key.

Warning: When using Time-based one-time password (TOTP) (OTP HOTP-time), be sure that the time on the
server and the OTP token generator are synchronized by NTP

To display the configured OTP user settings, use the command:

show openconnect-server user <username> otp <full|key-b32|key-hex|qrcode|uri>

Identity Based Configuration

OpenConnect supports a subset of it’s configuration options to be applied on a per user/group basis, for configuration
purposes we refer to this functionality as “Identity based config”. The following OpenConnect Server Manual outlines
the set of configuration options that are allowed. This can be leveraged to apply different sets of configs to different
users or groups of users.

sudo mkdir -p /config/auth/ocserv/config-per-user

sudo touch /config/auth/ocserv/default-user.conf

set vpn set vpn openconnect authentication identity-based-config mode user

set vpn openconnect authentication identity-based-config directory /config/auth/ocserv/
˓→config-per-user

set vpn openconnect authentication identity-based-config default-config /config/auth/

˓→ocserv/default-user.conf

Warning: The above directory and default-config must be a child directory of /config/auth, since files outside this
directory are not persisted after an image upgrade.

Once you commit the above changes you can create a config file in the /config/auth/ocserv/config-per-user directory
that matches a username of a user you have created e.g. “tst”. Now when logging in with the “tst” user the config
options you set in this file will be loaded.

8.13. VPN 1003

 VyOS Documentation, Release 1.5.x (circinus)

Be sure to set a sane default config in the default config file, this will be loaded in the case that a user is authenticated
and no file is found in the configured directory matching the users username/group.

sudo nano /config/auth/ocserv/config-per-user/tst

The same configuration options apply when Identity based config is configured in group mode except that group mode
can only be used with RADIUS authentication.

Warning: OpenConnect server matches the filename in a case sensitive manner, make sure the username/group
name you configure matches the filename exactly.

Configuring RADIUS accounting

OpenConnect can be configured to send accounting information to a RADIUS server to capture user session data such
as time of connect/disconnect, data transferred, and so on.
Configure an accounting server and enable accounting with:

set vpn openconnect accounting mode radius

set vpn openconnect accounting radius server 172.20.20.10
set vpn openconnect accounting radius server 172.20.20.10 port 1813
set vpn openconnect accounting radius server 172.20.20.10 key your_radius_secret

Warning: The RADIUS accounting feature must be used with the OpenConnect authentication mode RADIUS.
It cannot be used with local authentication. You must configure the OpenConnect authentication mode to “radius”.

An example of the data captured by a FREERADIUS server with sql accounting:

mysql> SELECT username, nasipaddress, acctstarttime, acctstoptime, acctinputoctets,␣

˓→acctoutputoctets, callingstationid, framedipaddress, connectinfo_start FROM radacct;

+----------+---------------+---------------------+---------------------+-----------------
˓→+------------------+-------------------+-----------------+-----------------------------

˓→------+

| username | nasipaddress | acctstarttime | acctstoptime | acctinputoctets␣

˓→| acctoutputoctets | callingstationid | framedipaddress | connectinfo_start ␣
˓→ |
+----------+---------------+---------------------+---------------------+-----------------
˓→+------------------+-------------------+-----------------+-----------------------------

˓→------+

| test | 198.51.100.15 | 2023-01-13 00:59:15 | 2023-01-13 00:59:21 | 10606␣

˓→| 152 | 192.168.6.1 | 172.20.20.198 | Open AnyConnect VPN Agent␣
˓→v8.05-1 |

+----------+---------------+---------------------+---------------------+-----------------
˓→+------------------+-------------------+-----------------+-----------------------------

˓→------+

8.13. VPN 1004

 VyOS Documentation, Release 1.5.x (circinus)

8.13.4 PPTP-Server

The Point-to-Point Tunneling Protocol (PPTP) has been implemented in VyOS only for backwards compatibility. PPTP
has many well known security issues and you should use one of the many other new VPN implementations.

Configuring PPTP Server

set vpn pptp remote-access authentication mode local

set vpn pptp remote-access authentication local-users username test password 'test'
set vpn pptp remote-access client-ip-pool PPTP-POOL range 192.168.255.2-192.168.255.254
set vpn pptp remote-access default-pool 'PPTP-POOL'
set vpn pptp remote-access outside-address 192.0.2.2
set vpn pptp remote-access gateway-address 192.168.255.1

set vpn pptp remote-access authentication mode <local | radius>

Set authentication backend. The configured authentication backend is used for all queries.
• radius: All authentication queries are handled by a configured RADIUS server.
• local: All authentication queries are handled locally.
• noauth: Authentication disabled.
set vpn pptp remote-access authentication local-users username <user> password <pass>
Create <user> for local authentication on this system. The users password will be set to <pass>.
set vpn pptp remote-access client-ip-pool <POOL-NAME> range <x.x.x.x-x.x.x.x | x.x.x.x/x>
Use this command to define the first IP address of a pool of addresses to be given to PPTP clients. If notation
x.x.x.x-x.x.x.x, it must be within a /24 subnet. If notation x.x.x.x/x is used there is possibility to set
host/netmask.
set vpn pptp remote-access default-pool <POOL-NAME>
Use this command to define default address pool name.
set vpn pptp remote-access gateway-address <gateway>
Specifies single <gateway> IP address to be used as local address of PPP interfaces.

Configuring RADIUS authentication

To enable RADIUS based authentication, the authentication mode needs to be changed within the configuration. Pre-
vious settings like the local users, still exists within the configuration, however they are not used if the mode has been
changed from local to radius. Once changed back to local, it will use all local accounts again.

set vpn pptp remote-access authentication mode radius

set vpn pptp remote-access authentication radius server <server> key <secret>
Configure RADIUS <server> and its required shared <secret> for communicating with the RADIUS server.
Since the RADIUS server would be a single point of failure, multiple RADIUS servers can be setup and will be used
subsequentially. For example:

set vpn pptp remote-access authentication radius server 10.0.0.1 key 'foo'
set vpn pptp remote-access authentication radius server 10.0.0.2 key 'foo'

8.13. VPN 1005

 VyOS Documentation, Release 1.5.x (circinus)

Note: Some RADIUS severs use an access control list which allows or denies queries, make sure to add your VyOS
router to the allowed client list.

RADIUS source address

If you are using OSPF as IGP, always the closest interface connected to the RADIUS server is used. You can bind all
outgoing RADIUS requests to a single source IP e.g. the loopback interface.
set vpn pptp remote-access authentication radius source-address <address>
Source IPv4 address used in all RADIUS server queires.

Note: The source-address must be configured on one of VyOS interface. Best practice would be a loopback or
dummy interface.

RADIUS advanced options

set vpn pptp remote-access authentication radius server <server> port <port>
Configure RADIUS <server> and its required port for authentication requests.
set vpn pptp remote-access authentication radius server <server> fail-time <time>
Mark RADIUS server as offline for this given <time> in seconds.
set vpn pptp remote-access authentication radius server <server> disable
Temporary disable this RADIUS server.
set vpn pptp remote-access authentication radius acct-timeout <timeout>
Timeout to wait reply for Interim-Update packets. (default 3 seconds)
set vpn pptp remote-access authentication radius dynamic-author server <address>
Specifies IP address for Dynamic Authorization Extension server (DM/CoA)
set vpn pptp remote-access authentication radius dynamic-author port <port>
Port for Dynamic Authorization Extension server (DM/CoA)
set vpn pptp remote-access authentication radius dynamic-author key <secret>
Secret for Dynamic Authorization Extension server (DM/CoA)
set vpn pptp remote-access authentication radius max-try <number>
Maximum number of tries to send Access-Request/Accounting-Request queries
set vpn pptp remote-access authentication radius timeout <timeout>
Timeout to wait response from server (seconds)
set vpn pptp remote-access authentication radius nas-identifier <identifier>
Value to send to RADIUS server in NAS-Identifier attribute and to be matched in DM/CoA requests.
set vpn pptp remote-access authentication radius nas-ip-address <address>

8.13. VPN 1006

 VyOS Documentation, Release 1.5.x (circinus)

Value to send to RADIUS server in NAS-IP-Address attribute and to be matched in DM/CoA requests. Also
DM/CoA server will bind to that address.
set vpn pptp remote-access authentication radius source-address <address>
Source IPv4 address used in all RADIUS server queires.
set vpn pptp remote-access authentication radius rate-limit attribute <attribute>
Specifies which RADIUS server attribute contains the rate limit information. The default attribute is Filter-Id.

Note: If you set a custom RADIUS attribute you must define it on both dictionaries at RADIUS server and client.

set vpn pptp remote-access authentication radius rate-limit enable

Enables bandwidth shaping via RADIUS.
set vpn pptp remote-access authentication radius rate-limit vendor
Specifies the vendor dictionary, dictionary needs to be in /usr/share/accel-ppp/radius.
Received RADIUS attributes have a higher priority than parameters defined within the CLI configuration, refer to the
explanation below.

Allocation clients ip addresses by RADIUS

If the RADIUS server sends the attribute Framed-IP-Address then this IP address will be allocated to the client and
the option default-pool within the CLI config is being ignored.
If the RADIUS server sends the attribute Framed-Pool, IP address will be allocated from a predefined IP pool whose
name equals the attribute value.
If the RADIUS server sends the attribute Stateful-IPv6-Address-Pool, IPv6 address will be allocated from a
predefined IPv6 pool prefix whose name equals the attribute value.
If the RADIUS server sends the attribute Delegated-IPv6-Prefix-Pool, IPv6 delegation pefix will be allocated
from a predefined IPv6 pool delegate whose name equals the attribute value.

Note: Stateful-IPv6-Address-Pool and Delegated-IPv6-Prefix-Pool are defined in RFC6911. If they are

not defined in your RADIUS server, add new dictionary.

User interface can be put to VRF context via RADIUS Access-Accept packet, or change it via RADIUS CoA.
Accel-VRF-Name is used from these purposes. It is custom ACCEL-PPP attribute. Define it in your RADIUS server.

Renaming clients interfaces by RADIUS

If the RADIUS server uses the attribute NAS-Port-Id, ppp tunnels will be renamed.

Note: The value of the attribute NAS-Port-Id must be less than 16 characters, otherwise the interface won’t be
renamed.

8.13. VPN 1007

 VyOS Documentation, Release 1.5.x (circinus)

IPv6

set vpn pptp remote-access ppp-options ipv6 <require | prefer | allow | deny>
Specifies IPv6 negotiation preference.
• require - Require IPv6 negotiation
• prefer - Ask client for IPv6 negotiation, do not fail if it rejects
• allow - Negotiate IPv6 only if client requests
• deny - Do not negotiate IPv6 (default value)
set vpn pptp remote-access client-ipv6-pool <IPv6-POOL-NAME> prefix <address> mask
<number-of-bits>
Use this comand to set the IPv6 address pool from which an PPTP client will get an IPv6 prefix of your defined
length (mask) to terminate the PPTP endpoint at their side. The mask length can be set from 48 to 128 bit long,
the default value is 64.
set vpn pptp remote-access client-ipv6-pool <IPv6-POOL-NAME> delegate <address>
delegation-prefix <number-of-bits>
Use this command to configure DHCPv6 Prefix Delegation (RFC3633) on PPTP. You will have to set your IPv6
pool and the length of the delegation prefix. From the defined IPv6 pool you will be handing out networks of
the defined length (delegation-prefix). The length of the delegation prefix can be set from 32 to 64 bit long.
set vpn pptp remote-access default-ipv6-pool <IPv6-POOL-NAME>
Use this command to define default IPv6 address pool name.

set vpn pptp remote-access ppp-options ipv6 allow

set vpn pptp remote-access client-ipv6-pool IPv6-POOL delegate '2001:db8:8003::/48'␣
˓→delegation-prefix '56'

set vpn pptp remote-access client-ipv6-pool IPv6-POOL prefix '2001:db8:8002::/48' mask

˓→'64'

set vpn pptp remote-access default-ipv6-pool IPv6-POOL

IPv6 Advanced Options

set vpn pptp remote-access ppp-options ipv6-accept-peer-interface-id

Accept peer interface identifier. By default is not defined.
set vpn pptp remote-access ppp-options ipv6-interface-id <random | x:x:x:x>
Specifies fixed or random interface identifier for IPv6. By default is fixed.
• random - Random interface identifier for IPv6
• x:x:x:x - Specify interface identifier for IPv6
set vpn pptp remote-access ppp-options ipv6-interface-id <random | x:x:x:x>
Specifies peer interface identifier for IPv6. By default is fixed.
• random - Random interface identifier for IPv6
• x:x:x:x - Specify interface identifier for IPv6
• ipv4-addr - Calculate interface identifier from IPv4 address.
• calling-sid - Calculate interface identifier from calling-station-id.

8.13. VPN 1008

 VyOS Documentation, Release 1.5.x (circinus)

Scripting

set vpn pptp remote-access extended-scripts on-change <path_to_script>

Script to run when session interface changed by RADIUS CoA handling
set vpn pptp remote-access extended-scripts on-down <path_to_script>
Script to run when session interface going to terminate
set vpn pptp remote-access extended-scripts on-pre-up <path_to_script>
Script to run before session interface comes up
set vpn pptp remote-access extended-scripts on-up <path_to_script>
Script to run when session interface is completely configured and started

Advanced Options

Authentication Advanced Options

set vpn pptp remote-access authentication local-users username <user> disable

Disable <user> account.
set vpn pptp remote-access authentication local-users username <user> static-ip <address>
Assign static IP address to <user> account.
set vpn pptp remote-access authentication local-users username <user> rate-limit download
<bandwidth>
Download bandwidth limit in kbit/s for <user>.
set vpn pptp remote-access authentication local-users username <user> rate-limit upload
<bandwidth>
Upload bandwidth limit in kbit/s for <user>.
set vpn pptp remote-access authentication protocols <pap | chap | mschap | mschap-v2>
Require the peer to authenticate itself using one of the following protocols: pap, chap, mschap, mschap-v2.

Client IP Pool Advanced Options

set vpn pptp remote-access client-ip-pool <POOL-NAME> next-pool <NEXT-POOL-NAME>

Use this command to define the next address pool name.

8.13. VPN 1009

 VyOS Documentation, Release 1.5.x (circinus)

PPP Advanced Options

set vpn pptp remote-access ppp-options disable-ccp

Disable Compression Control Protocol (CCP). CCP is enabled by default.
set vpn pptp remote-access ppp-options interface-cache <number>
Specifies number of interfaces to keep in cache. It means that don’t destroy interface after corresponding session
is destroyed, instead place it to cache and use it later for new sessions repeatedly. This should reduce kernel-level
interface creation/deletion rate lack. Default value is 0.
set vpn pptp remote-access ppp-options ipv4 <require | prefer | allow | deny>
Specifies IPv4 negotiation preference.
• require - Require IPv4 negotiation
• prefer - Ask client for IPv4 negotiation, do not fail if it rejects
• allow - Negotiate IPv4 only if client requests (Default value)
• deny - Do not negotiate IPv4
set vpn pptp remote-access ppp-options lcp-echo-failure <number>
Defines the maximum <number> of unanswered echo requests. Upon reaching the value <number>, the session
will be reset. Default value is 3.
set vpn pptp remote-access ppp-options lcp-echo-interval <interval>
If this option is specified and is greater than 0, then the PPP module will send LCP pings of the echo request
every <interval> seconds. Default value is 30.
set vpn pptp remote-access ppp-options lcp-echo-timeout
Specifies timeout in seconds to wait for any peer activity. If this option specified it turns on adaptive lcp echo
functionality and “lcp-echo-failure” is not used. Default value is 0.
set vpn pptp remote-access ppp-options min-mtu <number>
Defines minimum acceptable MTU. If client will try to negotiate less then specified MTU then it will be NAKed
or disconnected if rejects greater MTU. Default value is 100.
set vpn pptp remote-access ppp-options mppe <require | prefer | deny>
Specifies MPPE negotiation preference.
• require - ask client for mppe, if it rejects drop connection
• prefer - ask client for mppe, if it rejects don’t fail. (Default value)
• deny - deny mppe
Default behavior - don’t ask client for mppe, but allow it if client wants. Please note that RADIUS may override
this option by MS-MPPE-Encryption-Policy attribute.
set vpn pptp remote-access ppp-options mru <number>
Defines preferred MRU. By default is not defined.

8.13. VPN 1010

 VyOS Documentation, Release 1.5.x (circinus)

Global Advanced options

set vpn pptp remote-access description <description>

Set description.
set vpn pptp remote-access limits burst <value>
Burst count
set vpn pptp remote-access limits connection-limit <value>
Acceptable rate of connections (e.g. 1/min, 60/sec)
set vpn pptp remote-access limits timeout <value>
Timeout in seconds
set vpn pptp remote-access mtu
Maximum Transmission Unit (MTU) (default: 1436)
set vpn pptp remote-access max-concurrent-sessions
Maximum number of concurrent session start attempts
set vpn pptp remote-access name-server <address>
Connected client should use <address> as their DNS server. This command accepts both IPv4 and IPv6 ad-
dresses. Up to two nameservers can be configured for IPv4, up to three for IPv6.
set vpn pptp remote-access shaper fwmark <1-2147483647>
Match firewall mark value
set vpn pptp remote-access snmp master-agent
Enable SNMP
set vpn pptp remote-access wins-server <address>
Windows Internet Name Service (WINS) servers propagated to client

Monitoring

show pptp-server sessions

Use this command to locally check the active sessions in the PPTP server.

vyos@vyos:~$ show pptp-server sessions

ifname | username | ip | ip6 | ip6-dp | calling-sid | rate-limit | state | ␣
˓→uptime | rx-bytes | tx-bytes
--------+----------+----------+-----+--------+----------------+------------+--------+----
˓→------+----------+----------

pptp0 | test | 10.0.0.2 | | | 192.168.10.100 | | active |␣

˓→00:01:26 | 6.9 KiB | 220 B

vyos@vyos:~$ show pptp-server statistics

uptime: 0.00:04:52
cpu: 0%
mem(rss/virt): 5504/100176 kB
core:
(continues on next page)

8.13. VPN 1011

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

mempool_allocated: 152007
mempool_available: 149007
thread_count: 1
thread_active: 1
context_count: 6
context_sleeping: 0
context_pending: 0
md_handler_count: 6
md_handler_pending: 0
timer_count: 2
timer_pending: 0
sessions:
starting: 0
active: 1
finishing: 0
pptp:
starting: 0
active: 1

Troubleshooting

vyos@vyos:~$sudo journalctl -u accel-ppp@pptp -b 0

Feb 29 14:58:57 vyos accel-pptp[4629]: pptp: new connection from 192.168.10.100

Feb 29 14:58:57 vyos accel-pptp[4629]: :: recv [PPTP Start-Ctrl-Conn-Request <Version 1>
˓→<Framing 1> <Bearer 1> <Max-Chan 0>]

Feb 29 14:58:57 vyos accel-pptp[4629]: :: send [PPTP Start-Ctrl-Conn-Reply <Version 1>

˓→<Result 1> <Error 0> <Framing 3> <Bearer 3> <Max-Chan 1>]

Feb 29 14:58:57 vyos accel-pptp[4629]: :: recv [PPTP Outgoing-Call-Request <Call-ID 2961>

˓→ <Call-Serial 2> <Min-BPS 300> <Max-BPS 100000000> <Bearer 3> <Framing 3> <Window-Size␣

˓→64> <Delay 0>]

Feb 29 14:58:57 vyos accel-pptp[4629]: :: send [PPTP Outgoing-Call-Reply <Call-ID 2>

˓→<Peer-Call-ID 2961> <Result 1> <Error 0> <Cause 0> <Speed 100000000> <Window-Size 64>

˓→<Delay 0> <Channel 0>]

Feb 29 14:58:57 vyos accel-pptp[4629]: :: lcp_layer_init

Feb 29 14:58:57 vyos accel-pptp[4629]: :: auth_layer_init
Feb 29 14:58:57 vyos accel-pptp[4629]: :: ccp_layer_init
Feb 29 14:58:57 vyos accel-pptp[4629]: :: ipcp_layer_init
Feb 29 14:58:57 vyos accel-pptp[4629]: :: ipv6cp_layer_init
Feb 29 14:58:57 vyos accel-pptp[4629]: :: ppp establishing
Feb 29 14:58:57 vyos accel-pptp[4629]: :: lcp_layer_start
Feb 29 14:58:57 vyos accel-pptp[4629]: :: send [LCP ConfReq id=75 <auth PAP> <mru 1436>
˓→<magic 483920bd>]

Feb 29 14:58:57 vyos accel-pptp[4629]: :: recv [PPTP Set-Link-Info]

Feb 29 14:58:57 vyos accel-pptp[4629]: :: recv [LCP ConfReq id=0 <mru 1400> <magic␣
˓→0142785a> <pcomp> <accomp> < d 3 6 >]

Feb 29 14:58:57 vyos accel-pptp[4629]: :: send [LCP ConfRej id=0 <pcomp> <accomp> < d 3␣
˓→6 >]

Feb 29 14:58:57 vyos accel-pptp[4629]: :: recv [LCP ConfReq id=1 <mru 1400> <magic␣
˓→0142785a>]

(continues on next page)

8.13. VPN 1012

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Feb 29 14:58:57 vyos accel-pptp[4629]: :: send [LCP ConfAck id=1]
Feb 29 14:59:00 vyos accel-pptp[4629]: :: fsm timeout 9
Feb 29 14:59:00 vyos accel-pptp[4629]: :: send [LCP ConfReq id=75 <auth PAP> <mru 1436>
˓→<magic 483920bd>]

Feb 29 14:59:00 vyos accel-pptp[4629]: :: recv [LCP ConfNak id=75 <auth MSCHAP-v2>]
Feb 29 14:59:00 vyos accel-pptp[4629]: :: send [LCP ConfReq id=76 <auth CHAP-md5> <mru␣
˓→1436> <magic 483920bd>]

Feb 29 14:59:00 vyos accel-pptp[4629]: :: recv [LCP ConfNak id=76 <auth MSCHAP-v2>]
Feb 29 14:59:00 vyos accel-pptp[4629]: :: send [LCP ConfReq id=77 <auth MSCHAP-v1> <mru␣
˓→1436> <magic 483920bd>]

Feb 29 14:59:00 vyos accel-pptp[4629]: :: recv [LCP ConfNak id=77 <auth MSCHAP-v2>]
Feb 29 14:59:00 vyos accel-pptp[4629]: :: send [LCP ConfReq id=78 <auth MSCHAP-v2> <mru␣
˓→1436> <magic 483920bd>]

Feb 29 14:59:00 vyos accel-pptp[4629]: :: recv [LCP ConfAck id=78 <auth MSCHAP-v2> <mru␣
˓→1436> <magic 483920bd>]

Feb 29 14:59:00 vyos accel-pptp[4629]: :: lcp_layer_started

Feb 29 14:59:00 vyos accel-pptp[4629]: :: auth_layer_start
Feb 29 14:59:00 vyos accel-pptp[4629]: :: send [MSCHAP-v2 Challenge id=1
˓→<8aa758781676e6a8e85c11963ee010>]

Feb 29 14:59:00 vyos accel-pptp[4629]: :: recv [LCP Ident id=2 <MSRASV5.20>]

Feb 29 14:59:00 vyos accel-pptp[4629]: :: recv [LCP Ident id=3 <MSRAS-0-MSEDGEWIN10>]
Feb 29 14:59:00 vyos accel-pptp[4629]: [43B blob data]
Feb 29 14:59:00 vyos accel-pptp[4629]: :: recv [PPTP Set-Link-Info]
Feb 29 14:59:00 vyos accel-pptp[4629]: :: recv [MSCHAP-v2 Response id=1
˓→<90c21af1091f745e8bf22388b058>, <e695ae5aae274c88a3fa1ee3dc9057aece4d53c87b9fea>, F=0,␣

˓→name="test"]

Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: connect: ppp0 <--> pptp(192.168.10.100)

Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: ppp connected
Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: send [MSCHAP-v2 Success id=1
˓→"S=347F417CF04BEBBC7F75CFA7F43474C36FB218F9 M=Authentication succeeded"]

Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: test: authentication succeeded

Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: auth_layer_started
Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: ccp_layer_start
Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: send [CCP ConfReq id=b9 <mppe +H -M +S␣
˓→-L -D -C>]

Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: ipcp_layer_start

Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: ipv6cp_layer_start
Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: IPV6CP: discarding packet
Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: send [LCP ProtoRej id=122 <8057>]
Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: recv [IPCP ConfReq id=6 <addr 0.0.0.0>
˓→<dns1 0.0.0.0> <wins1 0.0.0.0> <dns2 0.0.0.0> <wins2 0.0.0.0>]

Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: send [IPCP ConfReq id=3b <addr 10.0.0.
˓→1>]

Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: send [IPCP ConfRej id=6 <dns1 0.0.0.0>
˓→<wins1 0.0.0.0> <dns2 0.0.0.0> <wins2 0.0.0.0>]

Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: recv [LCP ProtoRej id=7 <80fd>]
Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: ccp_layer_finished
Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: recv [IPCP ConfAck id=3b <addr 10.0.0.
˓→1>]

Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: recv [IPCP ConfReq id=8 <addr 0.0.0.0>]
Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: send [IPCP ConfNak id=8 <addr 10.0.0.2>
˓→]

(continues on next page)

8.13. VPN 1013

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: recv [IPCP ConfReq id=9 <addr 10.0.0.2>
˓→]

Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: send [IPCP ConfAck id=9]

Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: ipcp_layer_started
Feb 29 14:59:00 vyos accel-pptp[4629]: ppp0:test: rename interface to 'pptp0'
Feb 29 14:59:00 vyos accel-pptp[4629]: pptp0:test: pptp: ppp started

8.13.5 RSA-Keys

RSA can be used for services such as key exchanges and for encryption purposes. To make IPSec work with dynamic
address on one/both sides, we will have to use RSA keys for authentication. They are very fast and easy to setup.
First, on both routers run the operational command “generate pki key-pair install <key-pair nam>>”. You may choose
different length than 2048 of course.

vyos@left# run generate pki key-pair install ipsec-LEFT

Enter private key type: [rsa, dsa, ec] (Default: rsa)
Enter private key bits: (Default: 2048)
Note: If you plan to use the generated key on this router, do not encrypt the private␣
˓→key.

Do you want to encrypt the private key with a passphrase? [y/N] N

Configure mode commands to install key pair:
Do you want to install the public key? [Y/n] Y
set pki key-pair ipsec-LEFT public key 'MIIBIjANBgkqh...'
Do you want to install the private key? [Y/n] Y
set pki key-pair ipsec-LEFT private key 'MIIEvgIBADAN...'
[edit]

Configuration commands will display. Note the command with the public key (set pki key-pair ipsec-LEFT public key
‘MIIBIjANBgkqh. . . ’). Then do the same on the opposite router:

vyos@left# run generate pki key-pair install ipsec-RIGHT

Note the command with the public key (set pki key-pair ipsec-RIGHT public key ‘FAAOCAQ8AMII. . . ’).
The noted public keys should be entered on the opposite routers.
On the LEFT:

set pki key-pair ipsec-RIGHT public key 'FAAOCAQ8AMII...'

On the RIGHT:

set pki key-pair ipsec-LEFT public key 'MIIBIjANBgkqh...'

Now you are ready to setup IPsec. The key points:

1. Since both routers do not know their effective public addresses, we set the local-address of the peer to “any”.
2. On the initiator, we set the peer address to its public address, but on the responder we only set the id.
3. On the initiator, we need to set the remote-id option so that it can identify IKE traffic from the responder correctly.
4. On the responder, we need to set the local id so that initiator can know who’s talking to it for the point #3 to work.
On the LEFT (static address):

8.13. VPN 1014

 VyOS Documentation, Release 1.5.x (circinus)

set vpn ipsec interface eth0

set vpn ipsec esp-group MyESPGroup proposal 1 encryption aes128

set vpn ipsec esp-group MyESPGroup proposal 1 hash sha1

set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group 2

set vpn ipsec ike-group MyIKEGroup proposal 1 encryption aes128
set vpn ipsec ike-group MyIKEGroup proposal 1 hash sha1

set vpn ipsec site-to-site peer @RIGHT authentication id LEFT

set vpn ipsec site-to-site peer @RIGHT authentication mode rsa
set vpn ipsec site-to-site peer @RIGHT authentication rsa local-key ipsec-LEFT
set vpn ipsec site-to-site peer @RIGHT authentication rsa remote-key ipsec-RIGHT
set vpn ipsec site-to-site peer @RIGHT authentication remote-id RIGHT
set vpn ipsec site-to-site peer @RIGHT default-esp-group MyESPGroup
set vpn ipsec site-to-site peer @RIGHT ike-group MyIKEGroup
set vpn ipsec site-to-site peer @RIGHT local-address 192.0.2.10
set vpn ipsec site-to-site peer @RIGHT connection-type respond
set vpn ipsec site-to-site peer @RIGHT tunnel 1 local prefix 192.168.99.1/32 #␣
˓→Additional loopback address on the local

set vpn ipsec site-to-site peer @RIGHT tunnel 1 remote prefix 192.168.99.2/32 #␣
˓→Additional loopback address on the remote

On the RIGHT (dynamic address):

set vpn ipsec interface eth0

set vpn ipsec esp-group MyESPGroup proposal 1 encryption aes128

set vpn ipsec esp-group MyESPGroup proposal 1 hash sha1

set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group 2

set vpn ipsec ike-group MyIKEGroup proposal 1 encryption aes128
set vpn ipsec ike-group MyIKEGroup proposal 1 hash sha1

set vpn ipsec site-to-site peer 192.0.2.10 authentication id RIGHT

set vpn ipsec site-to-site peer 192.0.2.10 authentication mode rsa
set vpn ipsec site-to-site peer 192.0.2.10 authentication rsa local-key ipsec-RIGHT
set vpn ipsec site-to-site peer 192.0.2.10 authentication rsa remote-key ipsec-LEFT
set vpn ipsec site-to-site peer 192.0.2.10 authentication remote-id LEFT
set vpn ipsec site-to-site peer 192.0.2.10 connection-type initiate
set vpn ipsec site-to-site peer 192.0.2.10 default-esp-group MyESPGroup
set vpn ipsec site-to-site peer 192.0.2.10 ike-group MyIKEGroup
set vpn ipsec site-to-site peer 192.0.2.10 local-address any
set vpn ipsec site-to-site peer 192.0.2.10 tunnel 1 local prefix 192.168.99.2/32 #␣
˓→Additional loopback address on the local

set vpn ipsec site-to-site peer 192.0.2.10 tunnel 1 remote prefix 192.168.99.1/32 #␣
˓→Additional loopback address on the remote

8.13. VPN 1015

 VyOS Documentation, Release 1.5.x (circinus)

8.13.6 SSTP Server

SSTP is a form of VPN (Virtual Private Network) tunnel that provides a mechanism to transport PPP traffic through
an SSL/TLS channel. SSL/TLS provides transport-level security with key negotiation, encryption and traffic integrity
checking. The use of SSL/TLS over TCP port 443 allows SSTP to pass through virtually all firewalls and proxy servers
except for authenticated web proxies.
SSTP is available for Linux, BSD, and Windows.
VyOS utilizes accel-ppp to provide SSTP server functionality. We support both local and RADIUS authentication.
As SSTP provides PPP via a SSL/TLS channel the use of either publically signed certificates as well as a private PKI
is required.

Configuring SSTP Server

Certificates

Using our documentation chapter - PKI generate and install CA and Server certificate

vyos@vyos:~$ generate pki ca install CA

vyos@vyos:~$ generate pki certificate sign CA install Server

Configuration

set vpn sstp authentication local-users username test password 'test'

set vpn sstp authentication mode 'local'
set vpn sstp client-ip-pool SSTP-POOL range '10.0.0.2-10.0.0.100'
set vpn sstp default-pool 'SSTP-POOL'
set vpn sstp gateway-address '10.0.0.1'
set vpn sstp ssl ca-certificate 'CA1'
set vpn sstp ssl certificate 'Server'

set vpn sstp authentication mode <local | radius>

Set authentication backend. The configured authentication backend is used for all queries.
• radius: All authentication queries are handled by a configured RADIUS server.
• local: All authentication queries are handled locally.
set vpn sstp authentication local-users username <user> password <pass>
Create <user> for local authentication on this system. The users password will be set to <pass>.
set vpn sstp client-ip-pool <POOL-NAME> range <x.x.x.x-x.x.x.x | x.x.x.x/x>
Use this command to define the first IP address of a pool of addresses to be given to SSTP clients. If notation
x.x.x.x-x.x.x.x, it must be within a /24 subnet. If notation x.x.x.x/x is used there is possibility to set
host/netmask.
set vpn sstp default-pool <POOL-NAME>
Use this command to define default address pool name.
set vpn sstp gateway-address <gateway>

8.13. VPN 1016

 VyOS Documentation, Release 1.5.x (circinus)

Specifies single <gateway> IP address to be used as local address of PPP interfaces.

set vpn sstp ssl ca-certificate <file>
Name of installed certificate authority certificate.
set vpn sstp ssl certificate <file>
Name of installed server certificate.

Configuring RADIUS authentication

To enable RADIUS based authentication, the authentication mode needs to be changed within the configuration. Pre-
vious settings like the local users, still exists within the configuration, however they are not used if the mode has been
changed from local to radius. Once changed back to local, it will use all local accounts again.

set vpn sstp authentication mode radius

set vpn sstp authentication radius server <server> key <secret>

Configure RADIUS <server> and its required shared <secret> for communicating with the RADIUS server.
Since the RADIUS server would be a single point of failure, multiple RADIUS servers can be setup and will be used
subsequentially. For example:

set vpn sstp authentication radius server 10.0.0.1 key 'foo'

set vpn sstp authentication radius server 10.0.0.2 key 'foo'

Note: Some RADIUS severs use an access control list which allows or denies queries, make sure to add your VyOS
router to the allowed client list.

RADIUS source address

If you are using OSPF as IGP, always the closest interface connected to the RADIUS server is used. You can bind all
outgoing RADIUS requests to a single source IP e.g. the loopback interface.
set vpn sstp authentication radius source-address <address>
Source IPv4 address used in all RADIUS server queires.

Note: The source-address must be configured on one of VyOS interface. Best practice would be a loopback or
dummy interface.

8.13. VPN 1017

 VyOS Documentation, Release 1.5.x (circinus)

RADIUS advanced options

set vpn sstp authentication radius server <server> port <port>

Configure RADIUS <server> and its required port for authentication requests.
set vpn sstp authentication radius server <server> fail-time <time>
Mark RADIUS server as offline for this given <time> in seconds.
set vpn sstp authentication radius server <server> disable
Temporary disable this RADIUS server.
set vpn sstp authentication radius acct-timeout <timeout>
Timeout to wait reply for Interim-Update packets. (default 3 seconds)
set vpn sstp authentication radius dynamic-author server <address>
Specifies IP address for Dynamic Authorization Extension server (DM/CoA)
set vpn sstp authentication radius dynamic-author port <port>
Port for Dynamic Authorization Extension server (DM/CoA)
set vpn sstp authentication radius dynamic-author key <secret>
Secret for Dynamic Authorization Extension server (DM/CoA)
set vpn sstp authentication radius max-try <number>
Maximum number of tries to send Access-Request/Accounting-Request queries
set vpn sstp authentication radius timeout <timeout>
Timeout to wait response from server (seconds)
set vpn sstp authentication radius nas-identifier <identifier>
Value to send to RADIUS server in NAS-Identifier attribute and to be matched in DM/CoA requests.
set vpn sstp authentication radius nas-ip-address <address>
Value to send to RADIUS server in NAS-IP-Address attribute and to be matched in DM/CoA requests. Also
DM/CoA server will bind to that address.
set vpn sstp authentication radius source-address <address>
Source IPv4 address used in all RADIUS server queires.
set vpn sstp authentication radius rate-limit attribute <attribute>
Specifies which RADIUS server attribute contains the rate limit information. The default attribute is Filter-Id.

Note: If you set a custom RADIUS attribute you must define it on both dictionaries at RADIUS server and client.

set vpn sstp authentication radius rate-limit enable

Enables bandwidth shaping via RADIUS.
set vpn sstp authentication radius rate-limit vendor
Specifies the vendor dictionary, dictionary needs to be in /usr/share/accel-ppp/radius.
Received RADIUS attributes have a higher priority than parameters defined within the CLI configuration, refer to the
explanation below.

8.13. VPN 1018

 VyOS Documentation, Release 1.5.x (circinus)

Allocation clients ip addresses by RADIUS

If the RADIUS server sends the attribute Framed-IP-Address then this IP address will be allocated to the client and
the option default-pool within the CLI config is being ignored.
If the RADIUS server sends the attribute Framed-Pool, IP address will be allocated from a predefined IP pool whose
name equals the attribute value.
If the RADIUS server sends the attribute Stateful-IPv6-Address-Pool, IPv6 address will be allocated from a
predefined IPv6 pool prefix whose name equals the attribute value.
If the RADIUS server sends the attribute Delegated-IPv6-Prefix-Pool, IPv6 delegation pefix will be allocated
from a predefined IPv6 pool delegate whose name equals the attribute value.

Note: Stateful-IPv6-Address-Pool and Delegated-IPv6-Prefix-Pool are defined in RFC6911. If they are

not defined in your RADIUS server, add new dictionary.

User interface can be put to VRF context via RADIUS Access-Accept packet, or change it via RADIUS CoA.
Accel-VRF-Name is used from these purposes. It is custom ACCEL-PPP attribute. Define it in your RADIUS server.

Renaming clients interfaces by RADIUS

If the RADIUS server uses the attribute NAS-Port-Id, ppp tunnels will be renamed.

Note: The value of the attribute NAS-Port-Id must be less than 16 characters, otherwise the interface won’t be
renamed.

IPv6

set vpn sstp ppp-options ipv6 <require | prefer | allow | deny>

Specifies IPv6 negotiation preference.
• require - Require IPv6 negotiation
• prefer - Ask client for IPv6 negotiation, do not fail if it rejects
• allow - Negotiate IPv6 only if client requests
• deny - Do not negotiate IPv6 (default value)
set vpn sstp client-ipv6-pool <IPv6-POOL-NAME> prefix <address> mask <number-of-bits>
Use this comand to set the IPv6 address pool from which an SSTP client will get an IPv6 prefix of your defined
length (mask) to terminate the SSTP endpoint at their side. The mask length can be set from 48 to 128 bit long,
the default value is 64.
set vpn sstp client-ipv6-pool <IPv6-POOL-NAME> delegate <address> delegation-prefix
<number-of-bits>
Use this command to configure DHCPv6 Prefix Delegation (RFC3633) on SSTP. You will have to set your IPv6
pool and the length of the delegation prefix. From the defined IPv6 pool you will be handing out networks of
the defined length (delegation-prefix). The length of the delegation prefix can be set from 32 to 64 bit long.
set vpn sstp default-ipv6-pool <IPv6-POOL-NAME>

8.13. VPN 1019

 VyOS Documentation, Release 1.5.x (circinus)

Use this command to define default IPv6 address pool name.

set vpn sstp ppp-options ipv6 allow

set vpn sstp client-ipv6-pool IPv6-POOL delegate '2001:db8:8003::/48' delegation-prefix
˓→'56'

set vpn sstp client-ipv6-pool IPv6-POOL prefix '2001:db8:8002::/48' mask '64'

set vpn sstp default-ipv6-pool IPv6-POOL

IPv6 Advanced Options

set vpn sstp ppp-options ipv6-accept-peer-interface-id

Accept peer interface identifier. By default is not defined.
set vpn sstp ppp-options ipv6-interface-id <random | x:x:x:x>
Specifies fixed or random interface identifier for IPv6. By default is fixed.
• random - Random interface identifier for IPv6
• x:x:x:x - Specify interface identifier for IPv6
set vpn sstp ppp-options ipv6-interface-id <random | x:x:x:x>
Specifies peer interface identifier for IPv6. By default is fixed.
• random - Random interface identifier for IPv6
• x:x:x:x - Specify interface identifier for IPv6
• ipv4-addr - Calculate interface identifier from IPv4 address.
• calling-sid - Calculate interface identifier from calling-station-id.

Scripting

set vpn sstp extended-scripts on-change <path_to_script>

Script to run when session interface changed by RADIUS CoA handling
set vpn sstp extended-scripts on-down <path_to_script>
Script to run when session interface going to terminate
set vpn sstp extended-scripts on-pre-up <path_to_script>
Script to run before session interface comes up
set vpn sstp extended-scripts on-up <path_to_script>
Script to run when session interface is completely configured and started

8.13. VPN 1020

 VyOS Documentation, Release 1.5.x (circinus)

Advanced Options

Authentication Advanced Options

set vpn sstp authentication local-users username <user> disable

Disable <user> account.
set vpn sstp authentication local-users username <user> static-ip <address>
Assign static IP address to <user> account.
set vpn sstp authentication local-users username <user> rate-limit download <bandwidth>
Download bandwidth limit in kbit/s for <user>.
set vpn sstp authentication local-users username <user> rate-limit upload <bandwidth>
Upload bandwidth limit in kbit/s for <user>.
set vpn sstp authentication protocols <pap | chap | mschap | mschap-v2>
Require the peer to authenticate itself using one of the following protocols: pap, chap, mschap, mschap-v2.

Client IP Pool Advanced Options

set vpn sstp client-ip-pool <POOL-NAME> next-pool <NEXT-POOL-NAME>

Use this command to define the next address pool name.

PPP Advanced Options

set vpn sstp ppp-options disable-ccp

Disable Compression Control Protocol (CCP). CCP is enabled by default.
set vpn sstp ppp-options interface-cache <number>
Specifies number of interfaces to keep in cache. It means that don’t destroy interface after corresponding session
is destroyed, instead place it to cache and use it later for new sessions repeatedly. This should reduce kernel-level
interface creation/deletion rate lack. Default value is 0.
set vpn sstp ppp-options ipv4 <require | prefer | allow | deny>
Specifies IPv4 negotiation preference.
• require - Require IPv4 negotiation
• prefer - Ask client for IPv4 negotiation, do not fail if it rejects
• allow - Negotiate IPv4 only if client requests (Default value)
• deny - Do not negotiate IPv4
set vpn sstp ppp-options lcp-echo-failure <number>
Defines the maximum <number> of unanswered echo requests. Upon reaching the value <number>, the session
will be reset. Default value is 3.
set vpn sstp ppp-options lcp-echo-interval <interval>
If this option is specified and is greater than 0, then the PPP module will send LCP pings of the echo request
every <interval> seconds. Default value is 30.

8.13. VPN 1021

 VyOS Documentation, Release 1.5.x (circinus)

set vpn sstp ppp-options lcp-echo-timeout

Specifies timeout in seconds to wait for any peer activity. If this option specified it turns on adaptive lcp echo
functionality and “lcp-echo-failure” is not used. Default value is 0.
set vpn sstp ppp-options min-mtu <number>
Defines minimum acceptable MTU. If client will try to negotiate less then specified MTU then it will be NAKed
or disconnected if rejects greater MTU. Default value is 100.
set vpn sstp ppp-options mppe <require | prefer | deny>
Specifies MPPE negotiation preference.
• require - ask client for mppe, if it rejects drop connection
• prefer - ask client for mppe, if it rejects don’t fail. (Default value)
• deny - deny mppe
Default behavior - don’t ask client for mppe, but allow it if client wants. Please note that RADIUS may override
this option by MS-MPPE-Encryption-Policy attribute.
set vpn sstp ppp-options mru <number>
Defines preferred MRU. By default is not defined.

Global Advanced options

set vpn sstp description <description>

Set description.
set vpn sstp limits burst <value>
Burst count
set vpn sstp limits connection-limit <value>
Acceptable rate of connections (e.g. 1/min, 60/sec)
set vpn sstp limits timeout <value>
Timeout in seconds
set vpn sstp mtu
Maximum Transmission Unit (MTU) (default: 1500)
set vpn sstp max-concurrent-sessions
Maximum number of concurrent session start attempts
set vpn sstp name-server <address>
Connected client should use <address> as their DNS server. This command accepts both IPv4 and IPv6 ad-
dresses. Up to two nameservers can be configured for IPv4, up to three for IPv6.
set vpn sstp shaper fwmark <1-2147483647>
Match firewall mark value
set vpn sstp snmp master-agent
Enable SNMP
set vpn sstp wins-server <address>

8.13. VPN 1022

 VyOS Documentation, Release 1.5.x (circinus)

Windows Internet Name Service (WINS) servers propagated to client

set vpn sstp host-name <hostname>
If this option is given, only SSTP connections to the specified host and with the same TLS SNI will be allowed.

Configuring SSTP client

Once you have setup your SSTP server there comes the time to do some basic testing. The Linux client used for testing
is called sstpc. sstpc requires a PPP configuration/peer file.
If you use a self-signed certificate, do not forget to install CA on the client side.
The following PPP configuration tests MSCHAP-v2:

$ cat /etc/ppp/peers/vyos
usepeerdns
#require-mppe
#require-pap
require-mschap-v2
noauth
lock
refuse-pap
refuse-eap
refuse-chap
refuse-mschap
#refuse-mschap-v2
nobsdcomp
nodeflate
debug

You can now “dial” the peer with the follwoing command: sstpc --log-level 4 --log-stderr --user vyos
--password vyos vpn.example.com -- call vyos.
A connection attempt will be shown as:

$ sstpc --log-level 4 --log-stderr --user vyos --password vyos vpn.example.com -- call␣

˓→vyos

Mar 22 13:29:12 sstpc[12344]: Resolved vpn.example.com to 192.0.2.1

Mar 22 13:29:12 sstpc[12344]: Connected to vpn.example.com
Mar 22 13:29:12 sstpc[12344]: Sending Connect-Request Message
Mar 22 13:29:12 sstpc[12344]: SEND SSTP CRTL PKT(14)
Mar 22 13:29:12 sstpc[12344]: TYPE(1): CONNECT REQUEST, ATTR(1):
Mar 22 13:29:12 sstpc[12344]: ENCAP PROTO(1): 6
Mar 22 13:29:12 sstpc[12344]: RECV SSTP CRTL PKT(48)
Mar 22 13:29:12 sstpc[12344]: TYPE(2): CONNECT ACK, ATTR(1):
Mar 22 13:29:12 sstpc[12344]: CRYPTO BIND REQ(4): 40
Mar 22 13:29:12 sstpc[12344]: Started PPP Link Negotiation
Mar 22 13:29:15 sstpc[12344]: Sending Connected Message
Mar 22 13:29:15 sstpc[12344]: SEND SSTP CRTL PKT(112)
Mar 22 13:29:15 sstpc[12344]: TYPE(4): CONNECTED, ATTR(1):
Mar 22 13:29:15 sstpc[12344]: CRYPTO BIND(3): 104
Mar 22 13:29:15 sstpc[12344]: Connection Established

(continues on next page)

8.13. VPN 1023

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

$ ip addr show ppp0
164: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1452 qdisc fq_codel state␣
˓→UNKNOWN group default qlen 3

link/ppp promiscuity 0
inet 100.64.2.2 peer 100.64.1.1/32 scope global ppp0
valid_lft forever preferred_lft forever

Monitoring

show sstp-server sessions

Use this command to locally check the active sessions in the SSTP server.

vyos@vyos:~$ show sstp-server sessions

ifname | username | ip | ip6 | ip6-dp | calling-sid | rate-limit | state | ␣
˓→uptime | rx-bytes | tx-bytes
--------+----------+----------+-----+--------+----------------+------------+--------+----
˓→------+----------+----------

sstp0 | test | 10.0.0.2 | | | 192.168.10.100 | | active |␣

˓→00:15:46 | 16.3 KiB | 210 B

vyos@vyos:~$ show sstp-server statistics

uptime: 0.01:21:54
cpu: 0%
mem(rss/virt): 6688/100464 kB
core:
mempool_allocated: 149420
mempool_available: 146092
thread_count: 1
thread_active: 1
context_count: 6
context_sleeping: 0
context_pending: 0
md_handler_count: 7
md_handler_pending: 0
timer_count: 2
timer_pending: 0
sessions:
starting: 0
active: 1
finishing: 0
sstp:
starting: 0
active: 1

8.13. VPN 1024

 VyOS Documentation, Release 1.5.x (circinus)

Troubleshooting

vyos@vyos:~$sudo journalctl -u accel-ppp@sstp -b 0

Feb 28 17:03:04 vyos accel-sstp[2492]: sstp: new connection from 192.168.10.100:49852

Feb 28 17:03:04 vyos accel-sstp[2492]: sstp: starting
Feb 28 17:03:04 vyos accel-sstp[2492]: sstp: started
Feb 28 17:03:04 vyos accel-sstp[2492]: :: recv [HTTP <SSTP_DUPLEX_POST /sra_{BA195980-
˓→CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1>]

Feb 28 17:03:04 vyos accel-sstp[2492]: :: recv [HTTP <SSTPCORRELATIONID: {48B82435-099A-

˓→4158-A987-052E7570CFAA}>]

Feb 28 17:03:04 vyos accel-sstp[2492]: :: recv [HTTP <Content-Length:␣

˓→18446744073709551615>]

Feb 28 17:03:04 vyos accel-sstp[2492]: :: recv [HTTP <Host: vyos.io>]

Feb 28 17:03:04 vyos accel-sstp[2492]: :: send [HTTP <HTTP/1.1 200 OK>]
Feb 28 17:03:04 vyos accel-sstp[2492]: :: send [HTTP <Date: Wed, 28 Feb 2024 17:03:04␣
˓→GMT>]

Feb 28 17:03:04 vyos accel-sstp[2492]: :: send [HTTP <Content-Length:␣

˓→18446744073709551615>]

Feb 28 17:03:04 vyos accel-sstp[2492]: :: recv [SSTP SSTP_MSG_CALL_CONNECT_REQUEST]

Feb 28 17:03:04 vyos accel-sstp[2492]: :: send [SSTP SSTP_MSG_CALL_CONNECT_ACK]
Feb 28 17:03:04 vyos accel-sstp[2492]: :: lcp_layer_init
Feb 28 17:03:04 vyos accel-sstp[2492]: :: auth_layer_init
Feb 28 17:03:04 vyos accel-sstp[2492]: :: ccp_layer_init
Feb 28 17:03:04 vyos accel-sstp[2492]: :: ipcp_layer_init
Feb 28 17:03:04 vyos accel-sstp[2492]: :: ipv6cp_layer_init
Feb 28 17:03:04 vyos accel-sstp[2492]: :: ppp establishing
Feb 28 17:03:04 vyos accel-sstp[2492]: :: lcp_layer_start
Feb 28 17:03:04 vyos accel-sstp[2492]: :: send [LCP ConfReq id=56 <auth PAP> <mru 1452>
˓→<magic 1cd9ad05>]

Feb 28 17:03:04 vyos accel-sstp[2492]: :: recv [LCP ConfReq id=0 <mru 4091> <magic␣
˓→345f64ca> <pcomp> <accomp> < d 3 6 >]

Feb 28 17:03:04 vyos accel-sstp[2492]: :: send [LCP ConfRej id=0 <pcomp> <accomp> < d 3␣
˓→6 >]

Feb 28 17:03:04 vyos accel-sstp[2492]: :: recv [LCP ConfReq id=1 <mru 4091> <magic␣
˓→345f64ca>]

Feb 28 17:03:04 vyos accel-sstp[2492]: :: send [LCP ConfNak id=1 <mru 1452>]
Feb 28 17:03:04 vyos accel-sstp[2492]: :: recv [LCP ConfReq id=2 <mru 1452> <magic␣
˓→345f64ca>]

Feb 28 17:03:04 vyos accel-sstp[2492]: :: send [LCP ConfAck id=2]

Feb 28 17:03:07 vyos accel-sstp[2492]: :: fsm timeout 9
Feb 28 17:03:07 vyos accel-sstp[2492]: :: send [LCP ConfReq id=56 <auth PAP> <mru 1452>
˓→<magic 1cd9ad05>]

Feb 28 17:03:07 vyos accel-sstp[2492]: :: recv [LCP ConfAck id=56 <auth PAP> <mru 1452>
˓→<magic 1cd9ad05>]

Feb 28 17:03:07 vyos accel-sstp[2492]: :: lcp_layer_started

Feb 28 17:03:07 vyos accel-sstp[2492]: :: auth_layer_start
Feb 28 17:03:07 vyos accel-sstp[2492]: :: recv [LCP Ident id=3 <MSRASV5.20>]
Feb 28 17:03:07 vyos accel-sstp[2492]: :: recv [LCP Ident id=4 <MSRAS-0-MSEDGEWIN10>]
Feb 28 17:03:07 vyos accel-sstp[2492]: [50B blob data]
Feb 28 17:03:07 vyos accel-sstp[2492]: :: recv [PAP AuthReq id=3]
Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: connect: ppp0 <--> sstp(192.168.10.
˓→100:49852)

(continues on next page)

8.13. VPN 1025

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: ppp connected
Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: send [PAP AuthAck id=3 "Authentication␣
˓→succeeded"]

Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: test: authentication succeeded

Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: auth_layer_started
Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: ccp_layer_start
Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: ipcp_layer_start
Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: ipv6cp_layer_start
Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: recv [SSTP SSTP_MSG_CALL_CONNECTED]
Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: IPV6CP: discarding packet
Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: send [LCP ProtoRej id=88 <8057>]
Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: recv [IPCP ConfReq id=7 <addr 0.0.0.0>
˓→<dns1 0.0.0.0> <wins1 0.0.0.0> <dns2 0.0.0.0> <wins2 0.0.0.0>]

Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: send [IPCP ConfReq id=25 <addr 10.0.0.
˓→1>]

Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: send [IPCP ConfRej id=7 <dns1 0.0.0.0>
˓→<wins1 0.0.0.0> <dns2 0.0.0.0> <wins2 0.0.0.0>]

Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: recv [IPCP ConfAck id=25 <addr 10.0.0.
˓→1>]

Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: recv [IPCP ConfReq id=8 <addr 0.0.0.0>]
Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: send [IPCP ConfNak id=8 <addr 10.0.0.5>
˓→]

Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: recv [IPCP ConfReq id=9 <addr 10.0.0.5>
˓→]

Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: send [IPCP ConfAck id=9]

Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: ipcp_layer_started
Feb 28 17:03:07 vyos accel-sstp[2492]: ppp0:test: rename interface to 'sstp0'
Feb 28 17:03:07 vyos accel-sstp[2492]: sstp0:test: sstp: ppp: started

pages to sort

8.13.7 DMVPN

DMVPN (Dynamic Multipoint Virtual Private Network) is a dynamic VPN technology originally developed by Cisco.
While their implementation was somewhat proprietary, the underlying technologies are actually standards based. The
three technologies are:
• NHRP (Next Hop Resolution Protocol) RFC 2332
• mGRE (Multipoint Generic Routing Encapsulation) RFC 1702
• IPSec (IP Security) - too many RFCs to list, but start with RFC 4301
NHRP provides the dynamic tunnel endpoint discovery mechanism (endpoint registration, and endpoint discov-
ery/lookup), mGRE provides the tunnel encapsulation itself, and the IPSec protocols handle the key exchange, and
crypto mechanism.
In short, DMVPN provides the capability for creating a dynamic-mesh VPN network without having to pre-configure
(static) all possible tunnel end-point peers.

Note: DMVPN only automates the tunnel endpoint discovery and setup. A complete solution also incorporates the
use of a routing protocol. BGP is particularly well suited for use with DMVPN.

8.13. VPN 1026

 VyOS Documentation, Release 1.5.x (circinus)

Fig. 6: Baseline DMVPN topology

Configuration

• Please refer to the Tunnel documentation for the individual tunnel related options.
• Please refer to the IPsec documentation for the individual IPSec related options.
set protocols nhrp tunnel <tunnel> cisco-authentication <secret>
Enables Cisco style authentication on NHRP packets. This embeds the secret plaintext password to the outgoing
NHRP packets. Incoming NHRP packets on this interface are discarded unless the secret password is present.
Maximum length of the secret is 8 characters.
set protocols nhrp tunnel <tunnel> dynamic-map <address> nbma-domain-name <fqdn>
Specifies that the NBMA (Non-broadcast multiple-access network) addresses of the next hop servers are defined
in the domain name nbma-domain-name. For each A record opennhrp creates a dynamic NHS entry.
Each dynamic NHS will get a peer entry with the configured network address and the discovered NBMA address.
The first registration request is sent to the protocol broadcast address, and the server’s real protocol address is
dynamically detected from the first registration reply.
set protocols nhrp tunnel <tunnel> holding-time <timeout>
Specifies the holding time for NHRP Registration Requests and Resolution Replies sent from this interface or
shortcut-target. The holdtime is specified in seconds and defaults to two hours.
set protocols nhrp tunnel <tunnel> map cisco
If the statically mapped peer is running Cisco IOS, specify the cisco keyword. It is used to fix statically the
Registration Request ID so that a matching Purge Request can be sent if NBMA address has changed. This is
to work around broken IOS which requires Purge Request ID to match the original Registration Request ID.
set protocols nhrp tunnel <tunnel> map nbma-address <address>
Creates static peer mapping of protocol-address to NBMA address.
If the IP prefix mask is present, it directs opennhrp to use this peer as a next hop server when sending Resolution
Requests matching this subnet.
This is also known as the HUBs IP address or FQDN.
set protocols nhrp tunnel <tunnel> map register
The optional parameter register specifies that Registration Request should be sent to this peer on startup.
This option is required when running a DMVPN spoke.
set protocols nhrp tunnel <tunnel> multicast <dynamic | nhs>

8.13. VPN 1027

 VyOS Documentation, Release 1.5.x (circinus)

Determines how opennhrp daemon should soft switch the multicast traffic. Currently, multicast traffic is captured
by opennhrp daemon using a packet socket, and resent back to proper destinations. This means that multicast
packet sending is CPU intensive.
Specfying nhs makes all multicast packets to be repeated to each statically configured next hop.
Synamic instructs to forward to all peers which we have a direct connection with. Alternatively, you can specify
the directive multiple times for each protocol-address the multicast traffic should be sent to.

Warning: It is very easy to misconfigure multicast repeating if you have multiple NHSes.

set protocols nhrp tunnel <tunnel> non-caching

Disables caching of peer information from forwarded NHRP Resolution Reply packets. This can be
used to reduce memory consumption on big NBMA subnets.

Note: Currently does not do much as caching is not implemented.

set protocols nhrp tunnel <tunnel> redirect

Enable sending of Cisco style NHRP Traffic Indication packets. If this is enabled and opennhrp detects a for-
warded packet, it will send a message to the original sender of the packet instructing it to create a direct con-
nection with the destination. This is basically a protocol independent equivalent of ICMP redirect.
set protocols nhrp tunnel <tunnel> shortcut
Enable creation of shortcut routes.
A received NHRP Traffic Indication will trigger the resolution and establishment of a shortcut route.
set protocols nhrp tunnel <tunnel> shortcut-destination
This instructs opennhrp to reply with authorative answers on NHRP Resolution Requests destinied to addresses
in this interface (instead of forwarding the packets). This effectively allows the creation of shortcut routes to
subnets located on the interface.
When specified, this should be the only keyword for the interface.
set protocols nhrp tunnel <tunnel> shortcut-target <address>
Defines an off-NBMA network prefix for which the GRE interface will act as a gateway. This an alternative to
defining local interfaces with shortcut-destination flag.
set protocols nhrp tunnel <tunnel> shortcut-target <address> holding-time <timeout>
Specifies the holding time for NHRP Registration Requests and Resolution Replies sent from this interface or
shortcut-target. The holdtime is specified in seconds and defaults to two hours.

Example

This blueprint uses VyOS as the DMVPN Hub and Cisco (7206VXR) and VyOS as multiple spoke sites. The lab was
build using EVE-NG (Emulated Virtual Environment NG).
Each node (Hub and Spoke) uses an IP address from the network 172.16.253.128/29.
The below referenced IP address 192.0.2.1 is used as example address representing a global unicast address under
which the HUB can be contacted by each and every individual spoke.

8.13. VPN 1028

 VyOS Documentation, Release 1.5.x (circinus)

Fig. 7: DMVPN example network

Configuration

Hub

set interfaces ethernet eth0 address 192.0.2.1/24

set interfaces tunnel tun100 address '172.16.253.134/29'

set interfaces tunnel tun100 encapsulation 'gre'
set interfaces tunnel tun100 source-address '192.0.2.1'
set interfaces tunnel tun100 enable-multicast
set interfaces tunnel tun100 parameters ip key '1'

set protocols nhrp tunnel tun100 cisco-authentication 'secret'

set protocols nhrp tunnel tun100 holding-time '300'
set protocols nhrp tunnel tun100 multicast 'dynamic'
set protocols nhrp tunnel tun100 redirect
set protocols nhrp tunnel tun100 shortcut

set vpn ipsec esp-group ESP-HUB lifetime '1800'

set vpn ipsec esp-group ESP-HUB mode 'transport'
set vpn ipsec esp-group ESP-HUB pfs 'dh-group2'
set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1'
set vpn ipsec esp-group ESP-HUB proposal 2 encryption '3des'
set vpn ipsec esp-group ESP-HUB proposal 2 hash 'md5'
set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1'
set vpn ipsec ike-group IKE-HUB lifetime '3600'
(continues on next page)

8.13. VPN 1029

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2'
set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1'
set vpn ipsec ike-group IKE-HUB proposal 2 dh-group '2'
set vpn ipsec ike-group IKE-HUB proposal 2 encryption 'aes128'
set vpn ipsec ike-group IKE-HUB proposal 2 hash 'sha1'

set vpn ipsec interface 'eth0'

set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret'

set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret'
set vpn ipsec profile NHRPVPN bind tunnel 'tun100'
set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB'
set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB'

Note: Setting this up on AWS will require a “Custom Protocol Rule” for protocol number “47” (GRE) Allow Rule in
TWO places. Firstly on the VPC Network ACL, and secondly on the security group network ACL attached to the EC2
instance. This has been tested as working for the official AMI image on the AWS Marketplace. (Locate the correct
VPC and security group by navigating through the details pane below your EC2 instance in the AWS console).

Spoke

The individual spoke configurations only differ in the local IP address on the tun10 interface. See the above diagram
for the individual IP addresses.

spoke01-spoke04

crypto keyring DMVPN

pre-shared-key address 192.0.2.1 key secret
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
crypto isakmp invalid-spi-recovery
crypto isakmp keepalive 30 30 periodic
crypto isakmp profile DMVPN
keyring DMVPN
match identity address 192.0.2.1 255.255.255.255
!
crypto ipsec transform-set DMVPN-AES256 esp-aes 256 esp-sha-hmac
mode transport
!
crypto ipsec profile DMVPN
set security-association idle-time 720
set transform-set DMVPN-AES256
set isakmp-profile DMVPN
!
(continues on next page)

8.13. VPN 1030

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

interface Tunnel10
! individual spoke tunnel IP must change
ip address 172.16.253.129 255.255.255.248
no ip redirects
ip nhrp authentication secret
ip nhrp map 172.16.253.134 192.0.2.1
ip nhrp map multicast 192.0.2.1
ip nhrp network-id 1
ip nhrp holdtime 600
ip nhrp nhs 172.16.253.134
ip nhrp registration timeout 75
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel protection ipsec profile DMVPN
tunnel key 1
!
interface FastEthernet0/0
ip address dhcp
duplex half

spoke05

VyOS can also run in DMVPN spoke mode.

set interfaces ethernet eth0 address 'dhcp'

set interfaces tunnel tun100 address '172.16.253.133/29'

set interfaces tunnel tun100 source-address 0.0.0.0
set interfaces tunnel tun100 encapsulation 'gre'
set interfaces tunnel tun100 enable-multicast
set interfaces tunnel tun100 parameters ip key '1'

set protocols nhrp tunnel tun100 cisco-authentication 'secret'

set protocols nhrp tunnel tun100 holding-time '300'
set protocols nhrp tunnel tun100 map 172.16.253.134/29 nbma-address '192.0.2.1'
set protocols nhrp tunnel tun100 map 172.16.253.134/29 register
set protocols nhrp tunnel tun100 multicast 'nhs'
set protocols nhrp tunnel tun100 redirect
set protocols nhrp tunnel tun100 shortcut

set vpn ipsec esp-group ESP-HUB lifetime '1800'

set vpn ipsec esp-group ESP-HUB mode 'transport'
set vpn ipsec esp-group ESP-HUB pfs 'dh-group2'
set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1'
set vpn ipsec esp-group ESP-HUB proposal 2 encryption '3des'
set vpn ipsec esp-group ESP-HUB proposal 2 hash 'md5'
set vpn ipsec ike-group IKE-HUB close-action 'none'
set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1'
set vpn ipsec ike-group IKE-HUB lifetime '3600'
set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2'
(continues on next page)

8.13. VPN 1031

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1'
set vpn ipsec ike-group IKE-HUB proposal 2 dh-group '2'
set vpn ipsec ike-group IKE-HUB proposal 2 encryption 'aes128'
set vpn ipsec ike-group IKE-HUB proposal 2 hash 'sha1'

set vpn ipsec interface 'eth0'

set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret'

set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret'
set vpn ipsec profile NHRPVPN bind tunnel 'tun100'
set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB'
set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB'

8.13.8 Site-to-Site

Site-to-site mode provides a way to add remote peers, which could be configured to exchange encrypted information
between them and VyOS itself or connected/routed networks.
To configure site-to-site connection you need to add peers with the set vpn ipsec site-to-site peer <name>
command.
The peer name must be an alphanumeric and can have hypen or underscore as special characters. It is purely informa-
tional.
Each site-to-site peer has the next options:
• authentication - configure authentication between VyOS and a remote peer. If pre-shared-secret mode is
used, the secret key must be defined in set vpn ipsec authentication and suboptions:
• psk - Preshared secret key name:
• dhcp-interface - ID for authentication generated from DHCP address dynamically;
• id - static ID’s for authentication. In general local and remote address <x.x.x.x>,
<h:h:h:h:h:h:h:h> or %any;
• secret - predefined shared secret. Used if configured mode pre-shared-secret;
• local-id - ID for the local VyOS router. If defined, during the authentication it will be send to
remote peer;
• mode - mode for authentication between VyOS and remote peer:
• pre-shared-secret - use predefined shared secret phrase;
• rsa - use simple shared RSA key.
• x509 - use certificates infrastructure for authentication.
• remote-id - define an ID for remote peer, instead of using peer name or address. Useful in case if
the remote peer is behind NAT or if mode x509 is used;
• rsa - options for RSA authentication mode:
• local-key - name of PKI key-pair with local private key
• remote-key - name of PKI key-pair with remote public key
• passphrase - local private key passphrase

8.13. VPN 1032

 VyOS Documentation, Release 1.5.x (circinus)

• use-x509-id - use local ID from x509 certificate. Cannot be used when id is defined;
• x509 - options for x509 authentication mode:
• ca-certificate - CA certificate in PKI configuration. Using for authenticating remote peer;
• certificate - certificate file in PKI configuration, which will be used for authenticating local router
on remote peer;
• passphrase - private key passphrase, if needed.
• connection-type - how to handle this connection process. Possible variants:
• initiate - does initial connection to remote peer immediately after configuring and after boot. In this mode
the connection will not be restarted in case of disconnection, therefore should be used only together with DPD
or another session tracking methods;
• respond - does not try to initiate a connection to a remote peer. In this mode, the IPSec session will be established
only after initiation from a remote peer. Could be useful when there is no direct connectivity to the peer due to
firewall or NAT in the middle of the local and remote side.
• none - loads the connection only, which then can be manually initiated or used as a responder configuration.
• default-esp-group - ESP group to use by default for traffic encryption. Might be overwritten by individual
settings for tunnel or VTI interface binding;
• description - description for this peer;
• dhcp-interface - use an IP address, received from DHCP for IPSec connection with this peer, instead of
local-address;
• force-udp-encapsulation - force encapsulation of ESP into UDP datagrams. Useful in case if between local
and remote side is firewall or NAT, which not allows passing plain ESP packets between them;
• ike-group - IKE group to use for key exchanges;
• ikev2-reauth - reauthenticate remote peer during the rekeying process. Can be used only with IKEv2. Create
a new IKE_SA from the scratch and try to recreate all IPsec SAs;
• local-address - local IP address for IPSec connection with this peer. If defined any, then an IP address which
configured on interface with default route will be used;
• remote-address - remote IP address or hostname for IPSec connection. IPv4 or IPv6 address is used when a
peer has a public static IP address. Hostname is a DNS name which could be used when a peer has a public IP
address and DNS name, but an IP address could be changed from time to time.
• replay-window - IPsec replay window to configure for this CHILD_SA (default: 32), a value of 0 disables
IPsec replay protection
• tunnel - define criteria for traffic to be matched for encrypting and send it to a peer:
• disable - disable this tunnel;
• esp-group - define ESP group for encrypt traffic, defined by this tunnel;
• local - define a local source for match traffic, which should be encrypted and send to this peer:
• port - define port. Have effect only when used together with prefix;
• prefix - IP network at local side.
• priority - Add priority for policy-based IPSec VPN tunnels(lowest value more preferable)
• protocol - define the protocol for match traffic, which should be encrypted and send to this peer;
• remote - define the remote destination for match traffic, which should be encrypted and send to this
peer:

8.13. VPN 1033

 VyOS Documentation, Release 1.5.x (circinus)

• port - define port. Have effect only when used together with prefix;
• prefix - IP network at remote side.
• vti - use a VTI interface for traffic encryption. Any traffic, which will be send to VTI interface will be encrypted
and send to this peer. Using VTI makes IPSec configuration much flexible and easier in complex situation, and
allows to dynamically add/delete remote networks, reachable via a peer, as in this mode router don’t need to
create additional SA/policy for each remote network:
• bind - select a VTI interface to bind to this peer;
• esp-group - define ESP group for encrypt traffic, passed this VTI interface.
• virtual-address - Defines a virtual IP address which is requested by the initiator and one or several IPv4
and/or IPv6 addresses are assigned from multiple pools by the responder.

Examples:

IKEv1

Example:
• WAN interface on eth1
• left subnet: 192.168.0.0/24 site1, server side (i.e. locality, actually there is no client or server roles)
• left local_ip: 198.51.100.3 # server side WAN IP
• right subnet: 10.0.0.0/24 site2,remote office side
• right local_ip: 203.0.113.2 # remote office side WAN IP

# server config
set vpn ipsec authentication psk OFFICE-B id '198.51.100.3'
set vpn ipsec authentication psk OFFICE-B id '203.0.113.2'
set vpn ipsec authentication psk OFFICE-B secret 'SomePreSharedKey'
set vpn ipsec esp-group office-srv-esp lifetime '1800'
set vpn ipsec esp-group office-srv-esp mode 'tunnel'
set vpn ipsec esp-group office-srv-esp pfs 'enable'
set vpn ipsec esp-group office-srv-esp proposal 1 encryption 'aes256'
set vpn ipsec esp-group office-srv-esp proposal 1 hash 'sha1'
set vpn ipsec ike-group office-srv-ike key-exchange 'ikev1'
set vpn ipsec ike-group office-srv-ike lifetime '3600'
set vpn ipsec ike-group office-srv-ike proposal 1 encryption 'aes256'
set vpn ipsec ike-group office-srv-ike proposal 1 hash 'sha1'
set vpn ipsec interface 'eth1'
set vpn ipsec site-to-site peer OFFICE-B authentication local-id '198.51.100.3'
set vpn ipsec site-to-site peer OFFICE-B authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer OFFICE-B authentication remote-id '203.0.113.2'
set vpn ipsec site-to-site peer OFFICE-B ike-group 'office-srv-ike'
set vpn ipsec site-to-site peer OFFICE-B local-address '198.51.100.3'
set vpn ipsec site-to-site peer OFFICE-B remote-address '203.0.113.2'
set vpn ipsec site-to-site peer OFFICE-B tunnel 0 esp-group 'office-srv-esp'
set vpn ipsec site-to-site peer OFFICE-B tunnel 0 local prefix '192.168.0.0/24'
set vpn ipsec site-to-site peer OFFICE-B tunnel 0 remote prefix '10.0.0.0/21'

# remote office config

(continues on next page)

8.13. VPN 1034

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set vpn ipsec authentication psk OFFICE-A id '198.51.100.3'
set vpn ipsec authentication psk OFFICE-A id '203.0.113.2'
set vpn ipsec authentication psk OFFICE-A secret 'SomePreSharedKey'
set vpn ipsec esp-group office-srv-esp lifetime '1800'
set vpn ipsec esp-group office-srv-esp mode 'tunnel'
set vpn ipsec esp-group office-srv-esp pfs 'enable'
set vpn ipsec esp-group office-srv-esp proposal 1 encryption 'aes256'
set vpn ipsec esp-group office-srv-esp proposal 1 hash 'sha1'
set vpn ipsec ike-group office-srv-ike key-exchange 'ikev1'
set vpn ipsec ike-group office-srv-ike lifetime '3600'
set vpn ipsec ike-group office-srv-ike proposal 1 encryption 'aes256'
set vpn ipsec ike-group office-srv-ike proposal 1 hash 'sha1'
set vpn ipsec interface 'eth1'
set vpn ipsec site-to-site peer OFFICE-A authentication local-id '203.0.113.2'
set vpn ipsec site-to-site peer OFFICE-A authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer OFFICE-A authentication remote-id '198.51.100.3'
set vpn ipsec site-to-site peer OFFICE-A ike-group 'office-srv-ike'
set vpn ipsec site-to-site peer OFFICE-A local-address '203.0.113.2'
set vpn ipsec site-to-site peer OFFICE-A remote-address '198.51.100.3'
set vpn ipsec site-to-site peer OFFICE-A tunnel 0 esp-group 'office-srv-esp'
set vpn ipsec site-to-site peer OFFICE-A tunnel 0 local prefix '10.0.0.0/21'
set vpn ipsec site-to-site peer OFFICE-A tunnel 0 remote prefix '192.168.0.0/24'

Show status of new setup:

vyos@srv-gw0:~$ show vpn ike sa

Peer ID / IP Local ID / IP
------------ -------------
203.0.113.2 198.51.100.3
State Encrypt Hash D-H Grp NAT-T A-Time L-Time
----- ------- ---- ------- ----- ------ ------
up aes256 sha1 5 no 734 3600

vyos@srv-gw0:~$ show vpn ipsec sa

Peer ID / IP Local ID / IP
------------ -------------
203.0.113.2 198.51.100.3
Tunnel State Bytes Out/In Encrypt Hash NAT-T A-Time L-Time Proto
------ ----- ------------- ------- ---- ----- ------ ------ -----
0 up 7.5M/230.6K aes256 sha1 no 567 1800 all

If there is SNAT rules on eth1, need to add exclude rule

# server side
set nat source rule 10 destination address '10.0.0.0/24'
set nat source rule 10 'exclude'
set nat source rule 10 outbound-interface name 'eth1'
set nat source rule 10 source address '192.168.0.0/24'

# remote office side

set nat source rule 10 destination address '192.168.0.0/24'
set nat source rule 10 'exclude'
(continues on next page)

8.13. VPN 1035

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set nat source rule 10 outbound-interface name 'eth1'
set nat source rule 10 source address '10.0.0.0/24'

To allow traffic to pass through to clients, you need to add the following rules. (if you used the default configuration at
the top of this page)

# server side
set firewall name OUTSIDE-LOCAL rule 32 action 'accept'
set firewall name OUTSIDE-LOCAL rule 32 source address '10.0.0.0/24'

# remote office side

set firewall name OUTSIDE-LOCAL rule 32 action 'accept'
set firewall name OUTSIDE-LOCAL rule 32 source address '192.168.0.0/24'

IKEv2

Example:
• left local_ip: 192.168.0.10 # VPN Gateway, behind NAT device
• left public_ip:172.18.201.10
• right local_ip: 172.18.202.10 # right side WAN IP
Imagine the following topology

Fig. 8: IPSec IKEv2 site2site VPN (source ./draw.io/vpn_s2s_ikev2.drawio)

8.13. VPN 1036

 VyOS Documentation, Release 1.5.x (circinus)

LEFT: * WAN interface on eth0.201 * eth0.201 interface IP: 172.18.201.10/24 * vti10 interface IP: 10.0.0.2/31 * dum0
interface IP: 10.0.11.1/24 (for testing purposes)
RIGHT: * WAN interface on eth0.202 * eth0.201 interface IP: 172.18.202.10/24 * vti10 interface IP: 10.0.0.3/31 *
dum0 interface IP: 10.0.12.1/24 (for testing purposes)

Note: Don’t get confused about the used /31 tunnel subnet. RFC 3021 gives you additional information for using /31
subnets on point-to-point links.

LEFT

set interfaces ethernet eth0 vif 201 address '172.18.201.10/24'

set interfaces dummy dum0 address '10.0.11.1/24'
set interfaces vti vti10 address '10.0.0.2/31'

set vpn ipsec authentication psk peer_172-18-202-10 id '172.18.201.10'

set vpn ipsec authentication psk peer_172-18-202-10 id '172.18.202.10'
set vpn ipsec authentication psk peer_172-18-202-10 secret 'secretkey'
set vpn ipsec esp-group ESP_DEFAULT lifetime '3600'
set vpn ipsec esp-group ESP_DEFAULT mode 'tunnel'
set vpn ipsec esp-group ESP_DEFAULT pfs 'dh-group19'
set vpn ipsec esp-group ESP_DEFAULT proposal 10 encryption 'aes256gcm128'
set vpn ipsec esp-group ESP_DEFAULT proposal 10 hash 'sha256'
set vpn ipsec ike-group IKEv2_DEFAULT close-action 'none'
set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection action 'trap'
set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection interval '30'
set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection timeout '120'
set vpn ipsec ike-group IKEv2_DEFAULT disable-mobike
set vpn ipsec ike-group IKEv2_DEFAULT key-exchange 'ikev2'
set vpn ipsec ike-group IKEv2_DEFAULT lifetime '10800'
set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 dh-group '19'
set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 encryption 'aes256gcm128'
set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 hash 'sha256'
set vpn ipsec interface 'eth0.201'
set vpn ipsec site-to-site peer peer_172-18-202-10 authentication local-id '172.18.201.10
˓→'

set vpn ipsec site-to-site peer peer_172-18-202-10 authentication mode 'pre-shared-secret

˓→'

set vpn ipsec site-to-site peer peer_172-18-202-10 authentication remote-id '172.18.202.

˓→10'

set vpn ipsec site-to-site peer peer_172-18-202-10 connection-type 'initiate'

set vpn ipsec site-to-site peer peer_172-18-202-10 ike-group 'IKEv2_DEFAULT'
set vpn ipsec site-to-site peer peer_172-18-202-10 ikev2-reauth 'inherit'
set vpn ipsec site-to-site peer peer_172-18-202-10 local-address '172.18.201.10'
set vpn ipsec site-to-site peer peer_172-18-202-10 remote-address '172.18.202.10'
set vpn ipsec site-to-site peer peer_172-18-202-10 vti bind 'vti10'
set vpn ipsec site-to-site peer peer_172-18-202-10 vti esp-group 'ESP_DEFAULT'

set protocols static interface-route 10.0.12.0/24 next-hop-interface vti10

RIGHT

set interfaces ethernet eth0 vif 202 address '172.18.202.10/24'

(continues on next page)

8.13. VPN 1037

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set interfaces dummy dum0 address '10.0.12.1/24'
set interfaces vti vti10 address '10.0.0.3/31'

set vpn ipsec authentication psk peer_172-18-201-10 id '172.18.202.10'

set vpn ipsec authentication psk peer_172-18-201-10 id '172.18.201.10'
set vpn ipsec authentication psk peer_172-18-201-10 secret 'secretkey'
set vpn ipsec esp-group ESP_DEFAULT lifetime '3600'
set vpn ipsec esp-group ESP_DEFAULT mode 'tunnel'
set vpn ipsec esp-group ESP_DEFAULT pfs 'dh-group19'
set vpn ipsec esp-group ESP_DEFAULT proposal 10 encryption 'aes256gcm128'
set vpn ipsec esp-group ESP_DEFAULT proposal 10 hash 'sha256'
set vpn ipsec ike-group IKEv2_DEFAULT close-action 'none'
set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection action 'trap'
set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection interval '30'
set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection timeout '120'
set vpn ipsec ike-group IKEv2_DEFAULT disable-mobike
set vpn ipsec ike-group IKEv2_DEFAULT key-exchange 'ikev2'
set vpn ipsec ike-group IKEv2_DEFAULT lifetime '10800'
set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 dh-group '19'
set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 encryption 'aes256gcm128'
set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 hash 'sha256'
set vpn ipsec interface 'eth0.202'
set vpn ipsec site-to-site peer peer_172-18-201-10 authentication local-id '172.18.202.10
˓→'

set vpn ipsec site-to-site peer peer_172-18-201-10 authentication mode 'pre-shared-secret

˓→'

set vpn ipsec site-to-site peer peer_172-18-201-10 authentication remote-id '172.18.201.

˓→10'

set vpn ipsec site-to-site peer peer_172-18-201-10 connection-type 'initiate'

set vpn ipsec site-to-site peer peer_172-18-201-10 ike-group 'IKEv2_DEFAULT'
set vpn ipsec site-to-site peer peer_172-18-201-10 ikev2-reauth 'inherit'
set vpn ipsec site-to-site peer peer_172-18-201-10 local-address '172.18.202.10'
set vpn ipsec site-to-site peer peer_172-18-201-10 remote-address '172.18.201.10'
set vpn ipsec site-to-site peer peer_172-18-201-10 vti bind 'vti10'
set vpn ipsec site-to-site peer peer_172-18-201-10 vti esp-group 'ESP_DEFAULT'

set protocols static interface-route 10.0.11.0/24 next-hop-interface vti10

Key Parameters:
• authentication local-id/remote-id - IKE identification is used for validation of VPN peer devices during
IKE negotiation. If you do not configure local/remote-identity, the device uses the IPv4 or IPv6 address that
corresponds to the local/remote peer by default. In certain network setups (like ipsec interface with dynamic
address, or behind the NAT ), the IKE ID received from the peer does not match the IKE gateway configured on
the device. This can lead to a Phase 1 validation failure. So, make sure to configure the local/remote id explicitly
and ensure that the IKE ID is the same as the remote-identity configured on the peer device.
• disable-route-autoinstall - This option when configured disables the routes installed in the default table
220 for site-to-site ipsec. It is mostly used with VTI configuration.
• dead-peer-detection action = clear | trap | restart - R_U_THERE notification mes-
sages(IKEv1) or empty INFORMATIONAL messages (IKEv2) are periodically sent in order to check
the liveliness of the IPsec peer. The values clear, trap, and restart all activate DPD and determine the action
to perform on a timeout. With clear the connection is closed with no further actions taken. trap installs a

8.13. VPN 1038

 VyOS Documentation, Release 1.5.x (circinus)

trap policy, which will catch matching traffic and tries to re-negotiate the connection on demand. restart will
immediately trigger an attempt to re-negotiate the connection.
• close-action = none | clear | trap | start - defines the action to take if the remote peer unexpect-
edly closes a CHILD_SA (see above for meaning of values). A closeaction should not be used if the peer uses
reauthentication or uniqueids.
When the close-action option is set on the peers, the connection-type of each peer has to considered carefully.
For example, if the option is set on both peers, then both would attempt to initiate and hold open multiple copies
of each child SA. This might lead to instability of the device or cpu/memory utilization.
Below flow-chart could be a quick reference for the close-action combination depending on how the peer is
configured.

Fig. 9: Similar combinations are applicable for the dead-peer-detection.

8.13.9 IPSec IKEv2 Remote Access VPN

Internet Key Exchange version 2 (IKEv2) is a tunneling protocol, based on IPsec, that establishes a secure VPN com-
munication between VPN devices, and defines negotiation and authentication processes for IPsec security associations
(SAs). It is often known as IKEv2/IPSec or IPSec IKEv2 remote-access — or road-warriors as others call it.
Key exchange and payload encryption is done using IKE and ESP proposals as known from IKEv1 but the connections
are faster to establish, more reliable, and also support roaming from IP to IP (called MOBIKE which makes sure your
connection does not drop when changing networks from e.g. WIFI to LTE and back). Authentication can be achieved
with X.509 certificates.

8.13. VPN 1039

 VyOS Documentation, Release 1.5.x (circinus)

Setting up certificates:

First of all, we need to create a CA root certificate and server certificate on the server side.

[email protected]# run generate pki ca install ca_root

Enter private key type: [rsa, dsa, ec] (Default: rsa)
Enter private key bits: (Default: 2048)
Enter country code: (Default: GB)
Enter state: (Default: Some-State)
Enter locality: (Default: Some-City)
Enter organization name: (Default: VyOS)
Enter common name: (Default: vyos.io)
Enter how many days certificate will be valid: (Default: 1825)
Note: If you plan to use the generated key on this router, do not encrypt the private␣
˓→key.

Do you want to encrypt the private key with a passphrase? [y/N] N

2 value(s) installed. Use "compare" to see the pending changes, and "commit" to apply.
[edit]

[email protected]# comp
[pki ca]
+ ca_root {
+ certificate "MIIDnTCCAoWgAwI...."
+ private {
+ key "MIIEvAIBADANBgkqhkiG9....”

[email protected]# run generate pki certificate sign ca_root install server_cert

Do you already have a certificate request? [y/N] N
Enter private key type: [rsa, dsa, ec] (Default: rsa)
Enter private key bits: (Default: 2048)
Enter country code: (Default: GB)
Enter state: (Default: Some-State)
Enter locality: (Default: Some-City)
Enter organization name: (Default: VyOS)
Enter common name: (Default: vyos.io) vpn.vyos.net
Do you want to configure Subject Alternative Names? [y/N] N
Enter how many days certificate will be valid: (Default: 365)
Enter certificate type: (client, server) (Default: server)
Note: If you plan to use the generated key on this router, do not encrypt the private␣
˓→key.

Do you want to encrypt the private key with a passphrase? [y/N] N

2 value(s) installed. Use "compare" to see the pending changes, and "commit" to apply.

[email protected]# comp
[pki certificate]
+ server_cert {
+ certificate "MIIDuzCCAqOgAwIBAgIUaSrCPWx........."
+ private {
+ key "MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBK....."
+ }
+ }

Once the command is completed, it will add the certificate to the configuration session, to the pki subtree. You can

8.13. VPN 1040

 VyOS Documentation, Release 1.5.x (circinus)

then review the proposed changes and commit them.

Setting up IPSec:

After the PKI certs are all set up we can start configuring our IPSec/IKE proposals used for key-exchange end data
encryption. The used encryption ciphers and integrity algorithms vary from operating system to operating system. The
ones used in this example are validated to work on Windows 10.

set vpn ipsec esp-group ESP-RW lifetime '3600'

set vpn ipsec esp-group ESP-RW pfs 'disable'
set vpn ipsec esp-group ESP-RW proposal 10 encryption 'aes128gcm128'
set vpn ipsec esp-group ESP-RW proposal 10 hash 'sha256'

set vpn ipsec ike-group IKE-RW key-exchange 'ikev2'

set vpn ipsec ike-group IKE-RW lifetime '7200'
set vpn ipsec ike-group IKE-RW proposal 10 dh-group '14'
set vpn ipsec ike-group IKE-RW proposal 10 encryption 'aes128gcm128'
set vpn ipsec ike-group IKE-RW proposal 10 hash 'sha256'

Every connection/remote-access pool we configure also needs a pool where we can draw our client IP addresses from.
We provide one IPv4 and IPv6 pool. Authorized clients will receive an IPv4 address from the configured IPv4 prefix
and an IPv6 address from the IPv6 prefix. We can also send some DNS nameservers down to our clients used on their
connection.

set vpn ipsec remote-access pool ra-rw-ipv4 name-server '192.0.2.1'

set vpn ipsec remote-access pool ra-rw-ipv4 prefix '192.0.2.128/25'

set vpn ipsec remote-access pool ra-rw-ipv6 name-server '2001:db8:1000::1'

set vpn ipsec remote-access pool ra-rw-ipv6 prefix '2001:db8:2000::/64'

Setting up tunnel:

set vpn ipsec remote-access connection rw authentication local-id '192.0.2.1'

set vpn ipsec remote-access connection rw authentication server-mode 'x509'
set vpn ipsec remote-access connection rw authentication x509 ca-certificate 'ca_root'
set vpn ipsec remote-access connection rw authentication x509 certificate 'server_cert'
set vpn ipsec remote-access connection rw esp-group 'ESP-RW'
set vpn ipsec remote-access connection rw ike-group 'IKE-RW'
set vpn ipsec remote-access connection rw local-address '192.0.2.1'
set vpn ipsec remote-access connection rw pool 'ra-rw-ipv4'
set vpn ipsec remote-access connection rw pool 'ra-rw-ipv6'

VyOS also supports two different modes of authentication, local and RADIUS. To create a new local user named “vyos”
with a password of “vyos” use the following commands.

set vpn ipsec remote-access connection rw authentication client-mode 'eap-mschapv2'

set vpn ipsec remote-access connection rw authentication local-users username vyos␣
˓→password 'vyos'

8.13. VPN 1041

 VyOS Documentation, Release 1.5.x (circinus)

Client Configuration

Most operating systems include native client support for IPsec IKEv2 VPN connections, and others typically have an
app or add-on package which adds the capability. This section covers IPsec IKEv2 client configuration for Windows
10.
VyOS provides a command to generate a connection profile used by Windows clients that will connect to the “rw”
connection on our VyOS server.

Note: Windows expects the server name to be also used in the server’s certificate common name, so it’s best to use
this DNS name for your VPN connection.

[email protected]:~$ generate ipsec profile windows-remote-access rw remote vpn.vyos.net

==== <snip> ====

Add-VpnConnection -Name "VyOS IKEv2 VPN" -ServerAddress "vpn.vyos.net" -TunnelType "Ikev2
˓→"

Set-VpnConnectionIPsecConfiguration -ConnectionName "VyOS IKEv2 VPN" -

˓→AuthenticationTransformConstants GCMAES128 -CipherTransformConstants

GCMAES128 -EncryptionMethod GCMAES128 -IntegrityCheckMethod SHA256128 -PfsGroup None -

˓→DHGroup "Group14" -PassThru -Force

==== </snip> ====

Add the commands from Snippet in the Windows side via PowerShell. Also import the root CA cert to the Windows
“Trusted Root Certification Authorities” and establish the connection.

Verification:

[email protected]:~$ show vpn ipsec remote-access summary

Connection ID Username Protocol State Uptime Tunnel IP Remote Host ␣
˓→Remote ID IKE Proposal IPSec Proposal
--------------- ---------- ---------- ------- -------- ----------- ------------- -
˓→---------- ------------------------------------------ ------------------
5 vyos IKEv2 UP 37s 192.0.2.129 10.0.0.2 ␣
˓→10.0.0.2 AES_GCM_16-128/PRF_HMAC_SHA2_256/MODP_2048 ESP:AES_GCM_16-128

8.14 VRF

VRF devices combined with ip rules provides the ability to create virtual routing and forwarding domains (aka VRFs,
VRF-lite to be specific) in the Linux network stack. One use case is the multi-tenancy problem where each tenant has
their own unique routing tables and in the very least need different default gateways.

8.14. VRF 1042

 VyOS Documentation, Release 1.5.x (circinus)

8.14.1 Configuration

A VRF device is created with an associated route table. Network interfaces are then enslaved to a VRF device.
set vrf name <name>
Create new VRF instance with <name>. The name is used when placing individual interfaces into the VRF.
set vrf name <name> table <id>
Configured routing table <id> is used by VRF <name>.

Note: A routing table ID can not be modified once it is assigned. It can only be changed by deleting and
re-adding the VRF instance.

set vrf bind-to-all

By default the scope of the port bindings for unbound sockets is limited to the default VRF. That is, it will not
be matched by packets arriving on interfaces enslaved to a VRF and processes may bind to the same port if they
bind to a VRF.
TCP & UDP services running in the default VRF context (ie., not bound to any VRF device) can work across
all VRF domains by enabling this option.

Zebra/Kernel route filtering

Zebra supports prefix-lists and Route Maps to match routes received from other FRR components. The permit/deny
facilities provided by these commands can be used to filter which routes zebra will install in the kernel.
set vrf <name> ip protocol <protocol> route-map <route-map>
Apply a route-map filter to routes for the specified protocol.
The following protocols can be used: any, babel, bgp, connected, eigrp, isis, kernel, ospf, rip, static, table

Note: If you choose any as the option that will cause all protocols that are sending routes to zebra.

set vrf <name> ipv6 protocol <protocol> route-map <route-map>

Apply a route-map filter to routes for the specified protocol.
The following protocols can be used: any, babel, bgp, connected, isis, kernel, ospfv3, ripng, static, table

Note: If you choose any as the option that will cause all protocols that are sending routes to zebra.

8.14. VRF 1043

 VyOS Documentation, Release 1.5.x (circinus)

Nexthop Tracking

Nexthop tracking resolve nexthops via the default route by default. This is enabled by default for a traditional profile
of FRR which we use. It and can be disabled if you do not want to e.g. allow BGP to peer across the default route.
set vrf name <name> ip nht no-resolve-via-default
Do not allow IPv4 nexthop tracking to resolve via the default route. This parameter is configured per-VRF, so
the command is also available in the VRF subnode.
set vrf name <name> ipv6 nht no-resolve-via-default
Do not allow IPv4 nexthop tracking to resolve via the default route. This parameter is configured per-VRF, so
the command is also available in the VRF subnode.

Interfaces

When VRFs are used it is not only mandatory to create a VRF but also the VRF itself needs to be assigned to an
interface.
set interfaces <dummy | ethernet | bonding | bridge | pppoe> <interface> vrf <name>
Assign interface identified by <interface> to VRF named <name>.

Routing

Note: VyOS 1.4 (sagitta) introduced dynamic routing support for VRFs.

Currently dynamic routing is supported for the following protocols:

• BGP
• IS-IS
• OSPF
• OSPFv3 (IPv6)
• Static
The CLI configuration is same as mentioned in above articles. The only difference is, that each routing protocol used,
must be prefixed with the vrf name <name> command.

Example

The following commands would be required to set options for a given dynamic routing protocol inside a given vrf:
• BGP: set vrf name <name> protocols bgp ...
• IS-IS: set vrf name <name> protocols isis ...
• OSPF: set vrf name <name> protocols ospf ...
• OSPFv3 (IPv6): set vrf name <name> protocols ospfv3 ...
• Static: set vrf name <name> protocols static ...

8.14. VRF 1044

 VyOS Documentation, Release 1.5.x (circinus)

8.14.2 Operation

It is not sufficient to only configure a VRF but VRFs must be maintained, too. For VRF maintenance the following
operational commands are in place.
show vrf
Lists VRFs that have been created

vyos@vyos:~$ show vrf

VRF name state mac address flags interfaces
-------- ----- ----------- ----- ----------
blue up 00:53:12:d8:74:24 noarp,master,up,lower_up dum200,
˓→eth0.302

red up 00:53:de:02:df:aa noarp,master,up,lower_up dum100,

˓→eth0.300,bond0.100,peth0

Note: Command should probably be extended to list also the real interfaces assigned to this one VRF to get a
better overview.

show vrf <name>

vyos@vyos:~$ show vrf name blue

VRF name state mac address flags interfaces
-------- ----- ----------- ----- ----------
blue up 00:53:12:d8:74:24 noarp,master,up,lower_up dum200,
˓→eth0.302

show ip route vrf <name>

Display IPv4 routing table for VRF identified by <name>.

vyos@vyos:~$ show ip route vrf blue

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
F - PBR, f - OpenFabric,
> - selected route, * - FIB route, q - queued route, r - rejected route

VRF blue:
K 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 00:00:50
S>* 172.16.0.0/16 [1/0] via 192.0.2.1, dum1, 00:00:02
C>* 192.0.2.0/24 is directly connected, dum1, 00:00:06

show ipv6 route vrf <name>

Display IPv6 routing table for VRF identified by <name>.

vyos@vyos:~$ show ipv6 route vrf red

Codes: K - kernel route, C - connected, S - static, R - RIPng,
O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table,
v - VNC, V - VNC-Direct, A - Babel, D - SHARP, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued route, r - rejected route
(continues on next page)

8.14. VRF 1045

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

VRF red:
K ::/0 [255/8192] unreachable (ICMP unreachable), 00:43:20
C>* 2001:db8::/64 is directly connected, dum1, 00:02:19
C>* fe80::/64 is directly connected, dum1, 00:43:19
K>* ff00::/8 [0/256] is directly connected, dum1, 00:43:19

ping <host> vrf <name>

The ping command is used to test whether a network host is reachable or not.
Ping uses ICMP protocol’s mandatory ECHO_REQUEST datagram to elicit an ICMP ECHO_RESPONSE
from a host or gateway. ECHO_REQUEST datagrams (pings) will have an IP and ICMP header, followed by
“struct timeval” and an arbitrary number of pad bytes used to fill out the packet.
When doing fault isolation with ping, you should first run it on the local host, to verify that the local network
interface is up and running. Then, continue with hosts and gateways further down the road towards your desti-
nation. Round-trip time and packet loss statistics are computed.
Duplicate packets are not included in the packet loss calculation, although the round-trip time of these packets
is used in calculating the minimum/ average/maximum round-trip time numbers.

Note: Ping command can be interrupted at any given time using <Ctrl>+c. A brief statistic is shown after-
wards.

vyos@vyos:~$ ping 192.0.2.1 vrf red

PING 192.0.2.1 (192.0.2.1) 56(84) bytes of data.
64 bytes from 192.0.2.1: icmp_seq=1 ttl=64 time=0.070 ms
64 bytes from 192.0.2.1: icmp_seq=2 ttl=64 time=0.078 ms
^C
--- 192.0.2.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 4ms
rtt min/avg/max/mdev = 0.070/0.074/0.078/0.004 ms

traceroute vrf <name> [ipv4 | ipv6] <host>

Displays the route packets taken to a network host utilizing VRF instance identified by <name>. When using
the IPv4 or IPv6 option, displays the route packets taken to the given hosts IP address family. This option is
useful when the host is specified as a hostname rather than an IP address.
force vrf <name>
Join a given VRF. This will open a new subshell within the specified VRF.
The prompt is adjusted to reflect this change in both config and op-mode.

vyos@vyos:~$ force vrf blue

vyos@vyos(vrf:blue):~$

8.14. VRF 1046

 VyOS Documentation, Release 1.5.x (circinus)

8.14.3 Example

VRF route leaking

The following example topology was built using EVE-NG.

Fig. 10: VRF route leaking

• PC1 is in the default VRF and acting as e.g. a “fileserver”

• PC2 is in VRF blue which is the development department
• PC3 and PC4 are connected to a bridge device on router R1 which is in VRF red. Say this is the HR department.
• R1 is managed through an out-of-band network that resides in VRF mgmt

Configuration

set interfaces bridge br10 address '10.30.0.254/24'

set interfaces bridge br10 member interface eth3
set interfaces bridge br10 member interface eth4
set interfaces bridge br10 vrf 'red'

set interfaces ethernet eth0 address 'dhcp'

set interfaces ethernet eth0 vrf 'mgmt'
set interfaces ethernet eth1 address '10.0.0.254/24'
set interfaces ethernet eth2 address '10.20.0.254/24'
set interfaces ethernet eth2 vrf 'blue'

set protocols static route 10.20.0.0/24 interface eth2 vrf 'blue'

set protocols static route 10.30.0.0/24 interface br10 vrf 'red'

set service ssh disable-host-validation

set service ssh vrf 'mgmt'

(continues on next page)

8.14. VRF 1047

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set system name-server 'eth0'

set vrf name blue protocols static route 10.0.0.0/24 interface eth1 vrf
˓→'default'

set vrf name blue table '3000'

set vrf name mgmt table '1000'
set vrf name red protocols static route 10.0.0.0/24 interface eth1 vrf 'default
˓→'

set vrf name red table '2000'

VRF and NAT

Configuration

set interfaces ethernet eth0 address '172.16.50.12/24'

set interfaces ethernet eth0 vrf 'red'

set interfaces ethernet eth1 address '192.168.130.100/24'

set interfaces ethernet eth1 vrf 'blue'

set nat destination rule 110 description 'NAT ssh- INSIDE'

set nat destination rule 110 destination port '2022'
set nat destination rule 110 inbound-interface name 'eth0'
set nat destination rule 110 protocol 'tcp'
set nat destination rule 110 translation address '192.168.130.40'

set nat source rule 100 outbound-interface name 'eth0'

set nat source rule 100 protocol 'all'
set nat source rule 100 source address '192.168.130.0/24'
set nat source rule 100 translation address 'masquerade'

set service ssh vrf 'red'

set vrf bind-to-all

set vrf name blue protocols static route 0.0.0.0/0 next-hop 172.16.50.1 vrf
˓→'red'

set vrf name blue protocols static route 172.16.50.0/24 interface eth0 vrf 'red
˓→'

set vrf name blue table '1010'

set vrf name red protocols static route 0.0.0.0/0 next-hop 172.16.50.1
set vrf name red protocols static route 192.168.130.0/24 interface eth1 vrf
˓→'blue'

set vrf name red table '2020'

8.14. VRF 1048

 VyOS Documentation, Release 1.5.x (circinus)

Operation

After committing the configuration we can verify all leaked routes are installed, and try to ICMP ping PC1 from PC3.

PCS> ping 10.0.0.1

84 bytes from 10.0.0.1 icmp_seq=1 ttl=63 time=1.943 ms

84 bytes from 10.0.0.1 icmp_seq=2 ttl=63 time=1.618 ms
84 bytes from 10.0.0.1 icmp_seq=3 ttl=63 time=1.745 ms

VPCS> show ip

NAME : VPCS[1]
IP/MASK : 10.30.0.1/24
GATEWAY : 10.30.0.254
DNS :
MAC : 00:50:79:66:68:0f

VRF default routing table

vyos@R1:~$ show ip route

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
F - PBR, f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup

C>* 10.0.0.0/24 is directly connected, eth1, 00:07:44

S>* 10.20.0.0/24 [1/0] is directly connected, eth2 (vrf blue), weight 1,␣
˓→00:07:38

S>* 10.30.0.0/24 [1/0] is directly connected, br10 (vrf red), weight 1,␣
˓→00:07:38

VRF red routing table

vyos@R1:~$ show ip route vrf red

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
F - PBR, f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup

VRF red:
K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 00:07:57
S>* 10.0.0.0/24 [1/0] is directly connected, eth1 (vrf default), weight 1,␣
˓→00:07:40

C>* 10.30.0.0/24 is directly connected, br10, 00:07:54

8.14. VRF 1049

 VyOS Documentation, Release 1.5.x (circinus)

VRF blue routing table

vyos@R1:~$ show ip route vrf blue

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
F - PBR, f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup

VRF blue:
K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 00:08:00
S>* 10.0.0.0/24 [1/0] is directly connected, eth1 (vrf default), weight 1,␣
˓→00:07:44

C>* 10.20.0.0/24 is directly connected, eth2, 00:07:53

8.15 L3VPN VRFs

L3VPN VRFs ( Layer 3 Virtual Private Networks ) bgpd supports for IPv4 RFC 4364 and IPv6 RFC 4659. L3VPN
routes, and their associated VRF MPLS labels, can be distributed to VPN SAFI neighbors in the default, i.e., non VRF,
BGP instance. VRF MPLS labels are reached using core MPLS labels which are distributed using LDP or BGP labeled
unicast. bgpd also supports inter-VRF route leaking.

8.15.1 VRF Route Leaking

BGP routes may be leaked (i.e. copied) between a unicast VRF RIB and the VPN SAFI RIB of the default VRF for
use in MPLS-based L3VPNs. Unicast routes may also be leaked between any VRFs (including the unicast RIB of the
default BGP instance). A shortcut syntax is also available for specifying leaking from one VRF to another VRF using
the default instance’s VPN RIB as the intemediary . A common application of the VRF-VRF feature is to connect a
customer’s private routing domain to a provider’s VPN service. Leaking is configured from the point of view of an
individual VRF: import refers to routes leaked from VPN to a unicast VRF, whereas export refers to routes leaked from
a unicast VRF to VPN.

Note: Routes exported from a unicast VRF to the VPN RIB must be augmented by two parameters:
an RD / RTLIST
Configuration for these exported routes must, at a minimum, specify these two parameters.

8.15.2 Configuration

Configuration of route leaking between a unicast VRF RIB and the VPN SAFI RIB of the default VRF is accomplished
via commands in the context of a VRF address-family.
set vrf name <name> protocols bgp address-family <ipv4-unicast|ipv6-unicast> rd vpn
export <asn:nn|address:nn>
Specifies the route distinguisher to be added to a route exported from the current unicast VRF to VPN.
set vrf name <name> protocols bgp address-family <ipv4-unicast|ipv6-unicast> route-target
vpn <import|export|both> [RTLIST]

8.15. L3VPN VRFs 1050

 VyOS Documentation, Release 1.5.x (circinus)

Specifies the route-target list to be attached to a route (export) or the route-target list to match against (import)
when exporting/importing between the current unicast VRF and VPN.The RTLIST is a space-separated list of
route-targets, which are BGP extended community values as described in Extended Communities Attribute.
set vrf name <name> protocols bgp address-family <ipv4-unicast|ipv6-unicast> label vpn
export <0-1048575|auto>
Enables an MPLS label to be attached to a route exported from the current unicast VRF to VPN. If the value
specified is auto, the label value is automatically assigned from a pool maintained.
set vrf name <name> protocols bgp address-family <ipv4-unicast|ipv6-unicast> label vpn
allocation-mode per-nexthop
Select how labels are allocated in the given VRF. By default, the per-vrf mode is selected, and one label is used
for all prefixes from the VRF. The per-nexthop will use a unique label for all prefixes that are reachable via the
same nexthop.
set vrf name <name> protocols bgp address-family <ipv4-unicast|ipv6-unicast> route-map
vpn <import|export> [route-map <name>]
Specifies an optional route-map to be applied to routes imported or exported between the current unicast VRF
and VPN.
set vrf name <name> protocols bgp address-family <ipv4-unicast|ipv6-unicast>
<import|export> vpn
Enables import or export of routes between the current unicast VRF and VPN.
set vrf name <name> protocols bgp address-family <ipv4-unicast|ipv6-unicast> import vrf
<name>
Shortcut syntax for specifying automatic leaking from vrf VRFNAME to the current VRF using the VPN RIB
as intermediary. The RD and RT are auto derived and should not be specified explicitly for either the source or
destination VRF’s.
set vrf name <name> protocols bgp interface <interface> mpls forwarding
It is possible to permit BGP install VPN prefixes without transport labels. This configuration will install VPN
prefixes originated from an e-bgp session, and with the next-hop directly connected.

8.15.3 Operation

It is not sufficient to only configure a L3VPN VRFs but L3VPN VRFs must be maintained, too.For L3VPN VRF
maintenance the following operational commands are in place.
show bgp <ipv4|ipv6> vpn
Print active IPV4 or IPV6 routes advertised via the VPN SAFI.

BGP table version is 2, local router ID is 10.0.1.1, vrf id 0

Default local pref 100, local AS 65001
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 10.50.50.1:1011
*>i10.50.50.0/24 10.0.0.7 0 100 0 i
(continues on next page)

8.15. L3VPN VRFs 1051

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0
Route Distinguisher: 10.60.60.1:1011
*>i10.60.60.0/24 10.0.0.10 0 100 0 i
UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0

show bgp <ipv4|ipv6> vpn summary

Print a summary of neighbor connections for the specified AFI/SAFI combination.

BGP router identifier 10.0.1.1, local AS number 65001 vrf-id 0

BGP table version 0
RIB entries 9, using 1728 bytes of memory
Peers 4, using 85 KiB of memory
Peer groups 1, using 64 bytes of memory

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/

˓→PfxRcd PfxSnt
10.0.0.7 4 65001 2860 2870 0 0 0 1d23h34m ␣
˓→ 2 10

8.15. L3VPN VRFs 1052

 CHAPTER

NINE

OPERATION MODE

9.1 Information

VyOS features a rich set of operational level commands to retrieve arbitrary information about your running system.

9.1.1 Hardware

USB

In the past serial interface have been defined as ttySx and ttyUSBx where x was an instance number of the serial
interface. It was discovered that from system boot to system boot the mapping of USB based serial interfaces will
differ, depending which driver was loaded first by the operating system. This will become rather painful if you not only
have serial interfaces for a console server connected but in addition also a serial backed WWAN - Wireless Wide-Area-
Network.
To overcome this issue and the fact that in almost 50% of all cheap USB to serial converters there is no serial number
programmed, the USB to serial interface is now directly identified by the USB root bridge and bus it connects to. This
somehow mimics the new network interface definitions we see in recent Linux distributions.
For additional details you can refer to https://vyos.dev/T2490.
show hardware usb
Retrieve a tree like representation of all connected USB devices.

Note: If a device is unplugged and re-plugged it will receive a new Port, Dev, If identification.

vyos@vyos:~$ show hardware usb

/: Bus 03.Port 1: Dev 1, Class=root_hub, Driver=ehci-pci/2p, 480M
|__ Port 1: Dev 2, If 0, Class=Hub, Driver=hub/4p, 480M
|__ Port 3: Dev 4, If 0, Class=Vendor Specific Class, Driver=qcserial, 480M
|__ Port 3: Dev 4, If 2, Class=Vendor Specific Class, Driver=qcserial, 480M
|__ Port 3: Dev 4, If 3, Class=Vendor Specific Class, Driver=qcserial, 480M
|__ Port 3: Dev 4, If 8, Class=Vendor Specific Class, Driver=qmi_wwan, 480M
/: Bus 02.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/2p, 5000M
/: Bus 01.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/2p, 480M
|__ Port 1: Dev 2, If 0, Class=Vendor Specific Class, Driver=pl2303, 12M
|__ Port 2: Dev 3, If 0, Class=Hub, Driver=hub/4p, 480M
|__ Port 4: Dev 5, If 2, Class=Vendor Specific Class, Driver=ftdi_sio, 480M
|__ Port 4: Dev 5, If 0, Class=Vendor Specific Class, Driver=ftdi_sio, 480M
(continues on next page)

1053
 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

|__ Port 4: Dev 5, If 3, Class=Vendor Specific Class, Driver=ftdi_sio, 480M
|__ Port 4: Dev 5, If 1, Class=Vendor Specific Class, Driver=ftdi_sio, 480M
|__ Port 3: Dev 4, If 0, Class=Hub, Driver=hub/4p, 480M
|__ Port 3: Dev 6, If 0, Class=Hub, Driver=hub/4p, 480M
|__ Port 4: Dev 8, If 2, Class=Vendor Specific Class, Driver=ftdi_
˓→sio, 480M
|__ Port 4: Dev 8, If 0, Class=Vendor Specific Class, Driver=ftdi_
˓→sio, 480M
|__ Port 4: Dev 8, If 3, Class=Vendor Specific Class, Driver=ftdi_
˓→sio, 480M
|__ Port 4: Dev 8, If 1, Class=Vendor Specific Class, Driver=ftdi_
˓→sio, 480M
|__ Port 4: Dev 7, If 3, Class=Vendor Specific Class, Driver=ftdi_sio,␣
˓→480M
|__ Port 4: Dev 7, If 1, Class=Vendor Specific Class, Driver=ftdi_sio,␣
˓→480M
|__ Port 4: Dev 7, If 2, Class=Vendor Specific Class, Driver=ftdi_sio,␣
˓→480M
|__ Port 4: Dev 7, If 0, Class=Vendor Specific Class, Driver=ftdi_sio,␣
˓→480M

show hardware usb serial

Retrieve a list and description of all connected USB serial devices. The device name displayed, e.g.
usb0b2.4p1.0 can be directly used when accessing the serial console as console-server device.

vyos@vyos$ show hardware usb serial

Device Model Vendor
------ ------ ------
usb0b1.3p1.0 MC7710 Sierra Wireless, Inc.
usb0b1.3p1.2 MC7710 Sierra Wireless, Inc.
usb0b1.3p1.3 MC7710 Sierra Wireless, Inc.
usb0b1p1.0 USB-Serial_Controller_D Prolific Technology, Inc.
usb0b2.3.3.4p1.0 Quad_RS232-HS Future Technology Devices International, Ltd
usb0b2.3.3.4p1.1 Quad_RS232-HS Future Technology Devices International, Ltd
usb0b2.3.3.4p1.2 Quad_RS232-HS Future Technology Devices International, Ltd
usb0b2.3.3.4p1.3 Quad_RS232-HS Future Technology Devices International, Ltd
usb0b2.3.4p1.0 Quad_RS232-HS Future Technology Devices International, Ltd
usb0b2.3.4p1.1 Quad_RS232-HS Future Technology Devices International, Ltd
usb0b2.3.4p1.2 Quad_RS232-HS Future Technology Devices International, Ltd
usb0b2.3.4p1.3 Quad_RS232-HS Future Technology Devices International, Ltd
usb0b2.4p1.0 Quad_RS232-HS Future Technology Devices International, Ltd
usb0b2.4p1.1 Quad_RS232-HS Future Technology Devices International, Ltd
usb0b2.4p1.2 Quad_RS232-HS Future Technology Devices International, Ltd
usb0b2.4p1.3 Quad_RS232-HS Future Technology Devices International, Ltd

9.1. Information 1054

 VyOS Documentation, Release 1.5.x (circinus)

9.1.2 Version

show version
Return the current running VyOS version and build information. This includes also the name of the release train
which is crux on VyOS 1.2, equuleus on VyOS 1.3 and sagitta on VyOS 1.4.

vyos@vyos:~$ show version

Version: VyOS 1.4-rolling-202106270801

Release Train: sagitta

Built by: [email protected]

Built on: Sun 27 Jun 2021 09:50 UTC
Build UUID: ab43e735-edcb-405a-9f51-f16a1b104e52
Build Commit ID: f544d75eab758f

Architecture: x86_64
Boot via: installed image
System type: KVM guest

Hardware vendor: QEMU

Hardware model: Standard PC (i440FX + PIIX, 1996)
Hardware S/N:
Hardware UUID: Unknown

Copyright: VyOS maintainers and contributors

show version kernel

Return version number of the Linux Kernel used in this release.

vyos@vyos:~$ show version kernel

5.10.46-amd64-vyos

show version frr

Return version number of FRR (Free Range Routing - https://frrouting.org/) used in this release. This is the
routing control plane and a successor to GNU Zebra and Quagga.

vyos@vyos:~$ show version frr

FRRouting 7.5.1-20210625-00-gf07d935a2 (vyos).
Copyright 1996-2005 Kunihiro Ishiguro, et al.

9.2 Boot Options

Warning: This function may be highly disruptive. It may cause major service interruption, so make sure you
really need it and verify your input carefully.

VyOS has several kernel command line options to modify the normal boot process. To add an option, select the desired
image in GRUB menu at load time, press e, edit the first line, and press Ctrl-x to boot when ready.

9.2. Boot Options 1055

 VyOS Documentation, Release 1.5.x (circinus)

9.2.1 Specify custom config file

Tells the system to use specified file instead of /config/config.boot. If specified file does not exist or is not
readable, fall back to default config. No additional verification is performed, so make sure you specify a valid config
file.

vyos-config=/path/to/file

To load the factory default config, use:

vyos-config=/opt/vyatta/etc/config.boot.default

9.2.2 Disable specific boot process steps

These options disable some boot steps. Make sure you understand the boot process well before using them!
no-vyos-migrate
Do not perform config migration.
no-vyos-firewall
Do not initialize default firewall chains, renders any firewall configuration unusable.

9.3 Password Recovery

Using the console, restart the VyOS router. The GRUB menu appears. Select the relevant option from the GRUB menu
and press Enter. The option must start with “Lost password change.”
The stand-alone user-password recovery tool starts running and prompts you to reset the local system user password.

Do you wish to reset the admin password? (y or n)

y
Which admin account do you want to reset?[vyos]
my_username
(continues on next page)

9.3. Password Recovery 1056

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Enter my_username password:
Retype my_username password:
System will reboot in 10 seconds...

9.4 RAID-1

A Redundant Array of Independent Disks (RAID) uses two or more hard disk drives to improve disk speed, store
more data, and/or provide fault tolerance. There are several storage schemes possible in a RAID array, each offering a
different combination of storage, reliability, and/or performance. The VyOS system supports a “RAID 1” deployment.
RAID 1 allows two or more disks to mirror one another to provide system fault tolerance. In a RAID 1 solution, every
sector of one disk is duplicated onto every sector of all disks in the array. Provided even one disk in the RAID 1 set is
operational, the system continues to run, even through disk replacement (provided that the hardware supports in-service
replacement of drives). RAID 1 can be implemented using special hardware or it can be implemented in software. The
VyOS system supports software RAID 1 on two disks. The VyOS implementation of RAID 1 allows the following:
• Detection and reporting of disk failure
• The ability to maintain system operation with one failed disk
• The ability to boot the system with one failed disk
• The ability to replace a failed disk and initiate re-mirroring
• The ability to monitor the status of remirroring

9.4. RAID-1 1057

 VyOS Documentation, Release 1.5.x (circinus)

9.4.1 Installation Implications

The VyOS systems installation utility provides several options for installing to a RAID 1 set. You can:
• Use the install system to create the RAID 1 set
• Use the underlying Linux commands to create a RAID 1 set before running the install system command.
• Use a previously-created RAID 1 set.

Note: Before a permanent installation, VyOS runs a live installation

9.4.2 Configuration

Single disk, install as normal

When the VyOS system is installed, it automatically detects the presence of two disks not currently part of a RAID
array. In these cases, the VyOS installation utility automatically offers you the option of configuring RAID 1 mirroring
for the drives, with the following prompt.

Would you like to configure RAID 1 mirroring on them?

• If you do not want to configure RAID 1 mirroring, enter “No” at the prompt and continue with installation in the
normal way.

Empty 2+ Disk

If VyOS system detect two identical disks that are not currently part of a RAID-1 set, the VyOS installation utility
automatically offers you the option of configuring RAID 1 mirroring for the drives, with the following prompt.

Would you like to configure RAID 1 mirroring on them?

1 - To create a new RAID 1 array, enter “Yes” at the prompt. If the system detects a filesystem on the partitions being
used for RAID 1 it will prompt you to indicate whether you want to continue creating the RAID 1 array.

Continue creating array?

2 - To overwrite the old filesystem, enter “Yes”.

3 - The system informs you that all data on both drives will be erased. You are prompted to confirm that you want to
continue

Are you sure you want to do this?

4 - Enter “Yes” at the prompt to retain the current VyOS configuration once installation is complete. Enter “No” to
delete the current VyOS configuration.

Would you like me to save the data on it before I delete it?

5 - Enter “Yes” at the prompt to retain the current VyOS configuration once installation is complete. Enter “No” to
delete the current VyOS configuration.
6 - Continue with installation in the normal way.

9.4. RAID-1 1058

 VyOS Documentation, Release 1.5.x (circinus)

Present RAID-1

When the VyOS software on a system with a RAID 1 set already configured, the installation utility will detect the array
and will display the following prompt:

Would you like to use this one?

1 - To break apart the current RAID 1 set, enter “No” at the prompt. The
installation utility detects that there are two identical disks and offers you the option of configuring RAID 1 mirroring
on them, displaying the following prompt:

Would you like to configure RAID 1 mirroring on them?

2 - To decline to set up a new RAID 1 configuration on the disks, enter “No” at the prompt. The system prompts you
to indicate which partition you would like the system installed on.

Which partition should I install the root on? [sda1]:

3 - Enter the partition where you would like the system installed. The system then prompts you to indicate whether you
want to save the old configuration data. This represents the current VyOS configuration.

Would you like me to save the data on it before I delete it?

4 - Enter “Yes” at the prompt to retain the current VyOS configuration once installation is complete. Enter “No” to
delete the current VyOS configuration.
5 - Continue with installation in the normal way.

Detecting and Replacing a Failed RAID 1 Disk

The VyOS system automatically detects a disk failure within a RAID 1 set and reports it to the system console. You
can verify the failure by issuing the show raid command.
To replace a bad disk within a RAID 1 set, perform the following steps:
1 - Remove the failed disk from the RAID 1 set by issuing the following command:
delete raid <RAID-1-device> member <disk-partition>
where RAID-1-device is the name of the RAID 1 device (for example, md0) and disk-partition is the name of
the failed disk partition (for example, sdb2).
2- Physically remove the failed disk from the system. If the drives are not hot-swappable, then you must shut down the
system before removing the disk.
3 - Replace the failed drive with a drive of the same size or larger.
4 - Format the new disk for RAID 1 by issuing the following command:
format disk <disk-device1> like <disk-device2>
where disk-device1 is the replacement disk (for example, sdb) and disk-device2 is the existing healthy disk (for
example, sda).
5-Add the replacement disk to the RAID 1 set by issuing the following command:
add raid <RAID-1-device> member <disk-partition>
where RAID-1-device is the name of the RAID 1 device (for example, md0) and disk-partition is the name of
the replacement disk partition (for example, sdb2).

9.4. RAID-1 1059

 VyOS Documentation, Release 1.5.x (circinus)

9.4.3 Operation

This part introduces how to add a disk partition to a RAID-1 set initiates mirror synchronization, check and display
information.
add raid <RAID-1-device> member <disk-partition>
Use this command to add a member disk partition to the RAID 1 set. Adding a disk partition to a RAID 1 set
initiates mirror synchronization, where all data on the existing member partition is copied to the new partition.
format disk <disk-device1> like <disk-device2>
This command is typically used to prepare a disk to be added to a preexisting RAID 1 set (of which disk-device2
is already a member).
show raid <RAID-1-device>
shows output for show raid md0 as sdb1 is being added to the RAID 1 set and is in the process of being resyn-
chronized.

vyos@vyos:~$ show raid md0

/dev/md0:
Version : 00.90
Creation Time : Wed Oct 29 09:19:09 2008
Raid Level : raid1
Array Size : 1044800 (1020.48 MiB 1069.88 MB)
Used Dev Size : 1044800 (1020.48 MiB 1069.88 MB)
Raid Devices : 2
Total Devices : 2
Preferred Minor : 0
Persistence : Superblock is persistent
Update Time : Wed Oct 29 19:34:23 2008
State : active, degraded, recovering
Active Devices : 1
Working Devices : 2
Failed Devices : 0
Spare Devices : 1
Rebuild Status : 17% complete
UUID : 981abd77:9f8c8dd8:fdbf4de4:3436c70f
Events : 0.103
Number Major Minor RaidDevice State
0 8 1 0 active sync /dev/sda1
2 8 17 1 spare rebuilding /dev/sdb1

show raid <RAID-1-device>

Use this command to display the formatting of a hard disk.

vyos@vyos:~$ show disk sda format

Disk /dev/sda: 1073 MB, 1073741824 bytes
85 heads, 9 sectors/track, 2741 cylinders
Units = cylinders of 765 * 512 = 391680 bytes
Disk identifier: 0x000b7179
Device Boot Start End Blocks Id System
/dev/sda1 6 2737 1044922+ fd Linux raid autodetect

9.4. RAID-1 1060

 CHAPTER

TEN

VYOS AUTOMATION

10.1 VyOS API

For configuration and enabling the API see HTTP API

10.1.1 Authentication

All endpoints only listen on HTTP POST requests and the API KEY must set as key in the formdata.
Below see one example for curl and one for python. The rest of the documentation is reduced to curl.

curl --location --request POST 'https://vyos/retrieve' \

--form data='{"op": "showConfig", "path": []}' \
--form key='MY-HTTPS-API-PLAINTEXT-KEY'

import requests
url = "https://vyos/retrieve"
payload={'data': '{"op": "showConfig", "path": []}',
'key': 'MY-HTTPS-API-PLAINTEXT-KEY'
}
headers = {}
response = requests.request("POST", url, headers=headers, data=payload)
print(response.text)

10.1.2 API Endpoints

/retrieve

With the retrieve endpoint you get parts or the whole configuration.
To get the whole configuration, pass an empty list to the path field

curl --location --request POST 'https://vyos/retrieve' \

--form data='{"op": "showConfig", "path": []}' \
--form key='MY-HTTPS-API-PLAINTEXT-KEY'

response (shorted)
{
(continues on next page)

1061
 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

"success": true,
"data": {
"interfaces": {
"ethernet": {
"eth0": {
"address": "dhcp",
"duplex": "auto",
"hw-id": "50:00:00:01:00:00",
"speed": "auto"
},
"eth1": {
"duplex": "auto",
"hw-id": "50:00:00:01:00:01",
"speed": "auto"
...
},
"error": null
}

To only get a part of the configuration, for example system syslog.

curl -k --location --request POST 'https://vyos/retrieve' \

--form data='{"op": "showConfig", "path": ["system", "syslog"]}' \
--form key='MY-HTTPS-API-PLAINTEXT-KEY'

response:
{
"success": true,
"data": {
"global": {
"facility": {
"all": {
"level": "info"
},
"protocols": {
"level": "debug"
}
}
}
},
"error": null
}

if you just want the Value of a multi-valued node, use the returnValues operation.
For example, get the addresses of a dum0 interface.

curl -k --location --request POST 'https://vyos/retrieve' \

--form data='{"op": "returnValues", "path": ["interfaces","dummy","dum0","address"]}' \
--form key='MY-HTTPS-API-PLAINTEXT-KEY'

respone:
(continues on next page)

10.1. VyOS API 1062

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

{
"success": true,
"data": [
"10.10.10.10/24",
"10.10.10.11/24",
"10.10.10.12/24"
],
"error": null
}

To check existence of a configuration path, use the exists operation.

For example, check an existing path:

curl -k --location --request POST 'https://vyos/retrieve' \

--form data='{"op": "exists", "path": ["service","https","api"]}' \
--form key='MY-HTTPS-API-PLAINTEXT-KEY'

response:
{
"success": true,
"data": true,
"error": null
}

versus a non-existent path:

curl -k --location --request POST 'https://vyos/retrieve' \

--form data='{"op": "exists", "path": ["service","non","existent","path"]}' \
--form key='MY-HTTPS-API-PLAINTEXT-KEY'

response:
{
"success": true,
"data": false,
"error": null
}

/reset

The reset endpoint run a reset command.

curl --location --request POST 'https://vyos/reset' \

--form data='{"op": "reset", "path": ["ip", "bgp", "192.0.2.11"]}' \
--form key='MY-HTTPS-API-PLAINTEXT-KEY'

respone:
{
"success": true,
"data": "",
"error": null
}

10.1. VyOS API 1063

 VyOS Documentation, Release 1.5.x (circinus)

/reboot

To initiate a reboot use the reboot endpoint.

curl --location --request POST 'https://vyos/reboot' \

--form data='{"op": "reboot", "path": ["now"]}' \
--form key='MY-HTTPS-API-PLAINTEXT-KEY'

respone:
{
"success": true,
"data": "",
"error": null
}

/poweroff

To power off the system use the poweroff endpoint.

curl --location --request POST 'https://vyos/poweroff' \

--form data='{"op": "poweroff", "path": ["now"]}' \
--form key='MY-HTTPS-API-PLAINTEXT-KEY'

respone:
{
"success": true,
"data": "",
"error": null
}

/image

To add or delete an image, use the /image endpoint.

add an image

curl -k --location --request POST 'https://vyos/image' \

--form data='{"op": "add", "url": "https://downloads.vyos.io/rolling/current/amd64/vyos-
˓→rolling-latest.iso"}' \

--form key='MY-HTTPS-API-PLAINTEXT-KEY'

respone (shorted):
{
"success": true,
"data": "Trying to fetch ISO file from https://downloads.vyos.io/rolling-latest.iso\n
...
Setting up grub configuration...\nDone.\n",
"error": null
}

delete an image, for example 1.3-rolling-202006070117

10.1. VyOS API 1064

 VyOS Documentation, Release 1.5.x (circinus)

curl -k --location --request POST 'https://vyos/image' \

--form data='{"op": "delete", "name": "1.3-rolling-202006070117"}' \
--form key='MY-HTTPS-API-PLAINTEXT-KEY'

response:
{
"success": true,
"data": "Deleting the \"1.3-rolling-202006070117\" image...\nDone\n",
"error": null
}

/show

The /show endpoint is to show everything in the operational mode.

For example, show which images are installed.

curl -k --location --request POST 'https://vyos/show' \

--form data='{"op": "show", "path": ["system", "image"]}' \
--form key='MY-HTTPS-API-PLAINTEXT-KEY'

response:
{
"success": true,
"data": "The system currently has the following image(s) installed:\n\n
1: 1.4-rolling-202102280559 (default boot)\n
2: 1.4-rolling-202102230218\n
3: 1.3-beta-202102210443\n\n",
"error": null
}

/generate

The generate endpoint run a generate command.

curl -k --location --request POST 'https://vyos/generate' \

--form data='{"op": "generate", "path": ["pki", "wireguard", "key-pair"]}' \
--form key='MY-HTTPS-API-PLAINTEXT-KEY'

response:
{
"success": true,
"data": "Private key: CFZR2eyhoVZwk4n3JFPMJx3E145f1EYgDM+ubytXYVY=\n
Public key: jjtpPT8ycI1Q0bNtrWuxAkO4k88Xwzg5VHV9xGZ58lU=\n\n",
"error": null
}

10.1. VyOS API 1065

 VyOS Documentation, Release 1.5.x (circinus)

/configure

You can pass a set, delete or comment command to the /configure endpoint.
set a single command

curl -k --location --request POST 'https://vyos/configure' \

--form data='{"op": "set", "path": ["interfaces", "dummy", "dum1", "address", "10.11.0.1/
˓→32"]}' \

--form key='MY-HTTPS-API-PLAINTEXT-KEY'

response:
{
"success": true,
"data": null,
"error": null
}

delete a single command

curl -k --location --request POST 'https://vyos/configure' \

--form data='{"op": "delete", "path": ["interfaces", "dummy", "dum1", "address", "10.11.
˓→0.1/32"]}' \

--form key='MY-HTTPS-API-PLAINTEXT-KEY'

response:
{
"success": true,
"data": null,
"error": null
}

The API pushes every request to a session and commit it. But some of VyOS components like DHCP and PPPoE
Servers, IPSec, VXLAN, and other tunnels require full configuration for commit. The endpoint will process multiple
commands when you pass them as a list to the data field.

curl -k --location --request POST 'https://vyos/configure' \

--form data='[{"op": "set","path":["interfaces","vxlan","vxlan1","remote","203.0.113.99
˓→"]}, {"op": "set","path":["interfaces","vxlan","vxlan1","vni","1"]}]' \

--form key='MY-HTTPS-API-PLAINTEXT-KEY'

response:
{
"success": true,
"data": null,
"error": null
}

10.1. VyOS API 1066

 VyOS Documentation, Release 1.5.x (circinus)

/config-file

The endpoint /config-file is to save or load a configuration.

Save a running configuration to the startup configuration. When you don’t specify the file when saving, it saves to
/config/config.boot.

curl -k --location --request POST 'https://vyos/config-file' \

--form data='{"op": "save"}' \
--form key='MY-HTTPS-API-PLAINTEXT-KEY'

response:
{
"success": true,
"data": "Saving configuration to '/config/config.boot'...\nDone\n",
"error": null
}

Save a running configuration to a file.

curl -k --location --request POST 'https://vyos/config-file' \

--form data='{"op": "save", "file": "/config/test.config"}' \
--form key='MY-HTTPS-API-PLAINTEXT-KEY'

response:
{
"success": true,
"data": "Saving configuration to '/config/test.config'...\nDone\n",
"error": null
}

To Load a configuration file.

curl -k --location --request POST 'https://vyos/config-file' \

--form data='{"op": "load", "file": "/config/test.config"}' \
--form key='MY-HTTPS-API-PLAINTEXT-KEY'

response:
{
"success": true,
"data": null,
"error": null
}

10.2 Ansible

VyOS supports configuration via ansible. Need to install ansible and python3-paramiko module
Structure of files

.
ansible.cfg
files
(continues on next page)

10.2. Ansible 1067

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

id_rsa_docker.pub
hosts
main.yml

10.2.1 File contents

ansible.cfg

[defaults]
host_key_checking = no
retry_files_enabled = False
ANSIBLE_INVENTORY_UNPARSED_FAILED = true

id_rsa_docker.pub. Needs to declare only public key exactly.

AAAAB3NzaC1yc2EAAAADAQABAAABAQCoDgfhQJuJRFWJijHn7ZinZ3NWp4hWVrt7HFcvn0kgtP/5PeCtMt

hosts

[vyos_hosts]
r11 ansible_ssh_host=192.0.2.11

[vyos_hosts:vars]
ansible_python_interpreter=/usr/bin/python3
ansible_user=vyos
ansible_ssh_pass=vyos
ansible_network_os=vyos
ansible_connection=network_cli

main.yml

---

- hosts: r11

connection: network_cli
gather_facts: 'no'

tasks:
- name: Configure remote r11
vyos_config:
lines:
- set system host-name r11
- set system name-server 203.0.113.254
- set service ssh disable-host-validation
- set system login user vyos authentication public-keys docker@work type ssh-
˓→rsa

- set system login user vyos authentication public-keys docker@work key "{{␣
˓→lookup('file', 'id_rsa_docker.pub') }}"

- set system time-zone America/Los_Angeles

- set interfaces ethernet eth0 description WAN

10.2. Ansible 1068

 VyOS Documentation, Release 1.5.x (circinus)

10.2.2 Run ansible

$ ansible-playbook -i hosts main.yml

PLAY [r11]␣
˓→******************************************************************************************************

TASK [Configure remote r11]␣

˓→******************************************************************************************************

changed: [r11]

PLAY RECAP␣
˓→******************************************************************************************************

r11 : ok=1 changed=1 unreachable=0 failed=0 ␣

˓→skipped=0 rescued=0 ignored=0

10.3 VyOS Terraform

10.3.1 Terraform for VyOS

VyOS supports development infrastructure via Terraform and provisioning via Ansible. Terraform allows you to au-
tomate the process of deploying instances on many cloud and virtual platforms. In this article, we will look at using
terraforms to deploy VyOS on platforms - AWS, Azure, and vSphere. For more details about Terraform please have a
look here link.
Need to install Terraform
Structure of files in the standard Terraform project:

.
main.tf # The main script
version.tf # File for the changing version of Terraform.
variables.tf # The file of all variables in "main.tf"
terraform.tfvars # The value of all variables (passwords, login, ip adresses and␣
˓→so on)

General commands that we will use for running Terraform scripts

cd /<your folder> # go to the Terrafom project

terraform init # install all addons and provider (aws az and so on)
terraform plan # show what is changing
terraform apply # run script
yes # apply running

10.3. VyOS Terraform 1069

 VyOS Documentation, Release 1.5.x (circinus)

10.3.2 Deploying VyOS in the AWS cloud

With the help of Terraform, you can quickly deploy VyOS-based infrastructure in the AWS cloud. If necessary, the
infrastructure can be removed using terraform. Also we will make provisioning using Ansible.

In this case, we’ll create the necessary files for Terraform and Ansible next using Terraform we’ll create a single instance
on the AWS cloud and make provisioning using Ansible.

Preparation steps for deploying VyOS on AWS

How to create a single instance and install your configuration using Terraform+Ansible+AWS Step by step:
AWS
1 Create an account with AWS and get your “access_key”, “secret key”
2 Create a key pair and download your .pem key

Terraform
1 Create an UNIX or Windows instance
2 Download and install Terraform
3 Create the folder for example /root/awsterraform

mkdir /root/awsterraform

4 Copy all files into your Terraform project "/root/awsterraform" (vyos.tf, var.tf,␣
˓→terraform.tfvars,version.tf), more detailed see `Structure of files Terrafom for AWS`_

5 Type the commands :

10.3. VyOS Terraform 1070

 VyOS Documentation, Release 1.5.x (circinus)

cd /<your folder>
terraform init

Ansible
1 Create an UNIX instance whenever you want (local, cloud, and so on)
2 Download and install Ansible
3 Create the folder for example /root/aws/
4 Copy all files into your Ansible project “/root/aws/” (ansible.cfg, instance.yml, mykey.pem and “all”),
more detailed see Structure of files Ansible for AWS
mykey.pem you have to get using step 1.2
Start
Type the commands on your Terrafom instance:

cd /<your folder>
terraform plan
terraform apply
yes

Start creating an AWS instance and check the result

root@localhost:~/awsterraform# terraform apply

Terraform used the selected providers to generate the following execution plan.
Resource actions are indicated with the following symbols:
+ create

Terraform will perform the following actions:

# aws_instance.myVyOSec2 will be created

+ resource "aws_instance" "myVyOSec2" {
+ ami = "ami-************62c2d"
+ arn = (known after apply)
+ associate_public_ip_address = (known after apply)
+ availability_zone = (known after apply)
+ cpu_core_count = (known after apply)
+ cpu_threads_per_core = (known after apply)
+ disable_api_stop = (known after apply)
+ disable_api_termination = (known after apply)
+ ebs_optimized = (known after apply)
+ get_password_data = false
+ host_id = (known after apply)
+ host_resource_group_arn = (known after apply)
+ iam_instance_profile = (known after apply)
+ id = (known after apply)
+ instance_initiated_shutdown_behavior = (known after apply)
+ instance_lifecycle = (known after apply)
+ instance_state = (known after apply)
+ instance_type = "t2.micro"
(continues on next page)

10.3. VyOS Terraform 1071

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

+ ipv6_address_count = (known after apply)
+ ipv6_addresses = (known after apply)
+ key_name = "awsterraform"
+ monitoring = (known after apply)
+ outpost_arn = (known after apply)
+ password_data = (known after apply)
+ placement_group = (known after apply)
+ placement_partition_number = (known after apply)
+ primary_network_interface_id = (known after apply)
+ private_dns = (known after apply)
+ private_ip = (known after apply)
+ public_dns = (known after apply)
+ public_ip = (known after apply)
+ secondary_private_ips = (known after apply)
+ security_groups = [
+ "awsterraformsg",
]
+ source_dest_check = true
+ spot_instance_request_id = (known after apply)
+ subnet_id = (known after apply)
+ tags = {
+ "name" = "VyOS System"
}
+ tags_all = {
+ "name" = "VyOS System"
}
+ tenancy = (known after apply)
+ user_data = (known after apply)
+ user_data_base64 = (known after apply)
+ user_data_replace_on_change = false
+ vpc_security_group_ids = (known after apply)
}

# local_file.ip will be created

+ resource "local_file" "ip" {
+ content = (known after apply)
+ content_base64sha256 = (known after apply)
+ content_base64sha512 = (known after apply)
+ content_md5 = (known after apply)
+ content_sha1 = (known after apply)
+ content_sha256 = (known after apply)
+ content_sha512 = (known after apply)
+ directory_permission = "0777"
+ file_permission = "0777"
+ filename = "ip.txt"
+ id = (known after apply)
}

# null_resource.SSHconnection1 will be created

+ resource "null_resource" "SSHconnection1" {
+ id = (known after apply)
}
(continues on next page)

10.3. VyOS Terraform 1072

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

# null_resource.SSHconnection2 will be created

+ resource "null_resource" "SSHconnection2" {
+ id = (known after apply)
}

Plan: 4 to add, 0 to change, 0 to destroy.

Changes to Outputs:
+ my_IP = (known after apply)

Do you want to perform these actions?

Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.

Enter a value: yes

aws_instance.myVyOSec2: Creating...
aws_instance.myVyOSec2: Still creating... [10s elapsed]
aws_instance.myVyOSec2: Still creating... [20s elapsed]
aws_instance.myVyOSec2: Still creating... [30s elapsed]
aws_instance.myVyOSec2: Still creating... [40s elapsed]
aws_instance.myVyOSec2: Creation complete after 44s [id=i-09edfca15aac2fe0a]
null_resource.SSHconnection1: Creating...
null_resource.SSHconnection2: Creating...
null_resource.SSHconnection1: Provisioning with 'file'...
null_resource.SSHconnection2: Provisioning with 'remote-exec'...
null_resource.SSHconnection2 (remote-exec): Connecting to remote host via SSH...
null_resource.SSHconnection2 (remote-exec): Host: 10.217.80.104
null_resource.SSHconnection2 (remote-exec): User: root
null_resource.SSHconnection2 (remote-exec): Password: true
null_resource.SSHconnection2 (remote-exec): Private key: false
null_resource.SSHconnection2 (remote-exec): Certificate: false
null_resource.SSHconnection2 (remote-exec): SSH Agent: false
null_resource.SSHconnection2 (remote-exec): Checking Host Key: false
null_resource.SSHconnection2 (remote-exec): Target Platform: unix
local_file.ip: Creating...
local_file.ip: Creation complete after 0s [id=e8e91f2e24579cd28b92e2d152c0c24c3bf4b52c]
null_resource.SSHconnection2 (remote-exec): Connected!
null_resource.SSHconnection1: Creation complete after 0s [id=7070868940858935600]

null_resource.SSHconnection2 (remote-exec): PLAY [integration of terraform and ansible]␣

˓→************************************

null_resource.SSHconnection2 (remote-exec): TASK [Wait 300 seconds, but only start␣

˓→checking after 60 seconds] **************

null_resource.SSHconnection2: Still creating... [10s elapsed]

null_resource.SSHconnection2: Still creating... [20s elapsed]
null_resource.SSHconnection2: Still creating... [30s elapsed]
null_resource.SSHconnection2: Still creating... [40s elapsed]
null_resource.SSHconnection2: Still creating... [50s elapsed]
null_resource.SSHconnection2: Still creating... [1m0s elapsed]
(continues on next page)

10.3. VyOS Terraform 1073

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

null_resource.SSHconnection2 (remote-exec): ok: [54.xxx.xxx.xxx]

null_resource.SSHconnection2 (remote-exec): TASK [Configure general settings for the␣

˓→vyos hosts group] *********************

null_resource.SSHconnection2: Still creating... [1m10s elapsed]

null_resource.SSHconnection2 (remote-exec): changed: [54.xxx.xxx.xxx]

null_resource.SSHconnection2 (remote-exec): PLAY RECAP␣

˓→*********************************************************************

null_resource.SSHconnection2 (remote-exec): 54.xxx.xxx.xxx : ok=2 ␣

˓→changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

null_resource.SSHconnection2: Creation complete after 1m16s [id=4902256962410024771]

Apply complete! Resources: 4 added, 0 changed, 0 destroyed.

Outputs:

my_IP = "54.xxx.xxx.xxx"

After executing all the commands you will have your VyOS instance on the AWS cloud with your configuration, it’s a
very convenient desition. If you need to delete the instance please type the command:

terraform destroy

Troubleshooting

1 Ansible doesn’t connect via SSH to your AWS instance: you have to check that your SSH key has copied
into the path /root/aws/.
Also, increase the time in the file instance.yml from 300 sec to 500 sec or more. (It depends on your location). Make
sure that you have opened access to the instance in the security group.
2 Terraform doesn’t connect via SSH to your Ansible instance: you have to check the correct login and
password in the part of the file VyOS. tf

connection {
type = "ssh"
user = "root" # open root access using login and password on your␣
˓→Ansible

password = var.password # check password in the file terraform.tfvars isn't empty

host = var.host # check the correct IP address of your Ansible host
}

Make sure that Ansible is pinging from Terrafom.

10.3. VyOS Terraform 1074

 VyOS Documentation, Release 1.5.x (circinus)

Structure of files Terrafom for AWS

.
vyos.tf # The main script
var.tf # The file of all variables in "vyos.tf"
versions.tf # File for the changing version of Terraform.
terraform.tfvars # The value of all variables (passwords, login, ip␣
˓→adresses and so on)

File contents of Terrafom for AWS

vyos.tf

##############################################################################
# Build an VyOS VM from the Marketplace
# To finde nessesery AMI image_ in AWS
#
# In the script vyos.tf we'll use default values (you can chang it as you need)
# AWS Region = "us-east-1"
# AMI = "standard AMI of VyOS from AWS Marketplace"
# Size of VM = "t2.micro"
# AWS Region = "us-east-1"
# After deploying the AWS instance and getting an IP address, the IP address is copied␣
˓→into the file

#"ip.txt" and copied to the Ansible node for provisioning.

##############################################################################

provider "aws" {
access_key = var.access
secret_key = var.secret
region = var.region
}

variable "region" {
default = "us-east-1"
description = "AWS Region"
}

variable "ami" {
default = "ami-**************3b3" # ami image please enter your␣
˓→details

description = "Amazon Machine Image ID for VyOS"

}

variable "type" {
default = "t2.micro"
description = "Size of VM"
}

# my resource for VyOS

resource "aws_instance" "myVyOSec2" {

(continues on next page)

10.3. VyOS Terraform 1075

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

ami = var.ami
key_name = "awsterraform" # Please enter your␣
˓→details from 1.2 of Preparation steps for deploying VyOS on AWS

security_groups = ["awsterraformsg"] # Please enter your␣

˓→details from 1.3 of Preparation steps for deploying VyOS on AWS

instance_type = var.type
tags = {
name = "VyOS System"
}
}

##############################################################################
# specific variable (to getting type "terraform plan"):
# aws_instance.myVyOSec2.public_ip - the information about public IP address
# of our instance, needs for provisioning and ssh connection from Ansible
##############################################################################

output "my_IP"{
value = aws_instance.myVyOSec2.public_ip
}

##############################################################################
#
# IP of aws instance copied to a file ip.txt in local system Terraform
# ip.txt looks like:
# cat ./ip.txt
# ...
##############################################################################

resource "local_file" "ip" {

content = aws_instance.myVyOSec2.public_ip
filename = "ip.txt"
}

#connecting to the Ansible control node using SSH connection

##############################################################################
# Steps "SSHconnection1" and "SSHconnection2" need to get file ip.txt from the terraform␣
˓→node and start remotely the playbook of Ansible.

##############################################################################

resource "null_resource" "SSHconnection1" {

depends_on = [aws_instance.myVyOSec2]
connection {
type = "ssh"
user = "root"
password = var.password
host = var.host
}

#copying the ip.txt file to the Ansible control node from local system

(continues on next page)

10.3. VyOS Terraform 1076

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

provisioner "file" {
source = "ip.txt"
destination = "/root/aws/ip.txt" # The folder of your␣
˓→Ansible project

}
}

resource "null_resource" "SSHconnection2" {

depends_on = [aws_instance.myVyOSec2]
connection {
type = "ssh"
user = "root"
password = var.password
host = var.host
}
#command to run Ansible playbook on remote Linux OS
provisioner "remote-exec" {
inline = [
"cd /root/aws/",
"ansible-playbook instance.yml" # more detailed in
˓→"File contents of Ansible for AWS"

]
}
}

var.tf

variable "password" {
description = "pass for Ansible"
type = string
sensitive = true
}
variable "host"{
description = "The IP of my Ansible"
type = string
}
variable "access" {
description = "my access_key for AWS"
type = string
sensitive = true
}
variable "secret" {
description = "my secret_key for AWS"
type = string
sensitive = true
}

versions.tf

terraform {
required_providers {
aws = {
(continues on next page)

10.3. VyOS Terraform 1077

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

source = "hashicorp/aws"
version = "~> 5.0"
}
}
}

terraform.tfvars

password = "" # password for Ansible SSH

host = "" # IP of my Ansible
access = "" # access_key for AWS
secret = "" # secret_key for AWS

Structure of files Ansible for AWS

.
group_vars
all
ansible.cfg
mykey.pem
instance.yml

File contents of Ansible for AWS

ansible.cfg

[defaults]
inventory = /root/aws/ip.txt
host_key_checking= False
private_key_file = /root/aws/awsterraform.pem # check the name
remote_user=vyos

mykey.pem

Copy your key.pem from AWS

instance.yml

##############################################################################
# About tasks:
# "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh␣
˓→connection every 60 seconds until 300 seconds

# "Configure general settings for the VyOS hosts group" - make provisioning into AWS␣
˓→VyOS node

# You have to add all necessary cammans of VyOS under the block "lines:"
##############################################################################

- name: integration of terraform and ansible

hosts: all
(continues on next page)

10.3. VyOS Terraform 1078

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

gather_facts: 'no'

tasks:

- name: "Wait 300 seconds, but only start checking after 60 seconds"
wait_for_connection:
delay: 60
timeout: 300

- name: "Configure general settings for the VyOS hosts group"

vyos_config:
lines:
- set system name-server xxx.xxx.xxx.xxx
save:
true

group_vars/all

ansible_connection: ansible.netcommon.network_cli
ansible_network_os: vyos.vyos.vyos
ansible_user: vyos

Sourse files for AWS from GIT

All files about the article can be found here

10.3.3 Deploying VyOS in the Azure cloud

With the help of Terraform, you can quickly deploy VyOS-based infrastructure in the Azure cloud. If necessary, the
infrastructure can be removed using terraform. Also we will make provisioning using Ansible.
In this case, we’ll create the necessary files for Terraform and Ansible next using Terraform we’ll create a single instance
on the Azure cloud and make provisioning using Ansible.

Preparation steps for deploying VyOS on Azure

How to create a single instance and install your configuration using Terraform+Ansible+Azure Step by step:
Azure
1 Create an account with Azure
Terraform
1 Create an UNIX or Windows instance
2 Download and install Terraform
3 Create the folder for example /root/azvyos/

mkdir /root/azvyos

4 Copy all files into your Terraform project "/root/azvyos" (vyos.tf, var.tf, terraform.
(continues on next page)

10.3. VyOS Terraform 1079

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

˓→ tfvars), more detailed see `Structure of files Terrafom for Azure`_

5 Login with Azure using the command

az login

2.6 Type the commands :

cd /<your folder>
terraform init

Ansible
1 Create an UNIX instance whenever you want (local, cloud, and so on)
2 Download and install Ansible
3 Create the folder for example /root/az/
4 Copy all files into your Ansible project “/root/az/” (ansible.cfg, instance.yml,”all”), more detailed see
Structure of files Ansible for Azure
Start
Type the commands on your Terrafom instance:

cd /<your folder>
terraform plan
terraform apply
yes

After executing all the commands you will have your VyOS instance on the Azure cloud with your configuration, it’s a
very convenient desition. If you need to delete the instance please type the command:

terraform destroy

Structure of files Terrafom for Azure

.
vyos.tf # The main script
var.tf # File for the changing version of␣
˓→Terraform.

terraform.tfvars # The value of all variables (passwords, login, ip␣

˓→adresses and so on)

10.3. VyOS Terraform 1080

 VyOS Documentation, Release 1.5.x (circinus)

File contents of Terrafom for Azure

vyos.tf

##############################################################################
# HashiCorp Guide to Using Terraform on Azure
# This Terraform configuration will create the following:
# Resource group with a virtual network and subnet
# An VyOS server without ssh key (only login+password)
##############################################################################

# Chouse a provider

provider "azurerm" {
features {}
}

# Create a resource group. In Azure every resource belongs to a

# resource group.

resource "azurerm_resource_group" "azure_vyos" {

name = "${var.resource_group}"
location = "${var.location}"
}

# The next resource is a Virtual Network.

resource "azurerm_virtual_network" "vnet" {

name = "${var.virtual_network_name}"
location = "${var.location}"
address_space = ["${var.address_space}"]
resource_group_name = "${var.resource_group}"
}

# Build a subnet to run our VMs in.

resource "azurerm_subnet" "subnet" {

name = "${var.prefix}subnet"
virtual_network_name = "${azurerm_virtual_network.vnet.name}"
resource_group_name = "${var.resource_group}"
address_prefixes = ["${var.subnet_prefix}"]
}

##############################################################################
# Build an VyOS VM from the Marketplace
# To finde nessesery image use the command:
#
# az vm image list --offer vyos --all
#
# Now that we have a network, we'll deploy an VyOS server.
# An Azure Virtual Machine has several components. In this example we'll build
# a security group, a network interface, a public ip address, a storage
# account and finally the VM itself. Terraform handles all the dependencies
(continues on next page)

10.3. VyOS Terraform 1081

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

# automatically, and each resource is named with user-defined variables.
##############################################################################

# Security group to allow inbound access on port 22 (ssh)

resource "azurerm_network_security_group" "vyos-sg" {

name = "${var.prefix}-sg"
location = "${var.location}"
resource_group_name = "${var.resource_group}"

security_rule {
name = "SSH"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "Tcp"
source_port_range = "*"
destination_port_range = "22"
source_address_prefix = "${var.source_network}"
destination_address_prefix = "*"
}
}

# A network interface.

resource "azurerm_network_interface" "vyos-nic" {

name = "${var.prefix}vyos-nic"
location = "${var.location}"
resource_group_name = "${var.resource_group}"

ip_configuration {
name = "${var.prefix}ipconfig"
subnet_id = "${azurerm_subnet.subnet.id}"
private_ip_address_allocation = "Dynamic"
public_ip_address_id = "${azurerm_public_ip.vyos-pip.id}"
}
}

# Add a public IP address.

resource "azurerm_public_ip" "vyos-pip" {

name = "${var.prefix}-ip"
location = "${var.location}"
resource_group_name = "${var.resource_group}"
allocation_method = "Dynamic"
}

# Build a virtual machine. This is a standard VyOS instance from Marketplace.

resource "azurerm_virtual_machine" "vyos" {

name = "${var.hostname}-vyos"
(continues on next page)

10.3. VyOS Terraform 1082

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

location = "${var.location}"
resource_group_name = "${var.resource_group}"
vm_size = "${var.vm_size}"

network_interface_ids = ["${azurerm_network_interface.vyos-nic.id}"]
delete_os_disk_on_termination = "true"

# To finde an information about the plan use the command:

# az vm image list --offer vyos --all

plan {
publisher = "sentriumsl"
name = "vyos-1-3"
product = "vyos-1-2-lts-on-azure"
}

storage_image_reference {
publisher = "${var.image_publisher}"
offer = "${var.image_offer}"
sku = "${var.image_sku}"
version = "${var.image_version}"
}

storage_os_disk {
name = "${var.hostname}-osdisk"
managed_disk_type = "Standard_LRS"
caching = "ReadWrite"
create_option = "FromImage"
}

os_profile {
computer_name = "${var.hostname}"
admin_username = "${var.admin_username}"
admin_password = "${var.admin_password}"
}

os_profile_linux_config {
disable_password_authentication = false
}
}

data "azurerm_public_ip" "example" {

depends_on = ["azurerm_virtual_machine.vyos"]
name = "vyos-ip"
resource_group_name = "${var.resource_group}"
}
output "public_ip_address" {
value = data.azurerm_public_ip.example.ip_address
}

# IP of AZ instance copied to a file ip.txt in local system

(continues on next page)

10.3. VyOS Terraform 1083

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

resource "local_file" "ip" {
content = data.azurerm_public_ip.example.ip_address
filename = "ip.txt"
}

#Connecting to the Ansible control node using SSH connection

resource "null_resource" "nullremote1" {

depends_on = ["azurerm_virtual_machine.vyos"]
connection {
type = "ssh"
user = "root"
password = var.password
host = var.host
}

# Copying the ip.txt file to the Ansible control node from local system

provisioner "file" {
source = "ip.txt"
destination = "/root/az/ip.txt"
}
}

resource "null_resource" "nullremote2" {

depends_on = ["azurerm_virtual_machine.vyos"]
connection {
type = "ssh"
user = "root"
password = var.password
host = var.host
}

# Command to run ansible playbook on remote Linux OS

provisioner "remote-exec" {

inline = [
"cd /root/az/",
"ansible-playbook instance.yml"
]
}
}

var.tf

##############################################################################
# Variables File
#
# Here is where we store the default values for all the variables used in our
# Terraform code.
##############################################################################
(continues on next page)

10.3. VyOS Terraform 1084

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

variable "resource_group" {
description = "The name of your Azure Resource Group."
default = "my_resource_group"
}

variable "prefix" {
description = "This prefix will be included in the name of some resources."
default = "vyos"
}

variable "hostname" {
description = "Virtual machine hostname. Used for local hostname, DNS, and storage-
˓→related names."

default = "vyos_terraform"
}

variable "location" {
description = "The region where the virtual network is created."
default = "centralus"
}

variable "virtual_network_name" {
description = "The name for your virtual network."
default = "vnet"
}

variable "address_space" {
description = "The address space that is used by the virtual network. You can supply␣
˓→more than one address space. Changing this forces a new resource to be created."

default = "10.0.0.0/16"
}

variable "subnet_prefix" {
description = "The address prefix to use for the subnet."
default = "10.0.10.0/24"
}

variable "storage_account_tier" {
description = "Defines the storage tier. Valid options are Standard and Premium."
default = "Standard"
}

variable "storage_replication_type" {
description = "Defines the replication type to use for this storage account. Valid␣
˓→options include LRS, GRS etc."

default = "LRS"
}

# The most chippers size

variable "vm_size" {
(continues on next page)

10.3. VyOS Terraform 1085

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

description = "Specifies the size of the virtual machine."
default = "Standard_B1s"
}

variable "image_publisher" {
description = "Name of the publisher of the image (az vm image list)"
default = "sentriumsl"
}

variable "image_offer" {
description = "Name of the offer (az vm image list)"
default = "vyos-1-2-lts-on-azure"
}

variable "image_sku" {
description = "Image SKU to apply (az vm image list)"
default = "vyos-1-3"
}

variable "image_version" {
description = "Version of the image to apply (az vm image list)"
default = "1.3.3"
}

variable "admin_username" {
description = "Administrator user name"
default = "vyos"
}

variable "admin_password" {
description = "Administrator password"
default = "Vyos0!"
}

variable "source_network" {
description = "Allow access from this network prefix. Defaults to '*'."
default = "*"
}

variable "password" {
description = "pass for Ansible"
type = string
sensitive = true
}
variable "host"{
description = "IP of my Ansible"
}

terraform.tfvars

password = "" # password for Ansible SSH

host = "" # IP of my Ansible

10.3. VyOS Terraform 1086

 VyOS Documentation, Release 1.5.x (circinus)

Structure of files Ansible for Azure

.
group_vars
all
ansible.cfg
instance.yml

File contents of Ansible for Azure

ansible.cfg

[defaults]
inventory = /root/az/ip.txt
host_key_checking= False
remote_user=vyos

instance.yml

##############################################################################
# About tasks:
# "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh␣
˓→connection every 60 seconds until 300 seconds

# "Configure general settings for the VyOS hosts group" - make provisioning into Azure␣
˓→VyOS node

# You have to add all necessary cammans of VyOS under the block "lines:"
##############################################################################

- name: integration of terraform and ansible

hosts: all
gather_facts: 'no'

tasks:

- name: "Wait 300 seconds, but only start checking after 60 seconds"
wait_for_connection:
delay: 60
timeout: 300

- name: "Configure general settings for the VyOS hosts group"

vyos_config:
lines:
- set system name-server xxx.xxx.xxx.xxx
save:
true

group_vars/all

ansible_connection: ansible.netcommon.network_cli
ansible_network_os: vyos.vyos.vyos

(continues on next page)

10.3. VyOS Terraform 1087

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

# user and password gets from terraform variables "admin_username" and "admin_password"␣
˓→in the file /root/azvyos/var.tf

ansible_user: vyos
ansible_ssh_pass: Vyos0!

Sourse files for Azure from GIT

All files about the article can be found here

10.3.4 Deploying VyOS in the vSphere infrastructure

With the help of Terraform, you can quickly deploy VyOS-based infrastructure in the vSphere. Also we will make
provisioning using Ansible.
In this case, we’ll create the necessary files for Terraform and Ansible next using Terraform we’ll create a single instance
on the vSphere cloud and make provisioning using Ansible.

Preparation steps for deploying VyOS on vSphere

How to create a single instance and install your configuration using Terraform+Ansible+vSphere Step by step:
vSphere
1 Collect all data in to file “terraform.tfvars” and create resources for example “terraform”
Terraform
1 Create an UNIX or Windows instance
2 Download and install Terraform
3 Create the folder for example /root/vsphereterraform

mkdir /root/vsphereterraform

4 Copy all files into your Terraform project "/root/vsphereterraform" (vyos.tf, var.tf,␣
˓→terraform.tfvars,version.tf), more detailed see `Structure of files Terrafom for␣
˓→vSphere`_

5 Type the commands :

cd /<your folder>
terraform init

Ansible
1 Create an UNIX instance whenever you want (local, cloud, and so on)
2 Download and install Ansible
3 Create the folder for example /root/vsphereterraform/
4 Copy all files into your Ansible project “/root/vsphereterraform/” (ansible.cfg, instance.yml,”all”), more
detailed see Structure of files Ansible for vSphere

10.3. VyOS Terraform 1088

 VyOS Documentation, Release 1.5.x (circinus)

Start
Type the commands on your Terrafom instance:

cd /<your folder>
terraform plan
terraform apply
yes

After executing all the commands you will have your VyOS instance on the vSphere with your configuration, it’s a very
convenient desition. If you need to delete the instance please type the command:

terraform destroy

Structure of files Terrafom for vSphere

.
vyos.tf # The main script
versions.tf # File for the changing version of Terraform.
var.tf # File for the changing version of␣
˓→Terraform.

terraform.tfvars # The value of all variables (passwords, login, ip␣

˓→adresses and so on)

File contents of Terrafom for vSphere

vyos.tf

provider "vsphere" {
user = var.vsphere_user
password = var.vsphere_password
vsphere_server = var.vsphere_server
allow_unverified_ssl = true
}

data "vsphere_datacenter" "datacenter" {

name = var.datacenter
}

data "vsphere_datastore" "datastore" {

name = var.datastore
datacenter_id = data.vsphere_datacenter.datacenter.id
}

data "vsphere_compute_cluster" "cluster" {

name = var.cluster
datacenter_id = data.vsphere_datacenter.datacenter.id
}

data "vsphere_resource_pool" "default" {

name = format("%s%s", data.vsphere_compute_cluster.cluster.name, "/Resources/
˓→terraform") # set as you need
(continues on next page)

10.3. VyOS Terraform 1089

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

datacenter_id = data.vsphere_datacenter.datacenter.id
}

data "vsphere_host" "host" {

name = var.host
datacenter_id = data.vsphere_datacenter.datacenter.id
}

data "vsphere_network" "network" {

name = var.network_name
datacenter_id = data.vsphere_datacenter.datacenter.id
}

# Deployment of VM from Remote OVF

resource "vsphere_virtual_machine" "vmFromRemoteOvf" {
name = var.remotename
datacenter_id = data.vsphere_datacenter.datacenter.id
datastore_id = data.vsphere_datastore.datastore.id
host_system_id = data.vsphere_host.host.id
resource_pool_id = data.vsphere_resource_pool.default.id
network_interface {
network_id = data.vsphere_network.network.id
}
wait_for_guest_net_timeout = 2
wait_for_guest_ip_timeout = 2

ovf_deploy {
allow_unverified_ssl_cert = true
remote_ovf_url = var.url_ova
disk_provisioning = "thin"
ip_protocol = "IPv4"
ip_allocation_policy = "dhcpPolicy"
ovf_network_map = {
"Network 1" = data.vsphere_network.network.id
"Network 2" = data.vsphere_network.network.id
}
}
vapp {
properties = {
"password" = "12345678",
"local-hostname" = "terraform_vyos"
}
}
}

output "ip" {
description = "default ip address of the deployed VM"
value = vsphere_virtual_machine.vmFromRemoteOvf.default_ip_address
}

# IP of vSphere instance copied to a file ip.txt in local system

(continues on next page)

10.3. VyOS Terraform 1090

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

resource "local_file" "ip" {
content = vsphere_virtual_machine.vmFromRemoteOvf.default_ip_address
filename = "ip.txt"
}

#Connecting to the Ansible control node using SSH connection

resource "null_resource" "nullremote1" {

depends_on = ["vsphere_virtual_machine.vmFromRemoteOvf"]
connection {
type = "ssh"
user = "root"
password = var.ansiblepassword
host = var.ansiblehost

# Copying the ip.txt file to the Ansible control node from local system

provisioner "file" {
source = "ip.txt"
destination = "/root/vsphere/ip.txt"
}
}

resource "null_resource" "nullremote2" {

depends_on = ["vsphere_virtual_machine.vmFromRemoteOvf"]
connection {
type = "ssh"
user = "root"
password = var.ansiblepassword
host = var.ansiblehost
}

# Command to run ansible playbook on remote Linux OS

provisioner "remote-exec" {

inline = [
"cd /root/vsphere/",
"ansible-playbook instance.yml"
]
}
}

versions.tf

# Copyright (c) HashiCorp, Inc.

# SPDX-License-Identifier: MPL-2.0

terraform {
required_providers {
(continues on next page)

10.3. VyOS Terraform 1091

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

vsphere = {
source = "hashicorp/vsphere"
version = "2.4.0"
}
}
}

var.tf

# Copyright (c) HashiCorp, Inc.

# SPDX-License-Identifier: MPL-2.0

variable "vsphere_server" {
description = "vSphere server"
type = string
}

variable "vsphere_user" {
description = "vSphere username"
type = string
}

variable "vsphere_password" {
description = "vSphere password"
type = string
sensitive = true
}

variable "datacenter" {
description = "vSphere data center"
type = string
}

variable "cluster" {
description = "vSphere cluster"
type = string
}

variable "datastore" {
description = "vSphere datastore"
type = string
}

variable "network_name" {
description = "vSphere network name"
type = string
}

variable "host" {
description = "name if yor host"
type = string
}
(continues on next page)

10.3. VyOS Terraform 1092

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

variable "remotename" {
description = "the name of you VM"
type = string
}

variable "url_ova" {
description = "the URL to .OVA file or cloude store"
type = string
}

variable "ansiblepassword" {
description = "Ansible password"
type = string
}

variable "ansiblehost" {
description = "Ansible host name or IP"
type = string
}

terraform.tfvars

vsphere_user = ""
vsphere_password = ""
vsphere_server = ""
datacenter = ""
datastore = ""
cluster = ""
network_name = ""
host = ""
url_ova = ""
ansiblepassword = ""
ansiblehost = ""
remotename = ""

Structure of files Ansible for vSphere

.
group_vars
all
ansible.cfg
instance.yml

10.3. VyOS Terraform 1093

 VyOS Documentation, Release 1.5.x (circinus)

File contents of Ansible for vSphere

ansible.cfg

[defaults]
inventory = /root/vsphere/ip.txt
host_key_checking= False
remote_user=vyos

instance.yml

##############################################################################
# About tasks:
# "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh␣
˓→connection every 60 seconds until 300 seconds

# "Configure general settings for the VyOS hosts group" - make provisioning into vSphere␣
˓→VyOS node

# You have to add all necessary cammans of VyOS under the block "lines:"
##############################################################################

- name: integration of terraform and ansible

hosts: all
gather_facts: 'no'

tasks:

- name: "Wait 300 seconds, but only start checking after 60 seconds"
wait_for_connection:
delay: 60
timeout: 300

- name: "Configure general settings for the VyOS hosts group"

vyos_config:
lines:
- set system name-server 8.8.8.8
save:
true

group_vars/all

ansible_connection: ansible.netcommon.network_cli
ansible_network_os: vyos.vyos.vyos

# user and password gets from terraform variables "admin_username" and "admin_password"
ansible_user: vyos
# get from vyos.tf "vapp"
ansible_ssh_pass: 12345678

10.3. VyOS Terraform 1094

 VyOS Documentation, Release 1.5.x (circinus)

Sourse files for vSphere from GIT

All files about the article can be found here

10.3.5 Deploying VyOS in the google cloud

With the help of Terraform, you can quickly deploy VyOS-based infrastructure in the google cloud. If necessary, the
infrastructure can be removed using terraform. Also we will make provisioning using Ansible.
In this case, we’ll create the necessary files for Terraform and Ansible next using Terraform we’ll create a single instance
on the google cloud and make provisioning using Ansible.

Preparation steps for deploying VyOS on google

How to create a single instance and install your configuration using Terraform+Ansible+google Step by step:
google cloud
1 Create an account with google cloud and a new project

The .JSON file download automaticly after creating and will look like:

Terraform

10.3. VyOS Terraform 1095

 VyOS Documentation, Release 1.5.x (circinus)

1 Create an UNIX or Windows instance

2 Download and install Terraform
3 Create the folder for example /root/google

mkdir /root/google

4 Copy all files into your Terraform project "/root/google" (vyos.tf, var.tf, terraform.
˓→tfvars, .JSON), more detailed see `Structure of files Terrafom for google cloud`_

5 Type the commands :

cd /<your folder>
terraform init

Ansible
1 Create an UNIX instance whenever you want (local, cloud, and so on)
2 Download and install Ansible
3 Create the folder for example /root/google/
4 Copy all files into your Ansible project “/root/google/” (ansible.cfg, instance.yml, mykey.json and “all”),
more detailed see Structure of files Ansible for google cloud
mykey.json you have to get using step 2 of the google cloud
Start
Type the commands on your Terrafom instance:

cd /<your folder>
terraform plan
terraform apply
yes

Start creating a google cloud instance and check the result

# terraform apply

Terraform used the selected providers to generate the following execution plan. Resource␣
˓→actions are indicated with the following symbols:

+ create

Terraform will perform the following actions:

# google_compute_firewall.tcp_22[0] will be created

+ resource "google_compute_firewall" "tcp_22" {
+ creation_timestamp = (known after apply)
+ destination_ranges = (known after apply)
+ direction = (known after apply)
+ enable_logging = (known after apply)
+ id = (known after apply)
+ name = "vyos-tcp-22"
(continues on next page)

10.3. VyOS Terraform 1096

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

+ network = "default"
+ priority = 1000
+ project = "vyosproject"
+ self_link = (known after apply)
+ source_ranges = [
+ "0.0.0.0/0",
]
+ target_tags = [
+ "vyos-deployment",
]

+ allow {
+ ports = [
+ "22",
]
+ protocol = "tcp"
}
}

# google_compute_firewall.udp_500_4500[0] will be created

+ resource "google_compute_firewall" "udp_500_4500" {
+ creation_timestamp = (known after apply)
+ destination_ranges = (known after apply)
+ direction = (known after apply)
+ enable_logging = (known after apply)
+ id = (known after apply)
+ name = "vyos-udp-500-4500"
+ network = "default"
+ priority = 1000
+ project = "vyosproject"
+ self_link = (known after apply)
+ source_ranges = [
+ "0.0.0.0/0",
]
+ target_tags = [
+ "vyos-deployment",
]

+ allow {
+ ports = [
+ "500",
+ "4500",
]
+ protocol = "udp"
}
}

# google_compute_instance.default will be created

+ resource "google_compute_instance" "default" {
+ can_ip_forward = true
+ cpu_platform = (known after apply)
+ current_status = (known after apply)
(continues on next page)

10.3. VyOS Terraform 1097

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

+ deletion_protection = false
+ effective_labels = (known after apply)
+ guest_accelerator = (known after apply)
+ id = (known after apply)
+ instance_id = (known after apply)
+ label_fingerprint = (known after apply)
+ machine_type = "n2-highcpu-4"
+ metadata = {
+ "enable-oslogin" = "FALSE"
+ "serial-port-enable" = "TRUE"
+ "user-data" = ""
}
+ metadata_fingerprint = (known after apply)
+ min_cpu_platform = (known after apply)
+ name = "vyos"
+ project = "vyosproject"
+ self_link = (known after apply)
+ tags_fingerprint = (known after apply)
+ terraform_labels = (known after apply)
+ zone = "us-west1-a"

+ boot_disk {
+ auto_delete = true
+ device_name = (known after apply)
+ disk_encryption_key_sha256 = (known after apply)
+ kms_key_self_link = (known after apply)
+ mode = "READ_WRITE"
+ source = (known after apply)

+ initialize_params {
+ image = "projects/sentrium-public/global/images/vyos-1-
˓→3-5-20231222143039"

+ labels = (known after apply)

+ provisioned_iops = (known after apply)
+ provisioned_throughput = (known after apply)
+ size = (known after apply)
+ type = (known after apply)
}
}

+ network_interface {
+ internal_ipv6_prefix_length = (known after apply)
+ ipv6_access_type = (known after apply)
+ ipv6_address = (known after apply)
+ name = (known after apply)
+ network = "default"
+ network_ip = (known after apply)
+ nic_type = "GVNIC"
+ stack_type = (known after apply)
+ subnetwork = "default"
+ subnetwork_project = (known after apply)

(continues on next page)

10.3. VyOS Terraform 1098

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

+ access_config {
+ nat_ip = (known after apply)
+ network_tier = (known after apply)
}
}
}

# local_file.ip will be created

+ resource "local_file" "ip" {
+ content = (known after apply)
+ content_base64sha256 = (known after apply)
+ content_base64sha512 = (known after apply)
+ content_md5 = (known after apply)
+ content_sha1 = (known after apply)
+ content_sha256 = (known after apply)
+ content_sha512 = (known after apply)
+ directory_permission = "0777"
+ file_permission = "0777"
+ filename = "ip.txt"
+ id = (known after apply)
}

# null_resource.SSHconnection1 will be created

+ resource "null_resource" "SSHconnection1" {
+ id = (known after apply)
}

# null_resource.SSHconnection2 will be created

+ resource "null_resource" "SSHconnection2" {
+ id = (known after apply)
}

Plan: 6 to add, 0 to change, 0 to destroy.

Changes to Outputs:
+ public_ip_address = (known after apply)

Warning: Quoted references are deprecated

on vyos.tf line 126, in resource "null_resource" "SSHconnection1":

126: depends_on = ["google_compute_instance.default"]

In this context, references are expected literally rather than in quotes. Terraform 0.
˓→11 and earlier required quotes, but quoted references are now deprecated and will be␣
˓→removed in a

future version of Terraform. Remove the quotes surrounding this reference to silence␣
˓→this warning.

(and one more similar warning elsewhere)

Do you want to perform these actions?

(continues on next page)

10.3. VyOS Terraform 1099

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.

Enter a value: yes

google_compute_firewall.udp_500_4500[0]: Creating...
google_compute_firewall.tcp_22[0]: Creating...
google_compute_instance.default: Creating...
google_compute_firewall.udp_500_4500[0]: Still creating... [10s elapsed]
google_compute_firewall.tcp_22[0]: Still creating... [10s elapsed]
google_compute_instance.default: Still creating... [10s elapsed]
google_compute_firewall.tcp_22[0]: Creation complete after 16s [id=projects/vyosproject/
˓→global/firewalls/vyos-tcp-22]

google_compute_firewall.udp_500_4500[0]: Creation complete after 16s [id=projects/

˓→vyosproject/global/firewalls/vyos-udp-500-4500]

google_compute_instance.default: Creation complete after 20s [id=projects/vyosproject/

˓→zones/us-west1-a/instances/vyos]

null_resource.SSHconnection1: Creating...
null_resource.SSHconnection2: Creating...
null_resource.SSHconnection1: Provisioning with 'file'...
null_resource.SSHconnection2: Provisioning with 'remote-exec'...
null_resource.SSHconnection2 (remote-exec): Connecting to remote host via SSH...
null_resource.SSHconnection2 (remote-exec): Host: 10.***.***.104
null_resource.SSHconnection2 (remote-exec): User: root
null_resource.SSHconnection2 (remote-exec): Password: true
null_resource.SSHconnection2 (remote-exec): Private key: false
null_resource.SSHconnection2 (remote-exec): Certificate: false
null_resource.SSHconnection2 (remote-exec): SSH Agent: false
null_resource.SSHconnection2 (remote-exec): Checking Host Key: false
null_resource.SSHconnection2 (remote-exec): Target Platform: unix
local_file.ip: Creating...
local_file.ip: Creation complete after 0s [id=7d568c3b994a018c942a3cdb952ccbf3c729d0ca]
null_resource.SSHconnection2 (remote-exec): Connected!
null_resource.SSHconnection1: Creation complete after 4s [id=5175298735911137161]

null_resource.SSHconnection2 (remote-exec): PLAY [integration of terraform and ansible]␣

˓→************************************

null_resource.SSHconnection2 (remote-exec): TASK [Wait 300 seconds, but only start␣

˓→checking after 60 seconds] **************

null_resource.SSHconnection2: Still creating... [10s elapsed]

null_resource.SSHconnection2: Still creating... [20s elapsed]
null_resource.SSHconnection2: Still creating... [30s elapsed]
null_resource.SSHconnection2: Still creating... [40s elapsed]
null_resource.SSHconnection2: Still creating... [50s elapsed]
null_resource.SSHconnection2: Still creating... [1m0s elapsed]
null_resource.SSHconnection2: Still creating... [1m10s elapsed]
null_resource.SSHconnection2 (remote-exec): ok: [104.***.***.158]

null_resource.SSHconnection2 (remote-exec): TASK [Configure general settings for the␣

˓→vyos hosts group] *********************

null_resource.SSHconnection2: Still creating... [1m20s elapsed]

(continues on next page)

10.3. VyOS Terraform 1100

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

null_resource.SSHconnection2 (remote-exec): changed: [104.***.***.158]

null_resource.SSHconnection2 (remote-exec): PLAY RECAP␣

˓→*********************************************************************

null_resource.SSHconnection2 (remote-exec): 104.***.***.158 : ok=2 ␣

˓→changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

null_resource.SSHconnection2: Creation complete after 1m22s [id=3355727070503709742]

Apply complete! Resources: 6 added, 0 changed, 0 destroyed.

Outputs:

public_ip_address = "104.***.***.158"

After executing all the commands you will have your VyOS instance on the google cloud with your configuration, it’s
a very convenient desition. If you need to delete the instance please type the command:

terraform destroy

Troubleshooting

1 Increase the time in the file instance.yml from 300 sec to 500 sec or more. (It depends on your location).
Make sure that you have opened access to the instance in the security group.
2 Terraform doesn’t connect via SSH to your Ansible instance: you have to check the correct login and
password in the part of the file VyOS.tf

connection {
type = "ssh"
user = "root" # open root access using login and password on your␣
˓→Ansible

password = var.password # check password in the file terraform.tfvars isn't empty

host = var.host # check the correct IP address of your Ansible host
}

Make sure that Ansible is pinging from Terrafom.

Structure of files Terrafom for google cloud

.
vyos.tf # The main script
***.JSON # The credential file from google cloud
var.tf # The file of all variables in "vyos.tf"
terraform.tfvars # The value of all variables (passwords, login, ip␣
˓→adresses and so on)

10.3. VyOS Terraform 1101

 VyOS Documentation, Release 1.5.x (circinus)

File contents of Terrafom for google cloud

vyos.tf

##############################################################################
# Build an VyOS VM from the Marketplace
#
# After deploying the GCP instance and getting an IP address, the IP address is copied␣
˓→into the file

#"ip.txt" and copied to the Ansible node for provisioning.

##############################################################################

terraform {
required_providers {
google = {
source = "hashicorp/google"
}
}
}

provider "google" {
project = var.project_id
request_timeout = "60s"
credentials = file(var.gcp_auth_file)
}

locals {
network_interfaces = [for i, n in var.networks : {
network = n,
subnetwork = length(var.sub_networks) > i ? element(var.sub_networks, i) : null
external_ip = length(var.external_ips) > i ? element(var.external_ips, i) : "NONE"
}
]
}

resource "google_compute_instance" "default" {

name = var.goog_cm_deployment_name
machine_type = var.machine_type
zone = var.zone

metadata = {
enable-oslogin = "FALSE"
serial-port-enable = "TRUE"
user-data = var.vyos_user_data
}
boot_disk {
initialize_params {
image = var.image
}
}

can_ip_forward = true

(continues on next page)

10.3. VyOS Terraform 1102

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

dynamic "network_interface" {
for_each = local.network_interfaces
content {
network = network_interface.value.network
subnetwork = network_interface.value.subnetwork
nic_type = "GVNIC"
dynamic "access_config" {
for_each = network_interface.value.external_ip == "NONE" ? [] : [1]
content {
nat_ip = network_interface.value.external_ip == "EPHEMERAL" ? null : network_
˓→interface.value.external_ip

}
}
}
}
}

resource "google_compute_firewall" "tcp_22" {

count = var.enable_tcp_22 ? 1 : 0

name = "${var.goog_cm_deployment_name}-tcp-22"
network = element(var.networks, 0)

allow {
ports = ["22"]
protocol = "tcp"
}

source_ranges = ["0.0.0.0/0"]

target_tags = ["${var.goog_cm_deployment_name}-deployment"]
}

resource "google_compute_firewall" "udp_500_4500" {

count = var.enable_udp_500_4500 ? 1 : 0

name = "${var.goog_cm_deployment_name}-udp-500-4500"
network = element(var.networks, 0)

allow {
ports = ["500", "4500"]
protocol = "udp"
}

source_ranges = ["0.0.0.0/0"]

target_tags = ["${var.goog_cm_deployment_name}-deployment"]
}

output "public_ip_address" {
value = google_compute_instance.default.network_interface[0].access_config[0].nat_ip
}
(continues on next page)

10.3. VyOS Terraform 1103

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

##############################################################################
#
# IP of google instance copied to a file ip.txt in local system Terraform
# ip.txt looks like:
# cat ./ip.txt
# ...
##############################################################################

resource "local_file" "ip" {

content = google_compute_instance.default.network_interface[0].access_config[0].nat_
˓→ip

filename = "ip.txt"
}

#connecting to the Ansible control node using SSH connection

##############################################################################
# Steps "SSHconnection1" and "SSHconnection2" need to get file ip.txt from the terraform␣
˓→node and start remotely the playbook of Ansible.

##############################################################################

resource "null_resource" "SSHconnection1" {

depends_on = ["google_compute_instance.default"]
connection {
type = "ssh"
user = "root"
password = var.password
host = var.host
}

#copying the ip.txt file to the Ansible control node from local system

provisioner "file" {
source = "ip.txt"
destination = "/root/google/ip.txt" # The folder of your␣
˓→Ansible project

}
}

resource "null_resource" "SSHconnection2" {

depends_on = ["google_compute_instance.default"]
connection {
type = "ssh"
user = "root"
password = var.password
host = var.host
}

#command to run Ansible playbook on remote Linux OS

provisioner "remote-exec" {
(continues on next page)

10.3. VyOS Terraform 1104

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

inline = [
"cd /root/google/",
"ansible-playbook instance.yml" # more detailed in
˓→"File contents of Ansible for google cloud"

]
}
}

var.tf

variable "image" {
type = string
default = "projects/sentrium-public/global/images/vyos-1-3-5-20231222143039"
}

variable "project_id" {
type = string
}

variable "zone" {
type = string
}

##############################################################################
# You can choose more chipper type than n2-highcpu-4
##############################################################################

variable "machine_type" {
type = string
default = "n2-highcpu-4"
}

variable "networks" {
description = "The network name to attach the VM instance."
type = list(string)
default = ["default"]
}

variable "sub_networks" {
description = "The sub network name to attach the VM instance."
type = list(string)
default = ["default"]
}

variable "external_ips" {
description = "The external IPs assigned to the VM for public access."
type = list(string)
default = ["EPHEMERAL"]
}

variable "enable_tcp_22" {
description = "Allow SSH traffic from the Internet"
(continues on next page)

10.3. VyOS Terraform 1105

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

type = bool
default = true
}

variable "enable_udp_500_4500" {
description = "Allow IKE/IPSec traffic from the Internet"
type = bool
default = true
}

variable "vyos_user_data" {
type = string
default = ""
}

// Marketplace requires this variable name to be declared

variable "goog_cm_deployment_name" {
description = "VyOS Universal Router Deployment"
type = string
default = "vyos"
}

# GCP authentication file

variable "gcp_auth_file" {
type = string
description = "GCP authentication file"
}

variable "password" {
description = "pass for Ansible"
type = string
sensitive = true
}
variable "host"{
description = "The IP of my Ansible"
type = string
}

terraform.tfvars

##############################################################################
# Must be filled in
##############################################################################

zone = "us-west1-a"
gcp_auth_file = "/root/***/***.json" # path of your .json file
project_id = "" # the google project
password = "" # password for Ansible SSH
host = "" # IP of my Ansible

10.3. VyOS Terraform 1106

 VyOS Documentation, Release 1.5.x (circinus)

Structure of files Ansible for google cloud

.
group_vars
all
ansible.cfg
instance.yml

File contents of Ansible for google cloud

ansible.cfg

[defaults]
inventory = /root/google/ip.txt
host_key_checking= False
remote_user=vyos

instance.yml

##############################################################################
# About tasks:
# "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh␣
˓→connection every 60 seconds until 300 seconds

# "Configure general settings for the VyOS hosts group" - make provisioning into google␣
˓→cloud VyOS node

# You have to add all necessary cammans of VyOS under the block "lines:"
##############################################################################

- name: integration of terraform and ansible

hosts: all
gather_facts: 'no'

tasks:

- name: "Wait 300 seconds, but only start checking after 60 seconds"
wait_for_connection:
delay: 60
timeout: 300

- name: "Configure general settings for the VyOS hosts group"

vyos_config:
lines:
- set system name-server xxx.xxx.xxx.xxx
save:
true

group_vars/all

ansible_connection: ansible.netcommon.network_cli
ansible_network_os: vyos.vyos.vyos
ansible_user: vyos
ansible_ssh_pass: vyos

10.3. VyOS Terraform 1107

 VyOS Documentation, Release 1.5.x (circinus)

Sourse files for google cloud from GIT

All files about the article can be found here

10.4 Napalm

VyOS supports some napalm functions for configuration and op-mode. It requires more tests.
Install napalm-vyos module

apt install python3-pip

pip3 install napalm
pip3 install napalm-vyos

10.4.1 Op-mode

#!/usr/bin/env python3

import json
from napalm import get_network_driver

driver = get_network_driver('vyos')

vyos_router = driver(
hostname="192.0.2.1",
username="vyos",
password="vyospass",
optional_args={"port": 22},
)

vyos_router.open()
output = vyos_router.get_facts()
print(json.dumps(output, indent=4))

output = vyos_router.get_arp_table()
print(json.dumps(output, indent=4))

vyos_router.close()

Output op-mode

$ ./vyos-napalm.py
{
"uptime": 7185,
"vendor": "VyOS",
"os_version": "1.3.0-rc5",
"serial_number": "",
"model": "Standard PC (Q35 + ICH9, 2009)",
"hostname": "r4-1.3",
"fqdn": "vyos.local",
"interface_list": [
(continues on next page)

10.4. Napalm 1108

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

"eth0",
"eth1",
"eth2",
"lo",
"vtun10"
]
}
[
{
"interface": "eth1",
"mac": "52:54:00:b2:38:2c",
"ip": "192.0.2.2",
"age": 0.0
},
{
"interface": "eth0",
"mac": "52:54:00:a2:b9:5b",
"ip": "203.0.113.11",
"age": 0.0
}
]

10.4.2 Configuration

We need 2 files, commands.conf and script itself.

Content of commands.conf
set service ssh disable-host-validation
set service ssh port '2222'
set system name-server '192.0.2.8'
set system name-server '203.0.113.8'
set interfaces ethernet eth1 description 'FOO'

Script vyos-napalm.py

#!/usr/bin/env python3

from napalm import get_network_driver

driver = get_network_driver('vyos')

vyos_router = driver(
hostname="192.0.2.1",
username="vyos",
password="vyospass",
optional_args={"port": 22},
)

vyos_router.open()
vyos_router.load_merge_candidate(filename='commands.conf')
diffs = vyos_router.compare_config()
(continues on next page)

10.4. Napalm 1109

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

if bool(diffs) == True:
print(diffs)
vyos_router.commit_config()
else:
print('No configuration changes to commit')
vyos_router.discard_config()

vyos_router.close()

Output

$./vyos-napalm.py
[edit interfaces ethernet eth1]
+description FOO
[edit service ssh]
+disable-host-validation
+port 2222
[edit system]
+name-server 192.0.2.8
+name-server 203.0.113.8
[edit]

10.5 Netmiko

VyOS supports configuration via netmiko. It requires to install python3-netmiko module.

10.5.1 Example

#!/usr/bin/env python3

from netmiko import ConnectHandler

vyos_router = {
"device_type": "vyos",
"host": "192.0.2.1",
"username": "vyos",
"password": "vyospass",
"port": 22,
}

net_connect = ConnectHandler(**vyos_router)

config_commands = [
'set interfaces ethernet eth0 description WAN',
'set interfaces ethernet eth1 description LAN',
]

# set configuration
(continues on next page)

10.5. Netmiko 1110

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

output = net_connect.send_config_set(config_commands, exit_config_mode=False)
print(output)

# commit configuration
output = net_connect.commit()
print(output)

# op-mode commands
output = net_connect.send_command("run show interfaces")
print(output)

Output

$ ./vyos-netmiko.py
configure
set interfaces ethernet eth0 description WAN
[edit]
[email protected]# set interfaces ethernet eth1 description LAN
[edit]
[email protected]#
commit
[edit]
[email protected]#
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
eth0 203.0.113.1/24 u/u WAN
eth1 192.0.2.1/30 u/u LAN
eth2 - u/u
lo 127.0.0.1/8 u/u
::1/128
vtun10 10.10.0.1/24 u/u
[edit]

10.6 Salt

VyOS supports op-mode and configuration via salt.

Without proxy it requires VyOS minion configuration and supports op-mode data:

set service salt-minion id 'r14'

set service salt-minion master '192.0.2.250'

Check salt-keys on the salt master

/ # salt-key --list-all
Accepted Keys:
r11
Denied Keys:
Unaccepted Keys:
(continues on next page)

10.6. Salt 1111

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

r14
Rejected Keys:

Accept minion key

/ # salt-key --accept r14
The following keys are going to be accepted:
Unaccepted Keys:
r14
Proceed? [n/Y] y
Key for minion r14 accepted.

Check that salt master can communicate with minions

/ # salt '*' test.ping
r14:
True
r11:
True

At this step we can get some op-mode information from VyOS nodes:
/ # salt '*' network.interface eth0
r11:
|_
----------
address:
192.0.2.11
broadcast:
192.0.2.255
label:
eth0
netmask:
255.255.255.0
r14:
|_
----------
address:
192.0.2.14
broadcast:
192.0.2.255
label:
eth0
netmask:
255.255.255.0

/ # salt r14 network.arp

r14:
----------
aa:bb:cc:dd:f3:db:
192.0.2.1
aa:bb:cc:dd:2e:80:
(continues on next page)

10.6. Salt 1112

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

203.0.113.1

10.6.1 Netmiko-proxy

It is possible to configure VyOS via netmiko proxy module. It requires a minion with installed packet
python3-netmiko module who has a connection to VyOS nodes. Salt-minion have to communicate with salt master

Configuration

Salt master configuration:

/ # cat /etc/salt/master
file_roots:
base:
- /srv/salt/states

pillar_roots:
base:
- /srv/salt/pillars

Structure of /srv/salt:

/ # tree /srv/salt/
/srv/salt/
|___ pillars
| |__ r11-proxy.sls
| |__ top.sls
|___ states
|__ commands.txt

top.sls

/ # cat /srv/salt/pillars/top.sls
base:
r11-proxy:
- r11-proxy

r11-proxy.sls Includes parameters for connecting to salt-proxy minion

/ # cat /srv/salt/pillars/r11-proxy.sls
proxy:
proxytype: netmiko # how to connect to proxy minion, change it
device_type: vyos #
host: 192.0.2.250
username: user
password: secret_passwd

commands.txt

10.6. Salt 1113

 VyOS Documentation, Release 1.5.x (circinus)

/ # cat /srv/salt/states/commands.txt
set interfaces ethernet eth0 description 'WAN'
set interfaces ethernet eth1 description 'LAN'

Check that proxy minion is alive:

/ # salt r11-proxy test.ping

r11-proxy:
True
/ #

Examples

Example of op-mode:

/ # salt r11-proxy netmiko.send_command 'show interfaces ethernet eth0 brief' host=192.0.

˓→2.14 device_type=vyos username=vyos password=vyos

r11-proxy:
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
eth0 192.0.2.14/24 u/u Upstream
/ #

Example of configuration:

/ # salt r11-proxy netmiko.send_config config_commands=['set interfaces ethernet eth0␣

˓→description Link_to_WAN'] commit=True host=192.0.2.14 device_type=vyos username=vyos␣

˓→password=vyos

r11-proxy:
configure
set interfaces ethernet eth0 description Link_to_WAN
[edit]
vyos@r14# commit
[edit]
vyos@r14#
/ #

Example of configuration commands from the file “/srv/salt/states/commands.txt”

/ # salt r11-proxy netmiko.send_config config_file=salt://commands.txt commit=True␣

˓→host=192.0.2.11 device_type=vyos username=vyos password=vyos

r11-proxy:
configure
set interfaces ethernet eth0 description 'WAN'
[edit]
vyos@r1# set interfaces ethernet eth1 description 'LAN'
[edit]
vyos@r1# commit
[edit]
vyos@r1#
/ #

10.6. Salt 1114

 VyOS Documentation, Release 1.5.x (circinus)

10.7 Command Scripting

VyOS supports executing configuration and operational commands non-interactively from shell scripts.
To include VyOS specific functions and aliases you need to source /opt/vyatta/etc/functions/
script-template files at the top of your script.

#!/bin/vbash
source /opt/vyatta/etc/functions/script-template
exit

10.7.1 Run configuration commands

Configuration commands are executed just like from a normal config session. For example, if you want to disable a
BGP peer on VRRP transition to backup:

#!/bin/vbash
source /opt/vyatta/etc/functions/script-template
configure
set protocols bgp system-as 65536
set protocols bgp neighbor 192.168.2.1 shutdown
commit
exit

10.7.2 Run operational commands

Unlike a normal configuration session, all operational commands must be prepended with run, even if you haven’t
created a session with configure.

#!/bin/vbash
source /opt/vyatta/etc/functions/script-template
run show interfaces
exit

10.7.3 Run commands remotely

Sometimes you simply want to execute a bunch of op-mode commands via SSH on a remote VyOS system.

ssh 192.0.2.1 'vbash -s' <<EOF

source /opt/vyatta/etc/functions/script-template
run show interfaces
exit
EOF

Will return:

Welcome to VyOS
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
(continues on next page)

10.7. Command Scripting 1115

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

eth0 192.0.2.1/24 u/u
lo 127.0.0.1/8 u/u
::1/128

10.7.4 Other script languages

If you want to script the configs in a language other than bash you can have your script output commands and then
source them in a bash script.
Here is a simple example:

#!/usr/bin/env python3
print("delete firewall group address-group somehosts")
print("set firewall group address-group somehosts address '192.0.2.3'")
print("set firewall group address-group somehosts address '203.0.113.55'")

#!/bin/vbash
source /opt/vyatta/etc/functions/script-template
configure
source <(/config/scripts/setfirewallgroup.py)
commit

10.7.5 Executing Configuration Scripts

There is a pitfall when working with configuration scripts. It is tempting to call configuration scripts with “sudo” (i.e.,
temporary root permissions), because that’s the common way on most Linux platforms to call system commands.
On VyOS this will cause the following problem: After modifying the configuration via script like this once, it is not
possible to manually modify the config anymore:

sudo ./myscript.sh # Modifies config

configure
set ... # Any configuration parameter

This will result in the following error message: Set failed If this happens, a reboot is required to be able to edit the
config manually again.
To avoid these problems, the proper way is to call a script with the vyattacfg group, e.g., by using the sg (switch
group) command:

sg vyattacfg -c ./myscript.sh

To make sure that a script is not accidentally called without the vyattacfg group, the script can be safeguarded like
this:

if [ "$(id -g -n)" != 'vyattacfg' ] ; then

exec sg vyattacfg -c "/bin/vbash $(readlink -f $0) $@"
fi

10.7. Command Scripting 1116

 VyOS Documentation, Release 1.5.x (circinus)

10.7.6 Executing pre-hooks/post-hooks Scripts

VyOS has the ability to run custom scripts before and after each commit
The default directories where your custom Scripts should be located are:

/config/scripts/commit/pre-hooks.d - Directory with scripts that run before

each commit.

/config/scripts/commit/post-hooks.d - Directory with scripts that run after

each commit.

Scripts are run in alphabetical order. Their names must consist entirely of ASCII upper- and lower-case letters,ASCII
digits, ASCII underscores, and ASCII minus-hyphens.No other characters are allowed.

Note: Custom scripts are not executed with root privileges (Use sudo inside if this is necessary).

A simple example is shown below, where the ops command executed in the post-hook script is “show interfaces”.

vyos@vyos# set interfaces ethernet eth1 address 192.0.2.3/24

vyos@vyos# commit
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
eth0 198.51.100.10/24 u/u
eth1 192.0.2.3/24 u/u
eth2 - u/u
eth3 - u/u
lo 203.0.113.5/24 u/u

10.7.7 Preconfig on boot

The /config/scripts/vyos-preconfig-bootup.script script is called on boot before the VyOS configuration

during boot process.
Any modifications were done to work around unfixed bugs and implement enhancements that are not complete in the
VyOS system can be placed here.
The default file looks like this:

#!/bin/sh
# This script is executed at boot time before VyOS configuration is applied.
# Any modifications required to work around unfixed bugs or use
# services not available through the VyOS CLI system can be placed here.

10.7. Command Scripting 1117

 VyOS Documentation, Release 1.5.x (circinus)

10.7.8 Postconfig on boot

The /config/scripts/vyos-postconfig-bootup.script script is called on boot after the VyOS configuration

is fully applied.
Any modifications were done to work around unfixed bugs and implement enhancements that are not complete in the
VyOS system can be placed here.
The default file looks like this:

#!/bin/sh
# This script is executed at boot time after VyOS configuration is fully
# applied. Any modifications required to work around unfixed bugs or use
# services not available through the VyOS CLI system can be placed here.

Hint: For configuration/upgrade management issues, modification of this script should be the last option. Always try
to find solutions based on CLI commands first.

10.8 VyOS cloud-init

Cloud and virtualized instances of VyOS are initialized using the industry-standard cloud-init. Via cloud-init, the
system performs tasks such as injecting SSH keys and configuring the network. In addition, the user can supply a
custom configuration at the time of instance launch.

10.8.1 Config Sources

VyOS support three types of config sources.

• Metadata - Metadata is sourced by the cloud platform or hypervisor. In some clouds, there is implemented as an
HTTP endpoint at http://169.254.169.254.
• Network configuration - This config source informs the system about the network settings like IP addresses,
routes, DNS. Available only in several cloud and virtualization platforms.
• User-data - User-data is specified by the user. This config source offers the ability to insert any CLI configuration
commands into the configuration before the first boot.

10.8.2 User-data

Major cloud providers offer a means of providing user-data at the time of instance launch. It can be provided as plain
text or as base64-encoded text, depending on cloud provider. Also, it can be compressed using gzip, which makes sense
with a long configuration commands list, because of the hard limit to ~16384 bytes for the whole user-data.
The easiest way to configure the system via user-data is the Cloud-config syntax described below.

10.8. VyOS cloud-init 1118

 VyOS Documentation, Release 1.5.x (circinus)

10.8.3 Cloud-config modules

In VyOS, by default, enables only two modules:

• write_files - this module allows to insert any files into the filesystem before the first boot, for example, pre-
generated encryption keys, certificates, or even a whole config.boot file. The format is described in the clou-
dinit documentation Cloud-init-write_files.
• vyos_userdata - the module accepts a list of CLI configuration commands in a vyos_config_commands
section, which gives an easy way to configure the system during deployment.

10.8.4 cloud-config file format

A cloud-config document is written in YAML. The file must begin with #cloud-config line. The only supported
top-level keys are vyos_config_commands and write_files. The use of these keys is described in the following
two sections.

10.8.5 Initial Configuration

The key used to designate a VyOS configuration is vyos_config_commands. What follows is VyOS configuration
using the “set-style” syntax. Both “set” and “delete” commands are supported.
Commands requirements:
• One command per line.
• If command ends in a value, it must be inside single quotes.
• A single-quote symbol is not allowed inside command or value.
The commands list produced by the show configuration commands command on a VyOS router should comply
with all the requirements, so it is easy to get a proper commands list by copying it from another router.
The configuration specified in the cloud-config document overwrites default configuration values and values configured
via Metadata.
After the vyos_config_commands are executed, cloud-init will automatically perform a commit and save operation.
Here is an example cloud-config that appends configuration at the time of first boot.

#cloud-config
vyos_config_commands:
- set system host-name 'vyos-prod-ashburn'
- set service ntp server 1.pool.ntp.org
- set service ntp server 2.pool.ntp.org
- delete interfaces ethernet eth1 address 'dhcp'
- set interfaces ethernet eth1 address '192.0.2.247/24'
- set protocols static route 198.51.100.0/24 next-hop '192.0.2.1'

10.8. VyOS cloud-init 1119

 VyOS Documentation, Release 1.5.x (circinus)

System Defaults/Fallbacks

These are the VyOS defaults and fallbacks.

• SSH is configured on port 22.
• vyos/vyos credentials if no others specified by data source.
• DHCP on first Ethernet interface if no network configuration is provided.
All of these can be overridden using the configuration in user-data.

10.8.6 Command Execution at Initial Boot

VyOS supports the execution of operational commands and linux commands at initial boot. This is ac-
complished using write_files to certain files in the /opt/vyatta/etc/config/scripts directory. Commands
specified in opt/vyatta/etc/config/scripts/vyos-preconfig-bootup.script are executed prior to configuration. The
/opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script file contains commands to be executed after configuration.
In both cases, commands are executed as the root user.
Note that the /opt/vyatta/etc/config is used instead of the /config/scripts directory referenced in the Command Script-
ing section of the documentation because the /config/script directory isn’t mounted when the write_files module
executes.
The following example shows how to execute commands after the initial configuration.

#cloud-config
write_files:
- path: /opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script
owner: root:vyattacfg
permissions: '0775'
content: |
#!/bin/vbash
source /opt/vyatta/etc/functions/script-template
filename=/tmp/bgp_status_`date +"%Y_%m_%d_%I_%M_%p"`.log
run show ip bgp summary >> $filename

If you need to gather information from linux commands to configure VyOS, you can execute commands and then
configure VyOS in the same script.
The following example sets the hostname based on the instance identifier obtained from the EC2 metadata service.

#cloud-config
write_files:
- path: /opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script
owner: root:vyattacfg
permissions: '0775'
content: |
#!/bin/vbash
source /opt/vyatta/etc/functions/script-template
hostname=`curl -s http://169.254.169.254/latest/meta-data/instance-id`
configure
set system host-name $hostname
commit
exit

10.8. VyOS cloud-init 1120

 VyOS Documentation, Release 1.5.x (circinus)

10.8.7 NoCloud

Injecting configuration data is not limited to cloud platforms. Users can employ the NoCloud data source to inject
user-data and meta-data on virtualization platforms such as VMware, Hyper-V and KVM.
While other methods exist, the most straightforward method for using the NoCloud data source is creating a seed ISO
and attaching it to the virtual machine as a CD drive. The volume must be formatted as a vfat or ISO 9660 file system
with the label “cidata” or “CIDATA”.
Create text files named user-data and meta-data. On linux-based systems, the mkisofs utility can be used to create the
seed ISO. The following syntax will add these files to the ISO 9660 file system.

mkisofs -joliet -rock -volid "cidata" -output seed.iso meta-data user-data

The seed.iso file can be attached to the virtual machine. As an example, the method with KVM to attach the ISO as a
CD drive follows.

$ virt-install -n vyos_r1 \
--ram 4096 \
--vcpus 2 \
--cdrom seed.iso \
--os-type linux \
--os-variant debian10 \
--network network=default \
--graphics vnc \
--hvm \
--virt-type kvm \
--disk path=/var/lib/libvirt/images/vyos_kvm.qcow2,bus=virtio \
--import \
--noautoconsole

For more information on the NoCloud data source, visit its page nocloud in the cloud-init documentation.

10.8.8 Troubleshooting

If you encounter problems, verify that the cloud-config document contains valid YAML. Online resources such as
https://www.yamllint.com/ provide a simple tool for validating YAML.
cloud-init logs to /var/log/cloud-init.log. This file can be helpful in determining why the configuration varies from
what you expect. You can fetch the most important data filtering output for vyos keyword:

sudo grep vyos /var/log/cloud-init.log

10.8.9 Cloud-init on Proxmox

Before starting, please refer to cloud-init network-config-docs in order to know how to import user and network con-
figurations.
Most important keys that needs to be considered:
• VyOS configuration commands are defined in user-data file.
• Networking configurations shouldn’t be passed in user-data file.

10.8. VyOS cloud-init 1121

 VyOS Documentation, Release 1.5.x (circinus)

• If no networking configuration is provided, then dhcp client is going to be enabled on first interface. Bear in
mind that this configuration will be injected at an OS level, so don’t expect to find dhcp client configuration on
vyos cli. Because of this behavior, in next example lab we will disable dhcp-client configuration on eth0.
Also, this lab considers:
• Proxmox IP address: 192.168.0.253/24
• Storaged used: volume local, which is mounted on directory /var/lib/vz, and contains all type of content, includ-
ing snippets.
• Remove default dhcp client on first interface, and load other configuration during first boot, using cloud-init.

Generate qcow image

A VyOS qcow image with cloud-init options is needed. This can be obtained using vyos-vm-images repo. After cloning
the repo, edit the file qemu.yml and comment the download-iso role.
In this lab, we are using 1.3.0 VyOS version and setting a disk of 10G. Download VyOS .iso file and save it as /tmp/
vyos.iso. Command used for generating qcow image:

sudo ansible-playbook qemu.yml -e disk_size=10 \

-e iso_local=/tmp/vyos.iso -e grub_console=serial -e vyos_version=1.3.0 \
-e cloud_init=true -e cloud_init_ds=NoCloud

File generated with previous command: /tmp/vyos-1.3.0-cloud-init-10G-qemu.qcow2

Now, that file needs to be copied to proxmox server:

sudo scp /tmp/vyos-1.3.0-cloud-init-10G-qemu.qcow2 [email protected]:/tmp/

Prepare cloud-init files

In Proxmox server three files are going to be used for this setup:
• network-config: file that will indicate to avoid dhcp client on first interface.
• user-data: includes vyos-commands.
• meta-data: empty file (required).
In this lab, all files are located in /tmp/. So, before going on, lets move to that directory:

cd /tmp/

user-data file must start with #cloud-config and contains vyos-commands. For example:

#cloud-config
vyos_config_commands:
- set system host-name 'vyos-BRAS'
- set service ntp server 1.pool.ntp.org
- set service ntp server 2.pool.ntp.org
- delete interfaces ethernet eth0 address 'dhcp'
- set interfaces ethernet eth0 address '198.51.100.2/30'
- set interfaces ethernet eth0 description 'WAN - ISP01'
- set interfaces ethernet eth1 address '192.168.25.1/24'
- set interfaces ethernet eth1 description 'Comming through VLAN 25'
(continues on next page)

10.8. VyOS cloud-init 1122

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

- set interfaces ethernet eth2 address '192.168.26.1/24'
- set interfaces ethernet eth2 description 'Comming through VLAN 26'
- set protocols static route 0.0.0.0/0 next-hop '198.51.100.1'

network-config file only has configuration that disables the automatic dhcp client on first interface.
Content of network-config file:

version: 2
ethernets:
eth0:
dhcp4: false
dhcp6: false

Finally, file meta-data has no content, but it’s required.

Create seed.iso

Once the three files were created, it’s time to generate the seed.iso image, which needs to be mounted to the new VM
as a cd.
Command for generating seed.iso

mkisofs -joliet -rock -volid "cidata" -output seed.iso meta-data \

user-data network-config

NOTE: be careful while copying and pasting previous commands. Double quotes may need to be corrected.

Creating the VM

Notes for this particular example, that may need to be modified in other setups:
• VM ID: in this example, VM ID used is 555.
• VM Storage: local volume is used.
• ISO files storage: local volume is used for .iso file storage. In this scenario local volume type is set to
directory, abd attached to /var/lib/vz.
• VM Resources: these parameters can be modified as needed.
seed.iso was previously created in directory /tmp/. It’s necessary to move it to /var/lib/vz/template/iso

mv /tmp/seed.iso /var/lib/vz/template/iso/

On proxmox server:

## Create VM, import disk and define boot order

qm create 555 --name vyos-1.3.0-cloudinit --memory 1024 --net0 virtio,bridge=vmbr0
qm importdisk 555 vyos-1.3.0-cloud-init-10G-qemu.qcow2 local
qm set 555 --virtio0 local:555/vm-555-disk-0.raw
qm set 555 --boot order=virtio0

## Import seed.iso for cloud init

qm set 555 --ide2 media=cdrom,file=local:iso/seed.iso
(continues on next page)

10.8. VyOS cloud-init 1123

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

## Since this server has 1 nic, lets add network intefaces (vlan 25 and 26)
qm set 555 --net1 virtio,bridge=vmbr0,firewall=1,tag=25
qm set 555 --net2 virtio,bridge=vmbr0,firewall=1,tag=26

Power on VM and verifications

From cli or GUI, power on VM, and after it boots, verify configuration

References

• VyOS cloud-init-docs.
• Cloud-init network-config-docs.
• Proxmox Cloud-init-Support.

10.9 pyvyos

pyvyos is a Python library designed for interacting with VyOS devices through their API. This documentation is in-
tended to guide you in using pyvyos for programmatic management of your VyOS devices.
• pyvyos Documentation on Read the Docs provides detailed instructions on the installation, configuration, and
operation of the pyvyos library.
• pyvyos Source Code on GitHub allows you to access and contribute to the library’s code.
• pyvyos on PyPI for easy installation via pip, the Python package installer. Execute pip install pyvyos in your
terminal to install.

10.9.1 Installation

You can install pyvyos using pip:

pip install pyvyos

10.9.2 Getting Started

10.9.3 Importing and Disabling Warnings for verify=False

import urllib3
urllib3.disable_warnings()

10.9. pyvyos 1124

 VyOS Documentation, Release 1.5.x (circinus)

10.9.4 Using API Response Class

@dataclass
class ApiResponse:
status: int
request: dict
result: dict
error: str

10.9.5 Initializing a VyDevice Object

from dotenv import load_dotenv

load_dotenv()

hostname = os.getenv('VYDEVICE_HOSTNAME')
apikey = os.getenv('VYDEVICE_APIKEY')
port = os.getenv('VYDEVICE_PORT')
protocol = os.getenv('VYDEVICE_PROTOCOL')
verify_ssl = os.getenv('VYDEVICE_VERIFY_SSL')

verify = verify_ssl.lower() == "true" if verify_ssl else True

device = VyDevice(hostname=hostname, apikey=apikey, port=port, protocol=protocol,␣

˓→verify=verify)

10.9.6 Using pyvyos

Configure, then Set

response = device.configure_set(path=["interfaces", "ethernet", "eth0", "address", "192.

˓→168.1.1/24"])

if not response.error:
print(response.result)

Configure, then Show a Single Object Value

response = device.retrieve_return_values(path=["interfaces", "dummy", "dum1", "address"])

print(response.result)

10.9. pyvyos 1125

 VyOS Documentation, Release 1.5.x (circinus)

Configure, then Show Object

response = device.retrieve_show_config(path=[])
if not response.error:
print(response.result)

Configure, then Delete Object

response = device.configure_delete(path=["interfaces", "dummy", "dum1"])

Configure, then Save

response = device.config_file_save()

10.9.7 Configure, then Save File

response = device.config_file_save(file="/config/test300.config")

Show Object

response = device.show(path=["system", "image"])

print(response.result)

Generate Object

randstring = ''.join(random.choice(string.ascii_letters + string.digits) for _ in␣

˓→range(20))

keyrand = f'/tmp/key_{randstring}'
response = device.generate(path=["ssh", "client-key", keyrand])

Reset Object

response = device.reset(path=["conntrack-sync", "internal-cache"])

if not response.error:
print(response.result)

10.9. pyvyos 1126

 VyOS Documentation, Release 1.5.x (circinus)

Configure, then Load File

response = device.config_file_load(file="/config/test300.config")

10.9. pyvyos 1127

 CHAPTER

ELEVEN

TROUBLESHOOTING

Sometimes things break or don’t work as expected. This section describes several troubleshooting tools provided by
VyOS that can help when something goes wrong.

11.1 Connectivity Tests

11.1.1 Basic Connectivity Tests

Verifying connectivity can be done with the familiar ping and traceroute commands. The options for each are shown
(the options for each command were displayed using the built-in help as described in the Command Line Interface
section and are omitted from the output here):
ping <destination>
Send ICMP echo requests to destination host. There are multiple options to ping, inkl. VRF support.

vyos@vyos:~$ ping 10.1.1.1

Possible completions:
<Enter> Execute the current command
adaptive Ping options
allow-broadcast
audible
bypass-route
count
deadline
do-not-fragment
flood
interface
interval
mark
no-loopback
numeric
pattern
quiet
record-route
size
timestamp
tos
ttl
verbose
vrf

1128
 VyOS Documentation, Release 1.5.x (circinus)

traceroute <destination>
Trace path to target.

vyos@vyos:~$ traceroute
Possible completions:
<hostname> Track network path to specified node
<x.x.x.x>
<h:h:h:h:h:h:h:h>
ipv4 Track network path to <hostname|IPv4 address>
ipv6 Track network path to <hostname|IPv6 address>

11.1.2 Advanced Connectivity Tests

monitor traceroute <destination>

However, another helper is available which combines ping and traceroute into a single tool. An example of its
output is shown:

vyos@vyos:~$ mtr 10.62.212.12

My traceroute [v0.85]
vyos (0.0.0.0)
Keys: Help Display mode Restart statistics Order of fields quit
Packets Pings
Host Loss% Snt Last Avg Best Wrst StDev
1. 10.11.110.4 0.0% 34 0.5 0.5 0.4 0.8 0.1
2. 10.62.255.184 0.0% 34 1.1 1.0 0.9 1.4 0.1
3. 10.62.255.71 0.0% 34 1.4 1.4 1.3 2.0 0.1
4. 10.62.212.12 0.0% 34 1.6 1.6 1.6 1.7 0.0

Note: The output consumes the screen and will replace your command prompt.

Several options are available for changing the display output. Press h to invoke the built in help system. To quit,
just press q and you’ll be returned to the VyOS command prompt.

11.1.3 IPv6 Topology Discovery

IPv6 uses different techniques to discover its Neighbors/topology.

Router Discovery

force ipv6-rd interface <interface> [address <ipv6-address>]

Discover routers via eth0.
Example:

vyos@vyos:~$ force ipv6-rd interface eth0

Soliciting ff02::2 (ff02::2) on eth0...

(continues on next page)

11.1. Connectivity Tests 1129

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Hop limit : 60 ( 0x3c)
Stateful address conf. : No
Stateful other conf. : No
Mobile home agent : No
Router preference : high
Neighbor discovery proxy : No
Router lifetime : 1800 (0x00000708) seconds
Reachable time : unspecified (0x00000000)
Retransmit time : unspecified (0x00000000)
Prefix : 240e:fe:8ca7:ea01::/64
On-link : Yes
Autonomous address conf.: Yes
Valid time : 2592000 (0x00278d00) seconds
Pref. time : 14400 (0x00003840) seconds
Prefix : fc00:470:f1cd:101::/64
On-link : Yes
Autonomous address conf.: Yes
Valid time : 2592000 (0x00278d00) seconds
Pref. time : 14400 (0x00003840) seconds
Recursive DNS server : fc00:470:f1cd::ff00
DNS server lifetime : 600 (0x00000258) seconds
Source link-layer address: 00:98:2B:F8:3F:11
from fe80::298:2bff:fef8:3f11

Neighbor Discovery

force ipv6-nd interface <interface> address <ipv6-address>

Example:

vyos@vyos:~$ force ipv6-nd interface eth0 address fc00:470:f1cd:101::1

Soliciting fc00:470:f1cd:101::1 (fc00:470:f1cd:101::1) on eth0...

Target link-layer address: 00:98:2B:F8:3F:11 from fc00:470:f1cd:101::1

11.2 Interface names

If you find the names of your interfaces have changed, this could be because your MAC addresses have changed.
• For example, you have a VyOS VM with 4 Ethernet interfaces named eth0, eth1, eth2 and eth3. Then, you
migrate your VyOS VM to a different host and find your interfaces now are eth4, eth5, eth6 and eth7.
One way to fix this issue taking control of the MAC addresses is:
Log into VyOS and run this command to display your interface settings.

show interfaces detail

Take note of MAC addresses.

Now, in order to update a MAC address in the configuration, run this command specifying the interface name
and MAC address you want.

11.2. Interface names 1130

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces eth0 hw-id 00:0c:29:da:a4:fe

If it is a VM, go into the settings of the host and set the MAC address to the settings found in the config.boot file.
You can also set the MAC to static if the host allows so.
• Another example could be when cloning VyOS VMs in GNS3 and you get into the same issue: interface names
have changed.
And a more generic way to fix it is just deleting every MAC address at the configuration file of the cloned
machine. They will be correctly regenerated automatically.

11.3 Monitoring

VyOS features several monitoring tools.

vyos@vyos:~$ monitor
Possible completions:
bandwidth Monitor interface bandwidth in real time
bandwidth-test
Initiate or wait for bandwidth test
cluster Monitor clustering service
command Monitor an operational mode command (refreshes every 2 seconds)
conntrack-sync
Monitor conntrack-sync
content-inspection
Monitor Content-Inspection
dhcp Monitor Dynamic Host Control Protocol (DHCP)
dns Monitor a Domain Name Service (DNS) daemon
firewall Monitor Firewall
https Monitor the Secure Hypertext Transfer Protocol (HTTPS) service
lldp Monitor Link Layer Discovery Protocol (LLDP) daemon
log Monitor last lines of messages file
nat Monitor network address translation (NAT)
ndp Monitor the NDP information received by the router through the device
openvpn Monitor OpenVPN
protocol Monitor routing protocols
snmp Monitor Simple Network Management Protocol (SNMP) daemon
stop-all Stop all current background monitoring processes
traceroute Monitor the path to a destination in realtime
traffic Monitor traffic dumps
vpn Monitor VPN
vrrp Monitor Virtual Router Redundancy Protocol (VRRP)
webproxy Monitor Webproxy service

11.3. Monitoring 1131

 VyOS Documentation, Release 1.5.x (circinus)

11.3.1 Traffic Dumps

To monitor interface traffic, issue the monitor traffic interface <name> command, replacing <name> with
your chosen interface.

vyos@vyos:~$ monitor traffic interface eth0

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
15:54:28.581601 IP 192.168.0.1 > vyos: ICMP echo request, id 1870, seq 3848, length 64
15:54:28.581660 IP vyos > 192.168.0.1: ICMP echo reply, id 1870, seq 3848, length 64
15:54:29.583399 IP 192.168.0.1 > vyos: ICMP echo request, id 1870, seq 3849, length 64
15:54:29.583454 IP vyos > 192.168.0.1: ICMP echo reply, id 1870, seq 3849, length 64
^C
4 packets captured
4 packets received by filter
0 packets dropped by kernel
vyos@vyos:~$

To quit monitoring, press Ctrl-c and you’ll be returned to the VyOS command prompt.
Traffic can be filtered and saved.

vyos@vyos:~$ monitor traffic interface eth0

Possible completions:
<Enter> Execute the current command
filter Monitor traffic matching filter conditions
save Save traffic dump from an interface to a file

11.3.2 Interface Bandwidth Usage

to take a quick view on the used bandwidth of an interface use the monitor bandwidth command

vyos@vyos:~$ monitor bandwidth interface eth0

show the following:

B (RX Bytes/second)
198.00 .|....|.....................................................
165.00 .|....|.....................................................
132.00 ||..|.|.....................................................
99.00 ||..|.|.....................................................
66.00 |||||||.....................................................
33.00 |||||||.....................................................
1 5 10 15 20 25 30 35 40 45 50 55 60

KiB (TX Bytes/second)

3.67 ......|.....................................................
3.06 ......|.....................................................
2.45 ......|.....................................................
1.84 ......|.....................................................
1.22 ......|.....................................................
0.61 :::::||.....................................................
1 5 10 15 20 25 30 35 40 45 50 55 60

11.3. Monitoring 1132

 VyOS Documentation, Release 1.5.x (circinus)

11.3.3 Interface Performance

To take a look on the network bandwidth between two nodes, the monitor bandwidth-test command is used to run
iperf.

vyos@vyos:~$ monitor bandwidth-test

Possible completions:
accept Wait for bandwidth test connections (port TCP/5001)
initiate Initiate a bandwidth test

• The accept command opens a listening iperf server on TCP Port 5001
• The initiate command connects to that server to perform the test.

vyos@vyos:~$ monitor bandwidth-test initiate

Possible completions:
<hostname> Initiate a bandwidth test to specified host (port TCP/5001)
<x.x.x.x>
<h:h:h:h:h:h:h:h>

11.3.4 Monitor command

The monitor command command allows you to repeatedly run a command to view a continuously refreshed output.
The command is run and output every 2 seconds, allowing you to monitor the output continuously without having to
re-run the command. This can be useful to follow routing adjacency formation.

vyos@router:~$ monitor command "show interfaces"

Will clear the screen and show you the output of show interfaces every 2 seconds.

Every 2.0s: /opt/vyatta/bin/vyatta-op-cmd-wrapper Sun Mar 26 02:49:46 2019

Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down

Interface IP Address S/L Description
--------- ---------- --- -----------
eth0 192.168.1.1/24 u/u
eth0.5 198.51.100.4/24 u/u WAN
lo 127.0.0.1/8 u/u
::1/128
vti0 172.25.254.2/30 u/u
vti1 172.25.254.9/30 u/u

11.4 Terminal/Console

Sometimes you need to clear counters or statistics to troubleshoot better.

To do this use the clear command in Operational mode.
to clear the console output

vyos@vyos:~$ clear console

to clear interface counters

11.4. Terminal/Console 1133

 VyOS Documentation, Release 1.5.x (circinus)

# clear all interfaces

vyos@vyos:~$ clear interface ethernet counters
# clear specific interface
vyos@vyos:~$ clear interface ethernet eth0 counters

The command follow the same logic as the set command in configuration mode.

# clear all counters of a interface type

vyos@vyos:~$ clear interface <interface_type> counters
# clear counter of a interface in interface_type
vyos@vyos:~$ clear interface <interface_type> <interace_name> counters

to clear counters on firewall rulesets or single rules

vyos@vyos:~$ clear firewall name <ipv4 ruleset name> counters

vyos@vyos:~$ clear firewall name <ipv4 ruleset name> rule <rule#> counters

vyos@vyos:~$ clear firewall ipv6-name <ipv6 ruleset name> counters

vyos@vyos:~$ clear firewall ipv6-name <ipv6 ruleset name> rule <rule#> counters

11.5 System Information

11.5.1 Boot Steps

VyOS 1.2 uses Debian Jessie as the base Linux operating system. Jessie was the first version of Debian that uses
systemd as the default init system.
These are the boot steps for VyOS 1.2
1. The BIOS loads Grub (or isolinux for the Live CD)
2. Grub then starts the Linux boot and loads the Linux Kernel /boot/vmlinuz
3. Kernel Launches Systemd /lib/systemd/systemd
4. Systemd loads the VyOS service file /lib/systemd/system/vyos-router.service
5. The service file launches the VyOS router init script /usr/libexec/vyos/init/vyos-router - this is part
of the vyatta-cfg Debian package
1. Starts FRR - successor to GNU Zebra and Quagga
2. Initialises the boot configuration file - copies over config.boot.default if there is no configura-
tion
3. Runs the configuration migration, if the configuration is for an older version of VyOS
4. Runs The pre-config script, if there is one /config/scripts/vyos-preconfig-bootup.script
5. If the config file was upgraded, runs any post upgrade scripts /config/scripts/post-upgrade.d
6. Starts rl-system and firewall
7. Mounts the /boot partition
8. The boot configuration file is then applied by /opt/vyatta/sbin/
vyatta-boot-config-loader/opt/vyatta/etc/config/config.boot
1. The config loader script writes log entries to /var/log/vyatta-config-loader.log

11.5. System Information 1134

 VyOS Documentation, Release 1.5.x (circinus)

9. Runs telinit q to tell the init system to reload /etc/inittab

10. Finally it runs the post-config script /config/scripts/vyos-postconfig-bootup.script

11.5. System Information 1135

 CHAPTER

TWELVE

CONFIGURATION BLUEPRINTS

This chapter contains various configuration examples:

12.1 Firewall Examples

This section contains examples of firewall configurations for various deployments.

12.1.1 VRF and firewall example

Scenario and requirements

This example shows how to configure a VyOS router with VRFs and firewall rules.
Diagram used in this example:

1136
 VyOS Documentation, Release 1.5.x (circinus)

As exposed in the diagram, there are four VRFs. These VRFs are MGMT, WAN, LAN and PROD, and their requirements
are:
• VRF MGMT:
– Allow connections to LAN and PROD.
– Deny connections to internet(WAN).
– Allow connections to the router.
• VRF LAN:
– Allow connections to PROD.
– Allow connections to internet(WAN).
• VRF PROD:
– Only accepts connections.
• VRF WAN:
– Allow connection to PROD.

12.1. Firewall Examples 1137

 VyOS Documentation, Release 1.5.x (circinus)

Configuration

First, we need to configure the interfaces and VRFs:

set interfaces ethernet eth1 address '10.100.100.1/24'

set interfaces ethernet eth1 vrf 'MGMT'
set interfaces ethernet eth2 vif 150 address '10.150.150.1/24'
set interfaces ethernet eth2 vif 150 vrf 'LAN'
set interfaces ethernet eth2 vif 160 address '10.160.160.1/24'
set interfaces ethernet eth2 vif 160 vrf 'LAN'
set interfaces ethernet eth2 vif 3500 address '172.16.20.1/24'
set interfaces ethernet eth2 vif 3500 vrf 'PROD'
set interfaces loopback lo
set interfaces pppoe pppoe0 authentication password 'p4ssw0rd'
set interfaces pppoe pppoe0 authentication username 'vyos'
set interfaces pppoe pppoe0 source-interface 'eth0'
set interfaces pppoe pppoe0 vrf 'WAN'
set vrf bind-to-all
set vrf name LAN protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN'
set vrf name LAN protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT'
set vrf name LAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD'
set vrf name LAN table '103'
set vrf name MGMT protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN'
set vrf name MGMT protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN'
set vrf name MGMT protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD'
set vrf name MGMT table '102'
set vrf name PROD protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN'
set vrf name PROD protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT'
set vrf name PROD protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN'
set vrf name PROD protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN'
set vrf name PROD table '104'
set vrf name WAN protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN'
set vrf name WAN protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN'
set vrf name WAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD'
set vrf name WAN table '101'

And before firewall rules are shown, we need to pay attention how to configure and match interfaces and VRFs. In
case where an interface is assigned to a non-default VRF, if we want to use inbound-interface or outbound-interface in
firewall rules, we need to:
• For inbound-interface: use the interface name with the VRF name, like MGMT or LAN.
• For outbound-interface: use the interface name, like eth0, vtun0, eth2* or similar.
Next, we need to configure the firewall rules. First we will define all rules for transit traffic between VRFs.

set firewall ipv4 forward filter default-action 'drop'

set firewall ipv4 forward filter default-log
set firewall ipv4 forward filter rule 10 action 'accept'
set firewall ipv4 forward filter rule 10 description 'MGMT - Allow to LAN and PROD'
set firewall ipv4 forward filter rule 10 inbound-interface name 'MGMT'
set firewall ipv4 forward filter rule 10 outbound-interface name 'eth2*'
set firewall ipv4 forward filter rule 99 action 'drop'
set firewall ipv4 forward filter rule 99 description 'MGMT - Drop all going to mgmt'
set firewall ipv4 forward filter rule 99 outbound-interface name 'eth1'
(continues on next page)

12.1. Firewall Examples 1138

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set firewall ipv4 forward filter rule 120 action 'accept'
set firewall ipv4 forward filter rule 120 description 'LAN - Allow to PROD'
set firewall ipv4 forward filter rule 120 inbound-interface name 'LAN'
set firewall ipv4 forward filter rule 120 outbound-interface name 'eth2.3500'
set firewall ipv4 forward filter rule 130 action 'accept'
set firewall ipv4 forward filter rule 130 description 'LAN - Allow internet'
set firewall ipv4 forward filter rule 130 inbound-interface name 'LAN'
set firewall ipv4 forward filter rule 130 outbound-interface name 'pppoe0'

Also, we are adding global state policies, in order to allow established and related traffic, in order not to drop valid
responses:

set firewall global-options state-policy established action 'accept'

set firewall global-options state-policy invalid action 'drop'
set firewall global-options state-policy related action 'accept'

And finally, we need to allow input connections to the router itself only from vrf MGMT:

set firewall ipv4 input filter default-action 'drop'

set firewall ipv4 input filter default-log
set firewall ipv4 input filter rule 10 action 'accept'
set firewall ipv4 input filter rule 10 description 'MGMT - Allow input'
set firewall ipv4 input filter rule 10 inbound-interface name 'MGMT'

12.1.2 Zone-Policy example

Note: In T2199 the syntax of the zone configuration was changed. The zone configuration moved from zone-policy
zone <name> to firewall zone <name>.

Native IPv4 and IPv6

We have three networks.

WAN - 172.16.10.0/24, 2001:0DB8:0:9999::0/64

LAN - 192.168.100.0/24, 2001:0DB8:0:AAAA::0/64
DMZ - 192.168.200.0/24, 2001:0DB8:0:BBBB::0/64

This specific example is for a router on a stick, but is very easily adapted for however many NICs you have:
• Internet - 192.168.200.100 - TCP/80
• Internet - 192.168.200.100 - TCP/443
• Internet - 192.168.200.100 - TCP/25
• Internet - 192.168.200.100 - TCP/53
• VyOS acts as DHCP, DNS forwarder, NAT, router and firewall.
• 192.168.200.200/2001:0DB8:0:BBBB::200 is an internal/external DNS, web and mail (SMTP/IMAP) server.
• 192.168.100.10/2001:0DB8:0:AAAA::10 is the administrator’s console. It can SSH to VyOS.

12.1. Firewall Examples 1139

 VyOS Documentation, Release 1.5.x (circinus)

• LAN and DMZ hosts have basic outbound access: Web, FTP, SSH.
• LAN can access DMZ resources.
• DMZ cannot access LAN resources.
• Inbound WAN connect to DMZ host.

The VyOS interface is assigned the .1/:1 address of their respective networks. WAN is on VLAN 10, LAN on VLAN
20, and DMZ on VLAN 30.
It will look something like this:

interfaces {
ethernet eth0 {
duplex auto
hw-id 00:53:ed:6e:2a:92
smp_affinity auto
speed auto
(continues on next page)

12.1. Firewall Examples 1140

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

vif 10 {
address 172.16.10.1/24
address 2001:db8:0:9999::1/64
}
vif 20 {
address 192.168.100.1/24
address 2001:db8:0:AAAA::1/64
}
vif 30 {
address 192.168.200.1/24
address 2001:db8:0:BBBB::1/64
}
}
loopback lo {
}
}

Zones Basics

Each interface is assigned to a zone. The interface can be physical or virtual such as tunnels (VPN, PPTP, GRE, etc)
and are treated exactly the same.
Traffic flows from zone A to zone B. That flow is what I refer to as a zone-pair-direction. eg. A->B and B->A are two
zone-pair-destinations.
Ruleset are created per zone-pair-direction.
I name rule sets to indicate which zone-pair-direction they represent. eg. ZoneA-ZoneB or ZoneB-ZoneA. LAN-DMZ,
DMZ-LAN.
In VyOS, you have to have unique Ruleset names. In the event of overlap, I add a “-6” to the end of v6 rulesets. eg.
LAN-DMZ, LAN-DMZ-6. This allows for each auto-completion and uniqueness.
In this example we have 4 zones. LAN, WAN, DMZ, Local. The local zone is the firewall itself.
If your computer is on the LAN and you need to SSH into your VyOS box, you would need a rule to allow it in the
LAN-Local ruleset. If you want to access a webpage from your VyOS box, you need a rule to allow it in the Local-LAN
ruleset.
In rules, it is good to keep them named consistently. As the number of rules you have grows, the more consistency you
have, the easier your life will be.

Rule 1 - State Established, Related

Rule 2 - State Invalid
Rule 100 - ICMP
Rule 200 - Web
Rule 300 - FTP
Rule 400 - NTP
Rule 500 - SMTP
Rule 600 - DNS
Rule 700 - DHCP
Rule 800 - SSH
Rule 900 - IMAPS

The first two rules are to deal with the idiosyncrasies of VyOS and iptables.

12.1. Firewall Examples 1141

 VyOS Documentation, Release 1.5.x (circinus)

Zones and Rulesets both have a default action statement. When using Zone-Policies, the default action is set by the
zone-policy statement and is represented by rule 10000.
It is good practice to log both accepted and denied traffic. It can save you significant headaches when trying to trou-
bleshoot a connectivity issue.
To add logging to the default rule, do:

set firewall name <ruleSet> default-log

By default, iptables does not allow traffic for established sessions to return, so you must explicitly allow this. I do this
by adding two rules to every ruleset. 1 allows established and related state packets through and rule 2 drops and logs
invalid state packets. We place the established/related rule at the top because the vast majority of traffic on a network
is established and the invalid rule to prevent invalid state packets from mistakenly being matched against other rules.
Having the most matched rule listed first reduces CPU load in high volume environments. Note: I have filed a bug to
have this added as a default action as well.
‘’It is important to note, that you do not want to add logging to the established state rule as you will be logging both the
inbound and outbound packets for each session instead of just the initiation of the session. Your logs will be massive
in a very short period of time.”
In VyOS you must have the interfaces created before you can apply it to the zone and the rulesets must be created prior
to applying it to a zone-policy.
I create/configure the interfaces first. Build out the rulesets for each zone-pair-direction which includes at least the
three state rules. Then I setup the zone-policies.
Zones do not allow for a default action of accept; either drop or reject. It is important to remember this because if you
apply an interface to a zone and commit, any active connections will be dropped. Specifically, if you are SSH’d into
VyOS and add local or the interface you are connecting through to a zone and do not have rulesets in place to allow
SSH and established sessions, you will not be able to connect.
The following are the rules that were created for this example (may not be complete), both in IPv4 and IPv6. If there
is no IP specified, then the source/destination address is not explicit.

WAN - DMZ:192.168.200.200 - tcp/80

WAN - DMZ:192.168.200.200 - tcp/443
WAN - DMZ:192.168.200.200 - tcp/25
WAN - DMZ:192.168.200.200 - tcp/53
WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/80
WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/443
WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/25
WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/53

DMZ - Local - tcp/53

DMZ - Local - tcp/123
DMZ - Local - tcp/67,68

LAN - Local - tcp/53

LAN - Local - tcp/123
LAN - Local - tcp/67,68
LAN:192.168.100.10 - Local - tcp/22
LAN:2001:0DB8:0:AAAA::10 - Local - tcp/22

LAN - WAN - tcp/80

LAN - WAN - tcp/443
LAN - WAN - tcp/22
(continues on next page)

12.1. Firewall Examples 1142

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

LAN - WAN - tcp/20,21

DMZ - WAN - tcp/80

DMZ - WAN - tcp/443
DMZ - WAN - tcp/22
DMZ - WAN - tcp/20,21
DMZ - WAN - tcp/53
DMZ - WAN - udp/53

Local - WAN - tcp/80

Local - WAN - tcp/443
Local - WAN - tcp/20,21

Local - DMZ - tcp/25

Local - DMZ - tcp/67,68
Local - DMZ - tcp/53
Local - DMZ - udp/53

Local - LAN - tcp/67,68

LAN - DMZ - tcp/80

LAN - DMZ - tcp/443
LAN - DMZ - tcp/993
LAN:2001:0DB8:0:AAAA::10 - DMZ:2001:0DB8:0:BBBB::200 - tcp/22
LAN:192.168.100.10 - DMZ:192.168.200.200 - tcp/22

Since we have 4 zones, we need to setup the following rulesets.

Lan-wan
Lan-local
Lan-dmz
Wan-lan
Wan-local
Wan-dmz
Local-lan
Local-wan
Local-dmz
Dmz-lan
Dmz-wan
Dmz-local

Even if the two zones will never communicate, it is a good idea to create the zone-pair-direction rulesets and set default-
log. This will allow you to log attempts to access the networks. Without it, you will never see the connection attempts.
This is an example of the three base rules.

name wan-lan {
default-action drop
default-log
rule 1 {
action accept
state {
established enable
(continues on next page)

12.1. Firewall Examples 1143

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

related enable
}
}
rule 2 {
action drop
log enable
state {
invalid enable
}
}
}

Here is an example of an IPv6 DMZ-WAN ruleset.

ipv6-name dmz-wan-6 {
default-action drop
default-log
rule 1 {
action accept
state {
established enable
related enable
}
}
rule 2 {
action drop
log enable
state {
invalid enable
}
rule 100 {
action accept
log enable
protocol ipv6-icmp
}
rule 200 {
action accept
destination {
port 80,443
}
log enable
protocol tcp
}
rule 300 {
action accept
destination {
port 20,21
}
log enable
protocol tcp
}
rule 500 {
(continues on next page)

12.1. Firewall Examples 1144

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

action accept
destination {
port 25
}
log enable
protocol tcp
source {
address 2001:db8:0:BBBB::200
}
}
rule 600 {
action accept
destination {
port 53
}
log enable
protocol tcp_udp
source {
address 2001:db8:0:BBBB::200
}
}
rule 800 {
action accept
destination {
port 22
}
log enable
protocol tcp
}
}

Once you have all of your rulesets built, then you need to create your zone-policy.
Start by setting the interface and default action for each zone.

set firewall zone dmz default-action drop

set firewall zone dmz interface eth0.30

In this case, we are setting the v6 ruleset that represents traffic sourced from the LAN, destined for the DMZ. Because
the zone-policy firewall syntax is a little awkward, I keep it straight by thinking of it backwards.

set firewall zone dmz from lan firewall ipv6-name lan-dmz-6

DMZ-LAN policy is LAN-DMZ. You can get a rhythm to it when you build out a bunch at one time.
In the end, you will end up with something like this config. I took out everything but the Firewall, Interfaces, and
zone-policy sections. It is long enough as is.

12.1. Firewall Examples 1145

 VyOS Documentation, Release 1.5.x (circinus)

IPv6 Tunnel

If you are using a IPv6 tunnel from HE.net or someone else, the basis is the same except you have two WAN interfaces.
One for v4 and one for v6.
You would have 5 zones instead of just 4 and you would configure your v6 ruleset between your tunnel interface and
your LAN/DMZ zones instead of to the WAN.
LAN, WAN, DMZ, local and TUN (tunnel)
v6 pairs would be:

lan-tun
lan-local
lan-dmz
tun-lan
tun-local
tun-dmz
local-lan
local-tun
local-dmz
dmz-lan
dmz-tun
dmz-local

Notice, none go to WAN since WAN wouldn’t have a v6 address on it.

You would have to add a couple of rules on your wan-local ruleset to allow protocol 41 in.
Something like:

rule 400 {
action accept
destination {
address 172.16.10.1
}
log enable
protocol 41
source {
address ip.of.tunnel.broker
}
}

12.2 BGP IPv6 unnumbered with extended nexthop

General information can be found in the BGP chapter.

12.2. BGP IPv6 unnumbered with extended nexthop 1146

 VyOS Documentation, Release 1.5.x (circinus)

12.2.1 Configuration

• Router A:

set protocols bgp system-as 64496

set protocols bgp address-family ipv4-unicast redistribute connected
set protocols bgp address-family ipv6-unicast redistribute connected
set protocols bgp neighbor eth1 interface v6only
set protocols bgp neighbor eth1 interface v6only peer-group 'fabric'
set protocols bgp neighbor eth2 interface v6only
set protocols bgp neighbor eth2 interface v6only peer-group 'fabric'
set protocols bgp parameters bestpath as-path multipath-relax
set protocols bgp parameters bestpath compare-routerid
set protocols bgp parameters default no-ipv4-unicast
set protocols bgp parameters router-id '192.168.0.1'
set protocols bgp peer-group fabric address-family ipv4-unicast
set protocols bgp peer-group fabric address-family ipv6-unicast
set protocols bgp peer-group fabric capability extended-nexthop
set protocols bgp peer-group fabric remote-as 'external'

• Router B:

set protocols bgp system-as 64499

set protocols bgp address-family ipv4-unicast redistribute connected
set protocols bgp address-family ipv6-unicast redistribute connected
set protocols bgp neighbor eth1 interface v6only
set protocols bgp neighbor eth1 interface v6only peer-group 'fabric'
set protocols bgp neighbor eth2 interface v6only
set protocols bgp neighbor eth2 interface v6only peer-group 'fabric'
set protocols bgp parameters bestpath as-path multipath-relax
set protocols bgp parameters bestpath compare-routerid
set protocols bgp parameters default no-ipv4-unicast
set protocols bgp parameters router-id '192.168.0.2'
set protocols bgp peer-group fabric address-family ipv4-unicast
set protocols bgp peer-group fabric address-family ipv6-unicast
set protocols bgp peer-group fabric capability extended-nexthop
set protocols bgp peer-group fabric remote-as 'external'

12.2.2 Results

• Router A:

vyos@vyos:~$ show interfaces

Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
eth0 198.51.100.34/24 u/u
eth1 - u/u
eth2 - u/u
lo 127.0.0.1/8 u/u
192.168.0.1/32
::1/128

12.2. BGP IPv6 unnumbered with extended nexthop 1147

 VyOS Documentation, Release 1.5.x (circinus)

vyos@vyos:~$ show ip route

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
F - PBR, f - OpenFabric,
> - selected route, * - FIB route

S>* 0.0.0.0/0 [210/0] via 198.51.100.34, eth0, 03:21:53

C>* 198.51.100.0/24 is directly connected, eth0, 03:21:53
C>* 192.168.0.1/32 is directly connected, lo, 03:21:56
B>* 192.168.0.2/32 [20/0] via fe80::a00:27ff:fe3b:7ed2, eth2, 00:05:07
* via fe80::a00:27ff:fe7b:4000, eth1, 00:05:07

vyos@vyos:~$ ping 192.168.0.2

PING 192.168.0.2 (192.168.0.2) 56(84) bytes of data.
64 bytes from 192.168.0.2: icmp_seq=1 ttl=64 time=0.575 ms
64 bytes from 192.168.0.2: icmp_seq=2 ttl=64 time=0.628 ms
64 bytes from 192.168.0.2: icmp_seq=3 ttl=64 time=0.581 ms
64 bytes from 192.168.0.2: icmp_seq=4 ttl=64 time=0.682 ms
64 bytes from 192.168.0.2: icmp_seq=5 ttl=64 time=0.597 ms

--- 192.168.0.2 ping statistics ---

5 packets transmitted, 5 received, 0% packet loss, time 4086ms
rtt min/avg/max/mdev = 0.575/0.612/0.682/0.047 ms

vyos@vyos:~$ show ip bgp summary

IPv4 Unicast Summary:

BGP router identifier 192.168.0.1, local AS number 65020 vrf-id 0
BGP table version 4
RIB entries 5, using 800 bytes of memory
Peers 2, using 41 KiB of memory
Peer groups 1, using 64 bytes of memory

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

eth1 4 64499 13 13 0 0 0 00:05:33 2
eth2 4 64499 13 14 0 0 0 00:05:29 2

Total number of neighbors 2

• Router B:

vyos@vyos:~$ show interfaces

Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
eth0 198.51.100.33/24 u/u
eth1 - u/u
eth2 - u/u
lo 127.0.0.1/8 u/u
192.168.0.2/32
::1/128

12.2. BGP IPv6 unnumbered with extended nexthop 1148

 VyOS Documentation, Release 1.5.x (circinus)

vyos@vyos:~$ show ip route

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
F - PBR, f - OpenFabric,
> - selected route, * - FIB route

S>* 0.0.0.0/0 [210/0] via 198.51.100.33, eth0, 00:44:08

C>* 198.51.100.0/24 is directly connected, eth0, 00:44:09
B>* 192.168.0.1/32 [20/0] via fe80::a00:27ff:fe2d:205d, eth1, 00:06:18
* via fe80::a00:27ff:fe93:e142, eth2, 00:06:18
C>* 192.168.0.2/32 is directly connected, lo, 00:44:11

vyos@vyos:~$ ping 192.168.0.1

PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.
64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=0.427 ms
64 bytes from 192.168.0.1: icmp_seq=2 ttl=64 time=0.471 ms
64 bytes from 192.168.0.1: icmp_seq=3 ttl=64 time=0.782 ms
64 bytes from 192.168.0.1: icmp_seq=4 ttl=64 time=0.715 ms

--- 192.168.0.1 ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 3051ms
rtt min/avg/max/mdev = 0.427/0.598/0.782/0.155 ms

vyos@vyos:~$ show ip bgp summary

IPv4 Unicast Summary:
BGP router identifier 192.168.0.2, local AS number 65021 vrf-id 0
BGP table version 4
RIB entries 5, using 800 bytes of memory
Peers 2, using 41 KiB of memory
Peer groups 1, using 64 bytes of memory

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

eth1 4 64496 14 14 0 0 0 00:06:40 2
eth2 4 64496 14 14 0 0 0 00:06:37 2

Total number of neighbors 2

12.3 OSPF unnumbered with ECMP

General information can be found in the OSPF chapter.

12.3. OSPF unnumbered with ECMP 1149

 VyOS Documentation, Release 1.5.x (circinus)

12.3.1 Configuration

• Router A:

set interfaces ethernet eth0 address '10.0.0.1/24'

set interfaces ethernet eth1 address '192.168.0.1/32'
set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
set interfaces ethernet eth1 ip ospf network 'point-to-point'
set interfaces ethernet eth2 address '192.168.0.1/32'
set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
set interfaces ethernet eth2 ip ospf network 'point-to-point'
set interfaces loopback lo address '192.168.0.1/32'
set protocols ospf area 0.0.0.0 authentication 'md5'
set protocols ospf area 0.0.0.0 network '192.168.0.1/32'
set protocols ospf parameters router-id '192.168.0.1'
set protocols ospf redistribute connected

• Router B:

set interfaces ethernet eth0 address '10.0.0.2/24'

set interfaces ethernet eth1 address '192.168.0.2/32'
set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
set interfaces ethernet eth1 ip ospf network 'point-to-point'
set interfaces ethernet eth2 address '192.168.0.2/32'
set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
set interfaces ethernet eth2 ip ospf network 'point-to-point'
set interfaces loopback lo address '192.168.0.2/32'
set protocols ospf area 0.0.0.0 authentication 'md5'
set protocols ospf area 0.0.0.0 network '192.168.0.2/32'
set protocols ospf parameters router-id '192.168.0.2'
set protocols ospf redistribute connected

12.3.2 Results

• Router A:

vyos@vyos:~$ show interfaces

Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
eth0 10.0.0.1/24 u/u
eth1 192.168.0.1/32 u/u
eth2 192.168.0.1/32 u/u
lo 127.0.0.1/8 u/u
192.168.0.1/32
::1/128

vyos@vyos:~$ show ip route

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
F - PBR, f - OpenFabric,
(continues on next page)

12.3. OSPF unnumbered with ECMP 1150

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

> - selected route, * - FIB route, q - queued route, r - rejected route

S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34

O 10.0.0.0/24 [110/20] via 192.168.0.2, eth1 onlink, 00:13:21
via 192.168.0.2, eth2 onlink, 00:13:21
C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35
O 192.168.0.1/32 [110/0] is directly connected, lo, 00:48:53
C * 192.168.0.1/32 is directly connected, eth2, 00:56:31
C * 192.168.0.1/32 is directly connected, eth1, 00:56:31
C>* 192.168.0.1/32 is directly connected, lo, 00:57:36
O>* 192.168.0.2/32 [110/1] via 192.168.0.2, eth1 onlink, 00:29:03
* via 192.168.0.2, eth2 onlink, 00:29:03

• Router B:

vyos@vyos:~$ show interfaces

Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
eth0 10.0.0.2/24 u/u
eth1 192.168.0.2/32 u/u
eth2 192.168.0.2/32 u/u
lo 127.0.0.1/8 u/u
192.168.0.2/32
::1/128

vyos@vyos:~$ show ip route

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
F - PBR, f - OpenFabric,
> - selected route, * - FIB route, q - queued route, r - rejected route

S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34

O 10.0.0.0/24 [110/20] via 192.168.0.1, eth1 onlink, 00:13:21
via 192.168.0.1, eth2 onlink, 00:13:21
C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35
O 192.168.0.2/32 [110/0] is directly connected, lo, 00:48:53
C * 192.168.0.2/32 is directly connected, eth2, 00:56:31
C * 192.168.0.2/32 is directly connected, eth1, 00:56:31
C>* 192.168.0.2/32 is directly connected, lo, 00:57:36
O>* 192.168.0.1/32 [110/1] via 192.168.0.1, eth1 onlink, 00:29:03
* via 192.168.0.1, eth2 onlink, 00:29:03

12.3. OSPF unnumbered with ECMP 1151

 VyOS Documentation, Release 1.5.x (circinus)

12.4 Route-Based Site-to-Site VPN to Azure (BGP over IKEv2/IPsec)

This guide shows an example of a route-based IKEv2 site-to-site VPN to Azure using VTI and BGP for dynamic routing
updates.
For redundant / active-active configurations see Route-Based Redundant Site-to-Site VPN to Azure (BGP over
IKEv2/IPsec)

12.4.1 Prerequisites

• A pair of Azure VNet Gateways deployed in active-passive configuration with BGP enabled.
• A local network gateway deployed in Azure representing the Vyos device, matching the below Vyos settings
except for address space, which only requires the Vyos private IP, in this example 10.10.0.5/32
• A connection resource deployed in Azure linking the Azure VNet gateway and the local network gateway repre-
senting the Vyos device.

12.4.2 Example

WAN Interface eth0

On-premises address space 10.10.0.0/16
Azure address space 10.0.0.0/16
Vyos public IP 198.51.100.3
Vyos private IP 10.10.0.5
Azure VNet Gateway public IP 203.0.113.2
Azure VNet Gateway BGP IP 10.0.0.4
Pre-shared key ch00s3-4-s3cur3-psk
Vyos ASN 64499
Azure ASN 65540

12.4.3 Vyos configuration

• Configure the IKE and ESP settings to match a subset of those supported by Azure:

set vpn ipsec esp-group AZURE lifetime '3600'

set vpn ipsec esp-group AZURE mode 'tunnel'
set vpn ipsec esp-group AZURE pfs 'dh-group2'
set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256'
set vpn ipsec esp-group AZURE proposal 1 hash 'sha1'

set vpn ipsec ike-group AZURE dead-peer-detection action 'restart'

set vpn ipsec ike-group AZURE dead-peer-detection interval '15'
set vpn ipsec ike-group AZURE dead-peer-detection timeout '30'
set vpn ipsec ike-group AZURE ikev2-reauth
set vpn ipsec ike-group AZURE key-exchange 'ikev2'
set vpn ipsec ike-group AZURE lifetime '28800'
set vpn ipsec ike-group AZURE proposal 1 dh-group '2'
set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256'
set vpn ipsec ike-group AZURE proposal 1 hash 'sha1'

12.4. Route-Based Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) 1152

 VyOS Documentation, Release 1.5.x (circinus)

• Enable IPsec on eth0

set vpn ipsec interface 'eth0'

• Configure a VTI with a dummy IP address

set interfaces vti vti1 address '10.10.1.5/32'

set interfaces vti vti1 description 'Azure Tunnel'

• Clamp the VTI’s MSS to 1350 to avoid PMTU blackholes.

set interfaces vti vti1 ip adjust-mss 1350

• Configure the VPN tunnel

set vpn ipsec authentication psk azure id '198.51.100.3'

set vpn ipsec authentication psk azure id '203.0.113.2'
set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk'
set vpn ipsec site-to-site peer azure authentication local-id '198.51.100.3'
set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2'
set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'respond'
set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL'
set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE'
set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit'
set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5'
set vpn ipsec site-to-site peer azure remote-address '203.0.113.2'
set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1'
set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE'

• Important: Add an interface route to reach Azure’s BGP listener

set protocols static route 10.0.0.4/32 interface vti1

• Configure your BGP settings

set protocols bgp system-as 64499

set protocols bgp neighbor 10.0.0.4 remote-as '65540'
set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration
˓→'inbound'

set protocols bgp neighbor 10.0.0.4 timers holdtime '30'

set protocols bgp neighbor 10.0.0.4 timers keepalive '10'

• Important: Disable connected check

set protocols bgp neighbor 10.0.0.4 disable-connected-check

12.4. Route-Based Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) 1153

 VyOS Documentation, Release 1.5.x (circinus)

12.5 Route-Based Redundant Site-to-Site VPN to Azure (BGP over

IKEv2/IPsec)

This guide shows an example of a redundant (active-active) route-based IKEv2 site-to-site VPN to Azure using VTI
and BGP for dynamic routing updates.

12.5.1 Prerequisites

• A pair of Azure VNet Gateways deployed in active-active configuration with BGP enabled.
• A local network gateway deployed in Azure representing the Vyos device, matching the below Vyos settings
except for address space, which only requires the Vyos private IP, in this example 10.10.0.5/32
• A connection resource deployed in Azure linking the Azure VNet gateway and the local network gateway repre-
senting the Vyos device.

12.5.2 Example

WAN Interface eth0

On-premises address space 10.10.0.0/16
Azure address space 10.0.0.0/16
Vyos public IP 198.51.100.3
Vyos private IP 10.10.0.5
Azure VNet Gateway 1 public IP 203.0.113.2
Azure VNet Gateway 2 public IP 203.0.113.3
Azure VNet Gateway BGP IP 10.0.0.4,10.0.0.5
Pre-shared key ch00s3-4-s3cur3-psk
Vyos ASN 64499
Azure ASN 65540

12.5.3 Vyos configuration

• Configure the IKE and ESP settings to match a subset of those supported by Azure:

set vpn ipsec esp-group AZURE lifetime '3600'

set vpn ipsec esp-group AZURE mode 'tunnel'
set vpn ipsec esp-group AZURE pfs 'dh-group2'
set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256'
set vpn ipsec esp-group AZURE proposal 1 hash 'sha1'

set vpn ipsec ike-group AZURE dead-peer-detection action 'restart'

set vpn ipsec ike-group AZURE dead-peer-detection interval '15'
set vpn ipsec ike-group AZURE dead-peer-detection timeout '30'
set vpn ipsec ike-group AZURE ikev2-reauth
set vpn ipsec ike-group AZURE key-exchange 'ikev2'
set vpn ipsec ike-group AZURE lifetime '28800'
set vpn ipsec ike-group AZURE proposal 1 dh-group '2'
set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256'
set vpn ipsec ike-group AZURE proposal 1 hash 'sha1'

12.5. Route-Based Redundant Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) 1154
 VyOS Documentation, Release 1.5.x (circinus)

• Enable IPsec on eth0

set vpn ipsec interface 'eth0'

• Configure two VTIs with a dummy IP address each

set interfaces vti vti1 address '10.10.1.5/32'

set interfaces vti vti1 description 'Azure Primary Tunnel'

set interfaces vti vti2 address '10.10.1.6/32'

set interfaces vti vti2 description 'Azure Secondary Tunnel'

• Clamp the VTI’s MSS to 1350 to avoid PMTU blackholes.

set interfaces vti vti1 ip adjust-mss 1350

set interfaces vti vti2 ip adjust-mss 1350

• Configure the VPN tunnels

set vpn ipsec authentication psk azure id '198.51.100.3'

set vpn ipsec authentication psk azure id '203.0.113.2'
set vpn ipsec authentication psk azure id '203.0.113.3'
set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk'

set vpn ipsec site-to-site peer azure-primary authentication local-id '198.51.100.3'

set vpn ipsec site-to-site peer azure-primary authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer azure-primary authentication remote-id '203.0.113.2'
set vpn ipsec site-to-site peer azure-primary connection-type 'respond'
set vpn ipsec site-to-site peer azure-primary description 'AZURE PRIMARY TUNNEL'
set vpn ipsec site-to-site peer azure-primary ike-group 'AZURE'
set vpn ipsec site-to-site peer azure-primary ikev2-reauth 'inherit'
set vpn ipsec site-to-site peer azure-primary local-address '10.10.0.5'
set vpn ipsec site-to-site peer azure-primary remote-address '203.0.113.2'
set vpn ipsec site-to-site peer azure-primary vti bind 'vti1'
set vpn ipsec site-to-site peer azure-primary vti esp-group 'AZURE'

set vpn ipsec site-to-site peer azure-secondary authentication local-id '198.51.100.3'

set vpn ipsec site-to-site peer azure-secondary authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer azure-secondary authentication remote-id '203.0.113.3'
set vpn ipsec site-to-site peer azure-secondary connection-type 'respond'
set vpn ipsec site-to-site peer azure-secondary description 'AZURE secondary TUNNEL'
set vpn ipsec site-to-site peer azure-secondary ike-group 'AZURE'
set vpn ipsec site-to-site peer azure-secondary ikev2-reauth 'inherit'
set vpn ipsec site-to-site peer azure-secondary local-address '10.10.0.5'
set vpn ipsec site-to-site peer azure-secondary remote-address '203.0.113.3'
set vpn ipsec site-to-site peer azure-secondary vti bind 'vti2'
set vpn ipsec site-to-site peer azure-secondary vti esp-group 'AZURE'

• Important: Add an interface route to reach both Azure’s BGP listeners

set protocols static route 10.0.0.4/32 interface vti1

set protocols static route 10.0.0.5/32 interface vti2

• Configure your BGP settings

12.5. Route-Based Redundant Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) 1155
 VyOS Documentation, Release 1.5.x (circinus)

set protocols bgp system-as 64499

set protocols bgp neighbor 10.0.0.4 remote-as '65540'
set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration
˓→'inbound'

set protocols bgp neighbor 10.0.0.4 timers holdtime '30'

set protocols bgp neighbor 10.0.0.4 timers keepalive '10'

set protocols bgp neighbor 10.0.0.5 remote-as '65540'

set protocols bgp neighbor 10.0.0.5 address-family ipv4-unicast soft-reconfiguration
˓→'inbound'

set protocols bgp neighbor 10.0.0.5 timers holdtime '30'

set protocols bgp neighbor 10.0.0.5 timers keepalive '10'

• Important: Disable connected check, otherwise the routes learned from Azure will not be imported into the
routing table.

set protocols bgp neighbor 10.0.0.4 disable-connected-check

set protocols bgp neighbor 10.0.0.5 disable-connected-check

12.6 High Availability Walkthrough

This document walks you through a complete HA setup of two VyOS machines. This design is based on a VM as the
primary router and a physical machine as a backup, using VRRP, BGP, OSPF, and conntrack sharing.
This document aims to walk you through setting everything up, so at a point where you can reboot any machine and
not lose more than a few seconds worth of connectivity.

12.6.1 Design

This is based on a real-life production design. One of the complex issues is ensuring you have redundant data INTO
your network. We do this with a pair of Cisco Nexus switches and using Virtual PortChannels that are spanned across
them. As a bonus, this also allows for complete switch failure without an outage. How you achieve this yourself is left
as an exercise to the reader. But our setup is documented here.

Walkthrough suggestion

The commit command is implied after every section. If you make an error, commit will warn you and you can fix it
before getting too far into things. Please ensure you commit early and commit often.
If you are following through this document, it is strongly suggested you complete the entire document, ONLY doing
the virtual router1 steps, and then come back and walk through it AGAIN on the backup hardware router.
This ensures you don’t go too fast or miss a step. However, it will make your life easier to configure the fixed IP address
and default route now on the hardware router.

12.6. High Availability Walkthrough 1156

 VyOS Documentation, Release 1.5.x (circinus)

Example Network

In this document, we have been allocated 203.0.113.0/24 by our upstream provider, which we are publishing on
VLAN100.
They want us to establish a BGP session to their routers on 192.0.2.11 and 192.0.2.12 from our routers 192.0.2.21 and
192.0.2.22. They are AS 65550 and we are AS 65551.
Our routers are going to have a floating IP address of 203.0.113.1, and use .2 and .3 as their fixed IPs.
We are going to use 10.200.201.0/24 for an ‘internal’ network on VLAN201.
When traffic is originated from the 10.200.201.0/24 network, it will be masqueraded to 203.0.113.1
For connection between sites, we are running a WireGuard link to two REMOTE routers and using OSPF over those
links to distribute routes. That remote site is expected to send traffic from anything in 10.201.0.0/16

VLANs

These are the vlans we will be using:

• 50: Upstream, using the 192.0.2.0/24 network allocated by them.
• 100: ‘Public’ network, using our 203.0.113.0/24 network.
• 201: ‘Internal’ network, using 10.200.201.0/24

Hardware

• switch1 (Nexus 10gb Switch)

• switch2 (Nexus 10gb Switch)
• compute1 (VMware ESXi 6.5)
• compute2 (VMware ESXi 6.5)
• compute3 (VMware ESXi 6.5)
• router2 (Random 1RU machine with 4 NICs)
Note that router1 is a VM that runs on one of the compute nodes.

Network Cabling

• From Datacenter - This connects into port 1 on both switches, and is tagged as VLAN 50
• Cisco VPC Crossconnect - Ports 39 and 40 bonded between each switch
• Hardware Router - Port 8 of each switch
• compute1 - Port 9 of each switch
• compute2 - Port 10 of each switch
• compute3 - Port 11 of each switch
This is ignoring the extra Out-of-band management networking, which should be on totally different switches, and a
different feed into the rack, and is out of scope of this.

12.6. High Availability Walkthrough 1157

 VyOS Documentation, Release 1.5.x (circinus)

Note: Our implementation uses VMware’s Distributed Port Groups, which allows VMware to use LACP. This is a
part of the ENTERPRISE licence, and is not available on a free licence. If you are implementing this and do not have
access to DPGs, you should not use VMware, and use some other virtualization platform instead.

12.6.2 Basic Setup (via console)

Create your router1 VM. So it can withstand a VM Host failing or a network link failing. Using VMware, this is
achieved by enabling vSphere DRS, vSphere Availability, and creating a Distributed Port Group that uses LACP.
Many other Hypervisors do this, and I’m hoping that this document will be expanded to document how to do this for
others.
Create an ‘All VLANs’ network group, that passes all trunked traffic through to the VM. Attach this network group to
router1 as eth0.

Note: VMware: You must DISABLE SECURITY on this Port group. Make sure that Promiscuous Mode, MAC
address changes and Forged transmits are enabled. All of these will be done as part of failover.

Bonding on Hardware Router

Create a LACP bond on the hardware router. We are assuming that eth0 and eth1 are connected to port 8 on both
switches, and that those ports are configured as a Port-Channel.

set interfaces bonding bond0 description 'Switch Port-Channel'

set interfaces bonding bond0 hash-policy 'layer2'
set interfaces bonding bond0 member interface 'eth0'
set interfaces bonding bond0 member interface 'eth1'
set interfaces bonding bond0 mode '802.3ad'

Assign external IP addresses

VLAN 100 and 201 will have floating IP addresses, but VLAN50 does not, as this is talking directly to upstream.
Create our IP address on vlan50.
For the hardware router, replace eth0 with bond0. As (almost) every command is identical, this will not be specified
unless different things need to be performed on different hosts.

set interfaces ethernet eth0 vif 50 address '192.0.2.21/24'

In this case, the hardware router has a different IP, so it would be

set interfaces ethernet bond0 vif 50 address '192.0.2.22/24'

12.6. High Availability Walkthrough 1158

 VyOS Documentation, Release 1.5.x (circinus)

Add (temporary) default route

It is assumed that the routers provided by upstream are capable of acting as a default router, add that as a static route.

set protocols static route 0.0.0.0/0 next-hop 192.0.2.11

commit
save

Enable SSH

Enable SSH so you can now SSH into the routers, rather than using the console.

set service ssh

commit
save

At this point, you should be able to SSH into both of them, and will no longer need access to the console (unless you
break something!)

12.6.3 VRRP Configuration

We are setting up VRRP so that it does NOT fail back when a machine returns into service, and it prioritizes router1
over router2.

Internal Network

This has a floating IP address of 10.200.201.1/24, using virtual router ID 201. The difference between them is the
interface name, hello-source-address, and peer-address.
router1

set interfaces ethernet eth0 vif 201 address 10.200.201.2/24

set high-availability vrrp group int hello-source-address '10.200.201.2'
set high-availability vrrp group int interface 'eth0.201'
set high-availability vrrp group int peer-address '10.200.201.3'
set high-availability vrrp group int no-preempt
set high-availability vrrp group int priority '200'
set high-availability vrrp group int address '10.200.201.1/24'
set high-availability vrrp group int vrid '201'

router2

set interfaces ethernet bond0 vif 201 address 10.200.201.3/24

set high-availability vrrp group int hello-source-address '10.200.201.3'
set high-availability vrrp group int interface 'bond0.201'
set high-availability vrrp group int peer-address '10.200.201.2'
set high-availability vrrp group int no-preempt
set high-availability vrrp group int priority '100'
set high-availability vrrp group int address '10.200.201.1/24'
set high-availability vrrp group int vrid '201'

12.6. High Availability Walkthrough 1159

 VyOS Documentation, Release 1.5.x (circinus)

Public Network

This has a floating IP address of 203.0.113.1/24, using virtual router ID 113. The virtual router ID is just a random
number between 1 and 254, and can be set to whatever you want. Best practices suggest you try to keep them unique
enterprise-wide.
router1

set interfaces ethernet eth0 vif 100 address 203.0.113.2/24

set high-availability vrrp group public hello-source-address '203.0.113.2'
set high-availability vrrp group public interface 'eth0.100'
set high-availability vrrp group public peer-address '203.0.113.3'
set high-availability vrrp group public no-preempt
set high-availability vrrp group public priority '200'
set high-availability vrrp group public address '203.0.113.1/24'
set high-availability vrrp group public vrid '113'

router2

set interfaces ethernet bond0 vif 100 address 203.0.113.3/24

set high-availability vrrp group public hello-source-address '203.0.113.3'
set high-availability vrrp group public interface 'bond0.100'
set high-availability vrrp group public peer-address '203.0.113.2'
set high-availability vrrp group public no-preempt
set high-availability vrrp group public priority '100'
set high-availability vrrp group public address '203.0.113.1/24'
set high-availability vrrp group public vrid '113'

Create VRRP sync-group

The sync group is used to replicate connection tracking. It needs to be assigned to a random VRRP group, and we are
creating a sync group called sync using the vrrp group int.

set high-availability vrrp sync-group sync member 'int'

Testing

At this point, you should be able to see both IP addresses when you run show interfaces, and show vrrp should
show both interfaces in MASTER state (and SLAVE state on router2).

vyos@router1:~$ show vrrp

Name Interface VRID State Last Transition
-------- ----------- ------ ------- -----------------
int eth0.201 201 MASTER 100s
public eth0.100 113 MASTER 200s
vyos@router1:~$

You should be able to ping to and from all the IPs you have allocated.

12.6. High Availability Walkthrough 1160

 VyOS Documentation, Release 1.5.x (circinus)

12.6.4 NAT and conntrack-sync

Masquerade Traffic originating from 10.200.201.0/24 that is heading out the public interface.

Note: We explicitly exclude the primary upstream network so that BGP or OSPF traffic doesn’t accidentally get
NAT’ed.

set nat source rule 10 destination address '!192.0.2.0/24'

set nat source rule 10 outbound-interface name 'eth0.50'
set nat source rule 10 source address '10.200.201.0/24'
set nat source rule 10 translation address '203.0.113.1'

Configure conntrack-sync and enable helpers

Conntrack helper modules are enabled by default, but they tend to cause more problems than they’re worth in complex
networks. You can disable all of them at one go.

delete system conntrack modules

Now enable replication between nodes. Replace eth0.201 with bond0.201 on the hardware router.

set service conntrack-sync accept-protocol 'tcp,udp,icmp'

set service conntrack-sync event-listen-queue-size '8'
set service conntrack-sync failover-mechanism vrrp sync-group 'sync'
set service conntrack-sync interface eth0.201
set service conntrack-sync mcast-group '224.0.0.50'
set service conntrack-sync sync-queue-size '8'

Testing

The simplest way to test is to look at the connection tracking stats on the standby hardware router with the command
show conntrack-sync statistics. The numbers should be very close to the numbers on the primary router.
When you have both routers up, you should be able to establish a connection from a NAT’ed machine out to the internet,
reboot the active machine, and that connection should be preserved, and will not drop out.

12.6.5 OSPF Over WireGuard

Wireguard doesn’t have the concept of an up or down link, due to its design. This complicates AND simplifies using it
for network transport, as for reliable state detection you need to use SOMETHING to detect when the link is down.
If you use a routing protocol itself, you solve two problems at once. This is only a basic example, and is provided as a
starting point.

12.6. High Availability Walkthrough 1161

 VyOS Documentation, Release 1.5.x (circinus)

Configure Wireguard

There is plenty of instructions and documentation on setting up Wireguard. The only important thing you need to
remember is to only use one WireGuard interface per OSPF connection.
We use small /30’s from 10.254.60/24 for the point-to-point links.
router1
Replace the 203.0.113.3 with whatever the other router’s IP address is.

set interfaces wireguard wg01 address '10.254.60.1/30'

set interfaces wireguard wg01 description 'router1-to-offsite1'
set interfaces wireguard wg01 peer OFFSITE1 allowed-ips '0.0.0.0/0'
set interfaces wireguard wg01 peer OFFSITE1 endpoint '203.0.113.3:50001'
set interfaces wireguard wg01 peer OFFSITE1 persistent-keepalive '15'
set interfaces wireguard wg01 peer OFFSITE1 pubkey 'GEFMOWzAyau42/
˓→HwdwfXnrfHdIISQF8YHj35rOgSZ0o='

set interfaces wireguard wg01 port '50001'

set protocols ospf interface wg01 authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e'
set protocols ospf interface wg01 cost '11'
set protocols ospf interface wg01 dead-interval '5'
set protocols ospf interface wg01 hello-interval '1'
set protocols ospf interface wg01 network 'point-to-point'
set protocols ospf interface wg01 priority '1'
set protocols ospf interface wg01 retransmit-interval '5'
set protocols ospf interface wg01 transmit-delay '1'

offsite1
This is connecting back to the STATIC IP of router1, not the floating.

set interfaces wireguard wg01 address '10.254.60.2/30'

set interfaces wireguard wg01 description 'offsite1-to-router1'
set interfaces wireguard wg01 peer ROUTER1 allowed-ips '0.0.0.0/0'
set interfaces wireguard wg01 peer ROUTER1 endpoint '192.0.2.21:50001'
set interfaces wireguard wg01 peer ROUTER1 persistent-keepalive '15'
set interfaces wireguard wg01 peer ROUTER1 pubkey 'CKwMV3ZaLntMule2Kd3G7UyVBR7zE8/
˓→qoZgLb82EE2Q='

set interfaces wireguard wg01 port '50001'

set protocols ospf interface wg01 authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e'
set protocols ospf interface wg01 cost '11'
set protocols ospf interface wg01 dead-interval '5'
set protocols ospf interface wg01 hello-interval '1'
set protocols ospf interface wg01 network 'point-to-point'
set protocols ospf interface wg01 priority '1'
set protocols ospf interface wg01 retransmit-interval '5'
set protocols ospf interface wg01 transmit-delay '1'

12.6. High Availability Walkthrough 1162

 VyOS Documentation, Release 1.5.x (circinus)

Test WireGuard

Make sure you can ping 10.254.60.1 and .2 from both routers.

Create Export Filter

We only want to export the networks we know. Always do a whitelist on your route filters, both importing and exporting.
A good rule of thumb is ‘If you are not the default router for a network, don’t advertise it’. This means we explicitly
do not want to advertise the 192.0.2.0/24 network (but do want to advertise 10.200.201.0 and 203.0.113.0, which we
ARE the default route for). This filter is applied to redistribute connected. If we WERE to advertise it, the
remote machines would see 192.0.2.21 available via their default route, establish the connection, and then OSPF would
say ‘192.0.2.0/24 is available via this tunnel’, at which point the tunnel would break, OSPF would drop the routes, and
then 192.0.2.0/24 would be reachable via default again. This is called ‘flapping’.

set policy access-list 150 description 'Outbound OSPF Redistribution'

set policy access-list 150 rule 10 action 'permit'
set policy access-list 150 rule 10 destination any
set policy access-list 150 rule 10 source inverse-mask '0.0.0.255'
set policy access-list 150 rule 10 source network '10.200.201.0'
set policy access-list 150 rule 20 action 'permit'
set policy access-list 150 rule 20 destination any
set policy access-list 150 rule 20 source inverse-mask '0.0.0.255'
set policy access-list 150 rule 20 source network '203.0.113.0'
set policy access-list 150 rule 100 action 'deny'
set policy access-list 150 rule 100 destination any
set policy access-list 150 rule 100 source any

Create Import Filter

We only want to import networks we know. Our OSPF peer should only be advertising networks in the 10.201.0.0/16
range. Note that this is an INVERSE MATCH. You deny in access-list 100 to accept the route.

set policy access-list 100 description 'Inbound OSPF Routes from Peers'
set policy access-list 100 rule 10 action 'deny'
set policy access-list 100 rule 10 destination any
set policy access-list 100 rule 10 source inverse-mask '0.0.255.255'
set policy access-list 100 rule 10 source network '10.201.0.0'
set policy access-list 100 rule 100 action 'permit'
set policy access-list 100 rule 100 destination any
set policy access-list 100 rule 100 source any
set policy route-map PUBOSPF rule 100 action 'deny'
set policy route-map PUBOSPF rule 100 match ip address access-list '100'
set policy route-map PUBOSPF rule 500 action 'permit'

12.6. High Availability Walkthrough 1163

 VyOS Documentation, Release 1.5.x (circinus)

Enable OSPF

Every router must have a unique router-id. The ‘reference-bandwidth’ is used because when OSPF was originally
designed, the idea of a link faster than 1gbit was unheard of, and it does not scale correctly.

set protocols ospf area 0.0.0.0 authentication 'md5'

set protocols ospf area 0.0.0.0 network '10.254.60.0/24'
set protocols ospf auto-cost reference-bandwidth '10000'
set protocols ospf log-adjacency-changes
set protocols ospf parameters abr-type 'cisco'
set protocols ospf parameters router-id '10.254.60.2'
set protocols ospf route-map PUBOSPF

Test OSPF

When you have enabled OSPF on both routers, you should be able to see each other with the command show ip ospf
neighbour. The state must be ‘Full’ or ‘2-Way’. If it is not, then there is a network connectivity issue between the
hosts. This is often caused by NAT or MTU issues. You should not see any new routes (unless this is the second pass)
in the output of show ip route

12.6.6 Advertise connected routes

As a reminder, only advertise routes that you are the default router for. This is why we are NOT announcing the
192.0.2.0/24 network, because if that was announced into OSPF, the other routers would try to connect to that network
over a tunnel that connects to that network!

set protocols ospf access-list 150 export 'connected'

set protocols ospf redistribute connected

You should now be able to see the advertised network on the other host.

Duplicate configuration

At this point, you now need to create the X link between all four routers. Use amdifferent /30 for each link.

Priorities

Set the cost on the secondary links to be 200. This means that they will not be used unless the primary links are down.

set protocols ospf interface wg01 cost '10'

set protocols ospf interface wg01 cost '200'

This will be visible in ‘show ip route’.

12.6. High Availability Walkthrough 1164

 VyOS Documentation, Release 1.5.x (circinus)

12.6.7 BGP

BGP is an extremely complex network protocol. An example is provided here.

Note: Router id’s must be unique.

router1
The redistribute ospf command is there purely as an example of how this can be expanded. In this walkthrough,
it will be filtered by BGPOUT rule 10000, as it is not 203.0.113.0/24.

set policy prefix-list BGPOUT description 'BGP Export List'

set policy prefix-list BGPOUT rule 10 action 'deny'
set policy prefix-list BGPOUT rule 10 description 'Do not advertise short masks'
set policy prefix-list BGPOUT rule 10 ge '25'
set policy prefix-list BGPOUT rule 10 prefix '0.0.0.0/0'
set policy prefix-list BGPOUT rule 100 action 'permit'
set policy prefix-list BGPOUT rule 100 description 'Our network'
set policy prefix-list BGPOUT rule 100 prefix '203.0.113.0/24'
set policy prefix-list BGPOUT rule 10000 action 'deny'
set policy prefix-list BGPOUT rule 10000 prefix '0.0.0.0/0'

set policy route-map BGPOUT description 'BGP Export Filter'

set policy route-map BGPOUT rule 10 action 'permit'
set policy route-map BGPOUT rule 10 match ip address prefix-list 'BGPOUT'
set policy route-map BGPOUT rule 10000 action 'deny'
set policy route-map BGPPREPENDOUT description 'BGP Export Filter'
set policy route-map BGPPREPENDOUT rule 10 action 'permit'
set policy route-map BGPPREPENDOUT rule 10 set as-path prepend '65551 65551 65551'
set policy route-map BGPPREPENDOUT rule 10 match ip address prefix-list 'BGPOUT'
set policy route-map BGPPREPENDOUT rule 10000 action 'deny'

set protocols bgp system-as 65551

set protocols bgp address-family ipv4-unicast network 192.0.2.0/24
set protocols bgp address-family ipv4-unicast redistribute connected metric '50'
set protocols bgp address-family ipv4-unicast redistribute ospf metric '50'
set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast route-map export
˓→'BGPOUT'

set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast soft-reconfiguration␣

˓→inbound

set protocols bgp neighbor 192.0.2.11 remote-as '65550'

set protocols bgp neighbor 192.0.2.11 update-source '192.0.2.21'
set protocols bgp parameters router-id '192.0.2.21'

router2
This is identical, but you use the BGPPREPENDOUT route-map to advertise the route with a longer path.

12.6. High Availability Walkthrough 1165

 VyOS Documentation, Release 1.5.x (circinus)

12.7 WAN Load Balancer examples

12.7.1 Example 1: Distributing load evenly

The setup used in this example is shown in the following diagram:

12.7. WAN Load Balancer examples 1166

 VyOS Documentation, Release 1.5.x (circinus)

Overview

• All traffic coming in through eth2 is balanced between eth0 and eth1 on the router.
• Pings will be sent to four targets for health testing (33.44.55.66, 44.55.66.77, 55.66.77.88 and 66.77.88.99).
• All outgoing packets are assigned the source address of the assigned interface (SNAT).
• eth0 is set to be removed from the load balancer’s interface pool after 5 ping failures, eth1 will be removed after
4 ping failures.

Create static routes to ping targets

Create static routes through the two ISPs towards the ping targets and commit the changes:

set protocols static route 33.44.55.66/32 next-hop 11.22.33.1

set protocols static route 44.55.66.77/32 next-hop 11.22.33.1
set protocols static route 55.66.77.88/32 next-hop 22.33.44.1
set protocols static route 66.77.88.99/32 next-hop 22.33.44.1

Configure the load balancer

Configure the WAN load balancer with the parameters described above:

set load-balancing wan interface-health eth0 failure-count 5

set load-balancing wan interface-health eth0 nexthop 11.22.33.1
set load-balancing wan interface-health eth0 test 10 type ping
set load-balancing wan interface-health eth0 test 10 target 33.44.55.66
set load-balancing wan interface-health eth0 test 20 type ping
set load-balancing wan interface-health eth0 test 20 target 44.55.66.77
set load-balancing wan interface-health eth1 failure-count 4
set load-balancing wan interface-health eth1 nexthop 22.33.44.1
set load-balancing wan interface-health eth1 test 10 type ping
set load-balancing wan interface-health eth1 test 10 target 55.66.77.88
set load-balancing wan interface-health eth1 test 20 type ping
set load-balancing wan interface-health eth1 test 20 target 66.77.88.99
set load-balancing wan rule 10 inbound-interface eth2
set load-balancing wan rule 10 interface eth0
set load-balancing wan rule 10 interface eth1

12.7.2 Example 2: Failover based on interface weights

This example uses the failover mode.

12.7. WAN Load Balancer examples 1167

 VyOS Documentation, Release 1.5.x (circinus)

Overview

In this example, eth0 is the primary interface and eth1 is the secondary interface. To provide simple failover function-
ality. If eth0 fails, eth1 takes over.

Create interface weight based configuration

The configuration steps are the same as in the previous example, except rule 10. So we keep the configuration, remove
rule 10 and add a new rule for the failover mode:

delete load-balancing wan rule 10

set load-balancing wan rule 10 failover
set load-balancing wan rule 10 inbound-interface eth2
set load-balancing wan rule 10 interface eth0 weight 10
set load-balancing wan rule 10 interface eth1 weight 1

12.7.3 Example 3: Failover based on rule order

The previous example used the failover command to send traffic through eth1 if eth0 fails. In this example, failover
functionality is provided by rule order.

Overview

Two rules will be created, the first rule directs traffic coming in from eth2 to eth0 and the second rule directs the traffic
to eth1. If eth0 fails the first rule is bypassed and the second rule matches, directing traffic to eth1.

Create rule order based configuration

We keep the configuration from the previous example, delete rule 10 and create the two new rules as described:

delete load-balancing wan rule 10

set load-balancing wan rule 10 inbound-interface eth2
set load-balancing wan rule 10 interface eth0
set load-balancing wan rule 20 inbound-interface eth2
set load-balancing wan rule 20 interface eth1

12.7.4 Example 4: Failover based on rule order - priority traffic

A rule order for prioritizing traffic is useful in scenarios where the secondary link has a lower speed and should only
carry high priority traffic. It is assumed for this example that eth1 is connected to a slower connection than eth0 and
should prioritize VoIP traffic.

12.7. WAN Load Balancer examples 1168

 VyOS Documentation, Release 1.5.x (circinus)

Overview

A rule order for prioritizing traffic is useful in scenarios where the secondary link has a lower speed and should only
carry high priority traffic. It is assumed for this example that eth1 is connected to a slower connection than eth0 and
should prioritize VoIP traffic.

Create rule order based configuration with low speed secondary link

We keep the configuration from the previous example, delete rule 20 and create a new rule as described:

delete load-balancing wan rule 20

set load-balancing wan rule 20 inbound-interface eth2
set load-balancing wan rule 20 interface eth1
set load-balancing wan rule 20 destination port sip
set load-balancing wan rule 20 protocol tcp
set protocols static route 0.0.0.0/0 next-hop 11.22.33.1

12.7.5 Example 5: Exclude traffic from load balancing

In this example two LAN interfaces exist in different subnets instead of one like in the previous examples:

12.7. WAN Load Balancer examples 1169

 VyOS Documentation, Release 1.5.x (circinus)

Adding a rule for the second interface

Based on the previous example, another rule for traffic from the second interface eth3 can be added to the load balancer.
However, traffic meant to flow between the LAN subnets will be sent to eth0 and eth1 as well. To prevent this, another
rule is required. This rule excludes traffic between the local subnets from the load balancer. It also excludes locally-
sources packets (required for web caching with load balancing). eth+ is used as an alias that refers to all ethernet
interfaces:

set load-balancing wan rule 5 exclude

set load-balancing wan rule 5 inbound-interface eth+
set load-balancing wan rule 5 destination address 10.0.0.0/8

12.7. WAN Load Balancer examples 1170

 VyOS Documentation, Release 1.5.x (circinus)

12.8 PPPoE IPv6 Basic Setup for Home Network

This document is to describe a basic setup using PPPoE with DHCPv6-PD + SLAAC to construct a typical home
network. The user can follow the steps described here to quickly setup a working network and use this as a starting
point to further configure or fine-tune other settings.
To achieve this, your ISP is required to support DHCPv6-PD. If you’re not sure, please contact your ISP for more
information.

12.8.1 Network Topology

12.8.2 Configurations

PPPoE Setup

set interfaces pppoe pppoe0 authentication password <YOUR PASSWORD>

set interfaces pppoe pppoe0 authentication user <YOUR USERNAME>
set interfaces pppoe pppoe0 service-name <YOUR SERVICENAME>
set interfaces pppoe pppoe0 source-interface 'eth0'

• Fill password and user with the credential provided by your ISP.
• service-name can be an arbitrary string.

DHCPv6-PD Setup

During address configuration, in addition to assigning an address to the WAN interface, ISP also provides a prefix to
allow the router to configure addresses of LAN interface and other nodes connecting to LAN, which is called prefix
delegation (PD).

set interfaces pppoe pppoe0 ipv6 address autoconf

set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1 address '100'

• Here we use the prefix to configure the address of eth1 (LAN) to form <prefix>::64, where 64 is hexadecimal
of address 100.
• For home network users, most of time ISP only provides /64 prefix, hence there is no need to set SLA ID and
prefix length. See PPPoE for more information.

12.8. PPPoE IPv6 Basic Setup for Home Network 1171

 VyOS Documentation, Release 1.5.x (circinus)

Router Advertisement

We need to enable router advertisement for LAN network so that PC can receive the prefix and use SLAAC to configure
the address automatically.

set service router-advert interface eth1 link-mtu '1492'

set service router-advert interface eth1 name-server <NAME SERVER>
set service router-advert interface eth1 prefix ::/64 valid-lifetime '172800'

• Set MTU in advertisement to 1492 because of PPPoE header overhead.

• Set DNS server address in the advertisement so that clients can obtain it by using RDNSS option. Most operating
systems (Windows, Linux, Mac) should already support it.
• Here we set the prefix to ::/64 to indicate advertising any /64 prefix the LAN interface is assigned.
• Since some ISPs disconnects continuous connection for every 2~3 days, we set valid-lifetime to 2 days to
allow PC for phasing out old address.

Basic Firewall

To have basic protection while keeping IPv6 network functional, we need to:
• Allow all established and related traffic for router and LAN
• Allow all icmpv6 packets for router and LAN
• Allow DHCPv6 packets for router

set firewall ipv6 name WAN_IN default-action 'drop'

set firewall ipv6 name WAN_IN rule 10 action 'accept'
set firewall ipv6 name WAN_IN rule 10 state established 'enable'
set firewall ipv6 name WAN_IN rule 10 state related 'enable'
set firewall ipv6 name WAN_IN rule 20 action 'accept'
set firewall ipv6 name WAN_IN rule 20 protocol 'icmpv6'
set firewall ipv6 name WAN_LOCAL default-action 'drop'
set firewall ipv6 name WAN_LOCAL rule 10 action 'accept'
set firewall ipv6 name WAN_LOCAL rule 10 state established 'enable'
set firewall ipv6 name WAN_LOCAL rule 10 state related 'enable'
set firewall ipv6 name WAN_LOCAL rule 20 action 'accept'
set firewall ipv6 name WAN_LOCAL rule 20 protocol 'icmpv6'
set firewall ipv6 name WAN_LOCAL rule 30 action 'accept'
set firewall ipv6 name WAN_LOCAL rule 30 destination port '546'
set firewall ipv6 name WAN_LOCAL rule 30 protocol 'udp'
set firewall ipv6 name WAN_LOCAL rule 30 source port '547'
set firewall ipv6 forward filter rule 10 action jump
set firewall ipv6 forward filter rule 10 jump-target 'WAN_IN'
set firewall ipv6 forward filter rule 10 inbound-interface name 'pppoe0'
set firewall ipv6 input filter rule 10 action jump
set firewall ipv6 input filter rule 10 jump-target 'WAN_LOCAL'
set firewall ipv6 input filter rule 10 inbound-interface name 'pppoe0'

Note to allow the router to receive DHCPv6 response from ISP. We need to allow packets with source port 547 (server)
and destination port 546 (client).

12.8. PPPoE IPv6 Basic Setup for Home Network 1172

 VyOS Documentation, Release 1.5.x (circinus)

12.9 L3VPN for Hub-and-Spoke connectivity with VyOS

IP/MPLS technology is widely used by various service providers and large enterprises in order to achieve better network
scalability, manageability and flexibility. It also provides the possibility to deliver different services for the customers
in a seamless manner. Layer 3 VPN (L3VPN) is a type of VPN mode that is built and delivered through OSI layer 3
networking technologies. Often the border gateway protocol (BGP) is used to send and receive VPN-related data that
is responsible for the control plane. L3VPN utilizes virtual routing and forwarding (VRF) techniques to receive and
deliver user data as well as separate data planes of the end-users. It is built using a combination of IP- and MPLS-based
information. Generally, L3VPNs are used to send data on back-end VPN infrastructures, such as for VPN connections
between data centres, HQs and branches.
An L3VPN consists of multiple access links, multiple VPN routing and forwarding (VRF) tables, and multiple MPLS
paths or multiple P2MP LSPs. An L3VPN can be configured to connect two or more customer sites. In hub-and-spoke
MPLS L3VPN environments, the spoke routers need to have unique Route Distinguishers (RDs). In order to use the
hub site as a transit point for connectivity in such an environment, the spoke sites export their routes to the hub. Spokes
can talk to hubs, but never have direct paths to other spokes. All traffic between spokes is controlled and delivered over
the hub site.
To deploy a Layer3 VPN with MPLS on VyOS, we should meet a couple requirements in order to properly implement
the solution. We’ll use the following nodes in our LAB environment:
• 2 x Route reflectors (VyOS-RRx)
• 4 x Provider routers (VyOS-Px)
• 3 x Provider Edge (VyOs-PEx)
• 3 x Customer Edge (VyOS-CEx)
The following software was used in the creation of this document:
• Operating system: VyOS
• Version: 1.4-rolling-202110310317
• Image name: vyos-1.4-rolling-202110310317-amd64.iso
NOTE: VyOS Router (tested with VyOS 1.4-rolling-202110310317) – The configurations below are specifically for
VyOS 1.4.x.
General information can be found in the L3VPN VRFs chapter.

12.9. L3VPN for Hub-and-Spoke connectivity with VyOS 1173

 VyOS Documentation, Release 1.5.x (circinus)

12.9.1 Topology

12.9.2 How does it work?

As we know the main assumption of L3VPN “Hub and Spoke” is, that the traffic between spokes have to pass via
hub, in our scenario VyOS-PE2 is the Hub PE and the VyOS-CE1-HUB is the central customer office device that is
responsible for controlling access between all spokes and announcing its network prefixes (10.0.0.100/32). VyOS-
PE2 has the main VRF (its name is BLUE_HUB), its own Route-Distinguisher(RD) and route-target import/export
lists. Multiprotocol-BGP(MP-BGP) delivers L3VPN related control-plane information to the nodes across network
where PEs Spokes import the route-target 60535:1030 (this is export route-target of vrf BLUE_HUB) and export its
own route-target 60535:1011(this is vrf BLUE_SPOKE export route-target). Therefore, the Customer edge nodes can
only learn the network prefixes of the HUB site [10.0.0.100/32]. For this example VyOS-CE1 has network prefixes
[10.0.0.80/32] / VyOS-CE2 has network prefixes [10.0.0.90/32]. Route-Reflector devices VyOS-RR1 and VyOS-RR2
are used to simplify network routes exchange and minimize iBGP peerings between devices.
L3VPN configuration parameters table:

Node Role VRF RD RT import RT export

VyOS-PE2 Hub BLUE_HUB 10.80.80.1:1011 65035:1011 65035:1030 65035:1030
VyOS-PE1 Spoke BLUE_SPOKE 10.50.50.1:1011 65035:1030 65035:1011
VyOS-PE3 Spoke BLUE_SPOKE 10.60.60.1:1011 65035:1030 65035:1011

12.9.3 Configuration

Step-1: Configuring IGP and enabling MPLS LDP

At the first step we need to configure the IP/MPLS backbone network using OSPF as IGP protocol and LDP as label-
switching protocol for the base connectivity between P (rovider), P (rovider) E (dge) and R (oute) R (eflector) nodes:
• VyOS-P1:

# interfaces
set interfaces dummy dum10 address '10.0.0.3/32'
(continues on next page)

12.9. L3VPN for Hub-and-Spoke connectivity with VyOS 1174

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set interfaces ethernet eth0 address '172.16.30.1/24'
set interfaces ethernet eth1 address '172.16.40.1/24'
set interfaces ethernet eth2 address '172.16.90.1/24'
set interfaces ethernet eth3 address '172.16.10.1/24'
set interfaces ethernet eth5 address '172.16.100.1/24'

# protocols ospf+ldp
set protocols mpls interface 'eth1'
set protocols mpls interface 'eth2'
set protocols mpls interface 'eth3'
set protocols mpls interface 'eth5'
set protocols mpls interface 'eth0'
set protocols mpls ldp discovery transport-ipv4-address '10.0.0.3'
set protocols mpls ldp interface 'eth0'
set protocols mpls ldp interface 'eth1'
set protocols mpls ldp interface 'eth2'
set protocols mpls ldp interface 'eth3'
set protocols mpls ldp interface 'eth5'
set protocols mpls ldp router-id '10.0.0.3'
set protocols ospf area 0 network '0.0.0.0/0'
set protocols ospf parameters abr-type 'cisco'
set protocols ospf parameters router-id '10.0.0.3

• VyOS-P2:

# interfaces
set interfaces dummy dum10 address '10.0.0.4/32'
set interfaces ethernet eth0 address '172.16.30.2/24'
set interfaces ethernet eth1 address '172.16.20.1/24'
set interfaces ethernet eth2 address '172.16.120.1/24'
set interfaces ethernet eth3 address '172.16.60.1/24'

# protocols ospf+ldp
set protocols mpls interface 'eth1'
set protocols mpls interface 'eth2'
set protocols mpls interface 'eth3'
set protocols mpls interface 'eth0'
set protocols mpls ldp discovery transport-ipv4-address '10.0.0.4'
set protocols mpls ldp interface 'eth0'
set protocols mpls ldp interface 'eth1'
set protocols mpls ldp interface 'eth2'
set protocols mpls ldp interface 'eth3'
set protocols mpls ldp router-id '10.0.0.4'
set protocols ospf area 0 network '0.0.0.0/0'
set protocols ospf parameters abr-type 'cisco'
set protocols ospf parameters router-id '10.0.0.4'

• VyOS-P3:

# interfaces
set interfaces dummy dum10 address '10.0.0.5/32'
set interfaces ethernet eth0 address '172.16.110.1/24'
(continues on next page)

12.9. L3VPN for Hub-and-Spoke connectivity with VyOS 1175

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set interfaces ethernet eth1 address '172.16.40.2/24'
set interfaces ethernet eth2 address '172.16.50.1/24'
set interfaces ethernet eth3 address '172.16.70.1/24'

# protocols ospf + ldp

set protocols mpls interface 'eth1'
set protocols mpls interface 'eth2'
set protocols mpls interface 'eth3'
set protocols mpls interface 'eth0'
set protocols mpls ldp discovery transport-ipv4-address '10.0.0.5'
set protocols mpls ldp interface 'eth0'
set protocols mpls ldp interface 'eth1'
set protocols mpls ldp interface 'eth2'
set protocols mpls ldp interface 'eth3'
set protocols mpls ldp router-id '10.0.0.5'
set protocols ospf area 0 network '0.0.0.0/0'
set protocols ospf parameters abr-type 'cisco'
set protocols ospf parameters router-id '10.0.0.5'

• VyOS-P4:

# interfaces
set interfaces dummy dum10 address '10.0.0.6/32'
set interfaces ethernet eth0 address '172.16.80.2/24'
set interfaces ethernet eth1 address '172.16.130.1/24'
set interfaces ethernet eth2 address '172.16.50.2/24'
set interfaces ethernet eth3 address '172.16.60.2/24'
set interfaces ethernet eth5 address '172.16.140.1/24'

# protocols ospf + ldp

set protocols mpls interface 'eth1'
set protocols mpls interface 'eth2'
set protocols mpls interface 'eth3'
set protocols mpls interface 'eth0'
set protocols mpls interface 'eth5'
set protocols mpls ldp discovery transport-ipv4-address '10.0.0.6'
set protocols mpls ldp interface 'eth0'
set protocols mpls ldp interface 'eth1'
set protocols mpls ldp interface 'eth2'
set protocols mpls ldp interface 'eth3'
set protocols mpls ldp interface 'eth5'
set protocols mpls ldp router-id '10.0.0.6'
set protocols ospf area 0 network '0.0.0.0/0'
set protocols ospf parameters abr-type 'cisco'
set protocols ospf parameters router-id '10.0.0.6'

• VyOS-PE1:

# interfaces
set interfaces dummy dum10 address '10.0.0.7/32'
set interfaces ethernet eth0 address '172.16.90.2/24'
(continues on next page)

12.9. L3VPN for Hub-and-Spoke connectivity with VyOS 1176

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

# protocols ospf + ldp

set protocols mpls interface 'eth0'
set protocols mpls ldp discovery transport-ipv4-address '10.0.0.7'
set protocols mpls ldp interface 'eth0'
set protocols mpls ldp router-id '10.0.0.7'
set protocols ospf area 0 network '0.0.0.0/0'
set protocols ospf parameters abr-type 'cisco'
set protocols ospf parameters router-id '10.0.0.7'

• VyOS-PE2:
# interfaces
set interfaces dummy dum10 address '10.0.0.8/32'
set interfaces ethernet eth0 address '172.16.110.2/24'
set interfaces ethernet eth1 address '172.16.100.2/24'
set interfaces ethernet eth2 address '172.16.80.1/24'

# protocols ospf + ldp

set protocols mpls interface 'eth0'
set protocols mpls interface 'eth1'
set protocols mpls ldp discovery transport-ipv4-address '10.0.0.8'
set protocols mpls ldp interface 'eth0'
set protocols mpls ldp interface 'eth1'
set protocols mpls ldp router-id '10.0.0.8'
set protocols ospf area 0 network '0.0.0.0/0'
set protocols ospf parameters abr-type 'cisco'
set protocols ospf parameters router-id '10.0.0.8'

• VyOS-PE3:

# interfaces
set interfaces dummy dum10 address '10.0.0.10/32'
set interfaces ethernet eth0 address '172.16.140.2/24'

# protocols ospf + ldp

set protocols mpls interface 'eth0'
set protocols mpls ldp discovery transport-ipv4-address '10.0.0.10'
set protocols mpls ldp interface 'eth0'
set protocols mpls ldp router-id '10.0.0.10'
set protocols ospf area 0 network '0.0.0.0/0'
set protocols ospf parameters abr-type 'cisco'
set protocols ospf parameters router-id '10.0.0.10'

• VyOS-RR1:
# interfaces
set interfaces ethernet eth1 address '172.16.20.2/24'
set interfaces ethernet eth2 address '172.16.10.2/24'
set interfaces dummy dum10 address '10.0.0.1/32'

# protocols ospf + ldp

set protocols mpls interface 'eth1'
(continues on next page)

12.9. L3VPN for Hub-and-Spoke connectivity with VyOS 1177

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set protocols mpls interface 'eth2'
set protocols mpls ldp discovery transport-ipv4-address '10.0.0.1'
set protocols mpls ldp interface 'eth1'
set protocols mpls ldp interface 'eth2'
set protocols mpls ldp router-id '10.0.0.1'
set protocols ospf area 0 network '0.0.0.0/0'
set protocols ospf parameters abr-type 'cisco'
set protocols ospf parameters router-id '10.0.0.1'

• VyOS-RR2:

# interfaces
set interfaces ethernet eth0 address '172.16.80.1/24'
set interfaces ethernet eth1 address '172.16.70.2/24'
set interfaces dummy dum10 address '10.0.0.2/32'

# protocols ospf + ldp

set protocols mpls interface 'eth0'
set protocols mpls interface 'eth1'
set protocols mpls ldp discovery transport-ipv4-address '10.0.0.2'
set protocols mpls ldp interface 'eth1'
set protocols mpls ldp interface 'eth0'
set protocols mpls ldp router-id '10.0.0.2'
set protocols ospf area 0 network '0.0.0.0/0'
set protocols ospf parameters abr-type 'cisco'
set protocols ospf parameters router-id '10.0.0.2'

Step-2: Configuring iBGP for L3VPN control-plane

At this step we are going to enable iBGP protocol on MPLS nodes and Route Reflectors (two routers for redundancy)
that will deliver IPv4 VPN (L3VPN) routes between them:
• VyOS-RR1:

set protocols bgp system-as '65001'

set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client
set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4'
set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client
set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4'
set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client
set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4'
set protocols bgp parameters cluster-id '10.0.0.1'
set protocols bgp parameters log-neighbor-changes
set protocols bgp parameters router-id '10.0.0.1'
set protocols bgp peer-group RR_VPNv4 remote-as '65001'
set protocols bgp peer-group RR_VPNv4 update-source 'dum10'

• VyOS-RR2:

set protocols bgp system-as '65001'

set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client
set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4'
(continues on next page)

12.9. L3VPN for Hub-and-Spoke connectivity with VyOS 1178

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client
set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4'
set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client
set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4'
set protocols bgp parameters cluster-id '10.0.0.1'
set protocols bgp parameters log-neighbor-changes
set protocols bgp parameters router-id '10.0.0.2'
set protocols bgp peer-group RR_VPNv4 remote-as '65001'
set protocols bgp peer-group RR_VPNv4 update-source 'dum10'

• VyOS-PE1:

set protocols bgp system-as '65001'

set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self
set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4'
set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self
set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4'
set protocols bgp parameters log-neighbor-changes
set protocols bgp parameters router-id '10.0.0.7'
set protocols bgp peer-group RR_VPNv4 remote-as '65001'
set protocols bgp peer-group RR_VPNv4 update-source 'dum10'

• VyOS-PE2:

set protocols bgp system-as '65001'

set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self
set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4'
set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self
set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4'
set protocols bgp parameters log-neighbor-changes
set protocols bgp parameters router-id '10.0.0.8'
set protocols bgp peer-group RR_VPNv4 remote-as '65001'
set protocols bgp peer-group RR_VPNv4 update-source 'dum10'

• VyOS-PE3:

set protocols bgp system-as '65001'

set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self
set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4'
set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self
set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4'
set protocols bgp parameters log-neighbor-changes
set protocols bgp parameters router-id '10.0.0.10'
set protocols bgp peer-group RR_VPNv4 remote-as '65001'
set protocols bgp peer-group RR_VPNv4 update-source 'dum10'

12.9. L3VPN for Hub-and-Spoke connectivity with VyOS 1179

 VyOS Documentation, Release 1.5.x (circinus)

Step-3: Configuring L3VPN VRFs on PE nodes

This section provides configuration steps for setting up VRFs on our PE nodes including CE facing interfaces, BGP, rd
and route-target import/export based on the pre-defined parameters.
• VyOS-PE1:

# VRF settings
set vrf name BLUE_SPOKE table '200'
set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn
set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn
set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto'
set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.50.50.0/24
set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.50.
˓→50.1:1011'

set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected
set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn␣
˓→export '65035:1011'

set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn␣
˓→import '65035:1030'

set vrf name BLUE_SPOKE protocols bgp system-as '65001'

set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 address-family ipv4-unicast as-
˓→override

set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 remote-as '65035'

# interfaces
set interfaces ethernet eth3 address '10.50.50.1/24'
set interfaces ethernet eth3 vrf 'BLUE_SPOKE'

• VyOS-PE2:

# VRF settings
set vrf name BLUE_HUB table '400'
set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast export vpn
set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast import vpn
set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast label vpn export 'auto'
set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast network 10.80.80.0/24
set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast rd vpn export '10.80.80.
˓→1:1011'

set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast redistribute connected
set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn export
˓→'65035:1030'

set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn import
˓→'65035:1011 65050:2011 65035:1030'

set vrf name BLUE_HUB protocols bgp system-as '65001'

set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 address-family ipv4-unicast as-
˓→override

set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 remote-as '65035'

# interfaces
set interfaces ethernet eth3 address '10.80.80.1/24'
set interfaces ethernet eth3 vrf 'BLUE_HUB'

• VyOS-PE3:

12.9. L3VPN for Hub-and-Spoke connectivity with VyOS 1180

 VyOS Documentation, Release 1.5.x (circinus)

# VRF settings
set vrf name BLUE_SPOKE table '200'
set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn
set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn
set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto'
set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.60.60.0/24
set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.60.
˓→60.1:1011'

set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected
set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn␣
˓→export '65035:1011'

set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn␣
˓→import '65035:1030'

set vrf name BLUE_SPOKE protocols bgp system-as '65001'

set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 address-family ipv4-unicast as-
˓→override

set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 remote-as '65035'

# interfaces
set interfaces ethernet eth3 address '10.60.60.1/24'
set interfaces ethernet eth3 vrf 'BLUE_SPOKE'

Step-4: Configuring CE nodes

Dynamic routing used between CE and PE nodes and eBGP peering established for the route exchanging between them.
All routes received by PEs are then exported to L3VPN and delivered from Spoke sites to Hub and vise-versa based on
previously configured L3VPN parameters.
• VyOS-CE1-SPOKE:

# interfaces
set interfaces dummy dum20 address '10.0.0.80/32'
set interfaces ethernet eth0 address '10.50.50.2/24'

# BGP for peering with PE

set protocols bgp system-as 65035
set protocols bgp address-family ipv4-unicast network 10.0.0.80/32
set protocols bgp neighbor 10.50.50.1 ebgp-multihop '2'
set protocols bgp neighbor 10.50.50.1 remote-as '65001'
set protocols bgp neighbor 10.50.50.1 update-source 'eth0'
set protocols bgp parameters log-neighbor-changes
set protocols bgp parameters router-id '10.50.50.2'

• VyOS-CE1-HUB:

# interfaces
set interfaces dummy dum20 address '10.0.0.100/32'
set interfaces ethernet eth0 address '10.80.80.2/24'

# BGP for peering with PE

set protocols bgp system-as 65035
set protocols bgp address-family ipv4-unicast network 10.0.0.100/32
(continues on next page)

12.9. L3VPN for Hub-and-Spoke connectivity with VyOS 1181

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set protocols bgp address-family ipv4-unicast redistribute connected
set protocols bgp neighbor 10.80.80.1 ebgp-multihop '2'
set protocols bgp neighbor 10.80.80.1 remote-as '65001'
set protocols bgp neighbor 10.80.80.1 update-source 'eth0'
set protocols bgp parameters log-neighbor-changes
set protocols bgp parameters router-id '10.80.80.2'

• VyOS-CE2-SPOKE:

# interfaces
set interfaces dummy dum20 address '10.0.0.90/32'
set interfaces ethernet eth0 address '10.60.60.2/24'

# BGP for peering with PE

set protocols bgp system-as 65035
set protocols bgp address-family ipv4-unicast network 10.0.0.90/32
set protocols bgp neighbor 10.60.60.1 ebgp-multihop '2'
set protocols bgp neighbor 10.60.60.1 remote-as '65001'
set protocols bgp neighbor 10.60.60.1 update-source 'eth0'
set protocols bgp parameters log-neighbor-changes
set protocols bgp parameters router-id '10.60.60.2'

Step-5: Verification

This section describes verification commands for MPLS/BGP/LDP protocols and L3VPN related routes as well as
diagnosis and reachability checks between CE nodes.
Let’s check IPv4 routing and MPLS information on provider nodes (same procedure for all P nodes):
• “show ip ospf neighbor” for checking ospf relationship

vyos@VyOS-P1:~$ show ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface RXmtL␣

˓→RqstL DBsmL

10.0.0.4 1 Full/Backup 34.718s 172.16.30.2 eth0:172.16.30.1 ␣

˓→ 0 0 0
10.0.0.5 1 Full/Backup 35.132s 172.16.40.2 eth1:172.16.40.1 ␣
˓→ 0 0 0
10.0.0.7 1 Full/Backup 34.764s 172.16.90.2 eth2:172.16.90.1 ␣
˓→ 0 0 0
10.0.0.1 1 Full/Backup 35.642s 172.16.10.2 eth3:172.16.10.1 ␣
˓→ 0 0 0
10.0.0.8 1 Full/Backup 35.484s 172.16.100.2 eth5:172.16.100.1 ␣
˓→ 0 0 0

• “show mpls ldp neighbor “ for checking ldp neighbors

vyos@VyOS-P1:~$ show mpls ldp neighbor

AF ID State Remote Address Uptime
ipv4 10.0.0.1 OPERATIONAL 10.0.0.1 07w5d06h
ipv4 10.0.0.4 OPERATIONAL 10.0.0.4 09w3d00h
(continues on next page)

12.9. L3VPN for Hub-and-Spoke connectivity with VyOS 1182

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

ipv4 10.0.0.5 OPERATIONAL 10.0.0.5 09w2d23h
ipv4 10.0.0.7 OPERATIONAL 10.0.0.7 03w0d01h
ipv4 10.0.0.8 OPERATIONAL 10.0.0.8 01w3d02h

• “show mpls ldp binding” for checking mpls label assignment

vyos@VyOS-P1:~$ show mpls ldp discovery

AF Destination Nexthop Local Label Remote Label In Use
ipv4 10.0.0.1/32 10.0.0.1 23 imp-null yes
ipv4 10.0.0.1/32 10.0.0.4 23 20 no
ipv4 10.0.0.1/32 10.0.0.5 23 17 no
ipv4 10.0.0.1/32 10.0.0.7 23 16 no
ipv4 10.0.0.1/32 10.0.0.8 23 16 no
ipv4 10.0.0.2/32 10.0.0.1 20 16 no
ipv4 10.0.0.2/32 10.0.0.4 20 22 no
ipv4 10.0.0.2/32 10.0.0.5 20 24 yes
ipv4 10.0.0.2/32 10.0.0.7 20 17 no
ipv4 10.0.0.2/32 10.0.0.8 20 17 no
ipv4 10.0.0.3/32 10.0.0.1 imp-null 17 no
ipv4 10.0.0.3/32 10.0.0.4 imp-null 16 no
ipv4 10.0.0.3/32 10.0.0.5 imp-null 18 no
ipv4 10.0.0.3/32 10.0.0.7 imp-null 18 no
ipv4 10.0.0.3/32 10.0.0.8 imp-null 18 no
ipv4 10.0.0.4/32 10.0.0.1 16 18 no
ipv4 10.0.0.4/32 10.0.0.4 16 imp-null yes
ipv4 10.0.0.4/32 10.0.0.5 16 19 no
ipv4 10.0.0.4/32 10.0.0.7 16 19 no
ipv4 10.0.0.4/32 10.0.0.8 16 19 no
ipv4 10.0.0.5/32 10.0.0.1 21 19 no
ipv4 10.0.0.5/32 10.0.0.4 21 17 no
ipv4 10.0.0.5/32 10.0.0.5 21 imp-null yes
ipv4 10.0.0.5/32 10.0.0.7 21 20 no
ipv4 10.0.0.5/32 10.0.0.8 21 20 no
ipv4 10.0.0.6/32 10.0.0.1 17 20 no
ipv4 10.0.0.6/32 10.0.0.4 17 23 yes
ipv4 10.0.0.6/32 10.0.0.5 17 21 yes
ipv4 10.0.0.6/32 10.0.0.7 17 21 no
ipv4 10.0.0.6/32 10.0.0.8 17 21 no
ipv4 10.0.0.7/32 10.0.0.1 22 21 no
ipv4 10.0.0.7/32 10.0.0.4 22 18 no
ipv4 10.0.0.7/32 10.0.0.5 22 20 no
ipv4 10.0.0.7/32 10.0.0.7 22 imp-null yes
ipv4 10.0.0.7/32 10.0.0.8 22 22 no
ipv4 10.0.0.8/32 10.0.0.1 24 22 no
ipv4 10.0.0.8/32 10.0.0.4 24 19 no
ipv4 10.0.0.8/32 10.0.0.5 24 16 no
ipv4 10.0.0.8/32 10.0.0.7 24 22 no
ipv4 10.0.0.8/32 10.0.0.8 24 imp-null yes
ipv4 10.0.0.9/32 10.0.0.1 18 23 no
ipv4 10.0.0.9/32 10.0.0.4 18 21 yes
ipv4 10.0.0.9/32 10.0.0.5 18 22 no
ipv4 10.0.0.9/32 10.0.0.7 18 23 no
(continues on next page)

12.9. L3VPN for Hub-and-Spoke connectivity with VyOS 1183

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

ipv4 10.0.0.9/32 10.0.0.8 18 23 no
ipv4 10.0.0.10/32 10.0.0.1 19 24 no
ipv4 10.0.0.10/32 10.0.0.4 19 24 yes
ipv4 10.0.0.10/32 10.0.0.5 19 23 yes
ipv4 10.0.0.10/32 10.0.0.7 19 24 no
ipv4 10.0.0.10/32 10.0.0.8 19 24 no

Now we’re checking iBGP status and routes from route-reflector nodes to other devices:
• “show bgp ipv4 vpn summary” for checking BGP VPNv4 neighbors:

vyos@VyOS-RR1:~$ show bgp ipv4 vpn summary

BGP router identifier 10.0.0.1, local AS number 65001 vrf-id 0
BGP table version 0
RIB entries 9, using 1728 bytes of memory
Peers 4, using 85 KiB of memory
Peer groups 1, using 64 bytes of memory

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd ␣

˓→PfxSnt

10.0.0.7 4 65001 7719 7733 0 0 0 ␣

˓→5d07h56m 2 10
10.0.0.8 4 65001 7715 7724 0 0 0 ␣
˓→5d08h28m 4 10
10.0.0.9 4 65001 7713 7724 0 0 0 ␣
˓→5d08h28m 2 10
10.0.0.10 4 65001 7713 7724 0 0 0 5d08h28m ␣
˓→ 2 10

Total number of neighbors 4

• “show bgp ipv4 vpn” for checking all VPNv4 prefixes information:

vyos@VyOS-RR1:~$ show bgp ipv4 vpn

BGP table version is 2, local router ID is 10.0.0.1, vrf id 0
Default local pref 100, local AS 65001
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 10.50.50.1:1011
*>i10.50.50.0/24 10.0.0.7 0 100 0 i
UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0
*>i80.80.80.80/32 10.0.0.7 0 100 0 65035 i
UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0
Route Distinguisher: 10.60.60.1:1011
*>i10.60.60.0/24 10.0.0.10 0 100 0 i
UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0
*>i90.90.90.90/32 10.0.0.10 0 100 0 65035 i
UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0
Route Distinguisher: 10.80.80.1:1011
(continues on next page)

12.9. L3VPN for Hub-and-Spoke connectivity with VyOS 1184

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

*>i10.80.80.0/24 10.0.0.8 0 100 0 i
UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0
*>i100.100.100.100/32
10.0.0.8 0 100 0 65035 i
UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0
Route Distinguisher: 172.16.80.1:2011
*>i10.110.110.0/24 10.0.0.8 0 100 0 65050 i
UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0
*>i172.16.80.0/24 10.0.0.8 0 100 0 i
UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0
Route Distinguisher: 172.16.100.1:2011
*>i10.210.210.0/24 10.0.0.9 0 100 0 65050 i
UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0
*>i172.16.100.0/24 10.0.0.9 0 100 0 i
UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0

• “show bgp ipv4 vpn x.x.x.x/x” for checking best path selected for specific VPNv4 destination

vyos@VyOS-RR1:~$ show bgp ipv4 vpn 10.0.0.100/32

BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32
not allocated
Paths: (1 available, best #1)
Advertised to non peer-group peers:
10.0.0.7 10.0.0.8 10.0.0.9 10.0.0.10
65035, (Received from a RR-client)
10.0.0.8 from 10.0.0.8 (10.0.0.8)
Origin incomplete, metric 0, localpref 100, valid, internal, best (First path␣
˓→received)

Extended Community: RT:65035:1030

Remote label: 80
Last update: Tue Oct 19 13:45:32 202

Also we can verify how PE devices receives VPNv4 networks from the RRs and installing them to the specific customer
VRFs:
• “show bgp ipv4 vpn summary” for checking iBGP neighbors against route-reflector devices:

vyos@VyOS-PE1:~$ show bgp ipv4 vpn summary

BGP router identifier 10.0.0.7, local AS number 65001 vrf-id 0
BGP table version 0
RIB entries 9, using 1728 bytes of memory
Peers 2, using 43 KiB of memory
Peer groups 1, using 64 bytes of memory

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd ␣

˓→PfxSnt

10.0.0.1 4 65001 8812 8794 0 0 0 ␣

˓→01:18:42 8 2
10.0.0.2 4 65001 8800 8792 0 0 0 ␣
˓→6d02h27m 8 2

• “show bgp vrf all” for checking all the prefix learning on BGP
within VRFs:

12.9. L3VPN for Hub-and-Spoke connectivity with VyOS 1185

 VyOS Documentation, Release 1.5.x (circinus)

vyos@VyOS-PE1:~$ show bgp vrf all

Instance default:
No BGP prefixes displayed, 0 exist

Instance BLUE_SPOKE:
BGP table version is 8, local router ID is 10.50.50.1, vrf id 6
Default local pref 100, local AS 65001
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

* 10.50.50.0/24 0.0.0.0 0 32768 ?
*> 0.0.0.0 0 32768 i
*> 10.80.80.0/24 10.0.0.8@0< 0 100 0 i
* 10.0.0.8@0< 0 100 0 i
*> 10.0.0.80/32 10.50.50.2 0 0 65035 i
*> 10.0.0.100/32
10.0.0.8@0< 0 100 0 65035 ?
* 10.0.0.8@0< 0 100 0 65035 ?

• “show bgp vrf BLUE_SPOKE summary” for checking EBGP neighbor

information between PE and CE:

vyos@VyOS-PE1:~$ show bgp vrf BLUE_SPOKE summary

IPv4 Unicast Summary:

BGP router identifier 10.50.50.1, local AS number 65001 vrf-id 6
BGP table version 8
RIB entries 7, using 1344 bytes of memory
Peers 1, using 21 KiB of memory

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd ␣

˓→PfxSnt

10.50.50.2 4 65035 9019 9023 0 0 0 6d06h12m ␣

˓→ 1 4

Total number of neighbors 1

• “show ip route vrf BLUE_SPOKE” for viewing the RIB in our Spoke PE.
Using this command we are also able to check the transport and customer label (inner/outer) for Hub net-
work prefix (10.0.0.100/32):

vyos@VyOS-PE1:~$ show ip route vrf BLUE_SPOKE

Codes: K - kernel route, C - connected, S - static, R - RIP,

O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
F - PBR, f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
(continues on next page)

12.9. L3VPN for Hub-and-Spoke connectivity with VyOS 1186

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

VRF BLUE_SPOKE:
K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 03w0d23h
C>* 10.50.50.0/24 is directly connected, eth3, 03w0d23h
B> 10.80.80.0/24 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1,␣
˓→04:22:00

* via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1,␣

˓→04:22:00

B>* 10.0.0.80/32 [20/0] via 10.50.50.2, eth3, weight 1, 6d05h30m

B> 10.0.0.100/32 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1,␣
˓→04:22:00

* via 172.16.90.1, eth0 (vrf default), label 24/80,␣

˓→weight 1, 04:22:00

• “show bgp ipv4 vpn x.x.x.x/32” for checking the best-path to the
specific VPNv4 destination including extended community and remotelabel information. This procedure
is the same on all Spoke nodes:

vyos@VyOS-PE1:~$ show bgp ipv4 vpn 10.0.0.100/32

BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32
not allocated
Paths: (2 available, best #1)
Not advertised to any peer
65035
10.0.0.8 from 10.0.0.1 (10.0.0.8)
Origin incomplete, metric 0, localpref 100, valid, internal, best (Neighbor IP)
Extended Community: RT:65035:1030
Originator: 10.0.0.8, Cluster list: 10.0.0.1
Remote label: 80
Last update: Tue Oct 19 13:45:26 2021
65035
10.0.0.8 from 10.0.0.2 (10.0.0.8)
Origin incomplete, metric 0, localpref 100, valid, internal
Extended Community: RT:65035:1030
Originator: 10.0.0.8, Cluster list: 10.0.0.1
Remote label: 80
Last update: Wed Oct 13 12:39:34 202

Now, let’s check routing information on out Hub PE:

• “show bgp ipv4 vpn summary” for checking iBGP neighbors again
VyOS-RR1/RR2

vyos@VyOS-PE2:~$ show bgp ipv4 vpn summary

BGP router identifier 10.0.0.8, local AS number 65001 vrf-id 0
BGP table version 0
RIB entries 9, using 1728 bytes of memory
Peers 2, using 43 KiB of memory
Peer groups 1, using 64 bytes of memory

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd ␣

˓→PfxSnt

10.0.0.1 4 65001 15982 15949 0 0 0 05:41:28 ␣

(continues on next page)

12.9. L3VPN for Hub-and-Spoke connectivity with VyOS 1187

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

˓→ 6 4
10.0.0.2 4 65001 9060 9054 0 0 0 6d06h47m ␣
˓→ 6 4

Total number of neighbors

• “show bgp vrf all” for checking all the prefixes learning on BGP

vyos@VyOS-PE2:~$ show bgp vrf all

Instance default:
No BGP prefixes displayed, 0 exist

Instance BLUE_HUB:
BGP table version is 50, local router ID is 10.80.80.1, vrf id 8
Default local pref 100, local AS 65001
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

*> 10.50.50.0/24 10.0.0.7@0< 0 100 0 i
* 10.0.0.7@0< 0 100 0 i
*> 10.60.60.0/24 10.0.0.10@0< 0 100 0 i
* 10.0.0.10@0< 0 100 0 i
* 10.80.80.0/24 10.80.80.2 0 0 65035 ?
* 0.0.0.0 0 32768 i
*> 0.0.0.0 0 32768 ?
*> 10.110.110.0/24 172.16.80.2@9< 0 0 65050 i
*> 10.210.210.0/24 10.0.0.9@0< 0 100 0 65050 i
* 10.0.0.9@0< 0 100 0 65050 i
*> 10.0.0.80/32 10.0.0.7@0< 0 100 0 65035 i
* 10.0.0.7@0< 0 100 0 65035 i
*> 10.0.0.90/32 10.0.0.10@0< 0 100 0 65035 i
* 10.0.0.10@0< 0 100 0 65035 i
*> 10.0.0.100/32
10.80.80.2 0 0 65035 ?
*> 172.16.80.0/24 0.0.0.0@9< 0 32768 ?
0.0.0.0@9< 0 32768 i
*> 172.16.100.0/24 10.0.0.9@0< 0 100 0 i
* 10.0.0.9@0< 0 100 0 i

• “show bgp vrf BLUE_HUB summary” for checking EBGP neighbor

CE Hub device

vyos@VyOS-PE2:~$ show bgp vrf BLUE_HUB summary

IPv4 Unicast Summary:

BGP router identifier 10.80.80.1, local AS number 65001 vrf-id 8
BGP table version 50
RIB entries 19, using 3648 bytes of memory
(continues on next page)

12.9. L3VPN for Hub-and-Spoke connectivity with VyOS 1188

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Peers 1, using 21 KiB of memory

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd ␣

˓→PfxSnt

10.80.80.2 4 65035 15954 15972 0 0 0 01w4d01h ␣

˓→ 2 10

• “show ip route vrf BLUE_HUB” to view the RIB in our Hub PE.
With this command we are able to check the transport and customer label (inner/outer) for network spokes
prefixes 10.0.0.80/32 - 10.0.0.90/32

vyos@VyOS-PE2:~$ show ip route vrf BLUE_HUB

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
F - PBR, f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
VRF BLUE_HUB:
K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 01w4d01h
B> 10.50.50.0/24 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1,␣
˓→05:53:15

* via 172.16.100.1, eth1 (vrf default), label 22/144, weight␣

˓→1, 05:53:15

B> 10.60.60.0/24 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1,␣
˓→05:53:15

* via 172.16.110.1, eth0 (vrf default), label 23/144, weight␣

˓→1, 05:53:15

C>* 10.80.80.0/24 is directly connected, eth3, 01w4d01h

B>* 10.110.110.0/24 [200/0] via 172.16.80.2, eth2 (vrf GREEN), weight 1, 01w4d01h
B> 10.210.210.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1,␣
˓→05:53:15

* via 172.16.100.1, eth1 (vrf default), label 18/144, weight␣

˓→1, 05:53:15

* via 172.16.110.1, eth0 (vrf default), label 22/144, weight␣

˓→1, 05:53:15

B> 10.0.0.80/32 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1,␣
˓→05:53:15

* via 172.16.100.1, eth1 (vrf default), label 22/144, weight␣

˓→1, 05:53:15

B> 10.0.0.90/32 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1,␣
˓→05:53:15

* via 172.16.110.1, eth0 (vrf default), label 23/144, weight␣

˓→1, 05:53:15

B>* 10.0.0.100/32 [20/0] via 10.80.80.2, eth3, weight 1, 01w4d01h

B>* 172.16.80.0/24 [200/0] is directly connected, eth2 (vrf GREEN), weight 1, 01w4d01h
B> 172.16.100.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1,␣
˓→05:53:15

* via 172.16.100.1, eth1 (vrf default), label 18/144, weight␣

˓→1, 05:53:15

* via 172.16.110.1, eth0 (vrf default), label 22/144, weight␣

˓→1, 05:53:15

• “show bgp ipv4 vpn x.x.x.x/32” for checking best-path,

12.9. L3VPN for Hub-and-Spoke connectivity with VyOS 1189

 VyOS Documentation, Release 1.5.x (circinus)

extended community and remote label of specific destination

vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.80/32

BGP routing table entry for 10.50.50.1:1011:10.0.0.80/32
not allocated
Paths: (2 available, best #1)
Not advertised to any peer
65035
10.0.0.7 from 10.0.0.1 (10.0.0.7)
Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP)
Extended Community: RT:65035:1011
Originator: 10.0.0.7, Cluster list: 10.0.0.1
Remote label: 144
Last update: Tue Oct 19 13:45:30 2021
65035
10.0.0.7 from 10.0.0.2 (10.0.0.7)
Origin IGP, metric 0, localpref 100, valid, internal
Extended Community: RT:65035:1011
Originator: 10.0.0.7, Cluster list: 10.0.0.1
Remote label: 144
Last update: Wed Oct 13 12:39:37 2021

vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.90/32

BGP routing table entry for 10.60.60.1:1011:10.0.0.90/32
not allocated
Paths: (2 available, best #1)
Not advertised to any peer
65035
10.0.0.10 from 10.0.0.1 (10.0.0.10)
Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP)
Extended Community: RT:65035:1011
Originator: 10.0.0.10, Cluster list: 10.0.0.1
Remote label: 144
Last update: Tue Oct 19 13:45:30 2021
65035
10.0.0.10 from 10.0.0.2 (10.0.0.10)
Origin IGP, metric 0, localpref 100, valid, internal
Extended Community: RT:65035:1011
Originator: 10.0.0.10, Cluster list: 10.0.0.1
Remote label: 144
Last update: Wed Oct 13 12:45:44 2021

Finally, let’s check the reachability between CEs:

• VyOS-CE1-SPOKE —–> VyOS-CE-HUB

# check rib
vyos@VyOS-CE1-SPOKE:~$ show ip route
Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
F - PBR, f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup

(continues on next page)

12.9. L3VPN for Hub-and-Spoke connectivity with VyOS 1190

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

B 10.50.50.0/24 [20/0] via 10.50.50.1 inactive, weight 1, 6d07h53m
C>* 10.50.50.0/24 is directly connected, eth0, 09w0d00h
B>* 10.80.80.0/24 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m
C>* 10.0.0.80/32 is directly connected, dum20, 09w0d00h
B>* 10.0.0.100/32 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m

# check icmp
vyos@VyOS-CE1-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.80
PING 10.0.0.100 (10.0.0.100) from 10.0.0.80 : 56(84) bytes of data.
64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=6.52 ms
64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.13 ms
64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.04 ms
64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.03 ms
^C
--- 10.0.0.100 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 8ms
rtt min/avg/max/mdev = 4.030/4.680/6.518/1.064 ms

# check network path

vyos@VyOS-CE1-SPOKE:~$ traceroute 10.0.0.100
traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets
1 10.50.50.1 (10.50.50.1) 1.041 ms 1.252 ms 1.835 ms
2 * * *
3 10.0.0.100 (10.0.0.100) 9.225 ms 9.159 ms 9.121 m

• VyOS-CE-HUB ——-> VyOS-CE1-SPOKE

• VyOS-CE-HUB ——-> VyOS-CE2-SPOKE
# check rib
vyos@VyOS-CE-HUB:~$ show ip route
Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
F - PBR, f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup

B>* 10.50.50.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m

B>* 10.60.60.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m
C>* 10.80.80.0/24 is directly connected, eth0, 01w6d07h
B>* 10.110.110.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h
B>* 10.210.210.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m
B>* 10.0.0.80/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m
B>* 10.0.0.90/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m
C>* 10.0.0.100/32 is directly connected, dum20, 01w6d07h
B>* 172.16.80.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h
B>* 172.16.100.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m

# check icmp
vyos@VyOS-CE-HUB:~$ ping 10.0.0.80 interface 10.0.0.100 c 4
PING 10.0.0.80 (10.0.0.80) from 10.0.0.100 : 56(84) bytes of data.
64 bytes from 10.0.0.80: icmp_seq=1 ttl=62 time=3.31 ms
64 bytes from 10.0.0.80: icmp_seq=2 ttl=62 time=4.23 ms
(continues on next page)

12.9. L3VPN for Hub-and-Spoke connectivity with VyOS 1191

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

64 bytes from 10.0.0.80: icmp_seq=3 ttl=62 time=3.89 ms
64 bytes from 10.0.0.80: icmp_seq=4 ttl=62 time=3.22 ms

--- 10.0.0.80 ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 9ms
rtt min/avg/max/mdev = 3.218/3.661/4.226/0.421 ms

vyos@VyOS-CE-HUB:~$ ping 10.0.0.90 interface 10.0.0.100 c 4

PING 10.0.0.90 (10.0.0.90) from 10.0.0.100 : 56(84) bytes of data.
64 bytes from 10.0.0.90: icmp_seq=1 ttl=62 time=7.46 ms
64 bytes from 10.0.0.90: icmp_seq=2 ttl=62 time=4.43 ms
64 bytes from 10.0.0.90: icmp_seq=3 ttl=62 time=4.60 ms
^C
--- 10.0.0.90 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 6ms
rtt min/avg/max/mdev = 4.430/5.498/7.463/1.391 ms

# check network path

vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.80
traceroute to 10.0.0.80 (10.0.0.80), 30 hops max, 60 byte packets
1 10.80.80.1 (10.80.80.1) 1.563 ms 1.341 ms 1.075 ms
2 * * *
3 10.0.0.80 (10.0.0.80) 8.125 ms 8.019 ms 7.781 ms

vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.90

traceroute to 10.0.0.90 (10.0.0.90), 30 hops max, 60 byte packets
1 10.80.80.1 (10.80.80.1) 1.305 ms 1.137 ms 1.097 ms
2 * * *
3 * * *
4 10.0.0.90 (10.0.0.90) 9.358 ms 9.325 ms 9.292 ms

• VyOS-CE2-SPOKE ——-> VyOS-CE-HUB

# check rib
vyos@rt-ce2-SPOKE:~$ show ip route
Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
F - PBR, f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup

B 10.60.60.0/24 [20/0] via 10.60.60.1 inactive, weight 1, 02w6d00h

C>* 10.60.60.0/24 is directly connected, eth0, 02w6d00h
B>* 10.80.80.0/24 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m
C>* 10.0.0.90/32 is directly connected, dum20, 02w6d00h
B>* 10.0.0.100/32 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m

# check icmp
vyos@rt-ce2-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.90 c 4
PING 10.0.0.100 (10.0.0.100) from 10.0.0.90 : 56(84) bytes of data.
64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=4.97 ms
64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.45 ms
(continues on next page)

12.9. L3VPN for Hub-and-Spoke connectivity with VyOS 1192

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.20 ms
64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.29 ms

--- 10.0.0.100 ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 9ms
rtt min/avg/max/mdev = 4.201/4.476/4.971/0.309 ms

# check network path

vyos@rt-ce2-SPOKE:~$ traceroute 10.0.0.100
traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets
1 10.60.60.1 (10.60.60.1) 1.343 ms 1.190 ms 1.152 ms
2 * * *
3 * * *
4 10.0.0.100 (10.0.0.100) 7.504 ms 7.480 ms 7.488 ms

Note: At the moment, trace mpls doesn’t show labels/paths. So we’ll see * * * for the transit routers of the mpls
backbone.

12.10 PPPoE over L2TP

This document is to describe a basic setup using PPPoE over L2TP. LAC and LNS are components of the broadband
topology. LAC - L2TP access concentrator LNS - L2TP Network Server LAC and LNS forms L2TP tunnel. LAC
receives packets from PPPoE clients and forward them to LNS. LNS is the termination point that comes from PPP
packets from the remote client.
In this example we use VyOS 1.5 as LNS and Cisco IOS as LAC. All users with domain vyos.io will be tunneled to
LNS via L2TP.

12.10.1 Network Topology

12.10. PPPoE over L2TP 1193

 VyOS Documentation, Release 1.5.x (circinus)

12.10.2 Configurations

LAC

aaa new-model
!
aaa authentication ppp default local
!
vpdn enable
vpdn aaa attribute nas-ip-address vpdn-nas
!
vpdn-group LAC
request-dialin
protocol l2tp
domain vyos.io
initiate-to ip 192.168.139.100
source-ip 192.168.139.101
local name LAC
l2tp tunnel password 0 test123
!
bba-group pppoe MAIN-BBA
virtual-template 1
!
interface GigabitEthernet0/0
description To LNS
ip address 192.168.139.101 255.255.255.0
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/1
description To PPPoE clients
no ip address
duplex auto
speed auto
media-type rj45
pppoe enable group MAIN-BBA
!

LNS

set interfaces ethernet eth0 address '192.168.139.100/24'

set nat source rule 100 outbound-interface name 'eth0'
set nat source rule 100 source address '10.0.0.0/24'
set nat source rule 100 translation address 'masquerade'
set protocols static route 0.0.0.0/0 next-hop 192.168.139.2
set vpn l2tp remote-access authentication mode 'radius'
set vpn l2tp remote-access authentication radius server 192.168.139.110 key 'radiustest'
set vpn l2tp remote-access client-ip-pool TEST-POOL range '10.0.0.2-10.0.0.100'
set vpn l2tp remote-access default-pool 'TEST-POOL'
set vpn l2tp remote-access gateway-address '10.0.0.1'
(continues on next page)

12.10. PPPoE over L2TP 1194

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set vpn l2tp remote-access lns host-name 'LAC'
set vpn l2tp remote-access lns shared-secret 'test123'
set vpn l2tp remote-access name-server '8.8.8.8'
set vpn l2tp remote-access ppp-options disable-ccp

Note: This setup requires the Compression Control Protocol (CCP) being disabled, the command set vpn l2tp
remote-access ppp-options disable-ccp accomplishes that.

Client

In this lab we use Windows PPPoE client.

12.10. PPPoE over L2TP 1195

 VyOS Documentation, Release 1.5.x (circinus)

Monitoring

Monitoring on LNS side

vyos@vyos:~$ show l2tp-server sessions

ifname | username | ip | ip6 | ip6-dp | calling-sid | rate-limit | state ␣
˓→| uptime | rx-bytes | tx-bytes
--------+--------------+----------+-----+--------+-----------------+------------+--------
˓→+----------+-----------+----------

l2tp0 | [email protected] | 10.0.0.2 | | | 192.168.139.101 | | active␣

˓→| 00:00:35 | 188.4 KiB | 9.3 MiB

Monitoring on LAC side

Router#show pppoe session

1 session in FORWARDED (FWDED) State
1 session total
Uniq ID PPPoE RemMAC Port VT VA State
SID LocMAC VA-st Type
1 1 000c.290b.20a6 Gi0/1 1 N/A FWDED
0c58.88ac.0001

Router#show l2tp
L2TP Tunnel and Session Information Total tunnels 1 sessions 1

LocTunID RemTunID Remote Name State Remote Address Sessn L2TP Class/
Count VPDN Group
23238 2640 LAC est 192.168.139.100 1 LAC

LocID RemID TunID Username, Intf/ State Last Chg Uniq ID

Vcid, Circuit
25641 25822 23238 [email protected], Gi0/1 est 00:05:36 1

Monitoring on RADIUS Server side

root@Radius:~# cat /var/log/freeradius/radacct/192.168.139.100/detail-20240221

Wed Feb 21 13:37:17 2024
User-Name = "[email protected]"
NAS-Port = 0
NAS-Port-Id = "l2tp0"
NAS-Port-Type = Virtual
Service-Type = Framed-User
Framed-Protocol = PPP
Calling-Station-Id = "192.168.139.101"
Called-Station-Id = "192.168.139.100"
Acct-Status-Type = Start
Acct-Authentic = RADIUS
Acct-Session-Id = "45c731e169d9a4f1"
Acct-Session-Time = 0
Acct-Input-Octets = 0
Acct-Output-Octets = 0
Acct-Input-Packets = 0
Acct-Output-Packets = 0
Acct-Input-Gigawords = 0
(continues on next page)

12.10. PPPoE over L2TP 1196

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Acct-Output-Gigawords = 0
Framed-IP-Address = 10.0.0.2
NAS-IP-Address = 192.168.139.100
Event-Timestamp = "Feb 21 2024 13:37:17 UTC"
Tmp-String-9 = "ai:"
Acct-Unique-Session-Id = "ea6a1089816f19c0d0f1819bc61c3318"
Timestamp = 1708522637

12.11 Inter-VRF Routing over VRF Lite

Virtual Routing and Forwarding is a technology that allow multiple instance of a routing table to exist within a single
device. One of the key aspect of VRFs is that do not share the same routes or interfaces, therefore packets are forwarded
between interfaces that belong to the same VRF only.
Any information related to a VRF is not exchanged between devices -or in the same device- by default, this is a technique
called VRF-Lite.
Keep networks isolated is -in general- a good principle, but there are cases where you might need that some network
can access other in a different VRF.
The scope of this document is to cover such cases in a dynamic way without the use of MPLS-LDP.
General information about L3VPNs can be found in the L3VPN VRFs chapter.

12.11.1 Overview

Let’s say we have a requirement to have multiple networks.

• LAN 1
• LAN 2
• Management
• Internet
Both LANs have to be able to route between each other, both will have managed devices through a dedicated manage-
ment network and both will need Internet access yet the LAN2 will need access to some set of outside networks, not
all. The management network will need access to both LANs but cannot have access to/from the outside.
This scenario could be a nightmare applying regular routing and might need filtering in multiple interfaces.
A simple solution could be using different routing tables, or VRFs for all the networks so we can keep the routing
restrictions. But for us to route between the different VRFs we would need a cable or a logical connection between
each other:
• One cable/logical connection between LAN1 and LAN2
• One cable/logical connection between LAN1 and Internet
• One cable/logical connection between LAN2 and Internet
• One cable/logical connection between LAN1 and Management
• One cable/logical connection between LAN2 and Management

12.11. Inter-VRF Routing over VRF Lite 1197

 VyOS Documentation, Release 1.5.x (circinus)

As we can see this is unpractical.

To address this scenario we will use to our advantage an extension of the BGP routing protocol that will help us in the
“Export” between VRFs without the need for MPLS.
MP-BGP or MultiProtocol BGP introduces two main concepts to solve this limitation: - Route Distinguisher (RD): Is
used to distinguish between different VRFs –called VPNs- inside the BGP Process. The RD is appended to each IPv4
Network that is advertised into BGP for that VPN making it a unique VPNv4 route. - Route Target (RT): This is an
extended BGP community append to the VPNv4 route in the Import/Export process. When a route passes from the
VRF routing table into the BGP process it will add the configured export extended community(ies) for that VPN. When
that route needs to go from BGP into the VRF routing table will only pass if that given VPN import policy matches
any of the appended community(ies) into that prefix.

12.11.2 Topology

IP Schema

Device-A Device-B IPv4 Network IPv6 Network

Core LAN1 10.1.1.0/30 2001:db8::/127
Core LAN2 172.16.2.0/30 2001:db8::2/127
Core Management 192.168.3.0/30 2001:db8::4/127
Core ISP 10.2.2.0/30 2001:db8::6/127

RD & RT Schema

VRF RD RT
LAN1 64496:1 64496:1
LAN2 64496:2 64496:2
Management 64496:50 64496:50
Internet 64496:100 64496:100

12.11. Inter-VRF Routing over VRF Lite 1198

 VyOS Documentation, Release 1.5.x (circinus)

12.11.3 Configurations

Note: We use a static route configuration in between the Core and each LAN and Management router, and BGP
between the Core router and the ISP router but any dynamic routing protocol can be used.

Remote Networks

The following template configuration can be used in each remote router based in our topology.

# Interface Configuration
set interface eth eth<N> address <IP ADDRESS/CIDR>

# Static default route back to Core

set procotols static route 0.0.0.0/0 next-hop <CORE IP ADDRESS>

Core Router

Step 1: VRF and Configurations to remote networks

• Configuration
Set the VRF name and Table ID, set interface address and bind it to the VRF. Last add the static route to the remote
network.

# VRF name and table ID (MANDATORY)

set vrf name <VRF> table <ID>

# Interface Configuration
set interface eth eth<N> address <IP ADDRESS/CIDR>

# Assign interface to VRF

set interface eth eth<N> vrf <VRF>

# Static route to remote Network

set vrf name <VRF> protocols static route <NETWORK/CIDR> next-hop <REMOTE IP ADDRESS>

• Verification
Checking the routing table of the VRF should reveal both static and connected entries active. A PING test between the
Core and remote router is a way to validate connectivity within the VRF.

# show ip route vrf <VRF>

# show ipv6 route vrf <VRF>

vyos@Core:~$ show ip route vrf LAN1

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
(continues on next page)

12.11. Inter-VRF Routing over VRF Lite 1199

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

t - trapped, o - offload failure

VRF LAN1:
S>* 10.0.0.0/24 [1/0] via 10.1.1.2, eth0, weight 1, 00:05:41
C>* 10.1.1.0/30 is directly connected, eth0, 00:05:44

vyos@Core:~$ show ipv6 route vrf LAN1

Codes: K - kernel route, C - connected, S - static, R - RIPng,
O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table,
v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure

VRF LAN1:
C>* 2001:db8::/127 is directly connected, eth0, 00:18:43
S>* 2001:db8:0:1::/64 [1/0] via 2001:db8::1, eth0, weight 1, 00:16:03
C>* fe80::/64 is directly connected, eth0, 00:18:43

# ping <DESTINATION> vrf <VRF>

vyos@Core:~$ ping 10.1.1.2 vrf LAN1

PING 10.1.1.2 (10.1.1.2) 56(84) bytes of data.
64 bytes from 10.1.1.2: icmp_seq=1 ttl=64 time=1.52 ms
64 bytes from 10.1.1.2: icmp_seq=2 ttl=64 time=0.830 ms
^C
--- 10.1.1.2 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 0.830/1.174/1.518/0.344 ms
vyos@Core:~$ ping 10.0.0.1 vrf LAN1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.785 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.948 ms
^C
--- 10.0.0.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 0.785/0.866/0.948/0.081 ms

vyos@Core:~$ ping 2001:db8:0:1::1 vrf LAN1

PING 2001:db8:0:1::1(2001:db8:0:1::1) 56 data bytes
64 bytes from 2001:db8:0:1::1: icmp_seq=1 ttl=64 time=3.04 ms
64 bytes from 2001:db8:0:1::1: icmp_seq=2 ttl=64 time=1.04 ms
64 bytes from 2001:db8:0:1::1: icmp_seq=3 ttl=64 time=0.925 ms
^C
--- 2001:db8:0:1::1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2004ms
rtt min/avg/max/mdev = 0.925/1.665/3.035/0.969 ms

12.11. Inter-VRF Routing over VRF Lite 1200

 VyOS Documentation, Release 1.5.x (circinus)

Step 2: BGP Configuration for VRF-Lite

• Configuration
Setting BGP global local-as as well inside the VRF. Redistribute static routes to inject configured networks into the
BGP process but still inside the VRF.

# set BGP global local-as

set protocols bgp system-as <ASN>

# set BGP VRF local-as and redistribution

set vrf name <VRF> protocols bgp system-as <ASN>
set vrf name <VRF> protocols bgp address-family <AF IPv4/IPv6> redistribute static

• Verification
Check the BGP VRF table and verify if the static routes are injected showing the correct next-hop information.

# show ip bgp vrf <VRF>

# show bgp vrf <VRF> ipv6

vyos@Core:~$ show ip bgp vrf LAN1

BGP table version is 3, local router ID is 10.1.1.1, vrf id 8
Default local pref 100, local AS 64496
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

Network Next Hop Metric LocPrf Weight Path

*> 10.0.0.0/24 10.1.1.2 0 32768 ?

vyos@Core# run show bgp vrf LAN1 ipv6

BGP table version is 13, local router ID is 10.1.1.1, vrf id 8
Default local pref 100, local AS 64496
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

Network Next Hop Metric LocPrf Weight Path

*> 2001:db8:0:1::/64
2001:db8::1 0 32768 ?

12.11. Inter-VRF Routing over VRF Lite 1201

 VyOS Documentation, Release 1.5.x (circinus)

Step 3: VPN Configuration

• Configuration
Within the VRF we set the Route-Distinguisher (RD) and Route-Targets (RT), then we enable the export/import VPN.

# set Route-distinguisher
set vrf name <VRF> protocols bgp address-family <AF IPv4/IPv6> rd vpn export '<RD>'

# set route-target for import/export

# Note: RT are a list that can be more than one community between apostrophe
# and separated by blank space. Ex: '<RT:1> <RT:2> <RT:3>'
set vrf name <VRF> protocols bgp address-family <AF IPv4/IPv6> route-target vpn export '
˓→<RT:Export>'

set vrf name <VRF> protocols bgp address-family <AF IPv4/IPv6> route-target vpn import '
˓→<RT:Import>'

# Enable VPN export/import under this VRF

set vrf name <VRF> protocols bgp address-family <AF IPv4/IPv6> export vpn
set vrf name <VRF> protocols bgp address-family <AF IPv4/IPv6> import vpn

A key point to understand is that if we need two VRFs to communicate between each other EXPORT rt from VRF1
has to be in the IMPORT rt list from VRF2. But this is only in ONE direction, to complete the communication the
EXPORT rt from VRF2 has to be in the IMPORT rt list from VRF1.
There are some cases where this is not needed -for example, in some DDoS appliance- but most inter-vrf routing designs
use the above configurations.
• Verification
After configured all the VRFs involved in this topology we take a deeper look at both BGP and Routing table for the
VRF LAN1

# show ip bgp vrf <VRF>

# show bgp vrf <VRF> ipv6

vyos@Core# run show ip bgp vrf LAN1

BGP table version is 53, local router ID is 10.1.1.1, vrf id 8
Default local pref 100, local AS 64496
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

Network Next Hop Metric LocPrf Weight Path

*> 0.0.0.0/0 10.2.2.2@7< 0 64497 i
*> 10.0.0.0/24 10.1.1.2 0 32768 ?
*> 10.2.2.0/30 10.2.2.2@7< 0 0 64497 ?
*> 192.0.2.0/24 10.2.2.2@7< 0 0 64497 ?
*> 192.168.0.0/24 192.168.3.2@11< 0 32768 ?
*> 198.51.100.0/24 10.2.2.2@7< 0 0 64497 ?
*> 203.0.113.0/24 10.2.2.2@7< 0 0 64497 ?

vyos@Core# run show bgp vrf LAN1 ipv6

(continues on next page)

12.11. Inter-VRF Routing over VRF Lite 1202

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

BGP table version is 13, local router ID is 10.1.1.1, vrf id 8
Default local pref 100, local AS 64496
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

Network Next Hop Metric LocPrf Weight Path

*> ::/0 fe80::5200:ff:fe02:3@7<
0 64497 i
*> 2001:db8::6/127 fe80::5200:ff:fe02:3@7<
0 0 64497 ?
*> 2001:db8:0:1::/64
2001:db8::1 0 32768 ?
*> 2001:db8:0:3::/64
2001:db8::5@11< 0 32768 ?
*> 2001:db8:1::/48 fe80::5200:ff:fe02:3@7<
0 0 64497 ?
*> 2001:db8:2::/48 fe80::5200:ff:fe02:3@7<
0 0 64497 ?
*> 2001:db8:3::/48 fe80::5200:ff:fe02:3@7<
0 0 64497 ?

# show ip route vrf <VRF>

# show ipv6 route vrf <VRF>

vyos@Core:~$ show ip route vrf LAN1

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure

VRF LAN1:
B>* 0.0.0.0/0 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38
S>* 10.0.0.0/24 [1/0] via 10.1.1.2, eth0, weight 1, 00:29:57
C>* 10.1.1.0/30 is directly connected, eth0, 00:29:59
B 10.2.2.0/30 [20/0] via 10.2.2.2 (vrf Internet) inactive, weight 1, 00:00:38
B>* 172.16.0.0/24 [20/0] via 172.16.2.2, eth1 (vrf LAN2), weight 1, 00:00:38
B>* 192.0.2.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38
B>* 198.51.100.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38
B>* 203.0.113.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38

vyos@Core# run show ipv6 route vrf LAN1

Codes: K - kernel route, C - connected, S - static, R - RIPng,
O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table,
v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
(continues on next page)

12.11. Inter-VRF Routing over VRF Lite 1203

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

t - trapped, o - offload failure

VRF LAN1:
B>* ::/0 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50
C>* 2001:db8::/127 is directly connected, eth0, 05:33:43
B>* 2001:db8::6/127 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1,␣
˓→00:07:50

S>* 2001:db8:0:1::/64 [1/0] via 2001:db8::1, eth0, weight 1, 05:31:03

B>* 2001:db8:0:3::/64 [20/0] via 2001:db8::5, eth2 (vrf Management), weight 1, 00:07:50
B>* 2001:db8:1::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1,␣
˓→00:07:50

B>* 2001:db8:2::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1,␣
˓→00:07:50

B>* 2001:db8:3::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1,␣
˓→00:07:50

C>* fe80::/64 is directly connected, eth0, 05:33:43

As we can see in the BGP table any imported route has been injected with a “@” followed by the VPN id; In the routing
table of the VRF, if the route was installed, we can see -between round brackets- the exported VRF table.

Step 4: End to End verification

Now we perform some end-to-end testing

• From Management to LAN1/LAN2
vyos@Management:~$ ping 10.0.0.1 source-address 192.168.0.1
PING 10.0.0.1 (10.0.0.1) from 192.168.0.1 : 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=63 time=1.93 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=63 time=2.12 ms
64 bytes from 10.0.0.1: icmp_seq=3 ttl=63 time=2.12 ms
^C
--- 10.0.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2005ms
rtt min/avg/max/mdev = 1.931/2.056/2.123/0.088 ms
vyos@Management:~$ ping 172.16.0.1 source-address 192.168.0.1
PING 172.16.0.1 (172.16.0.1) from 192.168.0.1 : 56(84) bytes of data.
64 bytes from 172.16.0.1: icmp_seq=1 ttl=63 time=1.62 ms
64 bytes from 172.16.0.1: icmp_seq=2 ttl=63 time=1.75 ms
^C
--- 172.16.0.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 1.621/1.686/1.752/0.065 ms
vyos@Management:~$ ping 2001:db8:0:1::1 source-address 2001:db8:0:3::1
PING 2001:db8:0:1::1(2001:db8:0:1::1) from 2001:db8:0:3::1 : 56 data bytes
64 bytes from 2001:db8:0:1::1: icmp_seq=1 ttl=63 time=2.44 ms
64 bytes from 2001:db8:0:1::1: icmp_seq=2 ttl=63 time=2.40 ms
64 bytes from 2001:db8:0:1::1: icmp_seq=3 ttl=63 time=2.41 ms
^C
--- 2001:db8:0:1::1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 2.399/2.418/2.442/0.017 ms
(continues on next page)

12.11. Inter-VRF Routing over VRF Lite 1204

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

vyos@Management:~$ ping 2001:db8:0:2::1 source-address 2001:db8:0:3::1
PING 2001:db8:0:2::1(2001:db8:0:2::1) from 2001:db8:0:3::1 : 56 data bytes
64 bytes from 2001:db8:0:2::1: icmp_seq=1 ttl=63 time=1.66 ms
64 bytes from 2001:db8:0:2::1: icmp_seq=2 ttl=63 time=1.99 ms
64 bytes from 2001:db8:0:2::1: icmp_seq=3 ttl=63 time=1.88 ms
64 bytes from 2001:db8:0:2::1: icmp_seq=4 ttl=63 time=2.32 ms
^C
--- 2001:db8:0:2::1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 1.660/1.960/2.315/0.236 ms

• From Management to Outside (fails as intended)

vyos@Management:~$ show ip route

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure

S>* 0.0.0.0/0 [1/0] via 192.168.3.1, eth2, weight 1, 00:01:58

C>* 192.168.0.0/24 is directly connected, dum0, 00:02:05
C>* 192.168.3.0/30 is directly connected, eth2, 00:02:03
vyos@Management:~$ ping 192.0.2.1
PING 192.0.2.1 (192.0.2.1) 56(84) bytes of data.
From 192.168.3.1 icmp_seq=1 Destination Net Unreachable
From 192.168.3.1 icmp_seq=2 Destination Net Unreachable
^C
--- 192.0.2.1 ping statistics ---
2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms

vyos@Management:~$ ping 195.51.100.1

PING 195.51.100.1 (195.51.100.1) 56(84) bytes of data.
From 192.168.3.1 icmp_seq=1 Destination Net Unreachable
From 192.168.3.1 icmp_seq=2 Destination Net Unreachable
From 192.168.3.1 icmp_seq=3 Destination Net Unreachable
^C
--- 195.51.100.1 ping statistics ---
3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2003ms

vyos@Management:~$ ping 2001:db8:1::1

PING 2001:db8:1::1(2001:db8:1::1) 56 data bytes
From 2001:db8::4 icmp_seq=1 Destination unreachable: No route
From 2001:db8::4 icmp_seq=2 Destination unreachable: No route
^C
--- 2001:db8:1::1 ping statistics ---
2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms

vyos@Management:~$ ping 2001:db8:2::1

PING 2001:db8:2::1(2001:db8:2::1) 56 data bytes
From 2001:db8::4 icmp_seq=1 Destination unreachable: No route
(continues on next page)

12.11. Inter-VRF Routing over VRF Lite 1205

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

From 2001:db8::4 icmp_seq=2 Destination unreachable: No route
^C
--- 2001:db8:2::1 ping statistics ---
2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms

• LAN1 to Outside

vyos@LAN1:~$ ping 192.0.2.1 source-address 10.0.0.1

PING 192.0.2.1 (192.0.2.1) from 10.0.0.1 : 56(84) bytes of data.
64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=1.47 ms
64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=1.41 ms
64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=1.80 ms
^C
--- 192.0.2.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2004ms
rtt min/avg/max/mdev = 1.414/1.563/1.803/0.171 ms
vyos@LAN1:~$ ping 198.51.100.1 source-address 10.0.0.1
PING 198.51.100.1 (198.51.100.1) from 10.0.0.1 : 56(84) bytes of data.
64 bytes from 198.51.100.1: icmp_seq=1 ttl=63 time=1.71 ms
64 bytes from 198.51.100.1: icmp_seq=2 ttl=63 time=1.83 ms
^C
--- 198.51.100.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 1.705/1.766/1.828/0.061 ms
vyos@LAN1:~$ ping 203.0.113.1 source-address 10.0.0.1
PING 203.0.113.1 (203.0.113.1) from 10.0.0.1 : 56(84) bytes of data.
64 bytes from 203.0.113.1: icmp_seq=1 ttl=63 time=1.25 ms
64 bytes from 203.0.113.1: icmp_seq=2 ttl=63 time=1.88 ms
^C
--- 203.0.113.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1003ms
rtt min/avg/max/mdev = 1.249/1.566/1.884/0.317 ms
vyos@LAN1:~$ ping 2001:db8:1::1 source-address 2001:db8:0:1::1
PING 2001:db8:1::1(2001:db8:1::1) from 2001:db8:0:1::1 : 56 data bytes
64 bytes from 2001:db8:1::1: icmp_seq=1 ttl=63 time=2.35 ms
64 bytes from 2001:db8:1::1: icmp_seq=2 ttl=63 time=2.29 ms
64 bytes from 2001:db8:1::1: icmp_seq=3 ttl=63 time=2.22 ms
^C
--- 2001:db8:1::1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2004ms
rtt min/avg/max/mdev = 2.215/2.285/2.352/0.055 ms
vyos@LAN1:~$ ping 2001:db8:2::1 source-address 2001:db8:0:1::1
PING 2001:db8:2::1(2001:db8:2::1) from 2001:db8:0:1::1 : 56 data bytes
64 bytes from 2001:db8:2::1: icmp_seq=1 ttl=63 time=1.37 ms
64 bytes from 2001:db8:2::1: icmp_seq=2 ttl=63 time=2.68 ms
64 bytes from 2001:db8:2::1: icmp_seq=3 ttl=63 time=2.00 ms
^C
--- 2001:db8:2::1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 1.367/2.015/2.679/0.535 ms

Note: we are using “source-address” option cause we are not redistributing connected interfaces into BGP on the Core

12.11. Inter-VRF Routing over VRF Lite 1206

 VyOS Documentation, Release 1.5.x (circinus)

router hence there is no comeback route and ping will fail.

• LAN1 to LAN2

vyos@LAN1:~$ ping 172.16.0.1 source-address 10.0.0.1

PING 172.16.0.1 (172.16.0.1) from 10.0.0.1 : 56(84) bytes of data.
64 bytes from 172.16.0.1: icmp_seq=1 ttl=63 time=3.00 ms
64 bytes from 172.16.0.1: icmp_seq=2 ttl=63 time=2.20 ms
^C
--- 172.16.0.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 2.199/2.600/3.001/0.401 ms
vyos@LAN1:~$ ping 2001:db8:0:2::1 source 2001:db8:0:1::1
PING 2001:db8:0:2::1(2001:db8:0:2::1) from 2001:db8:0:1::1 : 56 data bytes
64 bytes from 2001:db8:0:2::1: icmp_seq=1 ttl=63 time=4.82 ms
64 bytes from 2001:db8:0:2::1: icmp_seq=2 ttl=63 time=1.95 ms
64 bytes from 2001:db8:0:2::1: icmp_seq=3 ttl=63 time=1.98 ms
^C
--- 2001:db8:0:2::1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 1.949/2.915/4.815/1.343 ms

12.11.4 Conclusions

Inter-VRF routing is a well-known solution to address complex routing scenarios that enable -in a dynamic way- to leak
routes between VRFs. Is recommended to take special consideration while designing route-targets and its application
as it can minimize future interventions while creating a new VRF will automatically take the desired effect in its
propagation.

12.11.5 Appendix-A

Full configuration from all devices

• Core

set interfaces ethernet eth0 address '10.1.1.1/30'

set interfaces ethernet eth0 address '2001:db8::/127'
set interfaces ethernet eth0 vrf 'LAN1'
set interfaces ethernet eth1 address '172.16.2.1/30'
set interfaces ethernet eth1 address '2001:db8::2/127'
set interfaces ethernet eth1 vrf 'LAN2'
set interfaces ethernet eth2 address '192.168.3.1/30'
set interfaces ethernet eth2 address '2001:db8::4/127'
set interfaces ethernet eth2 vrf 'Management'
set interfaces ethernet eth3 address '10.2.2.1/30'
set interfaces ethernet eth3 address '2001:db8::6/127'
set interfaces ethernet eth3 vrf 'Internet'
set protocols bgp address-family ipv4-unicast
set protocols bgp system-as '64496'
set vrf name Internet protocols bgp address-family ipv4-unicast export vpn
set vrf name Internet protocols bgp address-family ipv4-unicast import vpn
(continues on next page)

12.11. Inter-VRF Routing over VRF Lite 1207

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set vrf name Internet protocols bgp address-family ipv4-unicast rd vpn export '64496:100'
set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn export
˓→'64496:100'

set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn import
˓→'64496:1 64496:2'

set vrf name Internet protocols bgp address-family ipv6-unicast export vpn
set vrf name Internet protocols bgp address-family ipv6-unicast import vpn
set vrf name Internet protocols bgp address-family ipv6-unicast rd vpn export '64496:100'
set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn export
˓→'64496:100'

set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn import
˓→'64496:1 64496:2'

set vrf name Internet protocols bgp system-as '64496'

set vrf name Internet protocols bgp neighbor 10.2.2.2 address-family ipv4-unicast
set vrf name Internet protocols bgp neighbor 10.2.2.2 remote-as '64497'
set vrf name Internet protocols bgp neighbor 2001:db8::7 address-family ipv6-unicast
set vrf name Internet protocols bgp neighbor 2001:db8::7 remote-as '64497'
set vrf name Internet table '104'
set vrf name LAN1 protocols bgp address-family ipv4-unicast export vpn
set vrf name LAN1 protocols bgp address-family ipv4-unicast import vpn
set vrf name LAN1 protocols bgp address-family ipv4-unicast rd vpn export '64496:1'
set vrf name LAN1 protocols bgp address-family ipv4-unicast redistribute static
set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn export
˓→'64496:1'

set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn import
˓→'64496:100 64496:50 64496:2'

set vrf name LAN1 protocols bgp address-family ipv6-unicast export vpn
set vrf name LAN1 protocols bgp address-family ipv6-unicast import vpn
set vrf name LAN1 protocols bgp address-family ipv6-unicast rd vpn export '64496:1'
set vrf name LAN1 protocols bgp address-family ipv6-unicast redistribute static
set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn export
˓→'64496:1'

set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn import
˓→'64496:100 64496:50 64496:2'

set vrf name LAN1 protocols bgp system-as '64496'

set vrf name LAN1 protocols static route 10.0.0.0/24 next-hop 10.1.1.2
set vrf name LAN1 protocols static route6 2001:db8:0:1::/64 next-hop 2001:db8::1
set vrf name LAN1 table '101'
set vrf name LAN2 protocols bgp address-family ipv4-unicast export vpn
set vrf name LAN2 protocols bgp address-family ipv4-unicast import vpn
set vrf name LAN2 protocols bgp address-family ipv4-unicast rd vpn export '64496:2'
set vrf name LAN2 protocols bgp address-family ipv4-unicast redistribute static
set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn export
˓→'64496:2'

set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn import
˓→'64496:100 64496:50 64496:1'

set vrf name LAN2 protocols bgp address-family ipv6-unicast export vpn
set vrf name LAN2 protocols bgp address-family ipv6-unicast import vpn
set vrf name LAN2 protocols bgp address-family ipv6-unicast rd vpn export '64496:2'
set vrf name LAN2 protocols bgp address-family ipv6-unicast redistribute static
set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn export
˓→'64496:2'

(continues on next page)

12.11. Inter-VRF Routing over VRF Lite 1208

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn import
˓→'64496:100 64496:50 64496:1'

set vrf name LAN2 protocols bgp system-as '64496'

set vrf name LAN2 protocols static route 172.16.0.0/24 next-hop 172.16.2.2
set vrf name LAN2 protocols static route6 2001:db8:0:2::/64 next-hop 2001:db8::3
set vrf name LAN2 table '102'
set vrf name Management protocols bgp address-family ipv4-unicast export vpn
set vrf name Management protocols bgp address-family ipv4-unicast import vpn
set vrf name Management protocols bgp address-family ipv4-unicast rd vpn export '64496:50
˓→'

set vrf name Management protocols bgp address-family ipv4-unicast redistribute static
set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn␣
˓→export '64496:50'

set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn␣
˓→import '64496:1 64496:2'

set vrf name Management protocols bgp address-family ipv6-unicast export vpn
set vrf name Management protocols bgp address-family ipv6-unicast import vpn
set vrf name Management protocols bgp address-family ipv6-unicast rd vpn export '64496:50
˓→'

set vrf name Management protocols bgp address-family ipv6-unicast redistribute static
set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn␣
˓→export '64496:50'

set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn␣
˓→import '64496:1 64496:2'

set vrf name Management protocols bgp system-as '64496'

set vrf name Management protocols static route 192.168.0.0/24 next-hop 192.168.3.2
set vrf name Management protocols static route6 2001:db8:0:3::/64 next-hop 2001:db8::5
set vrf name Management table '103'

• LAN1
set interfaces dummy dum0 address '10.0.0.1/24'
set interfaces dummy dum0 address '2001:db8:0:1::1/64'
set interfaces ethernet eth0 address '10.1.1.2/30'
set interfaces ethernet eth0 address '2001:db8::1/127'
set protocols static route 0.0.0.0/0 next-hop 10.1.1.1
set protocols static route6 ::/0 next-hop 2001:db8::*

• LAN2
set interfaces dummy dum0 address '172.16.0.1/24'
set interfaces dummy dum0 address '2001:db8:0:2::1/64'
set interfaces ethernet eth0 hw-id '50:00:00:03:00:00'
set interfaces ethernet eth1 address '172.16.2.2/30'
set interfaces ethernet eth1 address '2001:db8::3/127'
set protocols static route 0.0.0.0/0 next-hop 172.16.2.1
set protocols static route6 ::/0 next-hop 2001:db8::2

• Management
set interfaces dummy dum0 address '192.168.0.1/24'
set interfaces dummy dum0 address '2001:db8:0:3::1/64'
set interfaces ethernet eth2 address '192.168.3.2/30'
(continues on next page)

12.11. Inter-VRF Routing over VRF Lite 1209

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set interfaces ethernet eth2 address '2001:db8::5/127'
set protocols static route 0.0.0.0/0 next-hop 192.168.3.1
set protocols static route6 ::/0 next-hop 2001:db8::4

• ISP

set interfaces dummy dum0 address '192.0.2.1/24'

set interfaces dummy dum0 address '2001:db8:1::1/48'
set interfaces dummy dum1 address '198.51.100.1/24'
set interfaces dummy dum1 address '2001:db8:2::1/48'
set interfaces dummy dum2 address '203.0.113.1/24'
set interfaces dummy dum2 address '2001:db8:3::1/48'
set interfaces ethernet eth3 address '10.2.2.2/30'
set interfaces ethernet eth3 address '2001:db8::7/127'
set protocols bgp address-family ipv4-unicast redistribute connected
set protocols bgp address-family ipv6-unicast redistribute connected
set protocols bgp system-as '64497'
set protocols bgp neighbor 10.2.2.1 address-family ipv4-unicast default-originate
set protocols bgp neighbor 10.2.2.1 remote-as '64496'
set protocols bgp neighbor 2001:db8::6 address-family ipv6-unicast default-originate
set protocols bgp neighbor 2001:db8::6 remote-as '64496'
set protocols static route 0.0.0.0/0 next-hop 10.2.2.1
set protocols static route6 ::/0 next-hop 2001:db8::6

12.11.6 Appendix-B

Route-Filtering

When importing routes using MP-BGP it is possible to filter a subset of them before are injected in the BGP table. One
of the most common case is to use a route-map with an prefix-list.
• Configuration
We create a prefix-list first and add all the routes we need to.

# set both ipv4 and ipv6 policies

set policy prefix-list LAN2-Internet rule 1 action 'permit'

set policy prefix-list LAN2-Internet rule 1 le '24'
set policy prefix-list LAN2-Internet rule 1 prefix '198.51.0.0/16'
set policy prefix-list LAN2-Internet rule 2 action 'permit'
set policy prefix-list LAN2-Internet rule 2 prefix '192.0.2.0/24'
set policy prefix-list LAN2-Internet rule 3 action 'permit'
set policy prefix-list LAN2-Internet rule 3 prefix '192.168.0.0/24'
set policy prefix-list LAN2-Internet rule 4 action 'permit'
set policy prefix-list LAN2-Internet rule 4 prefix '10.0.0.0/24'

set policy prefix-list6 LAN2-Internet-v6 rule 1 action 'permit'

set policy prefix-list6 LAN2-Internet-v6 rule 1 prefix '2001:db8:1::/48'
set policy prefix-list6 LAN2-Internet-v6 rule 2 action 'permit'
set policy prefix-list6 LAN2-Internet-v6 rule 2 prefix '2001:db8:2::/48'
set policy prefix-list6 LAN2-Internet-v6 rule 3 action 'permit'
(continues on next page)

12.11. Inter-VRF Routing over VRF Lite 1210

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set policy prefix-list6 LAN2-Internet-v6 rule 3 prefix '2001:db8:0:3::/64'
set policy prefix-list6 LAN2-Internet-v6 rule 4 action 'permit'
set policy prefix-list6 LAN2-Internet-v6 rule 4 prefix '2001:db8:0:1::/64'

Then add a route-map and reference to above prefix. Consider that the actions taken inside the prefix will MATCH the
routes that will be affected by the actions inside the rules of the route-map.

set policy route-map LAN2-Internet rule 1 action 'permit'

set policy route-map LAN2-Internet rule 1 match ip address prefix-list 'LAN2-Internet'

set policy route-map LAN2-Internet-v6 rule 1 action 'permit'

set policy route-map LAN2-Internet-v6 rule 1 match ipv6 address prefix-list 'LAN2-
˓→Internet-v6'

We are using a “white list” approach by allowing only what is necessary. In case that need to implement a “black list”
approach then you will need to change the action in the route-map for a deny BUT you need to add a rule that permits
the rest due to the implicit deny in the route-map.
Then we need to attach the policy to the BGP process. This needs to be under the import statement in the vrf we need
to filter.

set vrf name LAN2 protocols bgp address-family ipv4-unicast route-map vpn import 'LAN2-
˓→Internet'

set vrf name LAN2 protocols bgp address-family ipv6-unicast route-map vpn import 'LAN2-
˓→Internet-v6'

• Verification

# show ip route vrf LAN2

B>* 10.0.0.0/24 [20/0] via 10.1.1.2, eth0 (vrf LAN1), weight 1, 00:45:28
S>* 172.16.0.0/24 [1/0] via 172.16.2.2, eth1, weight 1, 00:45:32
C>* 172.16.2.0/30 is directly connected, eth1, 00:45:39
B>* 192.0.2.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:45:24
B>* 192.168.0.0/24 [20/0] via 192.168.3.2, eth2 (vrf Managment), weight 1, 00:45:27
B>* 198.51.100.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:45:24

# show ipv6 route vrf LAN2

C>* 2001:db8::2/127 is directly connected, eth1, 00:46:26

B>* 2001:db8:0:1::/64 [20/0] via 2001:db8::1, eth0 (vrf LAN1), weight 1, 00:46:17
S>* 2001:db8:0:2::/64 [1/0] via 2001:db8::3, eth1, weight 1, 00:46:21
B>* 2001:db8:0:3::/64 [20/0] via 2001:db8::5, eth2 (vrf Managment), weight 1, 00:46:16
B>* 2001:db8:1::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1,␣
˓→00:46:13

B>* 2001:db8:2::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1,␣
˓→00:46:13

C>* fe80::/64 is directly connected, eth1, 00:46:27

As we can see even if both VRF LAN1 and LAN2 has the same import RTs we are able to select which routes are
effectively imported and installed.

12.11. Inter-VRF Routing over VRF Lite 1211

 VyOS Documentation, Release 1.5.x (circinus)

12.12 QoS example

12.12.1 Configuration ‘dcsp’ and shaper using QoS

In this case, we’ll try to make a simple lab using QoS and the general ability of the VyOS system. We recommend you
to go through the main article about QoS first.
Using the general schema for example:

We have four hosts on the local network 172.17.1.0/24. All hosts are labeled CS0 by default. We need to replace labels
on all hosts except vpc8. We will replace the labels on the nearest router “VyOS3” using the IP addresses of the sources.
• 172.17.1.2 CS0 -> CS4
• 172.17.1.3 CS0 -> CS5
• 172.17.1.4 CS0 -> CS6
• 172.17.1.40 CS0 by default
Next, we will replace only all CS4 labels on the “VyOS2” router.
• CS4 -> CS5
In the end, we will configure the traffic shaper using QoS mechanisms on the “VYOS2” router.

12.12.2 Configuration:

Set IP addresses on all VPCs and a default gateway 172.17.1.1. We’ll use in this case only static routes. On the VyOS3
router, we need to change the ‘dscp’ labels for the VPCs. To do this, we use this configuration.

set interfaces ethernet eth0 address '10.1.1.100/24'

set interfaces ethernet eth1 address '172.17.1.1/24'
set protocols static route 0.0.0.0/0 next-hop 10.1.1.1
set qos policy shaper vyos3 class 10 match ADDRESS10 ip source address '172.17.1.2/32'
set qos policy shaper vyos3 class 10 set-dscp 'CS4'
set qos policy shaper vyos3 class 20 match ADDRESS20 ip source address '172.17.1.3/32'
set qos policy shaper vyos3 class 20 set-dscp 'CS5'
set qos policy shaper vyos3 class 30 match ADDRESS20 ip source address '172.17.1.4/32'
set qos policy shaper vyos3 class 30 set-dscp 'CS6'
set qos policy shaper vyos3 default bandwidth '10%'
(continues on next page)

12.12. QoS example 1212

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set qos policy shaper vyos3 default ceiling '100%'
set qos policy shaper vyos3 default priority '7'
set qos policy shaper vyos3 default queue-type 'fair-queue'
set qos interface eth0 egress 'vyos3'

Main rules:
• ADDRESS10 change CS0 -> CS4 source 172.17.1.2/32
• ADDRESS20 change CS0 -> CS5 source 172.17.1.3/32
• ADDRESS30 change CS0 -> CS6 source 172.17.1.4/32
Check the result

Before the interface eth0 on router VyOS3

After the interface eth0 on router VyOS3

On the router, VyOS4 set all traffic as CS4. We have to configure the default class and class for changing all labels
from CS0 to CS4

set interfaces ethernet eth0 address '10.2.1.100/24'

set protocols static route 0.0.0.0/0 next-hop 10.2.1.1
set qos policy shaper vyos4 class 10 bandwidth '100%'
set qos policy shaper vyos4 class 10 burst '15k'
set qos policy shaper vyos4 class 10 match ALL ether protocol 'all'
set qos policy shaper vyos4 class 10 queue-type 'fair-queue'
set qos policy shaper vyos4 class 10 set-dscp 'CS4'
set qos policy shaper vyos4 default bandwidth '10%'
(continues on next page)

12.12. QoS example 1213

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set qos policy shaper vyos4 default burst '15k'
set qos policy shaper vyos4 default ceiling '100%'
set qos policy shaper vyos4 default priority '7'
set qos policy shaper vyos4 default queue-type 'fair-queue'
set qos interface eth0 egress 'vyos4'

Next on the router VyOS2 we will change labels on all incoming traffic only from CS4-> CS6

set interfaces ethernet eth0 address '10.1.1.1/24'

set interfaces ethernet eth1 address '10.2.1.1/24'
set interfaces ethernet eth2 address '10.9.9.1/24'
set protocols static route 172.17.1.0/24 next-hop 10.1.1.100
set qos policy shaper vyos2 class 10 bandwidth '100%'
set qos policy shaper vyos2 class 10 burst '15k'
set qos policy shaper vyos2 class 10 match VYOS2 ip dscp 'CS4'
set qos policy shaper vyos2 class 10 queue-type 'fair-queue'
set qos policy shaper vyos2 class 10 set-dscp 'CS5'
set qos policy shaper vyos2 default bandwidth '100%'
set qos policy shaper vyos2 default burst '15k'
set qos policy shaper vyos2 default ceiling '100%'
set qos policy shaper vyos2 default priority '7'
set qos policy shaper vyos2 default queue-type 'fair-queue'
set qos interface eth2 egress 'vyos2'

12.12. QoS example 1214

 VyOS Documentation, Release 1.5.x (circinus)

• 172.17.1.2/24 CS0

• 172.17.1.2/24 CS0 - > CS4

• 172.17.1.2/24 CS4 - > CS5

In the end, on the router “VyOS2” we will set outgoing bandwidth limits between the “VyOS3” and “VyOS1” routers.
Let’s set a limit for IP 10.1.1.100 = 5 Mbps(Tx). We will check the result of the work with the help of the “iPerf” utility.
Set up bandwidth limits on the eth2 interface of the router “VyOS2”.

vyos@vyos2# show qos policy shaper vyos2 class 20

bandwidth 5mbit
description "for VyOS3 eth0"
match VyOS3 {
ip {
source {
address 10.1.1.100/32
}
}
}

Check the result.

12.12. QoS example 1215

 VyOS Documentation, Release 1.5.x (circinus)

As we see shaper is working and the traffic will not work over 5 Mbit/s.

12.13 Segment-routing IS-IS example

When utilizing VyOS in an environment with Cisco IOS-XR gear you can use this blue print as an initial setup to get
MPLS ISIS-SR working between those two devices.The lab was build using EVE-NG.

Fig. 1: ISIS-SR example network

The below configuration is used as example where we keep focus on VyOS-P1/VyOS-P2/XRv-P3 which we share the
settings.

12.13. Segment-routing IS-IS example 1216

 VyOS Documentation, Release 1.5.x (circinus)

12.13.1 Configuration

• VyOS-P1:
set interfaces dummy dum0 address '192.0.2.1/32'
set interfaces ethernet eth1 address '192.0.2.5/30'
set interfaces ethernet eth1 mtu '8000'
set interfaces ethernet eth3 address '192.0.2.21/30'
set interfaces ethernet eth3 mtu '8000'
set protocols isis interface dum0 passive
set protocols isis interface eth1 network point-to-point
set protocols isis interface eth3 network point-to-point
set protocols isis level 'level-2'
set protocols isis log-adjacency-changes
set protocols isis metric-style 'wide'
set protocols isis net '49.0000.0000.0000.0001.00'
set protocols isis segment-routing maximum-label-depth '8'
set protocols isis segment-routing prefix 192.0.2.1/32 index value '1'
set protocols mpls interface 'eth1'
set protocols mpls interface 'eth3'
set system host-name 'P1-VyOS'

• XRv-P3:
hostname P3-VyOS
interface Loopback0
ipv4 address 192.0.2.3 255.255.255.255
!
interface GigabitEthernet0/0/0/1
mtu 8014
ipv4 address 192.0.2.6 255.255.255.252
!
interface GigabitEthernet0/0/0/2
mtu 8014
ipv4 address 192.0.2.18 255.255.255.252
!
router isis VyOS
is-type level-2-only
net 49.0000.0000.0000.0003.00
log adjacency changes
address-family ipv4 unicast
metric-style wide
segment-routing mpls
!
interface Loopback0
passive
address-family ipv4 unicast
prefix-sid index 3
!
!
interface GigabitEthernet0/0/0/1
point-to-point
address-family ipv4 unicast
!
(continues on next page)

12.13. Segment-routing IS-IS example 1217

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

!
interface GigabitEthernet0/0/0/2
point-to-point
address-family ipv4 unicast
!
!
!

• VyOS-P2:

set interfaces dummy dum0 address '192.0.2.2/32'

set interfaces ethernet eth2 address '192.0.2.17/30'
set interfaces ethernet eth2 mtu '8000'
set interfaces ethernet eth3 address '192.0.2.26/30'
set interfaces ethernet eth3 mtu '8000'
set protocols isis interface dum0 passive
set protocols isis interface eth2 network point-to-point
set protocols isis interface eth3 network point-to-point
set protocols isis level 'level-2'
set protocols isis log-adjacency-changes
set protocols isis metric-style 'wide'
set protocols isis net '49.0000.0000.0000.0002.00'
set protocols isis segment-routing maximum-label-depth '8'
set protocols isis segment-routing prefix 192.0.2.2/32 index value '2'
set protocols mpls interface 'eth2'
set protocols mpls interface 'eth3'
set system host-name 'P2-VyOS'

This gives us MPLS segment routing enabled and labels forwarding :

vyos@P1-VyOS:~$ show mpls table

Inbound Label Type Nexthop Outbound Label
-----------------------------------------------------------------
15000 SR (IS-IS) 192.0.2.6 implicit-null
15001 SR (IS-IS) 192.0.2.22 implicit-null
15002 SR (IS-IS) fe80::5200:ff:fe04:3 implicit-null
16002 SR (IS-IS) 192.0.2.6 16002
16003 SR (IS-IS) 192.0.2.6 implicit-null
16011 SR (IS-IS) 192.0.2.22 implicit-null

vyos@P2-VyOS:~$ show mpls table

Inbound Label Type Nexthop Outbound Label
-------------------------------------------------------
15000 SR (IS-IS) 192.0.2.18 implicit-null
16001 SR (IS-IS) 192.0.2.18 16001
16003 SR (IS-IS) 192.0.2.18 implicit-null
16011 SR (IS-IS) 192.0.2.18 16011

RP/0/0/CPU0:P3-VyOS#show mpls forwarding

Tue Mar 28 17:47:18.928 UTC
Local Outgoing Prefix Outgoing Next Hop Bytes
Label Label or ID Interface Switched
(continues on next page)

12.13. Segment-routing IS-IS example 1218

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

------ ----------- ------------------ ------------ --------------- ------------
16001 Pop SR Pfx (idx 1) Gi0/0/0/1 192.0.2.5 0
16002 Pop SR Pfx (idx 2) Gi0/0/0/2 192.0.2.17 0
16011 16011 SR Pfx (idx 11) Gi0/0/0/1 192.0.2.5 0
24000 Pop SR Adj (idx 1) Gi0/0/0/1 192.0.2.5 0
24001 Pop SR Adj (idx 3) Gi0/0/0/1 192.0.2.5 0
24002 Pop SR Adj (idx 1) Gi0/0/0/2 192.0.2.17 0
24003 Pop SR Adj (idx 3) Gi0/0/0/2 192.0.2.17 0

VyOS is able to check MSD per devices:

vyos@P1-VyOS:~$ show isis segment-routing node

Area VyOS:
IS-IS L1 SR-Nodes:

IS-IS L2 SR-Nodes:

System ID SRGB SRLB Algorithm MSD

---------------------------------------------------------------
0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8
0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8
0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10
0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8

vyos@P2-VyOS:~$ show isis segment-routing node

Area VyOS:
IS-IS L1 SR-Nodes:

IS-IS L2 SR-Nodes:

System ID SRGB SRLB Algorithm MSD

---------------------------------------------------------------
0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8
0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8
0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10
0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8

Here is the routing tables showing the MPLS segment routing label operations:

vyos@P1-VyOS:~$ show ip route isis

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure

I>* 192.0.2.2/32 [115/30] via 192.0.2.6, eth1, label 16002, weight 1, 1d03h18m
I>* 192.0.2.3/32 [115/10] via 192.0.2.6, eth1, label implicit-null, weight 1, 1d03h18m
I 192.0.2.4/30 [115/20] via 192.0.2.6, eth1 inactive, weight 1, 1d03h18m
I>* 192.0.2.11/32 [115/20] via 192.0.2.22, eth3, label implicit-null, weight 1, 1d02h47m
I>* 192.0.2.16/30 [115/20] via 192.0.2.6, eth1, weight 1, 1d03h18m
(continues on next page)

12.13. Segment-routing IS-IS example 1219

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

I 192.0.2.20/30 [115/20] via 192.0.2.22, eth3 inactive, weight 1, 1d02h48m
I>* 192.0.2.24/30 [115/30] via 192.0.2.6, eth1, weight 1, 1d03h18m

vyos@P2-VyOS:~$ show ip route isis

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure

I>* 192.0.2.1/32 [115/30] via 192.0.2.18, eth2, label 16001, weight 1, 1d03h17m
I>* 192.0.2.3/32 [115/10] via 192.0.2.18, eth2, label implicit-null, weight 1, 1d03h17m
I>* 192.0.2.4/30 [115/20] via 192.0.2.18, eth2, weight 1, 1d03h17m
I>* 192.0.2.11/32 [115/40] via 192.0.2.18, eth2, label 16011, weight 1, 1d02h47m
I 192.0.2.16/30 [115/20] via 192.0.2.18, eth2 inactive, weight 1, 1d03h17m
I>* 192.0.2.20/30 [115/30] via 192.0.2.18, eth2, weight 1, 1d03h17m

RP/0/0/CPU0:P3-VyOS#show route isis

Tue Mar 28 18:19:16.417 UTC

i L2 192.0.2.1/32 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1

i L2 192.0.2.2/32 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2
i L2 192.0.2.11/32 [115/30] via 192.0.2.5, 1d02h, GigabitEthernet0/0/0/1
i L2 192.0.2.20/30 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1
i L2 192.0.2.24/30 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2

Information about prefix-sid and label-operation from VyOS

vyos@P1-VyOS:~$ show isis route prefix-sid

Area VyOS:
IS-IS L2 IPv4 routing table:

Prefix Metric Interface Nexthop SID Label Op.

----------------------------------------------------------------------
192.0.2.1/32 0 - - - -
192.0.2.2/32 30 eth1 192.0.2.6 2 Swap(16002, 16002)
192.0.2.3/32 10 eth1 192.0.2.6 3 Pop(16003)
192.0.2.4/30 20 eth1 192.0.2.6 - -
192.0.2.16/30 20 eth1 192.0.2.6 - -
192.0.2.20/30 0 - - - -
192.0.2.24/30 30 eth1 192.0.2.6 - -

vyos@P2-VyOS:~$ show isis route prefix-sid

Area VyOS:
IS-IS L2 IPv4 routing table:

Prefix Metric Interface Nexthop SID Label Op.

-----------------------------------------------------------------------
192.0.2.1/32 30 eth2 192.0.2.18 1 Swap(16001, 16001)
192.0.2.2/32 0 - - - -
(continues on next page)

12.13. Segment-routing IS-IS example 1220

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

192.0.2.3/32 10 eth2 192.0.2.18 3 Pop(16003)
192.0.2.4/30 20 eth2 192.0.2.18 - -
192.0.2.16/30 20 eth2 192.0.2.18 - -
192.0.2.20/30 30 eth2 192.0.2.18 - -
192.0.2.24/30 0 - - - -

Ping between VyOS-P1 / VyOS-P2 to confirm reachability:

vyos@P1-VyOS:~$ ping 192.0.2.2 source-address 192.0.2.1

PING 192.0.2.2 (192.0.2.2) from 192.0.2.1 : 56(84) bytes of data.
64 bytes from 192.0.2.2: icmp_seq=1 ttl=63 time=3.47 ms
64 bytes from 192.0.2.2: icmp_seq=2 ttl=63 time=2.06 ms
64 bytes from 192.0.2.2: icmp_seq=3 ttl=63 time=3.90 ms
64 bytes from 192.0.2.2: icmp_seq=4 ttl=63 time=3.87 ms
^C
--- 192.0.2.2 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 2.064/3.326/3.903/0.748 ms

vyos@P2-VyOS:~$ ping 192.0.2.1 source-address 192.0.2.2

PING 192.0.2.1 (192.0.2.1) from 192.0.2.2 : 56(84) bytes of data.
64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=2.91 ms
64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=3.23 ms
64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=2.91 ms
64 bytes from 192.0.2.1: icmp_seq=4 ttl=63 time=2.85 ms
^C
--- 192.0.2.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 2.846/2.972/3.231/0.151 ms

12.14 NMP example

Consider how to quickly set up NMP and VyOS for monitoring. NMP is multi-vendor network monitoring from
‘SolarWinds’ built to scale and expand with the needs of your network.

12.14.1 Configuration ‘VyOS’

First prepare our VyOS router for connection to NMP. We have to set up the SNMP protocol and connectivity between
the router and NMP.

set interfaces ethernet eth0 address 'dhcp'

set system name-server '8.8.8.8'
set service snmp community router authorization 'test'
set service snmp community router network '0.0.0.0/0'

12.14. NMP example 1221

 VyOS Documentation, Release 1.5.x (circinus)

12.14.2 Configuration ‘NMP’

Next, you just should follow the pictures:

12.14. NMP example 1222

 VyOS Documentation, Release 1.5.x (circinus)

12.14. NMP example 1223

 VyOS Documentation, Release 1.5.x (circinus)

In the end, you’ll get a powerful instrument for monitoring the VyOS systems.

12.15 Ansible example

12.15.1 Setting up Ansible on a server running the Debian operating system.

In this example, we will set up a simple use of Ansible to configure multiple VyoS routers. We have four pre-configured
routers with this configuration:
Using the general schema for example:

12.15. Ansible example 1224

 VyOS Documentation, Release 1.5.x (circinus)

We have four pre-configured routers with this configuration:

set interfaces ethernet eth0 address dhcp

set service ssh
commit
save

• vyos7 - 192.0.2.105
• vyos8 - 192.0.2.106
• vyos9 - 192.0.2.107
• vyos10 - 192.0.2.108

12.15. Ansible example 1225

 VyOS Documentation, Release 1.5.x (circinus)

12.15.2 Install Ansible:

# apt-get install ansible

Do you want to continue? [Y/n] y

12.15.3 Install Paramiko:

#apt-get install -y python3-paramiko

12.15.4 Check the version:

# ansible --version
ansible 2.10.8
config file = None
configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/
˓→plugins/modules']

ansible python module location = /usr/lib/python3/dist-packages/ansible

executable location = /usr/bin/ansible
python version = 3.9.2 (default, Feb 28 2021, 17:03:44) [GCC 10.2.1 20210110]

12.15.5 Basic configuration of ansible.cfg:

# nano /root/ansible.cfg
[defaults]
host_key_checking = no

12.15.6 Add all the VyOS hosts:

# nano /root/hosts
[vyos_hosts]
vyos7 ansible_ssh_host=192.0.2.105
vyos8 ansible_ssh_host=192.0.2.106
vyos9 ansible_ssh_host=192.0.2.107
vyos10 ansible_ssh_host=192.0.2.108

12.15.7 Add general variables:

# mkdir /root/group_vars/
# nano /root/group_vars/vyos_hosts
ansible_python_interpreter: /usr/bin/python3
ansible_network_os: vyos
ansible_connection: network_cli
ansible_user: vyos
ansible_ssh_pass: vyos

12.15. Ansible example 1226

 VyOS Documentation, Release 1.5.x (circinus)

12.15.8 Add a simple playbook with the tasks for each router:

# nano /root/main.yml

---
- hosts: vyos_hosts
gather_facts: 'no'
tasks:
- name: Configure general settings for the vyos hosts group
vyos_config:
lines:
- set system name-server 8.8.8.8
- set interfaces ethernet eth0 description '#WAN#'
- set interfaces ethernet eth1 description '#LAN#'
- set interfaces ethernet eth2 disable
- set interfaces ethernet eth3 disable
- set system host-name {{ inventory_hostname }}
save:
true

12.15.9 Start the playbook:

ansible-playbook -i hosts main.yml

PLAY [vyos_hosts] **************************************************************

TASK [Configure general settings for the vyos hosts group] *********************
ok: [vyos9]
ok: [vyos10]
ok: [vyos7]
ok: [vyos8]

PLAY RECAP *********************************************************************

vyos10 : ok=2 changed=0 unreachable=0 failed=0 skipped=0␣
˓→ rescued=0 ignored=0
vyos7 : ok=2 changed=0 unreachable=0 failed=0 skipped=0␣
˓→ rescued=0 ignored=0
vyos8 : ok=2 changed=0 unreachable=0 failed=0 skipped=0␣
˓→ rescued=0 ignored=0
vyos9 : ok=2 changed=0 unreachable=0 failed=0 skipped=0␣
˓→ rescued=0 ignored=0

12.15.10 Check the result on the vyos10 router:

vyos@vyos10:~$ show interfaces

Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
eth0 192.0.2.108/24 u/u WAN
eth1 - u/u LAN
eth2 - A/D
(continues on next page)

12.15. Ansible example 1227

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

eth3 - A/D
lo 127.0.0.1/8 u/u
::1/128

vyos@vyos10:~$ sh configuration commands | grep 8.8.8.8

set system name-server '8.8.8.8'

12.15.11 The simple way without configuration of the hostname (one task for all
routers):

# nano /root/hosts_v2
[vyos_hosts_group]
vyos7 ansible_ssh_host=192.0.2.105
vyos8 ansible_ssh_host=192.0.2.106
vyos9 ansible_ssh_host=192.0.2.107
vyos10 ansible_ssh_host=192.0.2.108
[vyos_hosts_group:vars]
ansible_python_interpreter=/usr/bin/python3
ansible_user=vyos
ansible_ssh_pass=vyos
ansible_network_os=vyos
ansible_connection=network_cli

# nano /root/main_v2.yml
---
- hosts: vyos_hosts_group

connection: network_cli
gather_facts: 'no'

tasks:
- name: Configure remote vyos_hosts_group
vyos_config:
lines:
- set system name-server 8.8.8.8
- set interfaces ethernet eth0 description WAN
- set interfaces ethernet eth1 description LAN
- set interfaces ethernet eth2 disable
- set interfaces ethernet eth3 disable
save:
true

# ansible-playbook -i hosts_v2 main_v2.yml

PLAY [vyos_hosts_group] ********************************************************

TASK [Configure remote vyos_hosts_group] ***************************************

ok: [vyos8]
ok: [vyos7]
ok: [vyos9]
(continues on next page)

12.15. Ansible example 1228

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

ok: [vyos10]

PLAY RECAP *********************************************************************

vyos10 : ok=1 changed=0 unreachable=0 failed=0 skipped=0␣
˓→ rescued=0 ignored=0
vyos7 : ok=1 changed=0 unreachable=0 failed=0 skipped=0␣
˓→ rescued=0 ignored=0
vyos8 : ok=1 changed=0 unreachable=0 failed=0 skipped=0␣
˓→ rescued=0 ignored=0
vyos9 : ok=1 changed=0 unreachable=0 failed=0 skipped=0␣
˓→ rescued=0 ignored=0

In the next chapter of the example, we’ll use Ansible with jinja2 templates and variables.

12.16 Policy-Based Site-to-Site VPN and Firewall Configuration

This guide shows an example policy-based IKEv2 site-to-site VPN between two VyOS routers, and firewall configura-
tion.
For simplicity, configuration and tests are done only using IPv4, and firewall configuration is done only on one router.

12.16.1 Network Topology and requirements

This configuration example and the requirements consists of:

• Two VyOS routers with public IP address.
• 2 private subnets on each site.
• Local subnets should be able to reach internet using source NAT.
• Communication between private subnets should be done through IPSec tunnel without NAT.
• Configuration of basic firewall in one site, in order to:
– Protect the router on ‘WAN’ interface, allowing only IPSec connections and SSH access from trusted IPs.
– Allow access to the router only from trusted networks.
– Allow DNS requests only only for local networks.
– Allow ICMP on all interfaces.
– Allow all new connections from local subnets.
– Allow connections from LANs to LANs through the tunnel.

12.16. Policy-Based Site-to-Site VPN and Firewall Configuration 1229

 VyOS Documentation, Release 1.5.x (circinus)

12.16.2 Configuration

Interface and routing configuration:

# LEFT router:
set interfaces ethernet eth0 address '198.51.100.14/30'
set interfaces ethernet eth1 vif 111 address '10.1.11.1/24'
set interfaces ethernet eth2 vif 112 address '10.1.12.1/24'
set protocols static route 0.0.0.0/0 next-hop 198.51.100.13

# RIGHT router:
set interfaces ethernet eth0 address '192.0.2.130/30'
set interfaces ethernet eth1 vif 221 address '10.2.21.1/24'
set interfaces ethernet eth2 vif 222 address '10.2.22.1/24'

IPSec configuration:

# LEFT router:
set vpn ipsec authentication psk RIGHT id '198.51.100.14'
set vpn ipsec authentication psk RIGHT id '192.0.2.130'
set vpn ipsec authentication psk RIGHT secret 'p4ssw0rd'
set vpn ipsec esp-group ESP-GROUP mode 'tunnel'
set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-GROUP proposal 1 hash 'sha256'
set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2'
set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group '14'
set vpn ipsec ike-group IKE-GROUP proposal 1 encryption 'aes256'
(continues on next page)

12.16. Policy-Based Site-to-Site VPN and Firewall Configuration 1230

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha256'
set vpn ipsec interface 'eth0'
set vpn ipsec site-to-site peer RIGHT authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer RIGHT connection-type 'initiate'
set vpn ipsec site-to-site peer RIGHT default-esp-group 'ESP-GROUP'
set vpn ipsec site-to-site peer RIGHT ike-group 'IKE-GROUP'
set vpn ipsec site-to-site peer RIGHT local-address '198.51.100.14'
set vpn ipsec site-to-site peer RIGHT remote-address '192.0.2.130'
set vpn ipsec site-to-site peer RIGHT tunnel 0 local prefix '10.1.11.0/24'
set vpn ipsec site-to-site peer RIGHT tunnel 0 remote prefix '10.2.21.0/24'
set vpn ipsec site-to-site peer RIGHT tunnel 1 local prefix '10.1.11.0/24'
set vpn ipsec site-to-site peer RIGHT tunnel 1 remote prefix '10.2.22.0/24'
set vpn ipsec site-to-site peer RIGHT tunnel 2 local prefix '10.1.12.0/24'
set vpn ipsec site-to-site peer RIGHT tunnel 2 remote prefix '10.2.21.0/24'
set vpn ipsec site-to-site peer RIGHT tunnel 3 local prefix '10.1.12.0/24'
set vpn ipsec site-to-site peer RIGHT tunnel 3 remote prefix '10.2.22.0/24'

# RIGHT router:
set vpn ipsec authentication psk LEFT id '192.0.2.130'
set vpn ipsec authentication psk LEFT id '198.51.100.14'
set vpn ipsec authentication psk LEFT secret 'p4ssw0rd'
set vpn ipsec esp-group ESP-GROUP mode 'tunnel'
set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-GROUP proposal 1 hash 'sha256'
set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2'
set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group '14'
set vpn ipsec ike-group IKE-GROUP proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha256'
set vpn ipsec interface 'eth0'
set vpn ipsec site-to-site peer LEFT authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer LEFT connection-type 'respond'
set vpn ipsec site-to-site peer LEFT default-esp-group 'ESP-GROUP'
set vpn ipsec site-to-site peer LEFT ike-group 'IKE-GROUP'
set vpn ipsec site-to-site peer LEFT local-address '192.0.2.130'
set vpn ipsec site-to-site peer LEFT remote-address '198.51.100.14'
set vpn ipsec site-to-site peer LEFT tunnel 0 local prefix '10.2.21.0/24'
set vpn ipsec site-to-site peer LEFT tunnel 0 remote prefix '10.1.11.0/24'
set vpn ipsec site-to-site peer LEFT tunnel 1 local prefix '10.2.22.0/24'
set vpn ipsec site-to-site peer LEFT tunnel 1 remote prefix '10.1.11.0/24'
set vpn ipsec site-to-site peer LEFT tunnel 2 local prefix '10.2.21.0/24'
set vpn ipsec site-to-site peer LEFT tunnel 2 remote prefix '10.1.12.0/24'
set vpn ipsec site-to-site peer LEFT tunnel 3 local prefix '10.2.22.0/24'
set vpn ipsec site-to-site peer LEFT tunnel 3 remote prefix '10.1.12.0/24'

Firewall Configuration:

# Firewall Groups:
set firewall group network-group LOCAL-NETS network '10.1.11.0/24'
set firewall group network-group LOCAL-NETS network '10.1.12.0/24'
set firewall group network-group REMOTE-NETS network '10.2.21.0/24'
set firewall group network-group REMOTE-NETS network '10.2.22.0/24'
set firewall group network-group TRUSTED network '198.51.100.125/32'
(continues on next page)

12.16. Policy-Based Site-to-Site VPN and Firewall Configuration 1231

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set firewall group network-group TRUSTED network '203.0.113.0/24'
set firewall group network-group TRUSTED network '10.1.11.0/24'
set firewall group network-group TRUSTED network '192.168.70.0/24'

# Forward traffic: default drop and only allow what is needed

set firewall ipv4 forward filter default-action 'drop'

# Forward traffic: global state policies

set firewall ipv4 forward filter rule 1 action 'accept'
set firewall ipv4 forward filter rule 1 state established 'enable'
set firewall ipv4 forward filter rule 1 state related 'enable'
set firewall ipv4 forward filter rule 2 action 'drop'
set firewall ipv4 forward filter rule 2 state invalid 'enable'

# Forward traffic: Accept all connections from local networks

set firewall ipv4 forward filter rule 10 action 'accept'
set firewall ipv4 forward filter rule 10 source group network-group 'LOCAL-NETS'

# Forward traffic: accept connections from remote LANs to local LANs

set firewall ipv4 forward filter rule 20 action 'accept'
set firewall ipv4 forward filter rule 20 destination group network-group 'LOCAL-NETS'
set firewall ipv4 forward filter rule 20 source group network-group 'REMOTE-NETS'

# Input traffic: default drop and only allow what is needed

set firewall ipv4 input filter default-action 'drop'

# Input traffic: global state policies

set firewall ipv4 input filter rule 1 action 'accept'
set firewall ipv4 input filter rule 1 state established 'enable'
set firewall ipv4 input filter rule 1 state related 'enable'
set firewall ipv4 input filter rule 2 action 'drop'
set firewall ipv4 input filter rule 2 state invalid 'enable'

# Input traffic: add rules needed for ipsec connection

set firewall ipv4 input filter rule 10 action 'accept'
set firewall ipv4 input filter rule 10 destination port '500,4500'
set firewall ipv4 input filter rule 10 inbound-interface interface-name 'eth0'
set firewall ipv4 input filter rule 10 protocol 'udp'
set firewall ipv4 input filter rule 15 action 'accept'
set firewall ipv4 input filter rule 15 inbound-interface interface-name 'eth0'
set firewall ipv4 input filter rule 15 protocol 'esp'

# Input traffic: accept ssh connection from trusted ips

set firewall ipv4 input filter rule 20 action 'accept'
set firewall ipv4 input filter rule 20 destination port '22'
set firewall ipv4 input filter rule 20 protocol 'tcp'
set firewall ipv4 input filter rule 20 source group network-group 'TRUSTED'

# Input traffic: accepd dns requests only from local networks.

set firewall ipv4 input filter rule 25 action 'accept'
set firewall ipv4 input filter rule 25 destination port '53'
set firewall ipv4 input filter rule 25 protocol 'udp'
(continues on next page)

12.16. Policy-Based Site-to-Site VPN and Firewall Configuration 1232

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set firewall ipv4 input filter rule 25 source group network-group 'LOCAL-NETS'

# Input traffic: allow icmp

set firewall ipv4 input filter rule 30 action 'accept'
set firewall ipv4 input filter rule 30 protocol 'icmp'

And NAT Configuration:

set nat source rule 10 destination group network-group 'REMOTE-NETS'

set nat source rule 10 exclude
set nat source rule 10 outbound-interface name 'eth0'
set nat source rule 10 source group network-group 'LOCAL-NETS'
set nat source rule 20 outbound-interface name 'eth0'
set nat source rule 20 source group network-group 'LOCAL-NETS'
set nat source rule 20 translation address 'masquerade'

12.16.3 Checking through op-mode commands

After some testing, we can check IPSec status, and counter on every tunnel:

vyos@LEFT:~$ show vpn ipsec sa

Connection State Uptime Bytes In/Out Packets In/Out Remote address ␣
˓→Remote ID Proposal
-------------- ------- -------- -------------- ---------------- ---------------- --
˓→--------- ---------------------------------------
RIGHT-tunnel-0 up 36m24s 840B/840B 10/10 192.0.2.130 ␣
˓→192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048
RIGHT-tunnel-1 up 36m33s 588B/588B 7/7 192.0.2.130 ␣
˓→192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048
RIGHT-tunnel-2 up 35m50s 1K/1K 15/15 192.0.2.130 ␣
˓→192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048
RIGHT-tunnel-3 up 36m54s 2K/2K 32/32 192.0.2.130 ␣
˓→192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048
vyos@LEFT:~$

Also, we can check firewall counters:

vyos@LEFT:~$ show firewall

Rulesets Information

---------------------------------
IPv4 Firewall "forward filter"

Rule Action Protocol Packets Bytes Conditions

------- -------- ---------- --------- ------- --------------------------------------
˓→----------------

1 accept all 681 96545 ct state { established, related } ␣

˓→accept

2 drop all 0 0 ct state invalid

10 accept all 360 27205 ip saddr @N_LOCAL-NETS accept
20 accept all 8 648 ip daddr @N_LOCAL-NETS ip saddr @N_
(continues on next page)

12.16. Policy-Based Site-to-Site VPN and Firewall Configuration 1233

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

˓→REMOTE-NETS accept
default drop all

---------------------------------
IPv4 Firewall "input filter"

Rule Action Protocol Packets Bytes Conditions

------- -------- ---------- --------- ------- --------------------------------------
˓→--------

1 accept all 901 123709 ct state { established, related } ␣

˓→accept

2 drop all 0 0 ct state invalid

10 accept udp 0 0 udp dport { 500, 4500 } iifname "eth0
˓→" accept
15 accept esp 0 0 meta l4proto esp iifname "eth0" ␣
˓→accept

20 accept tcp 1 60 tcp dport 22 ip saddr @N_TRUSTED ␣

˓→accept

25 accept udp 0 0 udp dport 53 ip saddr @N_LOCAL-NETS ␣

˓→accept

30 accept icmp 0 0 meta l4proto icmp accept

default drop all

vyos@LEFT:~$
vyos@LEFT:~$ show firewall statistics
Rulesets Statistics

---------------------------------
IPv4 Firewall "forward filter"

Rule Packets Bytes Action Source Destination Inbound-Interface ␣

˓→Outbound-interface

------- --------- ------- -------- ----------- ------------- ------------------- -

˓→-------------------

1 681 96545 accept any any any ␣

˓→any

2 0 0 drop any any any ␣

˓→any

10 360 27205 accept LOCAL-NETS any any ␣

˓→any

20 8 648 accept REMOTE-NETS LOCAL-NETS any ␣

˓→any

default N/A N/A drop any any any ␣

˓→any

---------------------------------
IPv4 Firewall "input filter"

Rule Packets Bytes Action Source Destination Inbound-Interface ␣

˓→Outbound-interface

------- --------- ------- -------- ---------- ------------- ------------------- --

˓→------------------

(continues on next page)

12.16. Policy-Based Site-to-Site VPN and Firewall Configuration 1234

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

1 905 124213 accept any any any ␣
˓→ any
2 0 0 drop any any any ␣
˓→ any
10 0 0 accept any any eth0 ␣
˓→ any
15 0 0 accept any any eth0 ␣
˓→ any
20 1 60 accept TRUSTED any any ␣
˓→ any
25 0 0 accept LOCAL-NETS any any ␣
˓→ any
30 0 0 accept any any any ␣
˓→ any
default N/A N/A drop any any any ␣
˓→any

vyos@LEFT:~$

12.17 Site-to-Site IPSec VPN to Cisco using FlexVPN

This guide shows a sample configuration for FlexVPN site-to-site Internet Protocol Security (IPsec)/Generic Routing
Encapsulation (GRE) tunnel.
FlexVPN is a newer “solution” for deployment of VPNs and it utilizes IKEv2 as the key exchange protocol. The result
is a flexible and scalable VPN solution that can be easily adapted to fit various network needs. It can also support a
variety of encryption methods, including AES and 3DES.
The lab was built using EVE-NG.

12.17.1 Configuration

VyOS

• GRE:

set interfaces tunnel tun1 encapsulation 'gre'

set interfaces tunnel tun1 ip adjust-mss '1336'
set interfaces tunnel tun1 mtu '1376'
set interfaces tunnel tun1 remote '10.1.1.6'
set interfaces tunnel tun1 source-address '88.2.2.1'

• IPsec:

set vpn ipsec authentication psk vyos_cisco_l id 'vyos.net’

set vpn ipsec authentication psk vyos_cisco_l id 'cisco.hub.net'
set vpn ipsec authentication psk vyos_cisco_l secret 'secret'
set vpn ipsec esp-group e1 lifetime '3600'
set vpn ipsec esp-group e1 mode 'tunnel'
set vpn ipsec esp-group e1 pfs 'disable'
(continues on next page)

12.17. Site-to-Site IPSec VPN to Cisco using FlexVPN 1235

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set vpn ipsec esp-group e1 proposal 1 encryption 'aes128'
set vpn ipsec esp-group e1 proposal 1 hash 'sha256'
set vpn ipsec ike-group i1 key-exchange 'ikev2'
set vpn ipsec ike-group i1 lifetime '28800'
set vpn ipsec ike-group i1 proposal 1 dh-group '5'
set vpn ipsec ike-group i1 proposal 1 encryption 'aes256'
set vpn ipsec ike-group i1 proposal 1 hash 'sha256'
set vpn ipsec interface 'eth2'
set vpn ipsec options disable-route-autoinstall
set vpn ipsec options flexvpn
set vpn ipsec options interface 'tun1'
set vpn ipsec options virtual-ip
set vpn ipsec site-to-site peer cisco_hub authentication local-id 'vyos.net'
set vpn ipsec site-to-site peer cisco_hub authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer cisco_hub authentication remote-id 'cisco.hub.net'
set vpn ipsec site-to-site peer cisco_hub connection-type 'initiate'
set vpn ipsec site-to-site peer cisco_hub default-esp-group 'e1'
set vpn ipsec site-to-site peer cisco_hub ike-group 'i1'
set vpn ipsec site-to-site peer cisco_hub local-address '88.2.2.1'
set vpn ipsec site-to-site peer cisco_hub remote-address '10.1.1.6'
set vpn ipsec site-to-site peer cisco_hub tunnel 1 local prefix '88.2.2.1/32'
set vpn ipsec site-to-site peer cisco_hub tunnel 1 protocol 'gre'
set vpn ipsec site-to-site peer cisco_hub tunnel 1 remote prefix '10.1.1.6/32'
set vpn ipsec site-to-site peer cisco_hub virtual-address '0.0.0.0'

Cisco

aaa new-model
!
!
aaa authorization network default local
!
crypto ikev2 name-mangler GET_DOMAIN
fqdn all
email all
!
!
crypto ikev2 authorization policy vyos
pool mypool
aaa attribute list mylist
route set interface
route accept any tag 100 distance 5
!
crypto ikev2 keyring mykeys
peer peer1
identity fqdn vyos.net
pre-shared-key local secret
pre-shared-key remote secret
crypto ikev2 profile my_profile
match identity remote fqdn vyos.net
(continues on next page)

12.17. Site-to-Site IPSec VPN to Cisco using FlexVPN 1236

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

identity local fqdn cisco.hub.net
authentication remote pre-share
authentication local pre-share
keyring local mykeys
dpd 10 3 periodic
aaa authorization group psk list local name-mangler GET_DOMAIN
aaa authorization user psk cached
virtual-template 1
!
!
!
crypto ipsec transform-set TSET esp-aes esp-sha256-hmac
mode tunnel
!
!
crypto ipsec profile my-ipsec-profile
set transform-set TSET
set ikev2-profile my_profile
!
interface Virtual-Template1 type tunnel
no ip address
ip mtu 1376
ip nhrp network-id 1
ip nhrp shortcut virtual-template 1
ip tcp adjust-mss 1336
tunnel path-mtu-discovery
tunnel protection ipsec profile my-ipsec-profile
!
ip local pool my_pool 172.16.122.1 172.16.122.254

Since the tunnel is a point-to-point GRE tunnel, it behaves like any other point-to-point interface (for example: serial,
dialer), and it is possible to run any Interior Gateway Protocol (IGP)/Exterior Gateway Protocol (EGP) over the link in
order to exchange routing information

12.17.2 Verification

vyos@vyos$ show interfaces

Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
eth0 - u/u
eth1 - u/u
eth2 88.2.2.1/24 u/u
eth3 172.16.1.2/24 u/u
lo 127.0.0.1/8 u/u
::1/128
tun1 172.16.122.2/32 u/u

vyos@vyos:~$ show vpn ipsec sa

Connection State Uptime Bytes In/Out Packets In/Out Remote address ␣
˓→ Remote ID Proposal
(continues on next page)

12.17. Site-to-Site IPSec VPN to Cisco using FlexVPN 1237

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

------------------ ------- -------- -------------- ---------------- ----------------
˓→ --------------------- -----------------------------
cisco_hub-tunnel-1 up 44m17s 35K/31K 382/367 10.1.1.6 ␣
˓→ cisco.hub.net AES_CBC_128/HMAC_SHA2_256_128

Hub#sh crypto ikev2 sa detailed

IPv4 Crypto IKEv2 SA

Tunnel-id Local Remote fvrf/ivrf Status

5 10.1.1.6/4500 88.2.2.1/4500 none/none READY
Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:5, Auth sign: PSK,␣
˓→Auth verify: PSK

Life/Active Time: 86400/2694 sec

CE id: 0, Session-id: 2
Status Description: Negotiation done
Local spi: C94EE2DC92A60C47 Remote spi: 9AF0EF151BECF14C
Local id: cisco.hub.net
Remote id: vyos.net
Local req msg id: 269 Remote req msg id: 0
Local next msg id: 269 Remote next msg id: 0
Local req queued: 269 Remote req queued: 0
Local window: 5 Remote window: 1
DPD configured for 10 seconds, retry 3
Fragmentation not configured.
Extended Authentication not configured.
NAT-T is not detected
Cisco Trust Security SGT is disabled
Assigned host addr: 172.16.122.2

12.17. Site-to-Site IPSec VPN to Cisco using FlexVPN 1238

 CHAPTER

THIRTEEN

CONFIGURATION BLUEPRINTS (AUTOTEST)

The next pages contains automatic full tested configuration examples.

Each lab will build an test from an external script. The page content will generate, so changes will not take an effect.
A host vyos-oobm will use as a ssh proxy. This host is just necessary for the Lab test.
The process will do the following steps:
1. create the lab on a eve-ng server
2. configure each host in the lab
3. do some defined tests
4. optional do an upgrade to a higher version and do step 3 again.
5. generate the documentation and include files
6. shutdown and destroy the lab, if there is no error

13.1 DHCP Relay trough GRE-Bridge

Testdate: 2023-05-11
Version: 1.4-rolling-202305100734

This simple structure shows how to configure a DHCP Relay over a GRE Bridge interface.

13.1.1 Topology

The topology has 3 VyOS routers and one client. Between the DHCP Server and the DHCP Relay is a GRE tunnel.
The transport VyOS represent a large Network.

1239
 VyOS Documentation, Release 1.5.x (circinus)

13.1.2 Configuration

First, we configure the transport network and the Tunnel interface.

Transport:

set interfaces ethernet eth1 address '10.0.10.254/24'

set interfaces ethernet eth2 address '10.0.20.254/24'

DHCP-Server

set interfaces ethernet eth1 address '10.0.20.10/24'

set interfaces tunnel tun100 address '172.16.0.1/30'
set interfaces tunnel tun100 encapsulation 'gretap'
set interfaces tunnel tun100 remote '10.0.10.10'
set interfaces tunnel tun100 source-address '10.0.20.10'
set protocols static route 0.0.0.0/0 next-hop 172.16.0.2
set protocols static route 10.0.10.0/24 next-hop 10.0.20.254
set protocols static route 192.168.0.0/24 next-hop 127.16.0.2

DHCP-Relay

set interfaces ethernet eth1 address '10.0.10.10/24'

set interfaces ethernet eth2 address '192.168.0.254/24'
set interfaces tunnel tun100 address '172.16.0.2/30'
set interfaces tunnel tun100 encapsulation 'gretap'
set interfaces tunnel tun100 remote '10.0.20.10'
set interfaces tunnel tun100 source-address '10.0.10.10'
set protocols static route 0.0.0.0/0 next-hop 172.16.0.1
set protocols static route 10.0.20.0/24 next-hop 10.0.10.254

After this, we need the DHCP-Server and Relay configuration. To get a testable result, we just have one IP in the DHCP
range. Expand it as you need it.

13.1. DHCP Relay trough GRE-Bridge 1240

 VyOS Documentation, Release 1.5.x (circinus)

DHCP-Server

set service dhcp-server listen-address '172.16.0.1'

set service dhcp-server shared-network-name DHCPTun100 authoritative
set service dhcp-server shared-network-name DHCPTun100 subnet 192.168.0.0/24 option␣
˓→default-router '192.168.0.254'

set service dhcp-server shared-network-name DHCPTun100 subnet 192.168.0.0/24 range 0␣

˓→start '192.168.0.30'

set service dhcp-server shared-network-name DHCPTun100 subnet 192.168.0.0/24 range 0␣

˓→stop '192.168.0.30'

DHCP-Relay

set service dhcp-relay interface 'eth2'

set service dhcp-relay interface 'tun100'

13.1.3 Test the result

Ping the Client from the DHCP Server.

vyos@dhcp-server:~$ ping 192.168.0.30 count 4

PING 192.168.0.30 (192.168.0.30) 56(84) bytes of data.
64 bytes from 192.168.0.30: icmp_seq=1 ttl=63 time=1.02 ms
64 bytes from 192.168.0.30: icmp_seq=2 ttl=63 time=1.06 ms
64 bytes from 192.168.0.30: icmp_seq=3 ttl=63 time=1.21 ms
64 bytes from 192.168.0.30: icmp_seq=4 ttl=63 time=1.16 ms

--- 192.168.0.30 ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 1.016/1.112/1.214/0.077 ms

And show all DHCP Leases

vyos@dhcp-server:~$ show dhcp server leases

IP Address MAC address State Lease start Lease expiration ␣
˓→Remaining Pool Hostname
------------ ----------------- ------- ------------------- ------------------- -----
˓→------ ---------- ----------
192.168.0.30 00:50:79:66:68:05 active 2023/05/11 13:08:50 2023/05/12 13:08:50 ␣
˓→23:59:16 DHCPTun100 VPCS

13.2 Tunnelbroker.net (IPv6)

Testdate: 2024-01-13
Version: 1.5-rolling-202401121239

This guide walks through the setup of https://www.tunnelbroker.net/ for an IPv6 Tunnel.

13.2. Tunnelbroker.net (IPv6) 1241

 VyOS Documentation, Release 1.5.x (circinus)

13.2.1 Prerequisites

• A public, routable IPv4 address. This does not necessarily need to be static, but you will need to update the
tunnel endpoint when/if your IP address changes, which can be done with a script and a scheduled task.
• Account at https://www.tunnelbroker.net/
• Requested a “Regular Tunnel”. You want to choose a location that is closest to your physical location for the best
response time.

Topology

The example topology has 2 VyOS routers. One as The WAN Router and on as a Client, to test a single LAN setup

Configuration

First, we configure the vyos-wan interface to get a DHCP address.

set interfaces ethernet eth1 address dhcp

Now we are able to setup the tunnel interface.

set interfaces tunnel tun0 address '2001:470:6c:779::2/64' #Tunnelbroker Client IPv6␣

˓→address

set interfaces tunnel tun0 description 'HE.NET IPv6 Tunnel'

set interfaces tunnel tun0 encapsulation 'sit'
set interfaces tunnel tun0 remote '216.66.86.114' #Tunnelbroker Server IPv4 address
set interfaces tunnel tun0 source-address '172.29.129.60' # Tunnelbroker Client IPv4␣
˓→address. See note below

Note: The source-address is the Tunnelbroker client IPv4 address or if there is NAT the current WAN interface
address.
If source-address is dynamic, the tunnel will cease working once the address changes. To avoid having to manually
update source-address each time the dynamic IP changes, an address of ‘0.0.0.0’ can be specified.

13.2. Tunnelbroker.net (IPv6) 1242

 VyOS Documentation, Release 1.5.x (circinus)

Setup the IPv6 default route to the tunnel interface

set protocols static route6 ::/0 interface tun0

Now you should be able to ping a public IPv6 Address

vyos@vyos-wan:~$ ping 2001:470:20::2 count 4

PING 2001:470:20::2(2001:470:20::2) 56 data bytes
64 bytes from 2001:470:20::2: icmp_seq=1 ttl=64 time=33.8 ms
64 bytes from 2001:470:20::2: icmp_seq=2 ttl=64 time=43.9 ms
64 bytes from 2001:470:20::2: icmp_seq=3 ttl=64 time=43.4 ms
64 bytes from 2001:470:20::2: icmp_seq=4 ttl=64 time=42.5 ms

--- 2001:470:20::2 ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 2999ms
rtt min/avg/max/mdev = 33.802/40.920/43.924/4.139 ms

Assuming the pings are successful, you need to add some DNS servers. Some options:

set system name-server 2001:470:20::2 #Tunnelbroker DNS Server

You should now be able to ping something by IPv6 DNS name:

vyos@vyos-wan:~$ ping tunnelbroker.net count 4

PING tunnelbroker.net(tunnelbroker.net (2001:470:0:63::2)) 56 data bytes
64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=1 ttl=48 time=285 ms
64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=2 ttl=48 time=186 ms
64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=3 ttl=48 time=178 ms
64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=4 ttl=48 time=177 ms

--- tunnelbroker.net ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 3002ms
rtt min/avg/max/mdev = 176.707/206.638/285.128/45.457 ms

LAN Configuration

At this point, your VyOS install should have full IPv6, but now your LAN devices need access.
With Tunnelbroker.net, you have two options:
• Routed /64. This is the default assignment. In IPv6-land, it’s good for a single “LAN”, and is somewhat equiva-
lent to a /24.
• Routed /48. This is something you can request by clicking the “Assign /48” link in the Tunnelbroker.net tunnel
config. It allows you to have up to 65k
Unlike IPv4, IPv6 is really not designed to be broken up smaller than /64. So if you ever want to have multiple LANs,
VLANs, DMZ, etc, you’ll want to ignore the assigned /64, and request the /48 and use that.

13.2. Tunnelbroker.net (IPv6) 1243

 VyOS Documentation, Release 1.5.x (circinus)

13.2.2 Single LAN Setup

Single LAN setup where eth2 is your LAN interface. Use the Tunnelbroker Routed /64 prefix:

set interface ethernet eth2 address '2001:470:6d:778::1/64' # Tunnelbroker Routed /64␣

˓→prefix

set service router-advert interface eth2 name-server '2001:470:20::2'

set service router-advert interface eth2 prefix 2001:470:6d:778::/64 # Tunnelbroker␣
˓→Routed /64 prefix

Please note, ‘autonomous-flag’ and ‘on-link-flag’ are enabled by default, ‘valid-lifetime’ and ‘preferred-lifetime’ are
set to default values of 30 days and 4 hours respectively.
And the client to receive an IPv6 address with stateless autoconfig.

set interfaces ethernet eth1 ipv6 address autoconf

This accomplishes a few things:

• Sets your LAN interface’s IP address
• Enables router advertisements. This is an IPv6 alternative for DHCP (though DHCPv6 can still be used). With
RAs, Your devices will automatically find the information they need for routing and DNS.
Now the Client is able to ping a public IPv6 address

vyos@client:~$ ping 2001:470:20::2 count 4

PING 2001:470:20::2(2001:470:20::2) 56 data bytes
64 bytes from 2001:470:20::2: icmp_seq=1 ttl=63 time=32.1 ms
64 bytes from 2001:470:20::2: icmp_seq=2 ttl=63 time=41.8 ms
64 bytes from 2001:470:20::2: icmp_seq=3 ttl=63 time=41.7 ms
64 bytes from 2001:470:20::2: icmp_seq=4 ttl=63 time=47.1 ms

--- 2001:470:20::2 ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 32.128/40.688/47.107/5.403 ms

13.2.3 Multiple LAN/DMZ Setup

That’s how you can expand the example above. Use the Routed /48 information. This allows you to assign a different
/64 to every interface, LAN, or even device. Or you could break your network into smaller chunks like /56 or /60.
The format of these addresses:
• 2001:470:xxxx::/48: The whole subnet. xxxx should come from Tunnelbroker.
• 2001:470:xxxx:1::/64: A subnet suitable for a LAN
• 2001:470:xxxx:2::/64: Another subnet
• 2001:470:xxxx:ffff:/64: The last usable /64 subnet.
In the above examples, 1,2,ffff are all chosen by you. You can use 1-ffff (1-65535).
So, when your LAN is eth1, your DMZ is eth2, your cameras are on eth3, etc:

13.2. Tunnelbroker.net (IPv6) 1244

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces ethernet eth1 address '2001:470:xxxx:1::1/64'

set service router-advert interface eth1 name-server '2001:470:20::2'
set service router-advert interface eth1 prefix 2001:470:xxxx:1::/64

set interfaces ethernet eth2 address '2001:470:xxxx:2::1/64'

set service router-advert interface eth2 name-server '2001:470:20::2'
set service router-advert interface eth2 prefix 2001:470:xxxx:2::/64

set interfaces ethernet eth3 address '2001:470:xxxx:3::1/64'

set service router-advert interface eth3 name-server '2001:470:20::2'
set service router-advert interface eth3 prefix 2001:470:xxxx:3::/64

Please note, ‘autonomous-flag’ and ‘on-link-flag’ are enabled by default, ‘valid-lifetime’ and ‘preferred-lifetime’ are
set to default values of 30 days and 4 hours respectively.

13.2.4 Firewall

Finally, don’t forget the firewall. The usage is identical, except for instead of set firewall name NAME, you would use
set firewall ipv6-name NAME.
Similarly, to attach the firewall, you would use set interfaces ethernet eth0 firewall in ipv6-name or set firewall zone
LOCAL from WAN firewall ipv6-name.

13.3 L3VPN EVPN with VyOS

Testdate: 2023-05-11
Version: 1.4-rolling-202305100734

I spun up a new lab in EVE-NG, which represents this as the “Foo Bar - Service Provider Inc.” that has 3 points of
presence (PoP) in random datacenters/sites named PE1, PE2, and PE3. Each PoP aggregates at least two customers.
I named the customers blue, red and green which is common practice in VRF (Virtual Routing and Forwarding) docu-
mentation scenarios.
• PE1 is located in an industrial area that holds multiple office buildings. All customers have a site in this area.
• PE2 is located in a smaller area where by coincidence two customers (blue and red) share an office building.
• PE3 is located in a smaller area where by coincidence two customers (blue and green) are located.

13.3.1 Management VRF

A brief excursion into VRFs: This has been one of the longest-standing feature requests of VyOS (dating back to 2016)
which can be described as “a VLAN for layer 2 is what a VRF is for layer 3”. With VRFs, a router/system can hold
multiple, isolated routing tables on the same system. If you wonder what’s the difference between multiple tables that
people used for policy-based routing since forever, it’s that a VRF also isolates connected routes rather than just static
and dynamically learned routes, so it allows NICs in different VRFs to use conflicting network ranges without issues.
VyOS 1.3 added initial support for VRFs (including IPv4/IPv6 static routing) and VyOS 1.4 now enables full dynamic
routing protocol support for OSPF, IS-IS, and BGP for individual VRFs.
The lab I built is using a VRF (called mgmt) to provide out-of-band SSH access to the PE (Provider Edge) routers.

13.3. L3VPN EVPN with VyOS 1245

 VyOS Documentation, Release 1.5.x (circinus)

set system host-name PE1

set interfaces ethernet eth0 address 'dhcp'
set interfaces ethernet eth0 description 'out-of-band management'
set interfaces ethernet eth0 vrf 'mgmt'
set service ssh vrf 'mgmt'
set vrf name mgmt table '1000'

13.3.2 Topology

We use the following network topology in this example:

13.3.3 Core network

I chose to run OSPF as the IGP (Interior Gateway Protocol). All required BGP sessions are established via a dummy
interfaces (similar to the loopback, but in Linux you can have only one loopback, while there can be many dummy
interfaces) on the PE routers. In case of a link failure, traffic is diverted in the other direction in this triangle setup and
BGP sessions will not go down. One could even enable BFD (Bidirectional Forwarding Detection) on the links for a
faster failover and resilience in the network.
Regular VyOS users will notice that the BGP syntax has changed in VyOS 1.4 from even the prior post about this
subject. This is due to T1711, where it was finally decided to get rid of the redundant BGP ASN (Autonomous System
Number) specification on the CLI and move it to a single leaf node (set protocols bgp local-as).
It’s important to note that all your existing configurations will be migrated automatically on image upgrade. Nothing
to do on your side.
PE1

13.3. L3VPN EVPN with VyOS 1246

 VyOS Documentation, Release 1.5.x (circinus)

set interfaces dummy dum0 address '172.29.255.1/32'

set interfaces ethernet eth1 address '172.29.0.2/31'

set interfaces ethernet eth1 description 'link to pe2'
set interfaces ethernet eth1 mtu '1600'
set interfaces ethernet eth3 address '172.29.0.6/31'
set interfaces ethernet eth3 description 'link to pe3'
set interfaces ethernet eth3 mtu '1600'

set protocols ospf area 0 network '172.29.0.2/31'

set protocols ospf area 0 network '172.29.0.6/31'
set protocols ospf interface eth1 network 'point-to-point'
set protocols ospf interface eth3 network 'point-to-point'
set protocols ospf interface eth1 passive disable
set protocols ospf interface eth3 passive disable
set protocols ospf log-adjacency-changes detail
set protocols ospf parameters abr-type 'cisco'
set protocols ospf parameters router-id '172.29.255.1'
set protocols ospf passive-interface 'default'
set protocols ospf redistribute connected

set protocols bgp address-family l2vpn-evpn advertise ipv4 unicast

set protocols bgp address-family l2vpn-evpn advertise-all-vni
set protocols bgp system-as '100'
set protocols bgp neighbor 172.29.255.2 peer-group 'ibgp'
set protocols bgp neighbor 172.29.255.3 peer-group 'ibgp'
set protocols bgp parameters log-neighbor-changes
set protocols bgp parameters router-id '172.29.255.1'
set protocols bgp peer-group ibgp address-family l2vpn-evpn
set protocols bgp peer-group ibgp remote-as '100'
set protocols bgp peer-group ibgp update-source 'dum0'

PE2
set interfaces dummy dum0 address '172.29.255.2/32'

set interfaces ethernet eth1 address '172.29.0.3/31'

set interfaces ethernet eth1 description 'link to pe1'
set interfaces ethernet eth1 mtu '1600'
set interfaces ethernet eth2 address '172.29.0.4/31'
set interfaces ethernet eth2 description 'link to pe3'
set interfaces ethernet eth2 mtu '1600'

set protocols ospf area 0 network '172.29.0.2/31'

set protocols ospf area 0 network '172.29.0.4/31'
set protocols ospf interface eth1 network 'point-to-point'
set protocols ospf interface eth2 network 'point-to-point'
set protocols ospf interface eth1 passive disable
set protocols ospf interface eth2 passive disable
set protocols ospf log-adjacency-changes detail
set protocols ospf parameters abr-type 'cisco'
set protocols ospf parameters router-id '172.29.255.2'
set protocols ospf passive-interface 'default'
(continues on next page)

13.3. L3VPN EVPN with VyOS 1247

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set protocols ospf redistribute connected

set protocols bgp address-family l2vpn-evpn advertise ipv4 unicast

set protocols bgp address-family l2vpn-evpn advertise-all-vni
set protocols bgp system-as '100'
set protocols bgp neighbor 172.29.255.1 peer-group 'ibgp'
set protocols bgp neighbor 172.29.255.3 peer-group 'ibgp'
set protocols bgp parameters log-neighbor-changes
set protocols bgp parameters router-id '172.29.255.2'
set protocols bgp peer-group ibgp address-family l2vpn-evpn
set protocols bgp peer-group ibgp remote-as '100'
set protocols bgp peer-group ibgp update-source 'dum0'

PE3

set interfaces dummy dum0 address '172.29.255.3/32'

set interfaces ethernet eth2 address '172.29.0.5/31'

set interfaces ethernet eth2 description 'link to pe2'
set interfaces ethernet eth2 mtu '1600'
set interfaces ethernet eth3 address '172.29.0.7/31'
set interfaces ethernet eth3 description 'link to pe1'
set interfaces ethernet eth3 mtu '1600'

set protocols ospf area 0 network '172.29.0.4/31'

set protocols ospf area 0 network '172.29.0.6/31'
set protocols ospf interface eth2 network 'point-to-point'
set protocols ospf interface eth3 network 'point-to-point'
set protocols ospf interface eth2 passive disable
set protocols ospf interface eth3 passive disable
set protocols ospf log-adjacency-changes detail
set protocols ospf parameters abr-type 'cisco'
set protocols ospf parameters router-id '172.29.255.3'
set protocols ospf passive-interface 'default'
set protocols ospf redistribute connected

set protocols bgp address-family l2vpn-evpn advertise ipv4 unicast

set protocols bgp address-family l2vpn-evpn advertise-all-vni
set protocols bgp system-as '100'
set protocols bgp neighbor 172.29.255.1 peer-group 'ibgp'
set protocols bgp neighbor 172.29.255.2 peer-group 'ibgp'
set protocols bgp parameters log-neighbor-changes
set protocols bgp parameters router-id '172.29.255.3'
set protocols bgp peer-group ibgp address-family l2vpn-evpn
set protocols bgp peer-group ibgp remote-as '100'
set protocols bgp peer-group ibgp update-source 'dum0'

13.3. L3VPN EVPN with VyOS 1248

 VyOS Documentation, Release 1.5.x (circinus)

13.3.4 Tenant networks (VRFs)

Once all routers can be safely remotely managed and the core network is operational, we can now setup the tenant
networks.
Every tenant is assigned an individual VRF that would support overlapping address ranges for customers blue, red and
green. In our example, we do not use overlapping ranges to make it easier when showing debug commands.
Thus you can easily match it to one of the devices/networks below.
Every router that provides access to a customer network needs to have the customer network (VRF + VNI) configured.
To make our own lives easier, we utilize the same VRF table id (local routing table number) and VNI (Virtual Network
Identifier) per tenant on all our routers.
• blue uses local routing table id and VNI 2000
• red uses local routing table id and VNI 3000
• green uses local routing table id and VNI 4000
PE1

set interfaces vxlan vxlan2000 mtu '1500'

set interfaces vxlan vxlan2000 parameters nolearning
set interfaces vxlan vxlan2000 port '4789'
set interfaces vxlan vxlan2000 source-address '172.29.255.1'
set interfaces vxlan vxlan2000 vni '2000'

set vrf name blue protocols bgp address-family ipv4-unicast redistribute connected
set vrf name blue protocols bgp address-family l2vpn-evpn advertise ipv4 unicast
set vrf name blue protocols bgp system-as '100'
set vrf name blue table '2000'
set vrf name blue vni '2000'

set interfaces vxlan vxlan3000 mtu '1500'

set interfaces vxlan vxlan3000 parameters nolearning
set interfaces vxlan vxlan3000 port '4789'
set interfaces vxlan vxlan3000 source-address '172.29.255.1'
set interfaces vxlan vxlan3000 vni '3000'

set vrf name red protocols bgp address-family ipv4-unicast redistribute connected
set vrf name red protocols bgp address-family l2vpn-evpn advertise ipv4 unicast
set vrf name red protocols bgp system-as '100'
set vrf name red table '3000'
set vrf name red vni '3000'

set interfaces vxlan vxlan4000 mtu '1500'

set interfaces vxlan vxlan4000 parameters nolearning
set interfaces vxlan vxlan4000 port '4789'
set interfaces vxlan vxlan4000 source-address '172.29.255.1'
set interfaces vxlan vxlan4000 vni '4000'

set vrf name green protocols bgp address-family ipv4-unicast redistribute connected
set vrf name green protocols bgp address-family l2vpn-evpn advertise ipv4 unicast
set vrf name green protocols bgp system-as '100'
set vrf name green table '4000'
set vrf name green vni '4000'
(continues on next page)

13.3. L3VPN EVPN with VyOS 1249

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set interfaces bridge br2000 address '10.1.1.1/24'

set interfaces bridge br2000 description 'customer blue'
set interfaces bridge br2000 member interface eth4
set interfaces bridge br2000 member interface vxlan2000
set interfaces bridge br2000 vrf 'blue'

set interfaces bridge br3000 address '10.2.1.1/24'

set interfaces bridge br3000 description 'customer red'
set interfaces bridge br3000 member interface eth5
set interfaces bridge br3000 member interface vxlan3000
set interfaces bridge br3000 vrf 'red'

set interfaces bridge br4000 address '10.3.1.1/24'

set interfaces bridge br4000 description 'customer green'
set interfaces bridge br4000 member interface eth6
set interfaces bridge br4000 member interface vxlan4000
set interfaces bridge br4000 vrf 'green'

set interfaces ethernet eth4 description 'customer blue'

set interfaces ethernet eth5 description 'customer red'
set interfaces ethernet eth6 description 'customer green'

PE2

set interfaces vxlan vxlan2000 mtu '1500'

set interfaces vxlan vxlan2000 parameters nolearning
set interfaces vxlan vxlan2000 port '4789'
set interfaces vxlan vxlan2000 source-address '172.29.255.2'
set interfaces vxlan vxlan2000 vni '2000'

set vrf name blue protocols bgp address-family ipv4-unicast redistribute connected
set vrf name blue protocols bgp address-family l2vpn-evpn advertise ipv4 unicast
set vrf name blue protocols bgp system-as '100'
set vrf name blue table '2000'
set vrf name blue vni '2000'

set interfaces vxlan vxlan3000 mtu '1500'

set interfaces vxlan vxlan3000 parameters nolearning
set interfaces vxlan vxlan3000 port '4789'
set interfaces vxlan vxlan3000 source-address '172.29.255.2'
set interfaces vxlan vxlan3000 vni '3000'

set vrf name red protocols bgp address-family ipv4-unicast redistribute connected
set vrf name red protocols bgp address-family l2vpn-evpn advertise ipv4 unicast
set vrf name red protocols bgp system-as '100'
set vrf name red table '3000'
set vrf name red vni '3000'

set interfaces vxlan vxlan4000 mtu '1500'

set interfaces vxlan vxlan4000 parameters nolearning
set interfaces vxlan vxlan4000 port '4789'
(continues on next page)

13.3. L3VPN EVPN with VyOS 1250

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set interfaces vxlan vxlan4000 source-address '172.29.255.2'
set interfaces vxlan vxlan4000 vni '4000'

set vrf name green protocols bgp address-family ipv4-unicast redistribute connected
set vrf name green protocols bgp address-family l2vpn-evpn advertise ipv4 unicast
set vrf name green protocols bgp system-as '100'
set vrf name green table '4000'
set vrf name green vni '4000'

set interfaces bridge br2000 address '10.1.2.1/24'

set interfaces bridge br2000 description 'customer blue'
set interfaces bridge br2000 member interface eth4
set interfaces bridge br2000 member interface vxlan2000
set interfaces bridge br2000 vrf 'blue'

set interfaces bridge br3000 address '10.2.2.1/24'

set interfaces bridge br3000 description 'customer red'
set interfaces bridge br3000 member interface eth5
set interfaces bridge br3000 member interface vxlan3000
set interfaces bridge br3000 vrf 'red'

set interfaces ethernet eth4 description 'customer blue'

set interfaces ethernet eth5 description 'customer red'

PE3

set interfaces vxlan vxlan2000 mtu '1500'

set interfaces vxlan vxlan2000 parameters nolearning
set interfaces vxlan vxlan2000 port '4789'
set interfaces vxlan vxlan2000 source-address '172.29.255.3'
set interfaces vxlan vxlan2000 vni '2000'

set vrf name blue protocols bgp address-family ipv4-unicast redistribute connected
set vrf name blue protocols bgp address-family l2vpn-evpn advertise ipv4 unicast
set vrf name blue protocols bgp system-as '100'
set vrf name blue table '2000'
set vrf name blue vni '2000'

set interfaces vxlan vxlan3000 mtu '1500'

set interfaces vxlan vxlan3000 parameters nolearning
set interfaces vxlan vxlan3000 port '4789'
set interfaces vxlan vxlan3000 source-address '172.29.255.3'
set interfaces vxlan vxlan3000 vni '3000'

set vrf name red protocols bgp address-family ipv4-unicast redistribute connected
set vrf name red protocols bgp address-family l2vpn-evpn advertise ipv4 unicast
set vrf name red protocols bgp system-as '100'
set vrf name red table '3000'
set vrf name red vni '3000'

set interfaces vxlan vxlan4000 mtu '1500'

set interfaces vxlan vxlan4000 parameters nolearning
(continues on next page)

13.3. L3VPN EVPN with VyOS 1251

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set interfaces vxlan vxlan4000 port '4789'
set interfaces vxlan vxlan4000 source-address '172.29.255.3'
set interfaces vxlan vxlan4000 vni '4000'

set vrf name green protocols bgp address-family ipv4-unicast redistribute connected
set vrf name green protocols bgp address-family l2vpn-evpn advertise ipv4 unicast
set vrf name green protocols bgp system-as '100'
set vrf name green table '4000'
set vrf name green vni '4000'

set interfaces bridge br2000 address '10.1.3.1/24'

set interfaces bridge br2000 description 'customer blue'
set interfaces bridge br2000 member interface eth4
set interfaces bridge br2000 member interface vxlan2000
set interfaces bridge br2000 vrf 'blue'

set interfaces bridge br4000 address '10.3.3.1/24'

set interfaces bridge br4000 description 'customer green'
set interfaces bridge br4000 member interface eth6
set interfaces bridge br4000 member interface vxlan4000
set interfaces bridge br4000 vrf 'green'

set interfaces ethernet eth4 description 'customer blue'

set interfaces ethernet eth6 description 'customer green'

13.3.5 Testing and debugging

You managed to come this far, now we want to see the network and routing tables in action.
Show routes for all VRFs

vyos@PE1:~$ show ip route vrf all

Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric,
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure

VRF blue:
C>* 10.1.1.0/24 is directly connected, br2000, 00:01:13
B>* 10.1.2.0/24 [200/0] via 172.29.255.2, br2000 onlink, weight 1, 00:00:49
B>* 10.1.3.0/24 [200/0] via 172.29.255.3, br2000 onlink, weight 1, 00:00:49

VRF default:
O 172.29.0.2/31 [110/1] is directly connected, eth1, weight 1, 00:01:09
C>* 172.29.0.2/31 is directly connected, eth1, 00:01:12
O>* 172.29.0.4/31 [110/2] via 172.29.0.3, eth1, weight 1, 00:00:46
* via 172.29.0.7, eth3, weight 1, 00:00:46
O 172.29.0.6/31 [110/1] is directly connected, eth3, weight 1, 00:01:09
C>* 172.29.0.6/31 is directly connected, eth3, 00:01:12
(continues on next page)

13.3. L3VPN EVPN with VyOS 1252

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

C>* 172.29.255.1/32 is directly connected, dum0, 00:01:14
O>* 172.29.255.2/32 [110/20] via 172.29.0.3, eth1, weight 1, 00:00:50
O>* 172.29.255.3/32 [110/20] via 172.29.0.7, eth3, weight 1, 00:00:45

VRF green:
C>* 10.3.1.0/24 is directly connected, br4000, 00:01:13
B>* 10.3.3.0/24 [200/0] via 172.29.255.3, br4000 onlink, weight 1, 00:00:49

VRF mgmt:
S>* 0.0.0.0/0 [210/0] via 10.100.0.1, eth0, weight 1, 00:01:45
C>* 10.100.0.0/24 is directly connected, eth0, 00:01:45

VRF red:
C>* 10.2.1.0/24 is directly connected, br3000, 00:01:13
B>* 10.2.2.0/24 [200/0] via 172.29.255.2, br3000 onlink, weight 1, 00:00:49

Information about Ethernet Virtual Private Networks

vyos@PE1:~$ show bgp l2vpn evpn

BGP table version is 1, local router ID is 172.29.255.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete
EVPN type-1 prefix: [1]:[EthTag]:[ESI]:[IPlen]:[VTEP-IP]:[Frag-id]
EVPN type-2 prefix: [2]:[EthTag]:[MAClen]:[MAC]:[IPlen]:[IP]
EVPN type-3 prefix: [3]:[EthTag]:[IPlen]:[OrigIP]
EVPN type-4 prefix: [4]:[ESI]:[IPlen]:[OrigIP]
EVPN type-5 prefix: [5]:[EthTag]:[IPlen]:[IP]

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 10.1.1.1:5
*> [5]:[0]:[24]:[10.1.1.0]
172.29.255.1 0 32768 ?
ET:8 RT:100:2000 Rmac:4e:bb:3c:ba:bd:a6
Route Distinguisher: 10.1.2.1:4
*>i[5]:[0]:[24]:[10.1.2.0]
172.29.255.2 0 100 0 ?
RT:100:2000 ET:8 Rmac:26:07:da:eb:fc:ea
Route Distinguisher: 10.1.3.1:4
*>i[5]:[0]:[24]:[10.1.3.0]
172.29.255.3 0 100 0 ?
RT:100:2000 ET:8 Rmac:26:98:28:24:6e:54
Route Distinguisher: 10.2.1.1:6
*> [5]:[0]:[24]:[10.2.1.0]
172.29.255.1 0 32768 ?
ET:8 RT:100:3000 Rmac:50:00:00:01:00:05
Route Distinguisher: 10.2.2.1:5
*>i[5]:[0]:[24]:[10.2.2.0]
172.29.255.2 0 100 0 ?
RT:100:3000 ET:8 Rmac:50:00:00:02:00:05
Route Distinguisher: 10.3.1.1:7
*> [5]:[0]:[24]:[10.3.1.0]
172.29.255.1 0 32768 ?
(continues on next page)

13.3. L3VPN EVPN with VyOS 1253

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

ET:8 RT:100:4000 Rmac:50:00:00:01:00:06
Route Distinguisher: 10.3.3.1:6
*>i[5]:[0]:[24]:[10.3.3.0]
172.29.255.3 0 100 0 ?
RT:100:4000 ET:8 Rmac:06:32:9d:22:55:8a

Displayed 7 out of 7 total prefixes

If we need to retrieve information about a specific host/network inside the EVPN network we need to run

vyos@PE2:~$ show bgp l2vpn evpn 10.3.1.10

BGP routing table entry for 10.3.1.1:7:[5]:[0]:[24]:[10.3.1.0]
Paths: (1 available, best #1)
Not advertised to any peer
Route [5]:[0]:[24]:[10.3.1.0] VNI 4000
Local
172.29.255.1 (metric 20) from 172.29.255.1 (172.29.255.1)
Origin incomplete, metric 0, localpref 100, valid, internal, best (First path␣
˓→received)

Extended Community: RT:100:4000 ET:8 Rmac:50:00:00:01:00:06

Last update: Thu May 11 13:31:13 2023

13.4 Wireguard

Testdate: 2024-01-13
Version: 1.5-rolling-202401121239

This simple structure show how to connect two offices. One remote branch and the central office.

13.4.1 Topology

The topology have a central and a branch VyOS router and one client, to test, in each site.

13.4. Wireguard 1254

 VyOS Documentation, Release 1.5.x (circinus)

13.4.2 Configuration

Set the local subnet on eth2 and the public ip address eth1 on each site.
Central

set interface ethernet eth2 address 10.0.1.254/24

set interface ethernet eth1 address 198.51.100.1/24

Branch

set interface ethernet eth2 address 10.0.2.254/24

set interface ethernet eth1 address 198.51.100.2/24

Next thing to do, is to create a wireguard keypair on each side. After this, the public key can be displayed, to save for
later.

vyos@central:~$ generate pki wireguard

Private key: wHQS+ib3eMIp2DxRiAeXfFVaSCMMP1YHBaKfSR1xfV8=
Public key: RCMy6BAER0uEcPvspUb3K38MHyHJpK5kiV5IOX943HI=

After you have each public key. The wireguard interfaces can be setup.
Central

set interfaces wireguard wg01 private-key 'wHQS+ib3eMIp2DxRiAeXfFVaSCMMP1YHBaKfSR1xfV8='

set interfaces wireguard wg01 address 192.168.0.1/24
set interfaces wireguard wg01 description 'VPN-to-Branch'
set interfaces wireguard wg01 peer branch allowed-ips 10.0.2.0/24
set interfaces wireguard wg01 peer branch allowed-ips 192.168.0.0/24
set interfaces wireguard wg01 peer branch address 198.51.100.2
set interfaces wireguard wg01 peer branch port 51820
set interfaces wireguard wg01 peer branch public-key 'nWhMTjGQbQiJwaNqHpZ/
˓→p8+iAH29HaJDNsdfsRdW9As='

set interfaces wireguard wg01 port 51820

Branch

set interfaces wireguard wg01 private-key 'QM3ZtmaxstxIDoz00AVLE/F/UVjmdcrOvfKYW/TVw18='

set interfaces wireguard wg01 address 192.168.0.2/24
set interfaces wireguard wg01 description 'VPN-to-central'
set interfaces wireguard wg01 peer central allowed-ips 10.0.1.0/24
set interfaces wireguard wg01 peer central allowed-ips 192.168.0.0/24
set interfaces wireguard wg01 peer central address 198.51.100.1
set interfaces wireguard wg01 peer central port 51820
set interfaces wireguard wg01 peer central public-key
˓→'RCMy6BAER0uEcPvspUb3K38MHyHJpK5kiV5IOX943HI='

set interfaces wireguard wg01 port 51820

To reach the network, a route must be set on each VyOS host. In this structure, a static interface route will fit the
requirements.
Central

set protocols static route 10.0.2.0/24 interface wg01

Branch

13.4. Wireguard 1255

 VyOS Documentation, Release 1.5.x (circinus)

set protocols static route 10.0.1.0/24 interface wg01

13.4.3 Testing and debugging

After all is done and commit, let’s take a look if the Wireguard interface is up and running.

vyos@central:~$ show interfaces wireguard

Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- --- -----------
wg01 192.168.0.1/24 u/u VPN-to-Branch

And ping the Branch PC from your central router to check the response.

vyos@central:~$ ping 10.0.2.100 count 4

PING 10.0.2.100 (10.0.2.100) 56(84) bytes of data.
64 bytes from 10.0.2.100: icmp_seq=1 ttl=63 time=0.894 ms
64 bytes from 10.0.2.100: icmp_seq=2 ttl=63 time=0.869 ms
64 bytes from 10.0.2.100: icmp_seq=3 ttl=63 time=0.966 ms
64 bytes from 10.0.2.100: icmp_seq=4 ttl=63 time=0.998 ms

--- 10.0.2.100 ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 0.869/0.931/0.998/0.052 ms

13.5 OpenVPN with LDAP

Testdate: 2023-05-11
Version: 1.4-rolling-202305100734

This LAB shows how to use OpenVPN with a Active Directory authentication method.
Topology consists of:
• Windows Server 2019 with a running Active Directory
• VyOS as a OpenVPN Server
• VyOS as Client

13.5. OpenVPN with LDAP 1256

 VyOS Documentation, Release 1.5.x (circinus)

13.5.1 Active Directory on Windows server

The lab assumes a full running Active Directory on the Windows Server. Here are some PowerShell commands to
quickly add a Test Active Directory.

# install the Active Directory Server role

Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

# install the Active Directory Server role

Install-ADDSForest -DomainName "vyos.local" -DomainNetBiosName "VYOS" -InstallDns:$true -
˓→NoRebootCompletion:$true

# create test user01 and binduser

New-ADUser binduser -AccountPassword(Read-Host -AsSecureString "Input Password") -
˓→Enabled $true

New-ADUser user01 -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled

˓→$true

13.5.2 Configure VyOS as OpenVPN Server

In this example OpenVPN will be setup with a client certificate and username / password authentication.
First a CA, a signed server and client ceftificate and a Diffie-Hellman parameter musst be generated and installed.
Please look here for more information.

Add the LDAP plugin configuration file /config/auth/ldap-auth.config

Check all possible settings here

<LDAP>
URL ldap://192.168.1.10
(continues on next page)

13.5. OpenVPN with LDAP 1257

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

BindDN [email protected]
Password P4ssw0rd123
Timeout 15
TLSEnable no
FollowReferrals no
</LDAP>
<Authorization>
BaseDN "DC=vyos,DC=local"
SearchFilter "sAMAccountName=%u"
RequireGroup false
</Authorization>

Now generate all required certificates on the ovpn-server:

First the CA

vyos@ovpn-server# run generate pki ca install OVPN-CA

after this create a signed server and a client certificate

vyos@ovpn-server# run generate pki certificate sign OVPN-CA install SRV

vyos@ovpn-server# run generate pki certificate sign OVPN-CA install CLIENT

and last the DH Key

vyos@ovpn-server# run generate pki dh install DH

after all these steps the config look like this:

set pki ca OVPN-CA certificate

˓→'MIIFnTCCA4WgAwIBAgIUIPFIXvCxYdavCnSPFNjr6lUtlsswDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMC

˓→az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8gatsatMkCsekGnK5BPzCDd5eCCLo//

˓→B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88zCIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SAsJTT

˓→EyauQMY/

˓→LC4tLc6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BGoewfHFhAdR61CXeLpmuneuhi96GcM031g

˓→RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo0

˓→QD+EIV9xXgOk14+BbnHKWbZ7Ou5emewFuE/

˓→bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABo2EwXzAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/

˓→wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFP5NDac/

˓→yC+mQmaTpZDUv9GZMGMBMA0GCSqGSIb3DQEBCwUAA4ICAQDEqpF2ibwYFxsF1XDIPS5/

˓→Gs0sZTZBuByNm5d2+jTyO7d5alZUdbvobbwhxZOhWasmFNyPLr4TYmZm5zF+efFsiOxjyRuEoVU+Fe8rZmpRIF/

˓→+6+nYX5r9vMI4QxGjeeyP20OHJ85Kvz182CTsITrM15Vw/kVVjAVzFI5Gm/

˓→QolalAoFQza9rAL4kDqaUszjHjPbysvDpGF+NLPjiYDHXcty/

˓→BC48bnuzAeEM60SGZ7EXvf8l0X8YsO7z39w6780A/3rbZvFhCYMKp/

˓→+p5xBRDjnX91dM6DJw73RwYQ1KHbHk9wWUwnL1giL71jzp/

˓→y4Oj6SSK2PQv+OnO80J6Zg06WIQx9xYcxr108Xh9FotUrlG7GYPI3Udf95t6SjuydDhULAVD0lMBxlDe9DHW1k1q1pOXaHZg926tY6

˓→lda6dcuwJjA2Dx5JI6L0u9ureQmQAtxvnoTCtf+hR1iX/IkskZCKs34SjNiCnBuw/

˓→DNfdOpfaABm7y+tWiXBwnu5l/

˓→K8poXcQYQByyZj6YMmpgsbVPr5KNsLWOgRA81M6IPof8qxvnFrkazhiQWh1YHSjnaHtA3z5/

˓→BdgwHVICuFyrIOlbkKyJOjKcKBsDdMwIV0tsnpnyli2xEPZKu1tAQFAavXrK/RGYYhOZ3e0aRSV8hlP8i/

˓→mf7p0I45cJiBCqPg=='

set pki ca OVPN-CA private key

˓→'MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDg45vAzS6xNqU+Pa7wk1Imt1/

(continues on next page)

13.5. OpenVPN with LDAP 1258

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

˓→ az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8gatsatMkCsekGnK5BPzCDd5eCCLo//
˓→B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88zCIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SAsJTT

˓→EyauQMY/

˓→LC4tLc6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BGoewfHFhAdR61CXeLpmuneuhi96GcM031g

˓→RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo0

˓→QD+EIV9xXgOk14+BbnHKWbZ7Ou5emewFuE/

˓→bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABAoICACVsewzYmD6RU2pKJYSPX4pl1aO6ADqNZHZi0GR4K+FyXUqDiHTw

˓→WWeUC6j5ZcH4XH+Gg0yumfCgNsnyNhDlyUNHIjPZBT4Cywvg/QTwEfK8//

˓→wEHYudT6aam0IIF1O12UW8VgmEiAwMN5Kz476lNQjbgg3efujmJaQhpnULKE2q3V51BC8qhe05JdafDOEE11vOmGj/

˓→ARYcbCQhoFJQpDzyTLB8RuEj0cTCe7oVXwwTUF1O4wcmoMCHNvsJxqKwFrER5m+giu83NcKTT13yRlg9LVg094XoGDFtRgmW1dD6ON

˓→2/mHh6kjv7pvppWdDhjkf+dWZ0frx2YyF5/dUgGG6e94hzOwRunEu4JVKl0Qr+Vfsqt/

˓→STVDA3vbhaMdMuIR2Ir0OkoYiqGBdiEGVx82lf4uDy2TXveqKUADXU5SchjP0JZpBANO4RVoxFpY2r1tEh/

˓→sRBu9wY+Fjk4FqdjjOmsbmFwhyG/j2VvKkVsq5itsxG/

˓→Rg1nTThE2LN+R6LUquujtn94rIaz6lukEr7Yq9qy14Prj5A7tYnuHbcN36b0A3xN7bxxeX6w12naVp0KZPmey6W4HNeNOOfTLh8BpG

˓→X0THkcDiozCy1IJchL4+GxxA0dp+NBispflvbFWZFAHMnbJx4cc7qMR9k8DDSHNQVgfV6nBa4xBvjBp+sanOOOLV4p+fQZW+n6VMzC

˓→s2bl6P8Mldpik2WhW0GdxHyK3sgZWXIrnkTlQg3EMPb2sPhFZm6pQKpxXwl8gGgFzEx4mEpHxHm/

˓→igZPVRTnYfGwkPmHu3caF59IWHq4jsUAxRQperRgStAoIBAQDjnJ4dZgcnI4PxiDKDKXeb5ZgjnIL0eyxMZoLtaVYnO2lLG0uMlACU

˓→vmpiYFdPo9aGaVR/fr+yPZ0h4S9wFShRBtDZapjAlds68ROQsvF/

˓→fdU4kqtfyIAst1lwtqMPeTmiZJxVubE0h2YEXOpwIEFcu3+MUvqtCd8X/

˓→T+VyF4ZQqn64NvYvkoWpfIiKmOGsCBc4agYuPs4Cy1QvN6oLXp+0b8mSzp+ot35n1lBGTSY2l4/

˓→9k6sIzWY7x23GS2g3AUJ2kYUTpQIq2pow8Sc8ptxLwZSQZwrAoIBABqhW7E3UDp8DO9XmHidVDR1dbCOdiyBvuKn8Fm2jABGCtwSN7

˓→8mRbQU31usnfAkb25ccI3SwhZ2vtVPGiJSqae1j0yZoDWg2gO2UDZ+xiqFFFQrUa2hirmBPj8y2rDT3ArN2CQfkWweSNVzcQmxXwC3

˓→ECggEBAIHl7i7k/YwOrsx3aCyGy+ZC39LjDbGtYhiwIGSRy0NUmsDscO9nv/

˓→TB23FHeufoPaSaKNJnzEvMH8TSYcskBop2NclK0ptvO8hEQ8MADu3uZHRVna1LQkkHPfUzw6+HjKuSkky1kTcsO/

˓→gSJbsPJOI0JAu9becU2NJj4/4HZpqheNUMRpUXBnRcQNI3DSm3cjSCWWyAAqO/JM5hi2dwK/

˓→P5QEMWmuVGlr1f2FZ/YbiO0QWf61IoUuiZN78KYb7KQ0U2y8PaJlBgtBoQZkDaiiWfmYNOt8d5NRVO+p8SWM/

˓→QwFPpk1Hdora9GnsHARuxxLY17eKgZ2MS6jdsGPV00EUCggEBAPuNZ3peHYhIo2EMb6wpnAFV2fAUajymwenr+Bmv5BlAnW7bE2bSN

˓→GedKiUyxP2UnaFS24mWpe44X3UlC+KJLqJG+zVGXryC7bvhS3N1KlI6H2pRY1fPAhlfUk2KAe+ZP5C7iWwtR6FlPpjB3JoS77qFVhn

˓→NA1CW3iFWIyG57oFMX1td3i3xJwhjd40M='

set pki certificate SRV certificate 'MIIFtTCCA52gAwIBAgIUeZnSAMPohIvKL/1Fy/

˓→pW2cV73HkwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0

˓→tacaRHvpchBKLigJ5FlqNNfJ2vnP87KfCmTA5tkWF7MtuY990tHZtl1vQ3Pim4d6XBOngiQmaw7tZeWAIrv1L2/

˓→VBjORUrLrQhkkg9nSpcYFxoyUQzukTY75PcwhYLkS6ZO/vPPSBuh97f3XR645Aauf7ZIk2NsUidP2uGZz/

˓→Sr5VC7ovH2l3zz1kIHPCinfvpPEVb5oTt7qEffk4vnKjy9RY+H1hZowvcAp1zfLaOt/

˓→dXaK6vfNutbmwDHbYAlIals0EcjtTr+63ymxmupn7RBjgWtK7MgocGZnt6HKJ4J6teP3WgiSd+I9pdFG4wHZOSVL3axf3rBx7q09DM

˓→Snvfbly+SlhXw9Ebk368J6j6rhNUkxo/

˓→M9fbfgxS0JnNjHInRNAvRQW5CgQfT9KyUdxR63BeSnngk2XYX+bDinb0ig+VDpZcr6PgOBR8aNFsCPbXRwDy0bmuFnFYMzs/

˓→7ZmFQhzE6rQykHvVvAsyv7FYrlW0E02H4+Xe6bEVpE1fLcH8OCGY2cfuTfq1Ax6R4r+tdHYW1kzFLjwdh3uqTLF11zcbkAwd78E/

˓→ItrfEadvgxrYR9gfhX79AkK0VHmZ/

˓→hzrLFeGznnVcqoTKgq21dfMfQG2P13QvqS7tCE5swM9N09ASVrifyVDuoL6jaW96wgeqR6eHMECAwEAAaN1MHMwDAYDVR0TAQH/

˓→BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHQYDVR0OBBYEFE1U3Zamfuv6ocYiF9q7H/

˓→/U8h+AMB8GA1UdIwQYMBaAFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0GCSqGSIb3DQEBCwUAA4ICAQBZwHvGj/

˓→jziNFwXS2W1Q11I12YANmVhISP39AA7DNhXR+E1hXFs+U52ehurZoLTi5YTjd8PD0KcE58mw8CLsFQB/

˓→+pni9EwJuAhpMb6XsmYEp0PeOH7C/q5eOc4TB/

˓→NBsvEa5IdTmUoewmjubKeJ8OHdRBMI77Me53lSC6iskc9DGyixSLqQogQW4aiTposFJOW/

˓→YugBy7kiuygmFNJv4luDbyRBb9131zH0qSSishLT4Bp5lXQNYWI4AU0JeyQcYaSHWCr0h6H9GN3QOf/emc3/

˓→2Tee40FcEMsszJBRnQ3IISzU5xVLlfU02SJMpjvFT2MGfHAs7obrNbwiFeoLZ6fQeGLe53aOQ5M9XeW5bdIeR2ZrLoO1hW33x5jYI8

˓→mjwfdrTsGChFzsLasB0Tj++mGMOXw3DSusppub17AE2bO2uO6J9XMlbkOC8EmDCF1Hetija4D3aunhtu6jRBOcR8DHVBqNae2YgUk1

˓→wzcBLjZaO8KBCtrmTdr1wMXizPT+XcjAlzRNXvHiZFq0NG5Rnim+LH9tp90EHzO7EeVXV+LegnIKQqboIrY3KOw5Qx8ska+t1WrWHp

˓→'

set pki certificate SRV private key

˓→'MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCkNbNNwHksUz+1pxpEe+lyEEouKAnkWWo018na+c/

(continues on next page)

13.5. OpenVPN with LDAP 1259

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

˓→ zsp8KZMDm2RYXsy25j33S0dm2XW9Dc+Kbh3pcE6eCJCZrDu1l5YAiu/
˓→Uvb9UGM5FSsutCGSSD2dKlxgXGjJRDO6RNjvk9zCFguRLpk7+889IG6H3t/ddHrjkBq5/tkiTY2xSJ0/

˓→a4ZnP9KvlULui8faXfPPWQgc8KKd++k8RVvmhO3uoR9+Ti+cqPL1Fj4fWFmjC9wCnXN8to6391dorq98261ubAMdtgCUhqWzQRyO1O

˓→daCJJ34j2l0UbjAdk5JUvdrF/

˓→esHHurT0Myf9Ke99uXL5KWFfD0RuTfrwnqPquE1STGj8z19t+DFLQmc2McidE0C9FBbkKBB9P0rJR3FHrcF5KeeCTZdhf5sOKdvSKD

˓→tmYVCHMTqtDKQe9W8CzK/

˓→sViuVbQTTYfj5d7psRWkTV8twfw4IZjZx+5N+rUDHpHiv610dhbWTMUuPB2He6pMsXXXNxuQDB3vwT8i2t8Rp2+DGthH2B+Ffv0CQr

˓→XdC+pLu0ITmzAz03T0BJWuJ/

˓→JUO6gvqNpb3rCB6pHp4cwQIDAQABAoICAQCgNLAZhFX0E8hNbplnBUltek0VGQUFnuLKaVlLZXwn8zXNCx1UW6l9N9e9eSw1uXzhue

˓→61JN9LxK1SvX3gO0g4Jipq0MgvokeF5mdyuvqaC8PWU1k+vo9PaVwsguqy5cSDZbz3F6BcE4Lj693cavRmb5F52+E9yDI/

˓→P4IhCLKIt4QCgmxiC3XgA43fq75+SV21LUTjzc/

˓→0mY+VoO9CmzJcQ0vDrclzJnyFfCwBAPZweL5iBc0zAGcNxTA5/

˓→k86ejHdLlASH0dRf55F8ALeO22um21F7cEqOSYBtl009LDvpHte9wKWp9MpHABeDCigYMc05/

˓→IgVPQemtd6NtQ0ZVWHWUiWWqh5cY4v8d0CHWAv4HJZI5JuGWdWUc1QufMfu9UbTuNJe0RGQ/

˓→N9OJZzzwX+Vpuflrg9K0CT47Yo3NGFbYOuxn12JQBEYDNl5VHWZGAe1x/

˓→ljD0OjWmw3xkLNyRqwZnSTTJ4salCSW6qLrsqHWEeNyx+J4t2gBY0TNoylQ8hECxozFu/

˓→CYNIlY7+dJjFFe29r+FNBK+WOuUcSoyrABbqCkQH3iXOC97SQSyxdXMNvkkl9X8gvQQKCAQEA2VKt5k7HqvUTC26DNswNQGfd89GcQ

˓→2rWhCeBGVqJKQ+qRjgk0KeVTcnTGzyujaHN1akUA1CRKEqtrCCspZjollWhxDygevMbXs/

˓→0QlDkUxaflPOzit6B5vDJqLGJUgvPI3Hc+9eDZXeCyCCdXOVGY8FUxMQ84RnDO8sVOthgahHsdbxjdUb0KcgaV5xNuMyuYsA++QG7f

˓→EmTp2OXKq+cuZHRZWaBtm3zDwfOz3FLVBXi3JGX9M6Hv6q/

˓→2cgLDudYiE3LCNagNkI7rRRO8Gfqd2i9KVRQHWCTl4mpTOwwmKWONNgS34aTPjD5UptNUzTvIItGGSMfg/

˓→DNrYg6G9HA666aIqpvodSfUv1ryJViml/

˓→3NtvmlRmRKEYe03txKhAN1Reuq30BoOGs4Tu5Hy8ijws9hOSCdZbOyte4EhDRSNyZB45YXooJOHEWTLjrZZqgGH3B/

˓→uUAUmyHbutPF/Wkep7M1LVeU8KS4HeVmwMRgPL10nxoHPE/

˓→UGBuqL09p4a1muXQ+TMHvnI59Shkn9cEiQKCAQEA10v/l/BoAse0TFj5iSnx3uKHkmsQX8P2UcsoRmPFW3RJd/

˓→7v2EJrTrwlxVqYMdpLDJIkB0MyIfry7H8QjNuUOqgAmazBToq08xCDD4GEXMpVkcgKuKRuU53ukNb26c+Ozshs4bqktMHQPGmZ5wgP

˓→YwLF0Y9cMO+noKHgdhwVbMIehXvRL2fBezLqKs17FDyD3rJyEQKCAQAdwFtHShJGe4qaVFcL2bbhU+xBDGMnDAI2bZ0BiwtrA3LBOi

˓→RcKV/u22j3G8OXqzS/

˓→ABT5ZX1Z42IDv08mYaH3cquSALJG7yT4+M4AHSmFZ06IuNpTZaePbWd+HJXkzdWmJFPmKpx7c5cjl6sb5q0XGgVt0spN3Dahabi2Zf

˓→OCSX1AkI3b5hdt/

˓→WJwDCFUmXfKmYZLvV+JSMsRHUWsBAoIBAC2ZuZ3hYmSFMq+rZme72lIl3PUiOWPO9VVbs+PsRk58/

˓→ceCWnGCO647+KGb4jFw0vKPwP5RKmPny9a6ZSpYB2jsgWItKewdah+VPEOSLZQT/

˓→aPB5f61eiazCnuUuWrrycQVyLlELD0pj29mMxAJ0Nr1CIVboYp+YYA7dWNVSUT6T+EV6ASEC6jflb//

˓→UUUmCjOfxILGMkqvNJ2T7WguaPLOw21wLx0eDvQA/N8ZTiyKmE+GVRkDwGzC/

˓→yLeelgzyBgmyr15hfo7Q41VtAso6rzzExc4GasmgQe8z4Y0Gm7t3RDL3GXxBmonZtxNZt0vwvVyS/

˓→kAJedmPgcfxJunPnM='

set pki certificate CLIENT certificate

˓→'MIIFsDCCA5igAwIBAgIUSzQgwzGsfJFecGxCwLXVsGCLMkAwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMC

˓→XLYJ1xIpcYTRXTut2CTGRar7fZZicu7x0yoK4TzrHvGVf1o4NC4NSGV5RX6kwRdrfWBmvpIkjSLGtCREFyhb+PHDpnsIS7cfN9udC0

˓→xM/sfcP6Vja/uFp+9TQcneJIxYw34zkF+TtOVbE3pP5VxU7ZAj8F5/q1ONhTMdzG4Ol4/

˓→0nBqZfdYA3LVDeSSNIJNF5jlaKXXFHz1EJRemTYDx+f5bfCVcK2Qs8fU9jCFBlATjMu9O5rgk6nMLRwEnJZuZ1gj2tWQvz4e9yo5yU

˓→j4o194mQ/Dt/Et+/Qn/DUFk2FB0rTMcQwJLTEAzxtTdmBJeJpipIPDR0u7UMZLNh/

˓→raQ8s3FsbY4uYORt2f5YQlCVHbth4dRa9xa+oRbm7eomNACIbWfkLh5Bzud1+qIfdBMZKaZbnf0HEeuH0J5LBJeova8EPxWbYMJPrR

˓→z+4wwLxtzq/c2xKw9yrOZ46ZVLwGDFq8rPwp7/

˓→P9r6mDKsbn6jIvGOeH71dMZvoc4lCaClw+hKIzLAgMBAAGjdTBzMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/

˓→BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMB0GA1UdDgQWBBS6j30FmL6kZW7rDH8QjRMoWoA/

˓→njAfBgNVHSMEGDAWgBT+TQ2nP8gvpkJmk6WQ1L/

˓→RmTBjATANBgkqhkiG9w0BAQsFAAOCAgEANW2Y4bgaB9oexEjj6rkGvePtQmXRkF/

˓→adVQREY9iZDGTe72ePybVzrfMkZHjse3o7JvXWRIVVztWSzEpv5noIOX7lAioGG3wsFTHotTFR0zrYJHXHBcV2Neq4Kx2Ta/

˓→TZwD8QnZHAAxEQ1pYb4fxwN/

˓→A60VElAZoz9zYsbrJyVrfuHDL9queQxPFzqis+7W1BiVIcv4rn0DMQ560jTGh4t4rImOSu5gUsUrQaih85XDdOBPxViSNwfVdZJIgb

˓→uCjcxpNnzIp0rhyYmDeqVat4GnTV7Sy48e/Uvcq71ZWbBYJF4+yW4pylIU2Sh/

(continues on next page)

13.5. OpenVPN with LDAP 1260

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

˓→ Uy2sAz4C2M71FlFB7qsmcnPRsFFHf+r1NyD1lkVI9k2371fTG/
˓→Kub9V0rOz4pvKz4Em5b4MUPdDbZOqJ8hQ+atGE3ovFJIovA3NFb0OtnyC4l+kG7dfjqFudOnmDa+Qsya+2YOxBZBIRfuhlXhb6Y6Sm

˓→vpoN+VusD/XEv2V0Ixm10YybA7BI/tixh9vwj3fdQXVLy3jSYjVBd5WOFPizbQZeD10ElvlLqZZyWrP/

˓→Wre7Nmi/gEOnhBXXmo034fFF/vXf0JRpQsd2oDs24+4XwZYb8mbM31j7Nx8YvhR+64='

set pki certificate CLIENT private key

˓→'MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDRzSTksHA20as4i9YF2JxyKuz+7xFBb0vHf1y2CdcSKXGE0V07r

˓→jxw6Z7CEu3HzfbnQtL6HKlZcf8TP7H3D+lY2v7hafvU0HJ3iSMWMN+M5Bfk7TlWxN6T+VcVO2QI/

˓→Bef6tTjYUzHcxuDpeP9JwamX3WANy1Q3kkjSCTReY5Wil1xR89RCUXpk2A8fn+W3wlXCtkLPH1PYwhQZQE4zLvTua4JOpzC0cBJyWb

˓→gpMYECWpej9wK96uIn7SYodyvv4+KNfeJkPw7fxLfv0J/

˓→w1BZNhQdK0zHEMCS0xAM8bU3ZgSXiaYqSDw0dLu1DGSzYf62kPLNxbG2OLmDkbdn+WEJQlR27YeHUWvcWvqEW5u3qJjQAiG1n5C4eQ

˓→DRLWEoayFW4nHTDUiN6TkEetDBYZB8AY0lNpf8/uMMC8bc6v3NsSsPcqzmeOmVS8BgxavKz8Ke/z/

˓→a+pgyrG5+oyLxjnh+9XTGb6HOJQmgpcPoSiMywIDAQABAoICACNXi396uWyCpXVBGSyi8LfKw2GupBmBxiI1Mkj4H2LP2G+nVS1Ye7

˓→jd23bqFYRERPgLUtPWNB0UQyMQsvNpVISm8JR45Sg0xq+bwEXabB7SyYLkZDKgsehxkuCJxZd625pl53vGMCKyzst0MBt4qCEsZQM7

˓→MpWFjnGSr4XDttXqz1YghTMHlWNpDCYtPN+3BO4iPnj+h0qCdXZ28jlLEczAc+oDKtzPqEmv/

˓→TDaKE6Qu6x+VbkBPmG+mkoX4qfokRwCs19CGheR38PxdDx7AgySv7K8hM8gFC0XEqNdjt86KG+N1Ps5Sru4QMrf8j9XXNPUvt0M8ws

˓→h0HIEROOFpEFbzWnhBChPVvFObuuEjl5Jnj3KUEnckQFU07mPP/BpysHo3v/

˓→p+VTVoo2UkfVvjamnwQOUt3cVlPVC4FzVgkswJa4f75nGmDv8dafyPrCYciOh0qyhD5Pw/

˓→EBJkKtDBYHaoxtAw9Ann4A5rvZAveLNTPESOMo90pJwJbQcZyq9H+UGVnde39I4m5vHB5izZJI24Yd3fjRRkRf+/

˓→68VYKrkI5B7oH73Z/cl/xgEdI1hag4MLv1gon8wna4yCX/

˓→321YPTrDABAoIBAQDpHtvnvpOaoSjkJHUx4EGJkrp5R/

˓→mPfEbzzU2Ov5pNIcufv++2lsoUVCTDwgp4+7GngqYO5vVyW/AS4pSrDx7kdWpFaUtJUUCcCHk/

˓→5hYcvvourYtW1NR+XPiI28IqRp1P0L1+P0mUaRgpEcw6nEnc37XEujvTB1M/

˓→yF2y6xc+kZGjrZTmJeu0V5kkaGcXlAqUv2k0Lj3tEPQR/

˓→qj+kMX5hidROGuybNBESgA5ELY6QVnpcOyNDyniWq+RIUyBOuXp7DpUbmUANFEEP8lwjZX+HqwTpSjTSFdcPrsmorc9FpTXA9ktt1Z

˓→XOpXlpNHx2ehrGWp/BbmlmrnQaRcbLPJaRtWSEywbWnG77g+zj0w+4BdsYyTtGGFj4tXVZhPPo/

˓→DID3FPLn9cSv8MIVWjzg1G/BZcxtCDBDRBhwhZHCPOfd0K/S7rvRBq7IsNNHMTGswWGRMaF+M/

˓→trZw7TsQ0BX+5zZUyO8VNBi/

˓→NgTV3yoQ8ynBefRt1dmNa2CKXPT+5R19cBtecFEyhc3yo8ryTtM22JzndzA8agQmNPnWmYGivvcNHNikTQ2qUvvcd7Siny6j0+CmFd

˓→1OyShRO+myPsql+U0kQQ8Zeh0kPWTJclFboMf7MePfJLj3waMvaZxfS9s9CvvKaCSY2YKtL7Sle5bWozCff27Q05jAgszwnkRGxj/

˓→AzAwpjnCft40UkL7majm2vk+pm6aPjcYPXnqKbcOmBjxJWIoNRkLCDKqw6IOs+zQDRNwPKNb5GhFGeA1pKjfGJddg6+u95uEVmPcRB

˓→5hUAoBUAW7jNNE5mHmZBO8DPwCotUc82bCojNVkxLxsKPE2VWtWdq+1t9SoevBVZItl2zgWpATHndhQlOgdONoWUgRT1J3x1HYewrg

˓→GypC17WV4Vw5FS6wopg71BAoIBAQC63vDgTGpauk0pOVyab1tSmNzhM2dn4BhMIcU+eqzAzTkO13sKBGrQJQ3cODoxDbSKSE61QN9D

˓→nTnCg0Q/P0g3QZTZyzsEb1/slYH9jKRnErl+eEdDXu0sB2qIBAa6Th2ojMM7q/

˓→RrF3HD6Qo20ZpQb951bnZsJ48j2WDCCGAdnLCsNe9zuqQsphNOf9BUbXYpGcKgSquPJfxXXvjgYdVcvJyIfc+GNAZQaS750bY6eYdL

˓→3zAoIBAQC8/7DglQGMcKnk4zX+7jCuc0p+qMcd5RdnfBKlRhcWYNRPup9jyDefdkXCBTumCHXrIil/

˓→rJzP6b1IZZdC4xkheQpLXNUcceAidRWIrTypaXKkmhR0D74uckGiLXB4S84HYmIdw89ZiF0gB0yyZH5mZnqVMojwnGmWqcM2sr2N44

˓→rVl26BXtRPiNPimfwWKrYNYhESN7A5/

˓→hWcrNUhE4PI+Pjd74npimqs5TDSst2Jc6DiahdaZ6JNNzp2PMUXNbfsMCVgZx+qtVNnVxVMiEngPRl'

set pki dh DH parameters

˓→'MIIBCAKCAQEAzPOQWrWaIX2qt4sbV6bRbUnFx4jmeE+WXC8GIvulnC4pIr1nt2Gc/

˓→7uNfEPjDZ4X6csD3X6zAWxtSuWeNuml9Yuy+tS8gI7d0FlbQRAFO/

˓→9GIlRuVdMcbCtEhg8ja7Y0g3fQjOSQJ9mqFo7sRoXyYQALD+MDEJOxhnV7neCrgDi1pqnN4xZLoR9DLARp0ad30VIvnv0ay55wxFWA

˓→J8Q+7YXmk4cN9tiVX4xR92edVO4z/vhMkjsGKLSDm/

˓→E6EMusX+N0UhQ3dv7qDgeSS8vDsqBm8XJonumNZLvFbYt2ARGRZYL6DUwIBAg=='

Once all the required certificates and keys are installed, the remaining OpenVPN Server configuration can be carried
out.

set interface ethernet eth1 address '192.168.1.1/24'

set interface ethernet eth2 address '198.51.100.254/24'
set interfaces openvpn vtun10 local-host '198.51.100.254'
set interfaces openvpn vtun10 local-port '1194'
(continues on next page)

13.5. OpenVPN with LDAP 1261

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

set interfaces openvpn vtun10 mode 'server'
set interfaces openvpn vtun10 openvpn-option '--plugin /usr/lib/openvpn/openvpn-auth-
˓→ldap.so /config/auth/ldap-auth.config'

set interfaces openvpn vtun10 persistent-tunnel

set interfaces openvpn vtun10 protocol 'udp'
set interfaces openvpn vtun10 server push-route '192.168.1.0/24'
set interfaces openvpn vtun10 server subnet '10.23.1.0/24'

set interfaces openvpn vtun10 tls ca-certificate OVPN-CA

set interfaces openvpn vtun10 tls certificate SRV
set interfaces openvpn vtun10 tls dh-params DH
set protocols static route 10.1.1.0/24 interface vtun10

13.5.3 Client configuration

One advantage of having the client certificate stored is the ability to create the client configuration.

vyos@ovpn-server:~$ generate openvpn client-config interface vtun10 ca OVPN-CA␣

˓→certificate CLIENT

save the output to a file and import it in nearly all openvpn clients.

client
nobind
remote 198.51.100.254 1194
remote-cert-tls server
proto udp
dev tun
dev-type tun
persist-key
persist-tun
verb 3

# Encryption options

keysize 256
comp-lzo no

<ca>
-----BEGIN CERTIFICATE-----
MIIFnTCCA4WgAwIBAgIUIPFIXvCxYdavCnSPFNjr6lUtlsswDQYJKoZIhvcNAQEL
BQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM
CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0y
MzA1MTExMjM4MjJaFw0zMzA1MDgxMjM4MjJaMFcxCzAJBgNVBAYTAkdCMRMwEQYD
VQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5
T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
AoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8
gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88z
CIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SA
sJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU
5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tL
(continues on next page)

13.5. OpenVPN with LDAP 1262

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

c6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BG
oewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC
8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1
cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00
uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7O
u5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABo2EwXzAP
BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEF
BQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0G
CSqGSIb3DQEBCwUAA4ICAQDEqpF2ibwYFxsF1XDIPS5/Gs0sZTZBuByNm5d2+jTy
O7d5alZUdbvobbwhxZOhWasmFNyPLr4TYmZm5zF+efFsiOxjyRuEoVU+Fe8rZmpR
IF/+6+nYX5r9vMI4QxGjeeyP20OHJ85Kvz182CTsITrM15Vw/kVVjAVzFI5Gm/Qo
lalAoFQza9rAL4kDqaUszjHjPbysvDpGF+NLPjiYDHXcty/BC48bnuzAeEM60SGZ
7EXvf8l0X8YsO7z39w6780A/3rbZvFhCYMKp/+p5xBRDjnX91dM6DJw73RwYQ1KH
bHk9wWUwnL1giL71jzp/y4Oj6SSK2PQv+OnO80J6Zg06WIQx9xYcxr108Xh9FotU
rlG7GYPI3Udf95t6SjuydDhULAVD0lMBxlDe9DHW1k1q1pOXaHZg926tY66xx/ld
a6dcuwJjA2Dx5JI6L0u9ureQmQAtxvnoTCtf+hR1iX/IkskZCKs34SjNiCnBuw/D
NfdOpfaABm7y+tWiXBwnu5l/K8poXcQYQByyZj6YMmpgsbVPr5KNsLWOgRA81M6I
Pof8qxvnFrkazhiQWh1YHSjnaHtA3z5/BdgwHVICuFyrIOlbkKyJOjKcKBsDdMwI
V0tsnpnyli2xEPZKu1tAQFAavXrK/RGYYhOZ3e0aRSV8hlP8i/mf7p0I45cJiBCq
Pg==
-----END CERTIFICATE-----

</ca>

<cert>
-----BEGIN CERTIFICATE-----
MIIFsDCCA5igAwIBAgIUSzQgwzGsfJFecGxCwLXVsGCLMkAwDQYJKoZIhvcNAQEL
BQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM
CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0y
MzA1MTExMjM4MzlaFw0zMzA1MDgxMjM4MzlaMFYxCzAJBgNVBAYTAkdCMRMwEQYD
VQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5
T1MxDzANBgNVBAMMBmNsaWVudDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
ggIBANHNJOSwcDbRqziL1gXYnHIq7P7vEUFvS8d/XLYJ1xIpcYTRXTut2CTGRar7
fZZicu7x0yoK4TzrHvGVf1o4NC4NSGV5RX6kwRdrfWBmvpIkjSLGtCREFyhb+PHD
pnsIS7cfN9udC0vocqVlx/xM/sfcP6Vja/uFp+9TQcneJIxYw34zkF+TtOVbE3pP
5VxU7ZAj8F5/q1ONhTMdzG4Ol4/0nBqZfdYA3LVDeSSNIJNF5jlaKXXFHz1EJRem
TYDx+f5bfCVcK2Qs8fU9jCFBlATjMu9O5rgk6nMLRwEnJZuZ1gj2tWQvz4e9yo5y
Uqf1PUhOrn3c81MRliUNHKr+CkxgQJal6P3Ar3q4iftJih3K+/j4o194mQ/Dt/Et
+/Qn/DUFk2FB0rTMcQwJLTEAzxtTdmBJeJpipIPDR0u7UMZLNh/raQ8s3FsbY4uY
ORt2f5YQlCVHbth4dRa9xa+oRbm7eomNACIbWfkLh5Bzud1+qIfdBMZKaZbnf0HE
euH0J5LBJeova8EPxWbYMJPrRHzu5gowkIKl+uIxcy8IiNTA9YEoJVonCjmlr8NE
tYShrIVbicdMNSI3pOQR60MFhkHwBjSU2l/z+4wwLxtzq/c2xKw9yrOZ46ZVLwGD
Fq8rPwp7/P9r6mDKsbn6jIvGOeH71dMZvoc4lCaClw+hKIzLAgMBAAGjdTBzMAwG
A1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMC
MB0GA1UdDgQWBBS6j30FmL6kZW7rDH8QjRMoWoA/njAfBgNVHSMEGDAWgBT+TQ2n
P8gvpkJmk6WQ1L/RmTBjATANBgkqhkiG9w0BAQsFAAOCAgEANW2Y4bgaB9oexEjj
6rkGvePtQmXRkF/adVQREY9iZDGTe72ePybVzrfMkZHjse3o7JvXWRIVVztWSzEp
v5noIOX7lAioGG3wsFTHotTFR0zrYJHXHBcV2Neq4Kx2Ta/TZwD8QnZHAAxEQ1pY
b4fxwN/A60VElAZoz9zYsbrJyVrfuHDL9queQxPFzqis+7W1BiVIcv4rn0DMQ560
jTGh4t4rImOSu5gUsUrQaih85XDdOBPxViSNwfVdZJIgbvamudpfEaKsIun/uCjc
xpNnzIp0rhyYmDeqVat4GnTV7Sy48e/Uvcq71ZWbBYJF4+yW4pylIU2Sh/Uy2sAz
4C2M71FlFB7qsmcnPRsFFHf+r1NyD1lkVI9k2371fTG/Kub9V0rOz4pvKz4Em5b4
(continues on next page)

13.5. OpenVPN with LDAP 1263

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

MUPdDbZOqJ8hQ+atGE3ovFJIovA3NFb0OtnyC4l+kG7dfjqFudOnmDa+Qsya+2YO
xBZBIRfuhlXhb6Y6Smsk9R6x0jBmcQTPS5ZmvKaTxQCFc53xMdQNAswjiI2L9rw4
BcqQfVmf/vpoN+VusD/XEv2V0Ixm10YybA7BI/tixh9vwj3fdQXVLy3jSYjVBd5W
OFPizbQZeD10ElvlLqZZyWrP/Wre7Nmi/gEOnhBXXmo034fFF/vXf0JRpQsd2oDs
24+4XwZYb8mbM31j7Nx8YvhR+64=
-----END CERTIFICATE-----

</cert>

<key>
-----BEGIN PRIVATE KEY-----
MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDRzSTksHA20as4
i9YF2JxyKuz+7xFBb0vHf1y2CdcSKXGE0V07rdgkxkWq+32WYnLu8dMqCuE86x7x
lX9aODQuDUhleUV+pMEXa31gZr6SJI0ixrQkRBcoW/jxw6Z7CEu3HzfbnQtL6HKl
Zcf8TP7H3D+lY2v7hafvU0HJ3iSMWMN+M5Bfk7TlWxN6T+VcVO2QI/Bef6tTjYUz
HcxuDpeP9JwamX3WANy1Q3kkjSCTReY5Wil1xR89RCUXpk2A8fn+W3wlXCtkLPH1
PYwhQZQE4zLvTua4JOpzC0cBJyWbmdYI9rVkL8+HvcqOclKn9T1ITq593PNTEZYl
DRyq/gpMYECWpej9wK96uIn7SYodyvv4+KNfeJkPw7fxLfv0J/w1BZNhQdK0zHEM
CS0xAM8bU3ZgSXiaYqSDw0dLu1DGSzYf62kPLNxbG2OLmDkbdn+WEJQlR27YeHUW
vcWvqEW5u3qJjQAiG1n5C4eQc7ndfqiH3QTGSmmW539BxHrh9CeSwSXqL2vBD8Vm
2DCT60R87uYKMJCCpfriMXMvCIjUwPWBKCVaJwo5pa/DRLWEoayFW4nHTDUiN6Tk
EetDBYZB8AY0lNpf8/uMMC8bc6v3NsSsPcqzmeOmVS8BgxavKz8Ke/z/a+pgyrG5
+oyLxjnh+9XTGb6HOJQmgpcPoSiMywIDAQABAoICACNXi396uWyCpXVBGSyi8LfK
w2GupBmBxiI1Mkj4H2LP2G+nVS1Ye7C2NcY311AeBX56/jd23bqFYRERPgLUtPWN
B0UQyMQsvNpVISm8JR45Sg0xq+bwEXabB7SyYLkZDKgsehxkuCJxZd625pl53vGM
CKyzst0MBt4qCEsZQM7jpQr9ZLS1DSQV05InI1wKcnp1k2hX2WSZ0nZp7qYbjyyQ
6DsS4D/MpWFjnGSr4XDttXqz1YghTMHlWNpDCYtPN+3BO4iPnj+h0qCdXZ28jlLE
czAc+oDKtzPqEmv/TDaKE6Qu6x+VbkBPmG+mkoX4qfokRwCs19CGheR38PxdDx7A
gySv7K8hM8gFC0XEqNdjt86KG+N1Ps5Sru4QMrf8j9XXNPUvt0M8wsPVeWa5ubkV
7/h0HIEROOFpEFbzWnhBChPVvFObuuEjl5Jnj3KUEnckQFU07mPP/BpysHo3v/p+
VTVoo2UkfVvjamnwQOUt3cVlPVC4FzVgkswJa4f75nGmDv8dafyPrCYciOh0qyhD
5Pw/EBJkKtDBYHaoxtAw9Ann4A5rvZAveLNTPESOMo90pJwJbQcZyq9H+UGVnde3
9I4m5vHB5izZJI24Yd3fjRRkRf+/68VYKrkI5B7oH73Z/cl/xgEdI1hag4MLv1go
n8wna4yCX/321YPTrDABAoIBAQDpHtvnvpOaoSjkJHUx4EGJkrp5R/mPfEbzzU2O
v5pNIcufv++2lsoUVCTDwgp4+7GngqYO5vVyW/AS4pSrDx7kdWpFaUtJUUCcCHk/
5hYcvvourYtW1NR+XPiI28IqRp1P0L1+P0mUaRgpEcw6nEnc37XEujvTB1M/yF2y
6xc+kZGjrZTmJeu0V5kkaGcXlAqUv2k0Lj3tEPQR/qj+kMX5hidROGuybNBESgA5
ELY6QVnpcOyNDyniWq+RIUyBOuXp7DpUbmUANFEEP8lwjZX+HqwTpSjTSFdcPrsm
orc9FpTXA9ktt1Z0ZxBzUvdcWbUeVsFqL0yICiShE7UxlOPBAoIBAQDmZGQ5roSK
KY+VnmjIq2+gx8zsMYeliQm0hnKrFw9MM8U+/XOpXlpNHx2ehrGWp/BbmlmrnQaR
cbLPJaRtWSEywbWnG77g+zj0w+4BdsYyTtGGFj4tXVZhPPo/DID3FPLn9cSv8MIV
Wjzg1G/BZcxtCDBDRBhwhZHCPOfd0K/S7rvRBq7IsNNHMTGswWGRMaF+M/trZw7T
sQ0BX+5zZUyO8VNBi/NgTV3yoQ8ynBefRt1dmNa2CKXPT+5R19cBtecFEyhc3yo8
ryTtM22JzndzA8agQmNPnWmYGivvcNHNikTQ2qUvvcd7Siny6j0+CmFdT9bl64VP
yRJrFCw3jaOLAoIBAQCQ/1OyShRO+myPsql+U0kQQ8Zeh0kPWTJclFboMf7MePfJ
Lj3waMvaZxfS9s9CvvKaCSY2YKtL7Sle5bWozCff27Q05jAgszwnkRGxj/AzAwpj
nCft40UkL7majm2vk+pm6aPjcYPXnqKbcOmBjxJWIoNRkLCDKqw6IOs+zQDRNwPK
Nb5GhFGeA1pKjfGJddg6+u95uEVmPcRBqQ79/5hUAoBUAW7jNNE5mHmZBO8DPwCo
tUc82bCojNVkxLxsKPE2VWtWdq+1t9SoevBVZItl2zgWpATHndhQlOgdONoWUgRT
1J3x1HYewrg1suYOd/GypC17WV4Vw5FS6wopg71BAoIBAQC63vDgTGpauk0pOVya
b1tSmNzhM2dn4BhMIcU+eqzAzTkO13sKBGrQJQ3cODoxDbSKSE61QN9D92nmVQzi
WKnxxmb1zS5sw7g15/nTnCg0Q/P0g3QZTZyzsEb1/slYH9jKRnErl+eEdDXu0sB2
(continues on next page)

13.5. OpenVPN with LDAP 1264

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

qIBAa6Th2ojMM7q/RrF3HD6Qo20ZpQb951bnZsJ48j2WDCCGAdnLCsNe9zuqQsph
NOf9BUbXYpGcKgSquPJfxXXvjgYdVcvJyIfc+GNAZQaS750bY6eYdLaIlDMqZk1R
unLuikCAWni86dvtMEU0qFi0E5Ovp7jWWWNE4CnYSyAzgy3oBssyoG74AQp8addX
k/3zAoIBAQC8/7DglQGMcKnk4zX+7jCuc0p+qMcd5RdnfBKlRhcWYNRPup9jyDef
dkXCBTumCHXrIil/rJzP6b1IZZdC4xkheQpLXNUcceAidRWIrTypaXKkmhR0D74u
ckGiLXB4S84HYmIdw89ZiF0gB0yyZH5mZnqVMojwnGmWqcM2sr2N44bNQMfhD+nC
SgQmReYKKfMQCdvYMxRLQfseU0pFEOGnh9jAmpn8qWMWxNDmFR/rVl26BXtRPiNP
imfwWKrYNYhESN7A5/hWcrNUhE4PI+Pjd74npimqs5TDSst2Jc6DiahdaZ6JNNzp
2PMUXNbfsMCVgZx+qtVNnVxVMiEngPRl
-----END PRIVATE KEY-----

</key>

Configure VyOS as client

set interfaces openvpn vtun10 authentication username 'user01'

set interfaces openvpn vtun10 authentication password '$ecret'
set interfaces openvpn vtun10 encryption cipher 'aes256'
set interfaces openvpn vtun10 hash 'sha512'
set interfaces openvpn vtun10 mode 'client'
set interfaces openvpn vtun10 persistent-tunnel
set interfaces openvpn vtun10 protocol 'udp'
set interfaces openvpn vtun10 remote-host '198.51.100.254'
set interfaces openvpn vtun10 remote-port '1194'
set interfaces openvpn vtun10 tls ca-certificate 'OVPN-CA'
set interfaces openvpn vtun10 tls certificate 'CLIENT'

13.5.4 Monitoring

If the client is connected successfully you can check the status

vyos@ovpn-server:~$ show openvpn server

OpenVPN status on vtun10

Client CN Remote Host Tunnel IP Local Host TX bytes RX bytes ␣

˓→ Connected Since
----------- ------------------ ----------- ------------------- ---------- ----------
˓→ -------------------
client 198.51.100.1:55150 10.23.1.6 198.51.100.254:1194 4.7 KB 4.7 KB ␣
˓→ 2023-05-11 12:47:11

13.5. OpenVPN with LDAP 1265

 CHAPTER

FOURTEEN

BUILD VYOS

14.1 Prerequisites

There are different ways you can build VyOS.

Building using a Docker container, although not the only way, is the easiest way as all dependencies are managed for
you. However, you can also set up your own build machine and run a Native Build.

Note: Starting with VyOS 1.2 the release model of VyOS has changed. VyOS is now free as in speech, but not as in
beer. This means that while VyOS is still an open source project, the release ISOs are no longer free and can only be
obtained via subscription, or by contributing to the community.
The source code remains public and an ISO can be built using the process outlined in this chapter.
The following includes the build process for VyOS 1.2 to the latest version.

This will guide you through the process of building a VyOS ISO using Docker. This process has been tested on clean
installs of Debian Jessie, Stretch, and Buster.

14.1.1 Native Build

To build VyOS natively you require a properly configured build host with the following Debian versions installed:
• Debian Jessie for VyOS 1.2 (crux)
• Debian Buster for VyOS 1.3 (equuleus)
• Debian Bookworm for VyOS 1.4 (sagitta)
• Debian Bookworm for the upcoming VyOS 1.5/circinus/current (subject to change) - aka the rolling release
To start, clone the repository to your local machine:

# For VyOS 1.2 (crux)

$ git clone -b crux --single-branch https://github.com/vyos/vyos-build

# For VyOS 1.3 (equuleus)

$ git clone -b equuleus --single-branch https://github.com/vyos/vyos-build

# For VyOS 1.4 (sagitta)

$ git clone -b sagitta --single-branch https://github.com/vyos/vyos-build

# For VyOS 1.5 (circinus,current)

(continues on next page)

1266
 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

$ git clone -b current --single-branch https://github.com/vyos/vyos-build

$ cd vyos-build

# For VyOS 1.2 (crux) and VyOS 1.3 (equuleus)

$ ./configure --architecture amd64 --build-by "[email protected]"
$ sudo make iso

# For VyOS 1.4 (sagitta)

$ sudo make clean
$ sudo ./build-vyos-image iso --architecture amd64 --build-by "[email protected]"

# For VyOS 1.5 (circinus,current)

$ sudo make clean
$ sudo ./build-vyos-image generic --architecture amd64 --build-by "[email protected]
˓→"

For the packages required, you can refer to the docker/Dockerfile file in the repository. The ./build-vyos-image
script will also warn you if any dependencies are missing.
This will guide you through the process of building a VyOS ISO using Docker. This process has been tested on clean
installs of Debian Bullseye (11) and Bookworm (12).

14.1.2 Docker

Installing Docker and prerequisites:

Hint: Due to the updated version of Docker, the following examples may become invalid.

# Add Docker's official GPG key:

sudo apt-get update
sudo apt-get install ca-certificates curl gnupg
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /etc/apt/
˓→keyrings/docker.gpg

sudo chmod a+r /etc/apt/keyrings/docker.gpg

# Add the repository to Apt sources:

echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https:/
˓→/download.docker.com/linux/debian \

$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \

sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt-get update

sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-
˓→compose-plugin

To be able to use Docker without sudo, the current non-root user must be added to the docker group by calling: sudo
usermod -aG docker yourusername.

14.1. Prerequisites 1267

 VyOS Documentation, Release 1.5.x (circinus)

Hint: Doing so grants privileges equivalent to the root user! It is recommended to remove the non-root user from
the docker group after building the VyOS ISO. See also Docker as non-root.

Note: The build process needs to be built on a local file system, building on SMB or NFS shares will result in the
container failing to build properly! VirtualBox Drive Share is also not an option as block device operations are not
implemented and the drive is always mounted as “nodev”

Build Container

The container can be built by hand or by fetching the pre-built one from DockerHub. Using the pre-built containers
from the VyOS DockerHub organisation will ensure that the container is always up-to-date. A rebuild is triggered once
the container changes (please note this will take 2-3 hours after pushing to the vyos-build repository).

Dockerhub

To manually download the container from DockerHub, run:

$ docker pull vyos/vyos-build:crux # For VyOS 1.2

$ docker pull vyos/vyos-build:equuleus # For VyOS 1.3
$ docker pull vyos/vyos-build:sagitta # For VyOS 1.4
$ docker pull vyos/vyos-build:current # For VyOS 1.5 rolling release

Build from source

The container can also be built directly from source:

# For VyOS 1.2 (crux)

$ git clone -b crux --single-branch https://github.com/vyos/vyos-build
# For VyOS 1.3 (equuleus)
$ git clone -b equuleus --single-branch https://github.com/vyos/vyos-build
# For VyOS 1.4 (sagitta)
$ git clone -b sagitta --single-branch https://github.com/vyos/vyos-build
# For VyOS 1.5 (circinus,current)
$ git clone -b current --single-branch https://github.com/vyos/vyos-build

$ cd vyos-build
$ docker build -t vyos/vyos-build:crux docker # For VyOS 1.2
$ docker build -t vyos/vyos-build:equuleus docker # For VyOS 1.3
$ docker build -t vyos/vyos-build:sagitta docker # For VyOS 1.4
$ docker build -t vyos/vyos-build:current docker # For VyOS 1.5 rolling release

Note: VyOS has switched to Debian (12) Bookworm in its current branch, Due to software version updates, it is
recommended to use the official Docker Hub image to build VyOS ISO.

14.1. Prerequisites 1268

 VyOS Documentation, Release 1.5.x (circinus)

Tips and Tricks

You can create yourself some handy Bash aliases to always launch the latest - per release train (current or crux) -
container. Add the following to your .bash_aliases file:

alias vybld='docker pull vyos/vyos-build:current && docker run --rm -it \

-v "$(pwd)":/vyos \
-v "$HOME/.gitconfig":/etc/gitconfig \
-v "$HOME/.bash_aliases":/home/vyos_bld/.bash_aliases \
-v "$HOME/.bashrc":/home/vyos_bld/.bashrc \
-w /vyos --privileged --sysctl net.ipv6.conf.lo.disable_ipv6=0 \
-e GOSU_UID=$(id -u) -e GOSU_GID=$(id -g) \
vyos/vyos-build:current bash'

alias vybld_crux='docker pull vyos/vyos-build:crux && docker run --rm -it \

-v "$(pwd)":/vyos \
-v "$HOME/.gitconfig":/etc/gitconfig \
-v "$HOME/.bash_aliases":/home/vyos_bld/.bash_aliases \
-v "$HOME/.bashrc":/home/vyos_bld/.bashrc \
-w /vyos --privileged --sysctl net.ipv6.conf.lo.disable_ipv6=0 \
-e GOSU_UID=$(id -u) -e GOSU_GID=$(id -g) \
vyos/vyos-build:crux bash'

Now you are prepared with two new aliases vybld and vybld_crux to spawn your development containers in your
current working directory.

Note: Some VyOS packages (namely vyos-1x) come with build-time tests which verify some of the internal library
calls that they work as expected. Those tests are carried out through the Python Unittest module. If you want to build
the vyos-1x package (which is our main development package) you need to start your Docker container using the
following argument: --sysctl net.ipv6.conf.lo.disable_ipv6=0, otherwise those tests will fail.

14.2 Build ISO

Now as you are aware of the prerequisites we can continue and build our own ISO from source. For this we have to
fetch the latest source code from GitHub. Please note as this will differ for both current and crux.

# For VyOS 1.2 (crux)

$ git clone -b crux --single-branch https://github.com/vyos/vyos-build

# For VyOS 1.3 (equuleus)

$ git clone -b equuleus --single-branch https://github.com/vyos/vyos-build

# For VyOS 1.4 (sagitta)

$ git clone -b sagitta --single-branch https://github.com/vyos/vyos-build

# For VyOS 1.5 (circinus,current)

$ git clone -b current --single-branch https://github.com/vyos/vyos-build

Now a fresh build of the VyOS ISO can begin. Change directory to the vyos-build directory and run:

14.2. Build ISO 1269

 VyOS Documentation, Release 1.5.x (circinus)

$ cd vyos-build
# For VyOS 1.2 (crux)
$ docker run --rm -it --privileged -v $(pwd):/vyos -w /vyos vyos/vyos-build:crux bash

# For VyOS 1.3 (equuleus)

$ docker run --rm -it --privileged -v $(pwd):/vyos -w /vyos vyos/vyos-build:equuleus bash

# For VyOS 1.4 (sagitta)

$ docker run --rm -it --privileged -v $(pwd):/vyos -w /vyos vyos/vyos-build:sagitta bash

# For VyOS 1.5 (current)

$ docker run --rm -it --privileged -v $(pwd):/vyos -w /vyos vyos/vyos-build:current bash

# For MacOS (crux, equuleus, sagitta)

$ git clone https://github.com/vyos/vyos-utils-misc
$ cd build-tools/macos-build

# For VyOS 1.2 (crux)

$ os=jessie64 branch=crux make build

# For VyOS 1.3 (equuleus)

$ os=buster64 branch=equuleus make build

# For VyOS 1.4 (sagitta)

$ os=buster64 branch=sagitta make build

Start the build:

# For VyOS 1.2 (crux) and VyOS 1.3 (equuleus)

vyos_bld@8153428c7e1f:/vyos$ ./configure --architecture amd64 --build-by "j.
˓→[email protected]"

vyos_bld@8153428c7e1f:/vyos$ sudo make iso

# For VyOS 1.4 (sagitta)

vyos_bld@8153428c7e1f:/vyos$ sudo make clean
vyos_bld@8153428c7e1f:/vyos$ sudo ./build-vyos-image iso --architecture amd64 --build-by
˓→"[email protected]"

# For VyOS 1.5 (circinus,current)

vyos_bld@8153428c7e1f:/vyos$ sudo make clean
vyos_bld@8153428c7e1f:/vyos$ sudo ./build-vyos-image generic --architecture amd64 --
˓→build-by "[email protected]"

When the build is successful, the resulting iso can be found inside the build directory as
live-image-[architecture].hybrid.iso.
Good luck!

Hint: Building VyOS on Windows WSL2 with Docker integrated into WSL2 will work like a charm. No problems
are known so far!

14.2. Build ISO 1270

 VyOS Documentation, Release 1.5.x (circinus)

14.2.1 Customize

This ISO can be customized with the following list of configure options. The full and current list can be generated with
./build-vyos-image --help:

$ vyos_bld@8153428c7e1f:/vyos$ sudo ./build-vyos-image --help

I: Checking if packages required for VyOS image build are installed
usage: build-vyos-image [-h] [--architecture ARCHITECTURE]
[--build-by BUILD_BY] [--debian-mirror DEBIAN_MIRROR]
[--debian-security-mirror DEBIAN_SECURITY_MIRROR]
[--pbuilder-debian-mirror PBUILDER_DEBIAN_MIRROR]
[--vyos-mirror VYOS_MIRROR] [--build-type BUILD_TYPE]
[--version VERSION] [--build-comment BUILD_COMMENT] [--debug] [--dry-run]
[--custom-apt-entry CUSTOM_APT_ENTRY] [--custom-apt-key CUSTOM_APT_KEY]
[--custom-package CUSTOM_PACKAGE]
[build_flavor]

positional arguments:
build_flavor Build flavor

optional arguments:
-h, --help show this help message and exit
--architecture ARCHITECTURE
Image target architecture (amd64 or arm64)
--build-by BUILD_BY Builder identifier (e.g. [email protected])
--debian-mirror DEBIAN_MIRROR
Debian repository mirror
--debian-security-mirror DEBIAN_SECURITY_MIRROR
Debian security updates mirror
--pbuilder-debian-mirror PBUILDER_DEBIAN_MIRROR
Debian repository mirror for pbuilder env bootstrap
--vyos-mirror VYOS_MIRROR
VyOS package mirror
--build-type BUILD_TYPE
Build type, release or development
--version VERSION Version number (release builds only)
--build-comment BUILD_COMMENT
Optional build comment
--debug Enable debug output
--dry-run Check build configuration and exit
--custom-apt-entry CUSTOM_APT_ENTRY
Custom APT entry
--custom-apt-key CUSTOM_APT_KEY
Custom APT key file
--custom-package CUSTOM_PACKAGE
Custom package to install from repositories

14.2. Build ISO 1271

 VyOS Documentation, Release 1.5.x (circinus)

ISO Build Issues

There are (rare) situations where building an ISO image is not possible at all due to a broken package feed in the
background. APT is not very good at reporting the root cause of the issue. Your ISO build will likely fail with a more
or less similar looking error message:

The following packages have unmet dependencies:

vyos-1x : Depends: accel-ppp but it is not installable
E: Unable to correct problems, you have held broken packages.
P: Begin unmounting filesystems...
P: Saving caches...
Reading package lists...
Building dependency tree...
Reading state information...
Del frr-pythontools 7.5-20210215-00-g8a5d3b7cd-0 [38.9 kB]
Del accel-ppp 1.12.0-95-g59f8e1b [475 kB]
Del frr 7.5-20210215-00-g8a5d3b7cd-0 [2671 kB]
Del frr-snmp 7.5-20210215-00-g8a5d3b7cd-0 [55.1 kB]
Del frr-rpki-rtrlib 7.5-20210215-00-g8a5d3b7cd-0 [37.3 kB]
make: *** [Makefile:30: iso] Error 1
(10:13) vyos_bld ece068908a5b:/vyos [current] #

To debug the build process and gain additional information of what could be the root cause, you need to use chroot to
change into the build directory. This is explained in the following step by step procedure:

vyos_bld ece068908a5b:/vyos [current] # sudo chroot build/chroot /bin/bash

We now need to mount some required, volatile filesystems

(live)root@ece068908a5b:/# mount -t proc none /proc

(live)root@ece068908a5b:/# mount -t sysfs none /sys
(live)root@ece068908a5b:/# mount -t devtmpfs none /dev

We now are free to run any command we would like to use for debugging, e.g. re-installing the failed package after
updating the repository.

(live)root@ece068908a5b:/# apt-get update; apt-get install vyos-1x

Get:1 file:/root/packages ./ InRelease
Ign:1 file:/root/packages ./ InRelease
Get:2 file:/root/packages ./ Release [1235 B]
Get:2 file:/root/packages ./ Release [1235 B]
Get:3 file:/root/packages ./ Release.gpg
Ign:3 file:/root/packages ./ Release.gpg
Hit:4 http://repo.powerdns.com/debian buster-rec-43 InRelease
Hit:5 http://repo.saltstack.com/py3/debian/10/amd64/archive/3002.2 buster InRelease
Hit:6 http://deb.debian.org/debian bullseye InRelease
Hit:7 http://deb.debian.org/debian buster InRelease
Hit:8 http://deb.debian.org/debian-security buster/updates InRelease
Hit:9 http://deb.debian.org/debian buster-updates InRelease
Hit:10 http://deb.debian.org/debian buster-backports InRelease
Hit:11 http://dev.packages.vyos.net/repositories/current current InRelease
Reading package lists... Done
N: Download is performed unsandboxed as root as file '/root/packages/./InRelease' couldn
˓→'t be accessed by user '_apt'. - pkgAcquire::Run (13: Permission denied)

(continues on next page)

14.2. Build ISO 1272

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Reading package lists... Done
Building dependency tree
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:

vyos-1x : Depends: accel-ppp but it is not installable
E: Unable to correct problems, you have held broken packages.

Now it’s time to fix the package mirror and rerun the last step until the package installation succeeds again!

14.2.2 Linux Kernel

The Linux kernel used by VyOS is heavily tied to the ISO build process. The file data/defaults.json hosts a JSON
definition of the kernel version used kernel_version and the kernel_flavor of the kernel which represents the
kernel’s LOCAL_VERSION. Both together form the kernel version variable in the system:

vyos@vyos:~$ uname -r
6.1.52-amd64-vyos

• Accel-PPP
• Intel NIC drivers
• Intel QAT
Each of those modules holds a dependency on the kernel version and if you are lucky enough to receive an ISO build
error which sounds like:

I: Create initramfs if it does not exist.

Extra argument '6.1.52-amd64-vyos'
Usage: update-initramfs {-c|-d|-u} [-k version] [-v] [-b directory]
Options:
-k version Specify kernel version or 'all'
-c Create a new initramfs
-u Update an existing initramfs
-d Remove an existing initramfs
-b directory Set alternate boot directory
-v Be verbose
See update-initramfs(8) for further details.
E: config/hooks/live/17-gen_initramfs.chroot failed (exit non-zero). You should check␣
˓→for errors.

The most obvious reasons could be:

• vyos-build repo is outdated, please git pull to update to the latest release kernel version from us.
• You have your own custom kernel *.deb packages in the packages folder but neglected to create all required
out-of tree modules like Accel-PPP, Intel QAT or Intel NIC drivers

14.2. Build ISO 1273

 VyOS Documentation, Release 1.5.x (circinus)

Building The Kernel

The kernel build is quite easy, most of the required steps can be found in the vyos-build/packages/linux-kernel/
Jenkinsfile but we will walk you through it.
Clone the kernel source to vyos-build/packages/linux-kernel/ :

$ cd vyos-build/packages/linux-kernel/
$ git clone https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Check out the required kernel version - see vyos-build/data/defaults.json file (example uses kernel 4.19.146):

$ cd vyos-build/packages/linux-kernel/linux
$ git checkout v4.19.146
Checking out files: 100% (61536/61536), done.
Note: checking out 'v4.19.146'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by performing another checkout.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -b with the checkout command again. Example:

git checkout -b <new-branch-name>

HEAD is now at 015e94d0e37b Linux 4.19.146

Now we can use the helper script build-kernel.sh which does all the necessary voodoo by applying
required patches from the vyos-build/packages/linux-kernel/patches folder, copying our kernel configuration
x86_64_vyos_defconfig to the right location, and finally building the Debian packages.

Note: Building the kernel will take some time depending on the speed and quantity of your CPU/cores and disk speed.
Expect 20 minutes (or even longer) on lower end hardware.

(18:59) vyos_bld 412374ca36b8:/vyos/vyos-build/packages/linux-kernel [current] # ./build-

˓→kernel.sh

I: Copy Kernel config (x86_64_vyos_defconfig) to Kernel Source

I: Apply Kernel patch: /vyos/vyos-build/packages/linux-kernel/patches/kernel/0001-VyOS-
˓→Add-linkstate-IP-device-attribute.patch

patching file Documentation/networking/ip-sysctl.txt

patching file include/linux/inetdevice.h
patching file include/linux/ipv6.h
patching file include/uapi/linux/ip.h
patching file include/uapi/linux/ipv6.h
patching file net/ipv4/devinet.c
Hunk #1 succeeded at 2319 (offset 1 line).
patching file net/ipv6/addrconf.c
patching file net/ipv6/route.c
I: Apply Kernel patch: /vyos/vyos-build/packages/linux-kernel/patches/kernel/0002-VyOS-
˓→add-inotify-support-for-stackable-filesystems-o.patch

patching file fs/notify/inotify/Kconfig

patching file fs/notify/inotify/inotify_user.c
(continues on next page)

14.2. Build ISO 1274

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

patching file fs/overlayfs/super.c
Hunk #2 succeeded at 1713 (offset 9 lines).
Hunk #3 succeeded at 1739 (offset 9 lines).
Hunk #4 succeeded at 1762 (offset 9 lines).
patching file include/linux/inotify.h
I: Apply Kernel patch: /vyos/vyos-build/packages/linux-kernel/patches/kernel/0003-RFC-
˓→builddeb-add-linux-tools-package-with-perf.patch

patching file scripts/package/builddeb

I: make x86_64_vyos_defconfig
HOSTCC scripts/basic/fixdep
HOSTCC scripts/kconfig/conf.o
YACC scripts/kconfig/zconf.tab.c
LEX scripts/kconfig/zconf.lex.c
HOSTCC scripts/kconfig/zconf.tab.o
HOSTLD scripts/kconfig/conf
#
# configuration written to .config
#
I: Generate environment file containing Kernel variable
I: Build Debian Kernel package
UPD include/config/kernel.release
/bin/sh ./scripts/package/mkdebian
dpkg-buildpackage -r"fakeroot -u" -a$(cat debian/arch) -b -nc -uc
dpkg-buildpackage: info: source package linux-4.19.146-amd64-vyos
dpkg-buildpackage: info: source version 4.19.146-1
dpkg-buildpackage: info: source distribution buster
dpkg-buildpackage: info: source changed by vyos_bld <[email protected]>
dpkg-buildpackage: info: host architecture amd64
dpkg-buildpackage: warning: debian/rules is not executable; fixing that
dpkg-source --before-build .
debian/rules build
make KERNELRELEASE=4.19.146-amd64-vyos ARCH=x86 KBUILD_BUILD_VERSION=1 KBUILD_
˓→SRC=

SYSTBL arch/x86/include/generated/asm/syscalls_32.h

...

dpkg-shlibdeps: warning: binaries to analyze should already be installed in their package

˓→'s directory

dpkg-shlibdeps: warning: binaries to analyze should already be installed in their package

˓→'s directory

dpkg-shlibdeps: warning: binaries to analyze should already be installed in their package

˓→'s directory

dpkg-shlibdeps: warning: binaries to analyze should already be installed in their package

˓→'s directory

dpkg-shlibdeps: warning: binaries to analyze should already be installed in their package

˓→'s directory

dpkg-shlibdeps: warning: binaries to analyze should already be installed in their package

˓→'s directory

dpkg-shlibdeps: warning: binaries to analyze should already be installed in their package

˓→'s directory

dpkg-shlibdeps: warning: binaries to analyze should already be installed in their package

(continues on next page)

14.2. Build ISO 1275

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

˓→ 's directory
dpkg-shlibdeps: warning: binaries to analyze should already be installed in their package
˓→'s directory

dpkg-shlibdeps: warning: binaries to analyze should already be installed in their package

˓→'s directory

dpkg-shlibdeps: warning: binaries to analyze should already be installed in their package

˓→'s directory

dpkg-shlibdeps: warning: binaries to analyze should already be installed in their package

˓→'s directory

dpkg-shlibdeps: warning: package could avoid a useless dependency if /vyos/vyos-build/

˓→packages/linux-kernel/linux/debian/toolstmp/usr/bin/trace /vyos/vyos-build/packages/

˓→linux-kernel/linux/debian/toolstmp/usr/bin/perf were not linked against libcrypto.so.1.

˓→1 (they use none of the library's symbols)

dpkg-shlibdeps: warning: package could avoid a useless dependency if /vyos/vyos-build/

˓→packages/linux-kernel/linux/debian/toolstmp/usr/bin/trace /vyos/vyos-build/packages/

˓→linux-kernel/linux/debian/toolstmp/usr/bin/perf were not linked against libcrypt.so.1␣

˓→(they use none of the library's symbols)

dpkg-deb: building package 'linux-tools-4.19.146-amd64-vyos' in '../linux-tools-4.19.146-

˓→amd64-vyos_4.19.146-1_amd64.deb'.

dpkg-genbuildinfo --build=binary
dpkg-genchanges --build=binary >../linux-4.19.146-amd64-vyos_4.19.146-1_amd64.changes
dpkg-genchanges: warning: package linux-image-4.19.146-amd64-vyos-dbg in control file␣
˓→but not in files list

dpkg-genchanges: info: binary-only upload (no source code included)

dpkg-source --after-build .
dpkg-buildpackage: info: binary-only upload (no source included)

In the end you will be presented with the kernel binary packages which you can then use in your custom ISO build
process, by placing all the *.deb files in the vyos-build/packages folder where they will be used automatically when
building VyOS as documented above.

Firmware

If you upgrade your kernel or include new drivers you may need new firmware. Build a new vyos-linux-firmware
package with the included helper scripts.

$ cd vyos-build/packages/linux-kernel
$ git clone https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git
$ ./build-linux-firmware.sh
$ cp vyos-linux-firmware_*.deb ../

This tries to automatically detect which blobs are needed based on which drivers were built. If it fails to find the correct
files you can add them manually to vyos-build/packages/linux-kernel/build-linux-firmware.sh:

ADD_FW_FILES="iwlwifi* ath11k/QCA6390/*/*.bin"

14.2. Build ISO 1276

 VyOS Documentation, Release 1.5.x (circinus)

Building Out-Of-Tree Modules

Building the kernel is one part, but now you also need to build the required out-of-tree modules so everything is lined up
and the ABIs match. To do so, you can again take a look at vyos-build/packages/linux-kernel/Jenkinsfile
to see all of the required modules and their selected versions. We will show you how to build all the current required
modules.

Accel-PPP

First, clone the source code and check out the appropriate version by running:

$ cd vyos-build/packages/linux-kernel
$ git clone https://github.com/accel-ppp/accel-ppp.git

We again make use of a helper script and some patches to make the build work. Just run the following command:

$ ./build-accel-ppp.sh
I: Build Accel-PPP Debian package
CMake Deprecation Warning at CMakeLists.txt:3 (cmake_policy):
The OLD behavior for policy CMP0003 will be removed from a future version
of CMake.

The cmake-policies(7) manual explains that the OLD behaviors of all

policies are deprecated and that a policy should be set to OLD only under
specific short-term circumstances. Projects should be ported to the NEW
behavior and not rely on setting a policy to OLD.

-- The C compiler identification is GNU 8.3.0

...

CPack: Create package using DEB

CPack: Install projects
CPack: - Run preinstall target for: accel-ppp
CPack: - Install project: accel-ppp
CPack: Create package
CPack: - package: /vyos/vyos-build/packages/linux-kernel/accel-ppp/build/accel-ppp.deb␣
˓→generated.

After compiling the packages you will find yourself the newly generated *.deb binaries in vyos-build/packages/
linux-kernel from which you can copy them to the vyos-build/packages folder for inclusion during the ISO
build.

Intel NIC

The Intel NIC drivers do not come from a Git repository, instead we just fetch the tarballs from our mirror and compile
them.
Simply use our wrapper script to build all of the driver modules.

./build-intel-drivers.sh
% Total % Received % Xferd Average Speed Time Time Time Current
(continues on next page)

14.2. Build ISO 1277

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Dload Upload Total Spent Left Speed
100 490k 100 490k 0 0 648k 0 --:--:-- --:--:-- --:--:-- 648k
I: Compile Kernel module for Intel ixgbe driver

...

I: Building Debian package vyos-intel-iavf

Doing `require 'backports'` is deprecated and will not load any backport in the next␣
˓→major release.

Require just the needed backports instead, or 'backports/latest'.

Debian packaging tools generally labels all files in /etc as config files, as mandated␣
˓→by policy, so fpm defaults to this behavior for deb packages. You can disable this␣

˓→default behavior with --deb-no-default-config-files flag {:level=>:warn}

Created package {:path=>"vyos-intel-iavf_4.0.1-0_amd64.deb"}

I: Cleanup iavf source

After compiling the packages you will find yourself the newly generated *.deb binaries in vyos-build/packages/
linux-kernel from which you can copy them to the vyos-build/packages folder for inclusion during the ISO
build.

Intel QAT

The Intel QAT (Quick Assist Technology) drivers do not come from a Git repository, instead we just fetch the tarballs
from 01.org, Intel’s open-source website.
Simply use our wrapper script to build all of the driver modules.

$ ./build-intel-qat.sh
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 5065k 100 5065k 0 0 1157k 0 0:00:04 0:00:04 --:--:-- 1157k
I: Compile Kernel module for Intel qat driver
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes

...

I: Building Debian package vyos-intel-qat

Doing `require 'backports'` is deprecated and will not load any backport in the next␣
˓→major release.

Require just the needed backports instead, or 'backports/latest'.

Debian packaging tools generally labels all files in /etc as config files, as mandated␣
˓→by policy, so fpm defaults to this behavior for deb packages. You can disable this␣

˓→default behavior with --deb-no-default-config-files flag {:level=>:warn}

Created package {:path=>"vyos-intel-qat_1.7.l.4.9.0-00008-0_amd64.deb"}

I: Cleanup qat source

After compiling the packages you will find yourself the newly generated *.deb binaries in vyos-build/packages/
linux-kernel from which you can copy them to the vyos-build/packages folder for inclusion during the ISO

14.2. Build ISO 1278

 VyOS Documentation, Release 1.5.x (circinus)

build.

14.2.3 Packages

If you are brave enough to build yourself an ISO image containing any modified package from our GitHub organisation
- this is the place to be.
Any “modified” package may refer to an altered version of e.g. vyos-1x package that you would like to test before filing
a pull request on GitHub.
Building an ISO with any customized package is in no way different than building a regular (customized or not) ISO
image. Simply place your modified *.deb package inside the packages folder within vyos-build. The build process will
then pickup your custom package and integrate it into your ISO.

14.2.4 Troubleshooting

Debian APT is not very verbose when it comes to errors. If your ISO build breaks for whatever reason and you suspect
it’s a problem with APT dependencies or installation you can add this small patch which increases the APT verbosity
during ISO build.

diff --git i/scripts/live-build-config w/scripts/live-build-config

index 1b3b454..3696e4e 100755
--- i/scripts/live-build-config
+++ w/scripts/live-build-config
@@ -57,7 +57,8 @@ lb config noauto \
--firmware-binary false \
--updates true \
--security true \
- --apt-options "--yes -oAcquire::Check-Valid-Until=false" \
+ --apt-options "--yes -oAcquire::Check-Valid-Until=false -oDebug::BuildDeps=true␣
˓→-oDebug::pkgDepCache::AutoInstall=true \

+ -oDebug::pkgDepCache::Marker=true -
˓→oDebug::pkgProblemResolver=true -oDebug::Acquire::gpgv=true" \

--apt-indices false
"${@}"
"""

14.2.5 Virtualization Platforms

QEMU

Run the following command after building the ISO image.

$ make qemu

14.2. Build ISO 1279

 VyOS Documentation, Release 1.5.x (circinus)

VMware

Run the following command after building the QEMU image.

$ make vmware

14.3 Packages

VyOS itself comes with a bunch of packages that are specific to our system and thus cannot be found in any Debian
mirror. Those packages can be found at the VyOS GitHub project in their source format can easily be compiled into a
custom Debian (*.deb) package.
The easiest way to compile your package is with the above mentioned Docker container, it includes all required depen-
dencies for all VyOS related packages.
Assume we want to build the vyos-1x package on our own and modify it to our needs. We first need to clone the
repository from GitHub.

$ git clone https://github.com/vyos/vyos-1x

14.3.1 Build

Launch Docker container and build package

# For VyOS 1.3 (equuleus, current)

$ docker run --rm -it --privileged -v $(pwd):/vyos -w /vyos vyos/vyos-build:current bash

# Change to source directory

$ cd vyos-1x

# Build DEB
$ dpkg-buildpackage -uc -us -tc -b

After a minute or two you will find the generated DEB packages next to the vyos-1x source directory:

# ls -al ../vyos-1x*.deb
-rw-r--r-- 1 vyos_bld vyos_bld 567420 Aug 3 12:01 ../vyos-1x_1.3dev0-1847-gb6dcb0a8_all.
˓→deb

-rw-r--r-- 1 vyos_bld vyos_bld 3808 Aug 3 12:01 ../vyos-1x-vmware_1.3dev0-1847-

˓→gb6dcb0a8_amd64.deb

14.3.2 Install

To take your newly created package on a test drive you can simply SCP it to a running VyOS instance and install the
new *.deb package over the current running one.
Just install using the following commands:

vyos@vyos:~$ dpkg --install /tmp/vyos-1x_1.3dev0-1847-gb6dcb0a8_all.deb

(Reading database ... 58209 files and directories currently installed.)
Preparing to unpack .../vyos-1x_1.3dev0-1847-gb6dcb0a8_all.deb ...
(continues on next page)

14.3. Packages 1280

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

Unpacking vyos-1x (1.3dev0-1847-gb6dcb0a8) over (1.3dev0-1847-gb6dcb0a8) ...
Setting up vyos-1x (1.3dev0-1847-gb6dcb0a8) ...
Processing triggers for rsyslog (8.1901.0-1) ...

You can also place the generated *.deb into your ISO build environment to include it in a custom iso, see Linux Kernel
for more information.

Warning: Any packages in the packages directory will be added to the iso during build, replacing the upstream
ones. Make sure you delete them (both the source directories and built deb packages) if you want to build an iso
from purely upstream packages.

14.3. Packages 1281

 CHAPTER

FIFTEEN

DEVELOPMENT

All VyOS source code is hosted on GitHub under the VyOS organization which can be found here: https://github.com/
vyos
Our code is split into several modules. VyOS is composed of multiple individual packages, some of them are forks of
upstream packages and are periodically synced with upstream, so keeping the whole source under a single repository
would be very inconvenient and slow. There is now an ongoing effort to consolidate all VyOS-specific framework/config
packages into vyos-1x package, but the basic structure is going to stay the same, just with fewer and fewer packages
while the base code is rewritten from Perl/BASH into Python using and XML based interface definition for the CLI.
The repository that contains all the ISO build scripts is: https://github.com/vyos/vyos-build
The README.md file will guide you to use the this top level repository.

15.1 Submit a Patch

Patches are always more than welcome. To have a clean and easy to maintain repository we have some guidelines when
working with Git. A clean repository eases the automatic generation of a changelog file.
A good approach for writing commit messages is actually to have a look at the file(s) history by invoking git log
path/to/file.txt.

15.1.1 Prepare patch/commit

In a big system, such as VyOS, that is comprised of multiple components, it’s impossible to keep track of all the changes
and bugs/feature requests in one’s head. We use a bugtracker known as Phabricator for it (“issue tracker” would be a
better term, but this one stuck).
The information is used in three ways:
• Keep track of the progress (what we’ve already done in this branch and what we still need to do).
• Prepare release notes for upcoming releases
• Help future maintainers of VyOS (it could be you!) to find out why certain things have been changed in the
codebase or why certain features have been added
To make this approach work, every change must be associated with a task number (prefixed with T) and a component.
If there is no bug report/feature request for the changes you are going to make, you have to create a Phabricator task
first. Once there is an entry in Phabricator, you should reference its id in your commit message, as shown below:
• ddclient: T1030: auto create runtime directories
• Jenkins: add current Git commit ID to build description

1282
 VyOS Documentation, Release 1.5.x (circinus)

If there is no Phabricator reference in the commits of your pull request, we have to ask you to amend the commit
message. Otherwise we will have to reject it.

Writing good commit messages

The format should be and is inspired by: https://git-scm.com/book/ch5-2.html It is also worth reading https://chris.
beams.io/posts/git-commit/
• A single, short, summary of the commit (recommended 50 characters or less, not exceeding 80 characters) con-
taining a prefix of the changed component and the corresponding Phabricator reference e.g. snmp: T1111: or
ethernet: T2222: - multiple components could be concatenated as in snmp: ethernet: T3333
• In some contexts, the first line is treated as the subject of an email and the rest of the text as the body. The blank
line separating the summary from the body is critical (unless you omit the body entirely); tools like rebase can
get confused if you run the two together.
• Followed by a message which describes all the details like:
– What/why/how something has been changed, makes everyone’s life easier when working with git bisect
– All text of the commit message should be wrapped at 72 characters if possible which makes reading commit
logs easier with git log on a standard terminal (which happens to be 80x25)
– If applicable a reference to a previous commit should be made linking those commits nicely when brows-
ing the history: After commit abcd12ef ("snmp: this is a headline") a Python import
statement is missing, throwing the following exception: ABCDEF
• Always use the -x option to the git cherry-pick command when back or forward porting an individual
commit. This automatically appends the line: (cherry picked from commit <ID>) to the original authors
commit message making it easier when bisecting problems.
• Every change set must be consistent (self containing)! Do not fix multiple bugs in a single commit. If you already
worked on multiple fixes in the same file use git add –patch to only add the parts related to the one issue into
your upcoming commit.
Limits:
• We only accept bugfixes in packages other than https://github.com/vyos/vyos-1x as no new functionality should
use the old style templates (node.def and Perl/BASH code. Use the new style XML/Python interface instead.
Please submit your patches using the well-known GitHub pull-request against our repositories found in the VyOS
GitHub organisation at https://github.com/vyos

15.1.2 Determinine source package

Suppose you want to make a change in the webproxy script but yet you do not know which of the many VyOS packages
ship this file. You can determine the VyOS package name in question by using Debian’s dpkg -S command of your
running VyOS installation.

vyos@vyos:~ dpkg -S /opt/vyatta/sbin/vyatta-update-webproxy.pl

vyatta-webproxy: /opt/vyatta/sbin/vyatta-update-webproxy.pl

This means the file in question (/opt/vyatta/sbin/vyatta-update-webproxy.pl) is located in the

vyatta-webproxy package which can be found here: https://github.com/vyos/vyatta-webproxy

15.1. Submit a Patch 1283

 VyOS Documentation, Release 1.5.x (circinus)

15.1.3 Fork Repository and submit Patch

Forking the repository and submitting a GitHub pull-request is the preferred way of submitting your changes to VyOS.
You can fork any VyOS repository to your very own GitHub account by just appending /fork to any repository’s
URL on GitHub. To e.g. fork the vyos-1x repository, open the following URL in your favourite browser: https:
//github.com/vyos/vyos-1x/fork
You then can proceed with cloning your fork or add a new remote to your local repository:
• Clone: git clone https://github.com/<user>/vyos-1x.git
• Fork: git remote add myfork https://github.com/<user>/vyos-1x.git
In order to record you as the author of the fix please identify yourself to Git by setting up your name and email. This
can be done local for this one and only repository git config or globally using git config --global.

git config --global user.name "J. Random Hacker"

git config --global user.email "[email protected]"

Make your changes and save them. Do the following for all changes files to record them in your created Git commit:
• Add file to Git index using git add myfile, or for a whole directory: git add somedir/*
• Commit the changes by calling git commit. Please use a meaningful commit headline (read above) and don’t
forget to reference the Phabricator ID.
• Submit the patch git push and create the GitHub pull-request.

15.1.4 Attach patch to Phabricator task

Follow the above steps on how to “Fork repository to submit a Patch”. Instead of uploading “pushing” your changes
to GitHub you can export the patches/ commits and send it to [email protected] or attach it directly to the bug
(preferred over email)
• Export last commit to patch file: git format-patch or export the last two commits into its appropriate patch
files: git format-patch -2

15.2 Coding Guidelines

Like any other project we have some small guidelines about our source code, too. The rules we have are not there to
punish you - the rules are in place to help us all. By having a consistent coding style it becomes very easy for new and
also longtime contributors to navigate through the sources and all the implied logic of any one source file..
Python 3 shall be used. How long can we keep Python 2 alive anyway? No considerations for Python 2 compatibility
should be taken at any time.

15.2. Coding Guidelines 1284

 VyOS Documentation, Release 1.5.x (circinus)

15.2.1 Formatting

• Python: Tabs shall not be used. Every indentation level should be 4 spaces
• XML: Tabs shall not be used. Every indentation level should be 2 spaces

Note: There are extensions to e.g. VIM (xmllint) which will help you to get your indention levels correct. Add to
following to your .vimrc file: au FileType xml setlocal equalprg=xmllint\ --format\ --recover\ -\
2>/dev/null now you can call the linter using gg=G in command mode.

Text generation

Template processor should be used for generating config files. Built-in string formatting may be used for simple
line-oriented formats where every line is self-contained, such as iptables rules. Template processor must be used for
structured, multi-line formats such as those used by ISC DHCPd.
The default template processor for VyOS code is Jinja2.

15.2.2 Summary

When modifying the source code, remember these rules of the legacy elimination campaign:
• No new features in Perl
• No old style command definitions
• No code incompatible with Python3

15.3 Python

The switch to the Python programming language for new code is not merely a change of the language, but a chance to
rethink and improve the programming approach.
Let’s face it: VyOS is full of spaghetti code where logic for reading the VyOS config, generating daemon configs, and
restarting processes is all mixed up.
Python (or any other language, for that matter) does not provide automatic protection from bad design, so we need to
also devise design guidelines and follow them to keep the system extensible and maintainable.
But we are here to assist you and want to guide you through how you can become a good VyOS contributor. The rules
we have are not there to punish you - the rules are in place to help us all. What does it mean? By having a consistent
coding style it becomes very easy for new contributors and also longtime contributors to navigate through the sources
and all the implied logic of the spaghetti code.
Please use the following template as good starting point when developing new modules or even rewrite a whole bunch
of code in the new style XML/Python interface.

15.3. Python 1285

 VyOS Documentation, Release 1.5.x (circinus)

15.3.1 Configuration Script Structure and Behaviour

Your configuration script or operation mode script which is also written in Python3 should have a line break on 80
characters. This seems to be a bit odd nowadays but as some people also work remotely or program using vi(m) this is
a fair good standard which I hope we can rely on.
In addition this also helps when browsing the GitHub codebase on a mobile device if you happen to be a crazy scientist.

#!/usr/bin/env python3
#
# Copyright (C) 2020 VyOS maintainers and contributors
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2 or later as
# published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.

import sys

from vyos.config import Config

from vyos import ConfigError

def get_config():
if config:
conf = config
else:
conf = Config()

# Base path to CLI nodes

base = ['...', '...']
# Convert the VyOS config to an abstract internal representation
config_data = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
return config_data

def verify(config):
# Verify that configuration is valid
if invalid:
raise ConfigError("Descriptive message")
return True

def generate(config):
# Generate daemon configs
pass

def apply(config):
# Apply the generated configs to the live system
pass
(continues on next page)

15.3. Python 1286

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

try:
c = get_config()
verify(c)
generate(c)
apply(c)
except ConfigError as e:
print(e)
sys.exit(1)

The get_config() function must convert the VyOS config to an abstract, internal representation. No other function
is allowed to call the vyos.config. Config object method directly. The rationale for it is that when config reads are
mixed with other logic, it’s very hard to change the config syntax since you need to weed out every occurrence of the
old syntax. If syntax-specific code is confined to a single function, the rest of the code can be left untouched as long
as the internal representation remains compatible.
Another advantage is testability of the code. Mocking the entire config subsystem is hard, while constructing an internal
representation by hand is way simpler.
The verify() function takes your internal representation of the config and checks if it’s valid, otherwise it must raise
ConfigError with an error message that describes the problem and possibly suggests how to fix it. It must not make
any changes to the system. The rationale for it is again testability and, in the future when the config backend is ready
and every script is rewritten in this fashion, ability to execute commit dry run (“commit test” like in JunOS) and abort
commit before making any changes to the system if an error is found in any component.
The generate() function generates config files for system components.
The apply() function applies the generated configuration to the live system. It should use non-disruptive reload
whenever possible. It may execute disruptive operations such as daemon process restart if a particular component
does not support non-disruptive reload, or when the expected service degradation is minimal (for example, in case of
auxiliary services such as LLDPd). In case of high impact services such as VPN daemon and routing protocols, when
non- disruptive reload is supported for some but not all types of configuration changes, scripts authors should make
effort to determine if a configuration change can be done in a non-disruptive way and only resort to disruptive restart
if it cannot be avoided.
Unless absolutely necessary, configuration scripts should not modify the active configuration of system components
directly. Whenever at all possible, scripts should generate a configuration file or files that can be applied with a single
command such as reloading a service through systemd init. Inserting statements one by one is particularly discouraged,
for example, when configuring netfilter rules, saving them to a file and loading it with iptables-restore should always
be preferred to executing iptables directly.
The apply() and generate() functions may raise ConfigError if, for example, the daemon failed to start with
the updated config. It shouldn’t be a substitute for proper config checking in the verify() function. All reasonable
effort should be made to verify that generated configuration is valid and will be accepted by the daemon, including,
when necessary, cross- checks with other VyOS configuration subtrees.
Exceptions, including VyOSError (which is raised by vyos.config.Config on improper config operations, such as
trying to use list_nodes() on a non-tag node) should not be silenced or caught and re-raised as config error. Sure
this will not look pretty on user’s screen, but it will make way better bug reports, and help users (and most VyOS users
are IT professionals) do their own debugging as well.
For easy orientation we suggest you take a look on the ntp.py or interfaces-bonding.py (for tag nodes) imple-
mentation. Both files can be found in the vyos-1x repository.

15.3. Python 1287

 VyOS Documentation, Release 1.5.x (circinus)

15.4 XML (used for CLI definitions)

The bash (or better vbash) completion in VyOS is defined in templates. Templates are text files (called node.def)
stored in a directory tree. The directory names define the command names, and template files define the command
behaviour. Before VyOS 1.2 (crux) this files were created by hand. After a complex redesign process the new style
template are automatically generated from a XML input file.
XML interface definitions for VyOS come with a RelaxNG schema and are located in the vyos-1x module. This schema
is a slightly modified schema from VyConf alias VyOS 2.0 So VyOS 1.2.x interface definitions will be reusable in
Nextgen VyOS Versions with very minimal changes.
The great thing about schemas is not only that people can know the complete grammar for certain, but also that it can
be automatically verified. The scripts/build-command-templates script that converts the XML definitions to old style
templates also verifies them against the schema, so a bad definition will cause the package build to fail. I do agree that
the format is verbose, but there is no other format now that would allow this. Besides, a specialized XML editor can
alleviate the issue with verbosity.
Example:

<?xml version="1.0"?>
<!-- Cron configuration -->
<interfaceDefinition>
<node name="system">
<children>
<node name="task-scheduler">
<properties>
<help>Task scheduler settings</help>
</properties>
<children>
<tagNode name="task" owner="${vyos_conf_scripts_dir}/task_scheduler.py">
<properties>
<help>Scheduled task</help>
<valueHelp>
<format>&lt;string&gt;</format>
<description>Task name</description>
</valueHelp>
<priority>999</priority>
</properties>
<children>
<leafNode name="crontab-spec">
<properties>
<help>UNIX crontab time specification string</help>
</properties>
</leafNode>
<leafNode name="interval">
<properties>
<help>Execution interval</help>
<valueHelp>
<format>&lt;minutes&gt;</format>
<description>Execution interval in minutes</description>
</valueHelp>
<valueHelp>
<format>&lt;minutes&gt;m</format>
<description>Execution interval in minutes</description>
(continues on next page)

15.4. XML (used for CLI definitions) 1288

 VyOS Documentation, Release 1.5.x (circinus)

(continued from previous page)

</valueHelp>
<valueHelp>
<format>&lt;hours&gt;h</format>
<description>Execution interval in hours</description>
</valueHelp>
<valueHelp>
<format>&lt;days&gt;d</format>
<description>Execution interval in days</description>
</valueHelp>
<constraint>
<regex>[1-9]([0-9]*)([mhd]{0,1})</regex>
</constraint>
</properties>
</leafNode>
<node name="executable">
<properties>
<help>Executable path and arguments</help>
</properties>
<children>
<leafNode name="path">
<properties>
<help>Path to executable</help>
</properties>
</leafNode>
<leafNode name="arguments">
<properties>
<help>Arguments passed to the executable</help>
</properties>
</leafNode>
</children>
</node>
</children>
</tagNode>
</children>
</node>
</children>
</node>
</interfaceDefinition>

Command definitions are purely declarative, and cannot contain any logic. All logic for generating config files for
target applications, restarting services and so on is implemented in configuration scripts instead.

15.4.1 GNU Preprocessor

XML interface definition files use the xml.in file extension which was implemented in T1843. XML interface definitions
tend to have a lot of duplicated code in areas such as:
• VIF (incl. VIF-S/VIF-C)
• Address
• Description
• Enabled/Disabled

15.4. XML (used for CLI definitions) 1289

 VyOS Documentation, Release 1.5.x (circinus)

Instead of supplying all those XML nodes multiple times there are now include files with predefined features. Brief
overview:
• IPv4, IPv6 and DHCP(v6) address assignment
• IPv4, IPv6 address assignment
• VLAN (VIF) definition
• MAC address assignment
All interface definition XML input files (.in suffix) will be sent to the GCC preprocess and the output is stored in the
build/interface-definitions folder. The previously mentioned scripts/build-command-templates script operates on the
build/interface-definitions folder to generate all required CLI nodes.

$ make interface_definitions
install -d -m 0755 build/interface-definitions
install -d -m 0755 build/op-mode-definitions
Generating build/interface-definitions/intel_qat.xml from interface-definitions/intel_
˓→qat.xml.in

Generating build/interface-definitions/interfaces-bonding.xml from interface-definitions/

˓→interfaces-bonding.xml.in

Generating build/interface-definitions/cron.xml from interface-definitions/cron.xml.in

Generating build/interface-definitions/pppoe-server.xml from interface-definitions/pppoe-
˓→server.xml.in

Generating build/interface-definitions/mdns-repeater.xml from interface-definitions/mdns-

˓→repeater.xml.in

Generating build/interface-definitions/tftp-server.xml from interface-definitions/tftp-

˓→server.xml.in

[...]

15.4.2 Guidelines

Use of numbers

Use of numbers in command names should be avoided unless a number is a part of a protocol name or similar. Thus,
protocols ospfv3 is perfectly fine, but something like server-1 is questionable at best.

Help String

To ensure uniform look and feel, and improve readability, we should follow a set of guidelines consistently.

Capitalization and punctuation

The first word of every help string must be capitalized. There must not be a period at the end of help strings.
Rationale: this seems to be the unwritten standard in network device CLIs, and a good aesthetic compromise.
Examples:
• Good: “Frobnication algorithm”
• Bad: “frobnication algorithm”
• Bad: “Frobnication algorithm.”

15.4. XML (used for CLI definitions) 1290

 VyOS Documentation, Release 1.5.x (circinus)

• Horrible: “frobnication algorithm.”

Use of abbreviations and acronyms

Abbreviations and acronyms must be capitalized.

Examples:
• Good: “TCP connection timeout”
• Bad: “tcp connection timeout”
• Horrible: “Tcp connection timeout”
Acronyms also must be capitalized to visually distinguish them from normal words:
Examples:
• Good: RADIUS (as in remote authentication for dial-in user services)
• Bad: radius (unless it’s about the distance between a center of a circle and any of its points)
Some abbreviations are traditionally written in mixed case. Generally, if it contains words “over” or “version”, the
letter should be lowercase. If there’s an accepted spelling (especially if defined by an RFC or another standard), it
must be followed.
Examples:
• Good: PPPoE, IPsec
• Bad: PPPOE, IPSEC
• Bad: pppoe, ipsec

Use of verbs

Verbs should be avoided. If a verb can be omitted, omit it.

Examples:
• Good: “TCP connection timeout”
• Bad: “Set TCP connection timeout”
If a verb is essential, keep it. For example, in the help text of set system ipv6 disable-forwarding, “Disable
IPv6 forwarding on all interfaces” is a perfectly justified wording.

Prefer infinitives

Verbs, when they are necessary, should be in their infinitive form.

Examples:
• Good: “Disable IPv6 forwarding”
• Bad: “Disables IPv6 forwarding”

15.4. XML (used for CLI definitions) 1291

 VyOS Documentation, Release 1.5.x (circinus)

15.4.3 Migrating old CLI

Old concept/syntax New syntax Notes

mynode/node.def <node name=”mynode”> Leaf nodes (nodes with values) use <leafNode> tag in-
</node> stead
mynode/node.tag , tag: <tagNode
name=”mynode> </node>
help: My node <properties> <help>My
node</help>
val_help: <format>; some <properties> <value- Do not add angle brackets around the format, they will
string Help> <format> format be inserted automatically
</format> <description>
some string </descrip-
tion>
syntax:expression: pattern <properties> <constraint> <constraintErrorMessage> will be displayed on failure
<regex> . . .
syntax:expression: None Use regex
$VAR(@) in “foo”,
“bar”, “baz”
syntax:expression: exec <properties> <constraint> “${vyos_libexecdir}/validators/foo bar $VAR(@)” will
... <validator> <name =”foo” be executed, <constraintErrorMessage> will be dis-
argument=”bar”> played on failure
syntax:expression: (arith- None External arithmetic validator may be added if there’s de-
metic expression) mand, complex validation is better left to commit-time
scripts
priority: 999 <properties> <prior- Please leave a comment explaining why the priority was
ity>999</priority> chosen (e.g. “after interfaces are configured”)
multi: <properties> <multi/> Only applicable to leaf nodes
allowed: echo foo bar <properties> <comple-
tionHelp> <list> foo bar
</list>
allowed: cli-shell-api <properties> <comple-
listNodes vpn ipsec esp- tionHelp> <path> vpn
group ipsec esp-group </path>
...
allowed: /path/to/script <properties> <com-
pletionHelp> <script>
/path/to/script </script>
...
default: None Move default values to scripts
commit:expression: None All commit time checks should be in the verify() function
of the script
begin:/create:/delete: None All logic should be in the scripts

15.4. XML (used for CLI definitions) 1292

 VyOS Documentation, Release 1.5.x (circinus)

15.5 C++ Backend Code

The CLI parser used in VyOS is a mix of bash, bash-completion helper and the C++ backend library [vyatta-cfg](https:
//github.com/vyos/vyatta-cfg). This section is a reference of common CLI commands and the respective entry point in
the C/C++ code.
• set
– https://github.com/vyos/vyatta-cfg/blob/0f42786a0b3/src/cstore/cstore.cpp#L352
– https://github.com/vyos/vyatta-cfg/blob/0f42786a0b3/src/cstore/cstore.cpp#L2549
• commit
– https://github.com/vyos/vyatta-cfg/blob/0f42786a0b3/src/commit/commit-algorithm.cpp#L1252

15.6 Continuous Integration

VyOS makes use of Jenkins as our Continuous Integration (CI) service. Our VyOS CI server is publicly accessible
here: https://ci.vyos.net. You can get a brief overview of all required components shipped in a VyOS ISO.
To build our modules we utilize a CI/CD Pipeline script. Each and every VyOS component comes with it’s own
Jenkinsfile which is (more or less) a copy. The Pipeline utilizes the Docker container from the Build ISO section -
but instead of building it from source on every run, we rather always fetch a fresh copy (if needed) from Dockerhub.
Each module is build on demand if a new commit on the branch in question is found. After a successful run the
resulting Debian Package(s) will be deployed to our Debian repository which is used during build time. It is located
here: http://dev.packages.vyos.net/repositories/.

15.5. C++ Backend Code 1293

 CHAPTER

SIXTEEN

ISSUES/FEATURE REQUESTS

16.1 Bug Report/Issue

Issues or bugs are found in any software project. VyOS is not an exception.
All issues should be reported to the developers. This lets the developers know what is not working properly. Without
this sort of feedback every developer will believe that everything is working correctly.

16.1.1 I have found a bug, what should I do?

When you believe you have found a bug, it is always a good idea to verify the issue prior to opening a bug request.
• Consult the documentation to ensure that you have configured your system correctly
• Get community support via Slack or our Forum

16.1.2 Ensure the problem is reproducible

You should include the following information:

• A sequence of configuration commands or a complete configuration file required to recreate a setup where the
bug occurs. Please avoid partial configs: a sequence of commands is easy to paste into the console, a complete
config is easy to load in a VM, but a partial config is neither! At least not until we implement a “merge from the
CLI” feature that allows pasting config file chunks into a session.
• The behavior you expect and how it’s different from the behavior you observe. Don’t just include command
outputs or traffic dumps — try to explain at least briefly why they are wrong and what they should be.
• A sequence of actions that triggers the bug. We understand that it’s not always possible, but it makes developer’s
job a lot easier and also allows any community member to independently confirm that the bug still exists or if
it’s already fixed.
• If it’s a regression, tell us a VyOS version where the feature still worked correctly. It’s perfect if you can tell
exactly which version broke it, but we understand that it’s not always easy or feasible — any working version is
acceptable.
If you aren’t certain what the correct behavior is and if what you see is really a bug, or if you don’t have a reproducing
procedure that reliably triggers it, please create a post on the forum or ask in the chat first — or, if you have a subscription,
create a support ticket. Our team and community members can help you identify the bug and work around it, then create
an actionable and testable bug report.

1294
 VyOS Documentation, Release 1.5.x (circinus)

16.1.3 Report a Bug

In order to open up a bug-report/feature request you need to create yourself an account on VyOS Phabricator. On
the left side of the specific project (VyOS 1.2 or VyOS 1.3) you will find quick-links for opening a bug-report/feature
request.
• Provide as much information as you can
• Which version of VyOS are you using? run show version
• How can we reproduce this Bug?

16.2 Feature Requests

You have an idea of how to make VyOS better or you are in need of a specific feature which all users of VyOS would
benefit from? To send a feature request please search Phabricator to check if there is already a request pending. You
can enhance it or if you don’t find one, create a new one by use the quick link in the left side under the specific project.
You must create a task before you start working on a feature. Yes, even if it’s a tiny feature — we use the task tracker
to generate release notes, so it’s essential that everything is reflected there.
You must include at least the following:
• A reasonably detailed description of the feature: what it is, how it’s supposed to work, and how you’d use it. The
maintainers aren’t familiar with every feature of every protocol and tool, and community contributors who are
looking for tasks to work on will also appreciate more information that helps them implement and test a feature.
• Proposed CLI syntax, if the feature requires new commands. Please include both configuration and operational
mode commands, if both are required.
You should include the following information:
• Is the feature supported by the underlying component (FreeRangeRouting, nftables, Kea. . . ) already?
• How you’d configure it by hand there?
• Are there any limitations (hardware support, resource usage)?
• Are there any adverse or non-obvious interactions with other features? Should it be mutually exclusive with
anything?
It’s fine if you cannot provide some of that information, but if you can, it makes the work of developers considerably
simpler, so try to do the research to answer those questions.

16.3 Task auto-closing

There is a special status for tasks where all work on the side of maintainers and contributors is complete: “Needs
reporter action”.
We assign that status to:
• Feature requests that do not include required information and need clarification.
• Bug reports that lack reproducing procedures.
• Tasks that are implemented and tested by the implementation author, but require testing in the real-world envi-
ronment that only the reporter can replicate (e.g., hardware we do not have, specific network conditions. . . ).
This is what will happen when a task is set to “Needs reporter action”:

16.2. Feature Requests 1295

 VyOS Documentation, Release 1.5.x (circinus)

• If there is no response from the reporter within two weeks, the task bot will add a comment (“Any news?”) to
remind the reporter to reply.
• If there is no response after further two weeks, the task will be automatically closed.
We will not auto-close tasks with any other status and will not close tasks for the lack of maintainer activity!

16.3. Task auto-closing 1296

 CHAPTER

SEVENTEEN

UPSTREAM PACKAGES

Many base system packages are pulled straight from Debian’s main and contrib repositories, but there are exceptions.
This chapter lists those exceptions and gives you a brief overview what we have done on those packages. If you only
want to build yourself a fresh ISO you can completely skip this chapter. It may become interesting once you have a
VyOS deep dive.

17.1 vyos-netplug

Due to issues in the upstream version that sometimes set interfaces down, a modified version is used.
The source is located at https://github.com/vyos/vyos-netplug
In the future, we may switch to using systemd infrastructure instead. Building it doesn’t require a special procedure.

17.2 keepalived

Keepalived normally isn’t updated to newer feature releases between Debian versions, so we are building it from source.
Debian does keep their package in git, but it’s upstream tarball imported into git without its original commit history.
To be able to merge new tags in, we keep a fork of the upstream repository with packaging files imported from Debian
at https://github.com/vyos/keepalived-upstream

17.3 strongswan

Our StrongSWAN build differs from the upstream:

• strongswan-nm package build is disabled since we don’t use NetworkManager
• Patches for DMVPN are merged in
The source is at https://github.com/vyos/vyos-strongswan
DMVPN patches are added by this commit: https://github.com/vyos/vyos-strongswan/commit/
1cf12b0f2f921bfc51affa3b81226
Our op mode scripts use the python-vici module, which is not included in Debian’s build, and isn’t quite easy to integrate
in that build. For this reason we debianize that module by hand now, using this procedure:
0. Install https://pypi.org/project/stdeb/
1. cd vyos-strongswan

1297
 VyOS Documentation, Release 1.5.x (circinus)

2. ./configure –enable-python-eggs
3. cd src/libcharon/plugins/vici/python
4. make
5. python3 setup.py –command-packages=stdeb.command bdist_deb
The package ends up in deb_dist dir.

17.4 mdns-repeater

This package doesn’t exist in Debian. A debianized fork is kept at https://github.com/vyos/mdns-repeater

No special build procedure is required.

17.5 udp-broadcast-relay

This package doesn’t exist in Debian. A debianized fork is kept at https://github.com/vyos/udp-broadcast-relay

No special build procedure is required.

17.6 hvinfo

A fork with packaging changes for VyOS is kept at https://github.com/vyos/hvinfo

The original repo is at https://github.com/dmbaturin/hvinfo
It’s an Ada program and requires GNAT and gprbuild for building, dependencies are properly specified so just follow
debuild’s suggestions.

17.4. mdns-repeater 1298

 CHAPTER

EIGHTEEN

DEBUGGING

There are two flags available to aid in debugging configuration scripts. Since configuration loading issues will manifest
during boot, the flags are passed as kernel boot parameters.

18.1 ISO image build

When having trouble compiling your own ISO image or debugging Jenkins issues you can follow the steps at ISO Build
Issues.

18.2 System Startup

The system startup can be debugged (like loading in the configuration file from /config/config.boot. This can be
achieve by extending the Kernel command-line in the bootloader.

18.2.1 Kernel

• vyos-debug - Adding the parameter to the linux boot line will produce timing results for the execution of
scripts during commit. If one is seeing an unexpected delay during manual or boot commit, this may be useful
in identifying bottlenecks. The internal flag is VYOS_DEBUG, and is found in vyatta-cfg. Output is directed to
/var/log/vyatta/cfg-stdout.log.
• vyos-config-debug - During development, coding errors can lead to a commit failure on boot, possibly result-
ing in a failed initialization of the CLI. In this circumstance, the kernel boot parameter vyos-config-debug will
ensure access to the system as user vyos, and will log a Python stack trace to the file /tmp/boot-config-trace.
File boot-config-trace will generate only if config loaded with a failure status.

18.3 Live System

A number of flags can be set up to change the behaviour of VyOS at runtime. These flags can be toggled using either
environment variables or creating files.
For each feature, a file called vyos.feature.debug can be created to toggle the feature on. If a parameter is required
it can be placed inside the file as its first line.
The file can be placed in /tmp for one time debugging (as the file will be removed on reboot) or placed in ‘/config’ to
stay permanently.
For example, /tmp/vyos.ifconfig.debug can be created to enable interface debugging.

1299
 VyOS Documentation, Release 1.5.x (circinus)

It is also possible to set up the debugging using environment variables. In that case, the name will be (in uppercase)
VYOS_FEATURE_DEBUG.
For example running, export VYOS_IFCONFIG_DEBUG="" on your vbash, will have the same effect as touch /tmp/
vyos.ifconfig.debug.
• ifconfig - Once set, all commands used, and their responses received from the OS, will be presented on the
screen for inspection.
• command - Once set, all commands used, and their responses received from the OS, will be presented on the
screen for inspection.
• developer - Should a command fail, instead of printing a message to the user explaining how to report issues,
the python interpreter will start a PBD post-mortem session to allow the developer to debug the issue. As the
debugger will wait from input from the developer, it has the capacity to prevent a router to boot and therefore
should only be permanently set up on production if you are ready to see the OS fail to boot.
• log - In some rare cases, it may be useful to see what the OS is doing, including during boot. This option sends
all commands used by VyOS to a file. The default file is /tmp/full-log but it can be changed.

Note: In order to retrieve the debug output on the command-line you need to disable vyos-configd in addition. This
can be run either one-time by calling sudo systemctl stop vyos-configd or make this reboot-safe by calling
sudo systemctl disable vyos-configd.

18.3.1 FRR

Recent versions use the vyos.frr framework. The Python class is located inside our vyos-1x:python/vyos/frr.
py. It comes with an embedded debugging/ (print style) debugger as vyos.ifconfig does.
To enable debugging just run: $ touch /tmp/vyos.frr.debug

18.3.2 Debugging Python Code with PDB

Sometimes it might be useful to debug Python code interactively on the live system rather than a IDE. This can be
achieved using pdb.
Let us assume you want to debug a Python script that is called by an op-mode command. After you found the script by
looking up the op-mode-defitions you can edit the script in the live system using e.g. vi: vi /usr/libexec/vyos/
op_mode/show_xyz.py
Insert the following statement right before the section where you want to investigate a problem (e.g. a statement you
see in a backtrace): import pdb; pdb.set_trace() Optionally you can surrounded this statement by an if which
only triggers under the condition you are interested in.
Once you run show xyz and your condition is triggered you should be dropped into the python debugger:

> /usr/libexec/vyos/op_mode/show_nat_translations.py(109)process()
-> rule_type = rule.get('type', '')
(Pdb)

You can type help to get an overview of the available commands, and help command to get more information on each
command.
Useful commands are:
• examine variables using pp(var)

18.3. Live System 1300

 VyOS Documentation, Release 1.5.x (circinus)

• continue execution using cont

• get a backtrace using bt

18.3.3 Config Migration Scripts

When writing a new configuration migrator it may happen that you see an error when you try to invoke it manually on
a development system. This error will look like:

vyos@vyos:~$ /opt/vyatta/etc/config-migrate/migrate/ssh/0-to-1 /tmp/config.boot

Traceback (most recent call last):
File "/opt/vyatta/etc/config-migrate/migrate/ssh/0-to-1", line 31, in <module>
config = ConfigTree(config_file)
File "/usr/lib/python3/dist-packages/vyos/configtree.py", line 134, in __init__
raise ValueError("Failed to parse config: {0}".format(msg))
ValueError: Failed to parse config: Syntax error on line 240, character 1: Invalid␣
˓→syntax.

The reason is that the configuration migration backend is rewritten and uses a new form of “magic string” which is
applied on demand when real config migration is run on boot. When running individual migrators for testing, you need
to convert the “magic string” on your own by:

vyos@vyos:~$ /usr/libexec/vyos/run-config-migration.py --virtual --set-vintage vyos /tmp/

˓→config.boot

18.3.4 Configuration Error on System Boot

Being brave and running the latest rolling releases will sometimes trigger bugs due to corner cases we missed in our
design. Those bugs should be filed via Phabricator but you can help us to narrow down the issue. Login to your VyOS
system and change into configuration mode by typing configure. Now re-load your boot configuration by simply
typing load followed by return.
You should now see a Python backtrace which will help us to handle the issue, please attach it to the Phabricator task.

18.3.5 Boot Timing

During the migration and extensive rewrite of functionality from Perl into Python a significant increase in the overall
system boottime was noticed. The system boot time can be analysed and a graph can be generated in the end which
shows in detail who called whom during the system startup phase.
This is done by utilizing the systemd-bootchart package which is now installed by default on the VyOS 1.3 (equ-
uleus) branch. The configuration is also versioned so we get comparable results. systemd-bootchart is configured
using this file: bootchart.conf
To enable boot time graphing change the Kernel commandline and add the following string: init=/usr/lib/
systemd/systemd-bootchart
This can also be done permanently by changing /boot/grub/grub.cfg.

18.3. Live System 1301

 VyOS Documentation, Release 1.5.x (circinus)

18.4 Priorities

VyOS CLI is all about priorities. Every CLI node has a corresponding node.def file and possibly an attached script
that is executed when the node is present. Nodes can have a priority, and on system bootup - or any other commit to
the config all scripts are executed from lowest to highest priority. This is good as this gives a deterministic behavior.
To debug issues in priorities or to see what’s going on in the background you can use the /opt/vyatta/sbin/
priority.pl script which lists to you the execution order of the scripts.

18.4. Priorities 1302

 CHAPTER

NINETEEN

TESTING

One of the major advantages introduced in VyOS 1.3 is an automated test framework. When assembling an ISO image
multiple things can go wrong badly and publishing a faulty ISO makes no sense. The user is disappointed by the quality
of the image and the developers get flodded with bug reports over and over again.
As the VyOS documentation is not only for users but also for the developers - and we keep no secret documentation -
this section describes how the automated testing works.

19.1 Jenkins CI

Our VyOS CI system is based on Jenkins and builds all our required packages for VyOS 1.2 to 1.4. In addition to
the package build, there is the vyos-build Job which builds and tests the VyOS ISO image which is published after a
successful test drive.
We differentiate in two independent tests, which are both run in parallel by two separate QEmu instances which are
launched via make test and make testc from within the vyos-build repository.

19.2 Smoketests

Smoketests executes predefined VyOS CLI commands and checks if the desired daemon/service configuration is rendert
- that is how to put it “short”.
When and ISO image is assembled by the VyOS CI, the BUILD_SMOKETEST parameter is enabled by default, which
will extend the ISO configuration line with the following packages:

def CUSTOM_PACKAGES = ''

if (params.BUILD_SMOKETESTS)
CUSTOM_PACKAGES = '--custom-package vyos-1x-smoketest'

So if you plan to build your own custom ISO image and want to make use of our smoketests, ensure that you have the
vyos-1x-smoketest package installed.
The make test command from the vyos-build repository will launch a new QEmu instance and the ISO image is first
installed to the virtual harddisk.
After its first boot into the newly installed system the main Smoketest script is executed, it can be found here:
/usr/bin/vyos-smoketest
The script only searches for executable “test-cases” under /usr/libexec/vyos/tests/smoke/cli/ and executes
them one by one.

1303
 VyOS Documentation, Release 1.5.x (circinus)

Note: As Smoketests will alter the system configuration and you are logged in remote you may loose your connection
to the system.

Note: To enable smoketest debugging (print of the CLI set commands used) you can run: touch /tmp/vyos.
smoketest.debug.

19.2.1 Manual Smoketest Run

On the other hand - as each test is contain in its own file - one can always execute a single Smoketest by hand by simply
running the Python test scripts.
Example:

vyos@vyos:~$ /usr/libexec/vyos/tests/smoke/cli/test_protocols_bgp.py
test_bgp_01_simple (__main__.TestProtocolsBGP) ... ok
test_bgp_02_neighbors (__main__.TestProtocolsBGP) ... ok
test_bgp_03_peer_groups (__main__.TestProtocolsBGP) ... ok
test_bgp_04_afi_ipv4 (__main__.TestProtocolsBGP) ... ok
test_bgp_05_afi_ipv6 (__main__.TestProtocolsBGP) ... ok
test_bgp_06_listen_range (__main__.TestProtocolsBGP) ... ok
test_bgp_07_l2vpn_evpn (__main__.TestProtocolsBGP) ... ok
test_bgp_08_zebra_route_map (__main__.TestProtocolsBGP) ... ok
test_bgp_09_distance_and_flowspec (__main__.TestProtocolsBGP) ... ok
test_bgp_10_vrf_simple (__main__.TestProtocolsBGP) ... ok
test_bgp_11_confederation (__main__.TestProtocolsBGP) ... ok
test_bgp_12_v6_link_local (__main__.TestProtocolsBGP) ... ok
test_bgp_13_solo (__main__.TestProtocolsBGP) ... ok

----------------------------------------------------------------------
Ran 13 tests in 348.191s

OK

19.2.2 Interface based tests

Our smoketests not only test daemons and serives, but also check if what we configure for an interface works. Thus there
is a common base classed named: base_interfaces_test.py which holds all the common code that an interface
supports and is tested.
Those common tests consists out of:
• Add one or more IP addresses
• DHCP client and DHCPv6 prefix delegation
• MTU size
• IP and IPv6 options
• Port description
• Port disable

19.2. Smoketests 1304

 VyOS Documentation, Release 1.5.x (circinus)

• VLANs (QinQ and regular 802.1q)

• ...

Note: When you are working on interface configuration and you also want to test if the Smoketests pass you would
normally loose the remote SSH connection to your DUT (Device Under Test). To handle this issue, some of the interface
based tests can be called with an environment variable beforehand to limit the number of interfaces used in the test. By
default all interface e.g. all Ethernet interfaces are used.

vyos@vyos:~$ TEST_ETH="eth1 eth2" /usr/libexec/vyos/tests/smoke/cli/test_interfaces_

˓→bonding.py

test_add_multiple_ip_addresses (__main__.BondingInterfaceTest) ... ok

test_add_single_ip_address (__main__.BondingInterfaceTest) ... ok
test_bonding_hash_policy (__main__.BondingInterfaceTest) ... ok
test_bonding_lacp_rate (__main__.BondingInterfaceTest) ... ok
test_bonding_min_links (__main__.BondingInterfaceTest) ... ok
test_bonding_remove_member (__main__.BondingInterfaceTest) ... ok
test_dhcpv6_client_options (__main__.BondingInterfaceTest) ... ok
test_dhcpv6pd_auto_sla_id (__main__.BondingInterfaceTest) ... ok
test_dhcpv6pd_manual_sla_id (__main__.BondingInterfaceTest) ... ok
test_interface_description (__main__.BondingInterfaceTest) ... ok
test_interface_disable (__main__.BondingInterfaceTest) ... ok
test_interface_ip_options (__main__.BondingInterfaceTest) ... ok
test_interface_ipv6_options (__main__.BondingInterfaceTest) ... ok
test_interface_mtu (__main__.BondingInterfaceTest) ... ok
test_ipv6_link_local_address (__main__.BondingInterfaceTest) ... ok
test_mtu_1200_no_ipv6_interface (__main__.BondingInterfaceTest) ... ok
test_span_mirror (__main__.BondingInterfaceTest) ... ok
test_vif_8021q_interfaces (__main__.BondingInterfaceTest) ... ok
test_vif_8021q_lower_up_down (__main__.BondingInterfaceTest) ... ok
test_vif_8021q_mtu_limits (__main__.BondingInterfaceTest) ... ok
test_vif_8021q_qos_change (__main__.BondingInterfaceTest) ... ok
test_vif_s_8021ad_vlan_interfaces (__main__.BondingInterfaceTest) ... ok
test_vif_s_protocol_change (__main__.BondingInterfaceTest) ... ok

----------------------------------------------------------------------
Ran 23 tests in 244.694s

OK

This will limit the bond interface test to only make use of eth1 and eth2 as member ports.

19.3 Config Load Tests

The other part of our tests are called “config load tests”. The config load tests will load - one after another - arbitrary
configuration files to test if the configuration migration scripts work as designed and that a given set of functionality
still can be loaded with a fresh VyOS ISO image.
The configurations are all derived from production systems and can not only act as a testcase but also as reference if
one wants to enable a certain feature. The configurations can be found here: https://github.com/vyos/vyos-1x/tree/
current/smoketest/configs

19.3. Config Load Tests 1305

 VyOS Documentation, Release 1.5.x (circinus)

The entire test is controlled by the main wrapper script /usr/bin/vyos-configtest which behaves in the same way
as the main smoketest script. It scans the folder for potential configuration files and issues a load command one after
another.

19.3.1 Manual config load test

One is not bound to load all configurations one after another but can also load individual test configurations on his own.

vyos@vyos:~$ configure
load[edit]

vyos@vyos# load /usr/libexec/vyos/tests/config/ospf-small

Loading configuration from '/usr/libexec/vyos/tests/config/ospf-small'
Load complete. Use 'commit' to make changes effective.
[edit]
vyos@vyos# compare
[edit interfaces ethernet eth0]
-hw-id 00:50:56:bf:c5:6d
[edit interfaces ethernet eth1]
+duplex auto
-hw-id 00:50:56:b3:38:c5
+speed auto
[edit interfaces]
-ethernet eth2 {
- hw-id 00:50:56:b3:9c:1d
-}
-vti vti1 {
- address 192.0.2.1/30
-}
...

vyos@vyos# commit
vyos@vyos#

Note: Some of the configurations have preconditions which need to be met. Those most likely include generation of
crypographic keys before the config can be applied - you will get a commit error otherwise. If you are interested how
those preconditions are fulfilled check the vyos-build repository and the scripts/check-qemu-install file.

19.3. Config Load Tests 1306

 CHAPTER

TWENTY

WRITE DOCUMENTATION

We encourage every VyOS user to help us improve our documentation as we have a deficit like most software projects.
This not only helps you when reading but also everyone else.
If you are willing to contribute to our documentation this is the definite guide how to do so.

Note: In contrast to submitting code patches, there is no requirement that you open up a Phabricator task prior to
submitting a Pull-Request to the documentation.

VyOS documentation is written in reStructuredText and generated to Read the Docs pages with Sphinx, as per the
Python tradition. We welcome all sorts of contributions to the documentation. Not just new additions but also correc-
tions to existing documentation.
The documentation source is kept in the Git repository at https://github.com/vyos/vyos-documentation and you can
follow the instructions in the README.md to build and test your changes.
You can either install Sphinx and build the documentation locally, or use the Dockerfile to build it in a container.

20.1 Guidelines

There are a few things to keep in mind when contributing to the documentation, for the sake of consistency and read-
ability.
The following is a quick summary of the rules:
• Use American English at all times. It’s always a good idea to run your text through a grammar and spell checker,
such as Grammarly.
• Don’t forget to update index.rst when adding a new node.
• Try not to exceed 80 characters per line, but don’t break URLs over this.
• Properly quote commands, filenames and brief code snippets with double backticks.
• Use literal blocks for longer snippets.
• Leave a newline before and after a header.
• Indent with two spaces.
• When in doubt, follow the style of existing documentation.
And finally, remember that the reStructuredText files aren’t exclusively for generating HTML and PDF. They should be
human-readable and easily perused from a console.

1307
 VyOS Documentation, Release 1.5.x (circinus)

20.2 Page content

All RST files must follow the same TOC Level syntax and have to start with

#####
Title
#####

The configuration mode folder and the articles cover the specific level of the commands. The exact level depends on
the command. This should provide stability for URLs used in the forum or blogpost.
For example:
• set firewall zone is written in firewall/zone.rst
• set interfaces ethernet is written in interfaces/ethernet.rst
In the configuration part of the page, all possible configuration options should be documented. Use .. cfgcmd::
described above.
Related operation command must be documented in the next part of the article. Use ::opcmd.. for these commands.
Each page must contain the following parts:

20.2.1 1. Theoretical information

Theoretical information required for users to understand the next document sections:
• a simple explanation of what is this page about, why or when it is required to be used
• references to standards, RFCs

20.2.2 2. Configuration description

Describe CLI items related to the service or use case. Each config line or section must be explained, using
information provided in the 1st part of the page.

20.2.3 3. Configuration examples

Practical examples of the service or use case configuration. They must contain topology maps (if applica-
ble) and short descriptions.

20.2.4 4. Known issues

This section must contain a list of:

• known issues or potential problems for the service or use case
• workarounds for known issues (if any exist)

20.2. Page content 1308

 VyOS Documentation, Release 1.5.x (circinus)

20.2.5 5. Debugging

Described procedures for debugging a service:

• how to collect logs or other debugging information (like show commands output)
• how to read and what to search for in logs and collected information
• what are indicators of good and bad states in debugging outputs

20.3 Style Guide

20.3.1 Formatting and Sphinxmarkup

TOC Level

We use the following syntax for Headlines.

#####
Title
#####

********
Chapters
********

Sections
========

Subsections
-----------

Subsubsections
^^^^^^^^^^^^^^

Paragraphs
""""""""""

Cross-References

A plugin will be used to generate a reference label for each headline. To reference a page or a section in the documen-
tation use the :ref: command.
For example, you want to reference the headline VLAN in the ethernet.rst page. The plugin generates the label based
on the headline and the file path.
:ref:`configuration/interfaces/ethernet:vlan
to use an alternative hyperlink use it this way:
:ref:`Check out VLAN<configuration/interfaces/ethernet:vlan>

20.3. Style Guide 1309

 VyOS Documentation, Release 1.5.x (circinus)

handle build errors

The plugin will warn on build if a headline has a duplicate name in the same document. To prevent this warning, you
have to put a custom link on top of the headline.

Section A
==========

Lorem ipsum dolor sit amet, consetetur sadipscing elitr

Example
-------

Lorem ipsum dolor sit amet, consetetur sadipscing elitr

Section B
==========

Lorem ipsum dolor sit amet, consetetur sadipscing elitr

.. _section B example:

Example
-------

Lorem ipsum dolor sit amet, consetetur sadipscing elitr

Address space

Note the following RFCs (RFC 5737, RFC 3849, RFC 5389 and RFC 7042), which describe the reserved public IP
addresses and autonomous system numbers for the documentation:
• 192.0.2.0/24
• 198.51.100.0/24
• 203.0.113.0/24
• 2001:db8::/32
• 16bit ASN: 64496 - 64511
• 32bit ASN: 65536 - 65551
• Unicast MAC Addresses: 00-53-00 to 00-53-FF
• Multicast MAC-Addresses: 90-10-00 to 90-10-FF
Please do not use other public address space.

20.3. Style Guide 1310

 VyOS Documentation, Release 1.5.x (circinus)

Line length

Limit all lines to a maximum of 80 characters.

Except in .. code-block:: because it uses the html tag <pre> and renders the same line format from the source rst
file.

Autolinter

Each GitHub pull request is automatically linted to check the address space and line length.
Sometimes it is necessary to provide real IP addresses like in the Configuration Blueprints. For this, please use the
sphinx comment syntax .. stop_vyoslinter to stop the linter and .. start_vyoslinter to start.

Custom Sphinx-doc Markup

Custom commands have been developed for writing the documentation. Please make yourself comfortable with those
commands as this eases the way we render the documentation.

cfgcmd

When documenting CLI commands, use the .. cfgcmd:: directive for all configuration mode commands. An expla-
nation of the described command should be added below this statement. Replace all variable contents with <value> or
something similar.
With those custom commands, it will be possible to render them in a more descriptive way in the resulting HTML/PDF
manual.

.. cfgcmd:: protocols static arp <ipaddress> hwaddr <macaddress>

This will configure a static ARP entry, always resolving `192.0.2.100` to

`00:53:27:de:23:aa`.

For an inline configuration level command, use :cfgcmd:

:cfgcmd:`set interface ethernet eth0`

To extract a defaultvalue from the XML definitions add a :defaultvalue: to .. cfgcmd:: directive. To have this
feature locally, the vyos-1x submodule must be initialized before. Please be aware to not update the submodule in your
PR.

.. cfgcmd:: set system conntrack table-size <1-50000000>

:defaultvalue:

The connection tracking table contains one entry for each connection being
tracked by the system.

20.3. Style Guide 1311

 VyOS Documentation, Release 1.5.x (circinus)

opcmd

When documenting operational level commands, use the .. opcmd:: directive. An explanation of the described
command should be added below this statement.
With those custom commands, it is possible to render them in a more descriptive way in the resulting HTML/PDF
manual.

.. opcmd:: show protocols static arp

Display all known ARP table entries spanning across all interfaces

For an inline operational level command, use :opcmd:

:opcmd:`add system image`

cmdinclude

To minimize redundancy, there is a special include directive. It includes a txt file and replace the {{ var0 }} - {{
var9 }} with the correct value.

.. cmdinclude:: /_include/interface-address.txt
:var0: ethernet
:var1: eth1

the content of interface-address.txt looks like this

.. cfgcmd:: set interfaces {{ var0 }} <interface> address <address | dhcp |

dhcpv6>

Configure interface `<interface>` with one or more interface

addresses.

* **address** can be specified multiple times as IPv4 and/or IPv6

address, e.g. 192.0.2.1/24 and/or 2001:db8::1/64
* **dhcp** interface address is received by DHCP from a DHCP server
on this segment.
* **dhcpv6** interface address is received by DHCPv6 from a DHCPv6
server on this segment.

Example:

.. code-block:: none

set interfaces {{ var0 }} {{ var1 }} address 192.0.2.1/24

set interfaces {{ var0 }} {{ var1 }} address 192.0.2.2/24
set interfaces {{ var0 }} {{ var1 }} address 2001:db8::ffff/64
set interfaces {{ var0 }} {{ var1 }} address 2001:db8:100::ffff/64

20.3. Style Guide 1312

 VyOS Documentation, Release 1.5.x (circinus)

vytask

When referencing to VyOS Phabricator Tasks, there is a custom Sphinx Markup command called vytask that auto-
matically renders to a proper Phabricator URL. This is heavily used in the Changelog section.

* :vytask:`T1605` Fixed regression in L2TP/IPsec server

* :vytask:`T1613` Netflow/sFlow captures IPv6 traffic correctly

20.4 Forking Workflow

The Forking Workflow is fundamentally different from other popular Git workflows. Instead of using a single server-
side repository to act as the “central” codebase, it gives every developer their own server-side repository. This means
that each contributor has not one, but two Git repositories: a private local one and a public server-side one.
The main advantage of the Forking Workflow is that contributions can be integrated without the need for everybody to
push to a single central repository. Developers push to their own server-side repositories, and only the project maintainer
can push to the official repository. This allows the maintainer to accept commits from any developer without giving
them write access to the official codebase.

Note: Updates to our documentation should be delivered by a GitHub pull-request. This requires you already have a
GitHub account.

• Fork this project on GitHub https://github.com/vyos/vyos-documentation/fork

• Clone fork to local machine, then change to that directory $ cd vyos-documentation
• Install the requirements $ pip install -r requirements.txt (or something similar)
• Create a new branch for your work, use a descriptive name of your work: $ git checkout -b
<branch-name>
• Make all your changes - please keep our commit rules in mind (Prepare patch/commit). This mainly applies to
proper commit messages describing your change (how and why). Please check out the documentation of Sphinx-
doc or reStructuredText if you are not familiar with it. This is used for writing our docs. Additional directives
how to write in RST can be obtained from reStructuredTextDirectives.
• Check your changes by locally building the documentation $ make livehtml. Sphinx will build the html files
in the docs/_build folder. We provide you with a Docker container for an easy-to-use user experience. Check
the README.md file of this repository.
• View modified files by calling $ git status. You will get an overview of all files modified by you. You can
add individual files to the Git Index in the next step.
• Add modified files to Git index $ git add path/to/filename or add all unstaged files $ git add .. All
files added to the Git index will be part of you following Git commit.
• Commit your changes with the message, $ git commit -m "<commit message>" or use $ git commit
-v to have your configured editor launched. You can type in a commit message. Again please make yourself
comfortable without rules (Prepare patch/commit).
• Push commits to your GitHub project: $ git push -u origin <branch-name>
• Submit pull-request. In GitHub visit the main repository and you should see a banner suggesting to make a pull
request. Fill out the form and describe what you do.

20.4. Forking Workflow 1313

 VyOS Documentation, Release 1.5.x (circinus)

• Once pull requests have been approved, you may want to locally update your forked repository too. First
you’ll have to add a second remote called upstream which points to our main repository. $ git remote add
upstream https://github.com/vyos/vyos-documentation.git
Check your configured remote repositories:

$ git remote -v
origin https://github.com/<username>/vyos-documentation.git (fetch)
origin https://github.com/<username>/vyos.documentation.git (push)
upstream https://github.com/vyos/vyos-documentation.git (fetch)
upstream https://github.com/vyos/vyos-documentation.git (push)

Your remote repo on Github is called origin, while the original repo you have forked is called upstream. Now
you can locally update your forked repo.

$ git fetch upstream

$ git checkout current
$ git merge upstream/current

• If you also want to update your fork on GitHub, use the following: $ git push origin current

20.4. Forking Workflow 1314

 CHAPTER

TWENTYONE

COVERAGE

Overview over all commands, which are documented in the .. cfgcmd:: or .. opcmd:: Directives.
The build process take all xml definition files from vyos-1x and a periodical export of all VyOS commands and extract
each leaf command or executable command. After this the commands are compare and shown in the following two
tables. The script compare only the fixed part of a command. All varables or values will be erase and then compare:
for example there are these two commands:
• documentation: interfaces ethernet <interface> address <address | dhcp | dhcpv6>
• xml: interfaces ethernet <ethernet> address <address>
• VyOS: interfaces ethernet <text> address <value>
Now the script earse all in between < and > and simply compare the strings.
There are 3 kind of problems:
Not documented yet
• A XML command are not found in .. cfgcmd:: or .. opcmd:: Commands
• The command should be documented
Nothing found in XML Definitions
• .. cfgcmd:: or .. opcmd:: Command are not found in a XML command
• Maybe the command where changed in the XML Definition, the feature is not anymore in VyOS, or there is a
typo
Nothing found in VyOS
• .. cfgcmd:: or .. opcmd:: Command are not found in a VyOS command
• Maybe the command where changed, the feature is not anymore in VyOS, or there is a typo

21.1 Configuration Commands

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-

202308240020
× set Nothing found in XML Nothing found in VyOS
Definitions
× not yet documented Nothing found in XML cluster dead-interval
Definitions <value>
continues on next page

1315
 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented Nothing found in XML cluster group <text> auto-
Definitions failback <value>
× not yet documented Nothing found in XML cluster group <text> mon-
Definitions itor <value>
× not yet documented Nothing found in XML cluster group <text> pri-
Definitions mary <value>
× not yet documented Nothing found in XML cluster group <text> sec-
Definitions ondary <value>
× not yet documented Nothing found in XML cluster group <text> ser-
Definitions vice <value>
× not yet documented Nothing found in XML cluster interface <value>
Definitions
× not yet documented Nothing found in XML cluster keepalive-interval
Definitions <value>
× not yet documented Nothing found in XML cluster mcast-group
Definitions <value>
× not yet documented Nothing found in XML cluster monitor-dead-
Definitions interval <value>
× not yet documented Nothing found in XML cluster pre-shared-secret
Definitions <value>
× comment <config Nothing found in XML Nothing found in VyOS
node> "comment text" Definitions
× commit Nothing found in XML Nothing found in VyOS
Definitions
× commit-confirm Nothing found in XML Nothing found in VyOS
<minutes> Definitions
× compare <saved | N> Nothing found in XML Nothing found in VyOS
<M> Definitions
✓ set container container.xml.in: container name <text>
name <name> container name <name> allow-host-networks
allow-host-networks allow-host-networks
× set container Nothing found in XML Nothing found in VyOS
name <name> Definitions
allow-host-pid
✓ set container name container.xml.in: container name <text> ar-
<name> arguments container name <name> guments <value>
<arguments> arguments
× not yet documented Nothing found in XML container name <text>
Definitions cap-add <value>
× set container name container.xml.in: Nothing found in VyOS
<name> capability container name <name>
<text> capability
✓ set container name container.xml.in: container name <text>
<name> command container name <name> command <value>
<command> command
× set container name Nothing found in XML Nothing found in VyOS
<name> cpu-quota Definitions
<num>
continues on next page

21.1. Configuration Commands 1316

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set container name container.xml.in: container name <text> de-
<name> description container name <name> scription <value>
<text> description
✓ set container name container.xml.in: container name <text>
<name> device container name <name> device <text> destination
<devicename> device <device> destina- <value>
destination <path> tion
✓ set container container.xml.in: container name <text>
name <name> device container name <name> device <text> source
<devicename> source device <device> source <value>
<path>
✓ set container name container.xml.in: container name <text> dis-
<name> disable container name <name> able
disable
✓ set container name container.xml.in: container name <text> en-
<name> entrypoint container name <name> trypoint <value>
<entrypoint> entrypoint
✓ set container name container.xml.in: container name <text>
<name> environment container name <name> environment <text> value
<key> value <value> environment <environ- <value>
ment> value
× set container name container.xml.in: Nothing found in VyOS
<name> gid <number> container name <name>
gid
✓ set container name container.xml.in: container name <text>
<name> host-name container name <name> host-name <value>
<hostname> host-name
✓ set container name container.xml.in: container name <text> im-
<name> image container name <name> age <value>
image
× set container name container.xml.in: Nothing found in VyOS
<name> label <label> container name <name>
value <value> label <label> value
✓ set container name container.xml.in: container name <text>
<name> memory <MB> container name <name> memory <value>
memory
× set container name Nothing found in XML Nothing found in VyOS
<name> network Definitions
<networkname>
✓ set container name container.xml.in: container name <text>
<name> network container name <name> network <text> address
<networkname> network <network> <value>
address <address> address
✓ set container container.xml.in: container name <text>
name <name> container name <name> port <text> destination
port <portname> port <port> destination <value>
destination
<portnumber>
continues on next page

21.1. Configuration Commands 1317

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented container.xml.in: container name <text>
container name <name> port <text> listen-address
port <port> listen-address <value>
✓ set container container.xml.in: container name <text>
name <name> port container name <name> port <text> protocol
<portname> protocol port <port> protocol <value>
<tcp | udp>
✓ set container container.xml.in: container name <text>
name <name> port container name <name> port <text> source
<portname> source port <port> source <value>
<portnumber>
✓ set container name container.xml.in: container name <text>
<name> restart container name <name> restart <value>
[no | on-failure restart
| always]
× not yet documented container.xml.in: container name <text>
container name <name> shared-memory <value>
shared-memory
× set container Nothing found in XML Nothing found in VyOS
name <name> Definitions
sysctl parameter
<parameter> value
<value>
× set container name container.xml.in: Nothing found in VyOS
<name> uid <number> container name <name>
uid
✓ set container name container.xml.in: container name <text>
<name> volume container name <name> volume <text> destination
<volumename> volume <volume> destina- <value>
destination <path> tion
✓ set container name container.xml.in: container name <text>
<name> volume container name <name> volume <text> mode
<volumename> mode volume <volume> mode <value>
<ro | rw>
× not yet documented container.xml.in: container name <text>
container name <name> volume <text> propaga-
volume <volume> propa- tion <value>
gation
✓ set container container.xml.in: container name <text>
name <name> volume container name <name> volume <text> source
<volumename> source volume <volume> source <value>
<path>
× set container Nothing found in XML Nothing found in VyOS
network <name> Definitions
✓ set container container.xml.in: container network <text>
network <name> container network <net- description <value>
description work> description
continues on next page

21.1. Configuration Commands 1318

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set container container.xml.in: container network <text>
network <name> container network <net- prefix <value>
prefix <ipv4|ipv6> work> prefix
✓ set container container.xml.in: container network <text>
network <name> vrf container network <net- vrf <value>
<nme> work> vrf
× set container Nothing found in XML Nothing found in VyOS
registry <name> Definitions
✓ set container container.xml.in: container registry <text>
registry <name> container registry <reg- authentication password
authentication istry> authentication <value>
password password
✓ set container container.xml.in: container registry <text>
registry <name> container registry <reg- authentication username
authentication istry> authentication <value>
username username
✓ set container container.xml.in: container registry <text>
registry <name> container registry <reg- disable
disable istry> disable
× copy Nothing found in XML Nothing found in VyOS
Definitions
× delete Nothing found in XML Nothing found in VyOS
Definitions
× delete protocols Nothing found in XML Nothing found in VyOS
static route 0.0.0. Definitions
0/0
× exit [discard] Nothing found in XML Nothing found in VyOS
Definitions
× set firewall bridge Nothing found in XML Nothing found in VyOS
... Definitions
× set firewall bridge firewall.xml.in: Nothing found in VyOS
forward filter firewall bridge forward fil-
default-action ter default-action
[accept | drop]
× set firewall bridge firewall.xml.in: Nothing found in VyOS
forward filter firewall bridge forward fil-
default-log ter default-log
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall bridge forward fil-
ter description
× set firewall bridge firewall.xml.in: Nothing found in VyOS
forward filter rule firewall bridge forward fil-
<1-999999> action ter rule <rule> action
[accept | continue |
drop | jump | queue
| return]
continues on next page

21.1. Configuration Commands 1319

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall bridge firewall.xml.in: Nothing found in VyOS
forward filter firewall bridge forward fil-
rule <1-999999> ter rule <rule> destination
destination mac-address
mac-address
<mac-address>
× set firewall bridge firewall.xml.in: Nothing found in VyOS
forward filter rule firewall bridge forward fil-
<1-999999> disable ter rule <rule> disable
× set firewall bridge firewall.xml.in: Nothing found in VyOS
forward filter firewall bridge forward fil-
rule <1-999999> ter rule <rule> inbound-
inbound-interface interface group
group <iface_group>
× set firewall bridge firewall.xml.in: Nothing found in VyOS
forward filter firewall bridge forward fil-
rule <1-999999> ter rule <rule> inbound-
inbound-interface interface name
name <iface>
× set firewall bridge firewall.xml.in: Nothing found in VyOS
forward filter firewall bridge forward fil-
rule <1-999999> ter rule <rule> jump-target
jump-target <text>
× set firewall bridge firewall.xml.in: Nothing found in VyOS
forward filter rule firewall bridge forward fil-
<1-999999> log ter rule <rule> log
× set firewall bridge firewall.xml.in: Nothing found in VyOS
forward filter firewall bridge forward fil-
rule <1-999999> ter rule <rule> log-options
log-options group group
<0-65535>
× set firewall bridge firewall.xml.in: Nothing found in VyOS
forward filter firewall bridge forward fil-
rule <1-999999> ter rule <rule> log-options
log-options level level
[emerg | alert |
crit | err | warn
| notice | info |
debug]
× set firewall bridge firewall.xml.in: Nothing found in VyOS
forward filter firewall bridge forward fil-
rule <1-999999> ter rule <rule> log-options
log-options queue-threshold
queue-threshold
<0-65535>
continues on next page

21.1. Configuration Commands 1320

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall bridge firewall.xml.in: Nothing found in VyOS
forward filter firewall bridge forward fil-
rule <1-999999> ter rule <rule> log-options
log-options snapshot-length
snapshot-length
<0-9000>
× set firewall bridge firewall.xml.in: Nothing found in VyOS
forward filter firewall bridge forward fil-
rule <1-999999> ter rule <rule> outbound-
outbound-interface interface group
group <iface_group>
× set firewall bridge firewall.xml.in: Nothing found in VyOS
forward filter firewall bridge forward fil-
rule <1-999999> ter rule <rule> outbound-
outbound-interface interface name
name <iface>
× set firewall bridge firewall.xml.in: Nothing found in VyOS
forward filter rule firewall bridge forward fil-
<1-999999> queue ter rule <rule> queue
<0-65535>
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall bridge forward
filter rule <rule> queue-
options
× set firewall bridge Nothing found in XML Nothing found in VyOS
forward filter Definitions
rule <1-999999>
queue-options
bypass
× set firewall bridge Nothing found in XML Nothing found in VyOS
forward filter Definitions
rule <1-999999>
queue-options
fanout
× set firewall bridge firewall.xml.in: Nothing found in VyOS
forward filter firewall bridge forward
rule <1-999999> filter rule <rule> source
source mac-address mac-address
<mac-address>
× set firewall bridge firewall.xml.in: Nothing found in VyOS
forward filter rule firewall bridge forward fil-
<1-999999> vlan id ter rule <rule> vlan id
<0-4096>
× set firewall bridge firewall.xml.in: Nothing found in VyOS
forward filter rule firewall bridge forward fil-
<1-999999> vlan ter rule <rule> vlan prior-
priority <0-7> ity
continues on next page

21.1. Configuration Commands 1321

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall firewall.xml.in: Nothing found in VyOS
bridge name <name> firewall bridge name
default-action <name> default-action
[accept | continue |
drop | jump | queue
| return]
× set firewall firewall.xml.in: Nothing found in VyOS
bridge name <name> firewall bridge name
default-jump-target <name> default-jump-
<text> target
× set firewall firewall.xml.in: Nothing found in VyOS
bridge name <name> firewall bridge name
default-log <name> default-log
× set firewall firewall.xml.in: Nothing found in VyOS
bridge name <name> firewall bridge name
description <text> <name> description
× set firewall bridge firewall.xml.in: Nothing found in VyOS
name <name> rule firewall bridge name
<1-999999> action <name> rule <rule>
[accept | continue | action
drop | jump | queue
| return]
× set firewall firewall.xml.in: Nothing found in VyOS
bridge name <name> firewall bridge name
rule <1-999999> <name> rule <rule>
destination destination mac-address
mac-address
<mac-address>
× set firewall bridge firewall.xml.in: Nothing found in VyOS
name <name> rule firewall bridge name
<1-999999> disable <name> rule <rule>
disable
× set firewall firewall.xml.in: Nothing found in VyOS
bridge name <name> firewall bridge name
rule <1-999999> <name> rule <rule>
inbound-interface inbound-interface group
group <iface_group>
× set firewall firewall.xml.in: Nothing found in VyOS
bridge name <name> firewall bridge name
rule <1-999999> <name> rule <rule>
inbound-interface inbound-interface name
name <iface>
× set firewall firewall.xml.in: Nothing found in VyOS
bridge name <name> firewall bridge name
rule <1-999999> <name> rule <rule>
jump-target <text> jump-target
× set firewall bridge firewall.xml.in: Nothing found in VyOS
name <name> rule firewall bridge name
<1-999999> log <name> rule <rule> log
continues on next page

21.1. Configuration Commands 1322

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall firewall.xml.in: Nothing found in VyOS
bridge name <name> firewall bridge name
rule <1-999999> <name> rule <rule>
log-options group log-options group
<0-65535>
× set firewall firewall.xml.in: Nothing found in VyOS
bridge name <name> firewall bridge name
rule <1-999999> <name> rule <rule>
log-options level log-options level
[emerg | alert |
crit | err | warn
| notice | info |
debug]
× set firewall firewall.xml.in: Nothing found in VyOS
bridge name <name> firewall bridge name
rule <1-999999> <name> rule <rule> log-
log-options options queue-threshold
queue-threshold
<0-65535>
× set firewall firewall.xml.in: Nothing found in VyOS
bridge name <name> firewall bridge name
rule <1-999999> <name> rule <rule> log-
log-options options snapshot-length
snapshot-length
<0-9000>
× set firewall firewall.xml.in: Nothing found in VyOS
bridge name <name> firewall bridge name
rule <1-999999> <name> rule <rule>
outbound-interface outbound-interface group
group <iface_group>
× set firewall firewall.xml.in: Nothing found in VyOS
bridge name <name> firewall bridge name
rule <1-999999> <name> rule <rule>
outbound-interface outbound-interface name
name <iface>
× set firewall bridge firewall.xml.in: Nothing found in VyOS
name <name> rule firewall bridge name
<1-999999> queue <name> rule <rule>
<0-65535> queue
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall bridge name
<name> rule <rule>
queue-options
× set firewall Nothing found in XML Nothing found in VyOS
bridge name <name> Definitions
rule <1-999999>
queue-options
bypass
continues on next page

21.1. Configuration Commands 1323

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall Nothing found in XML Nothing found in VyOS
bridge name <name> Definitions
rule <1-999999>
queue-options
fanout
× set firewall firewall.xml.in: Nothing found in VyOS
bridge name <name> firewall bridge name
rule <1-999999> <name> rule <rule>
source mac-address source mac-address
<mac-address>
× set firewall bridge firewall.xml.in: Nothing found in VyOS
name <name> rule firewall bridge name
<1-999999> vlan id <name> rule <rule> vlan
<0-4096> id
× set firewall bridge firewall.xml.in: Nothing found in VyOS
name <name> rule firewall bridge name
<1-999999> vlan <name> rule <rule> vlan
priority <0-7> priority
× set firewall firewall.xml.in: Nothing found in VyOS
flowtable firewall flowtable
<flow_table_name> <flowtable> descrip-
description <text> tion
× set firewall firewall.xml.in: Nothing found in VyOS
flowtable firewall flowtable
<flow_table_name> <flowtable> interface
interface <iface>
× set firewall firewall.xml.in: Nothing found in VyOS
flowtable firewall flowtable
<flow_table_name> <flowtable> offload
offload <hardware |
software>
× set firewall Nothing found in XML Nothing found in VyOS
flowtables ... Definitions
× set firewall [ipv4 | Nothing found in XML Nothing found in VyOS
ipv6] forward filter Definitions
rule <1-999999>
action offload
× set firewall [ipv4 | Nothing found in XML Nothing found in VyOS
ipv6] forward filter Definitions
rule <1-999999>
offload-target
<flowtable>
× set firewall Nothing found in XML Nothing found in VyOS
global-options .. Definitions
.
✓ set firewall firewall.xml.in: firewall global-options all-
global-options firewall global-options all- ping <value>
all-ping [enable ping
| disable]
continues on next page

21.1. Configuration Commands 1324

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall firewall.xml.in: firewall global-options
global-options firewall global-options broadcast-ping <value>
broadcast-ping broadcast-ping
[enable | disable]
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall global-options
directed-broadcast
✓ set firewall firewall.xml.in: firewall global-options ip-
global-options firewall global-options ip- src-route <value>
ip-src-route [enable src-route
| disable]
✓ set firewall firewall.xml.in: firewall global-options
global-options firewall global-options ipv6-receive-redirects
ipv6-receive-redirects ipv6-receive-redirects <value>
[enable | disable]
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall global-options
ipv6-source-validation
✓ set firewall firewall.xml.in: firewall global-options
global-options firewall global-options ipv6-src-route <value>
ipv6-src-route ipv6-src-route
[enable | disable]
✓ set firewall firewall.xml.in: firewall global-options
global-options firewall global-options log-martians <value>
log-martians [enable log-martians
| disable]
✓ set firewall firewall.xml.in: firewall global-options
global-options firewall global-options receive-redirects <value>
receive-redirects receive-redirects
[enable | disable]
× not yet documented firewall.xml.in: firewall global-options
firewall global-options resolver-cache
resolver-cache
× not yet documented firewall.xml.in: firewall global-options
firewall global-options resolver-interval <value>
resolver-interval
✓ set firewall firewall.xml.in: firewall global-options
global-options firewall global-options send-redirects <value>
send-redirects send-redirects
[enable | disable]
✓ set firewall firewall.xml.in: firewall global-options
global-options firewall global-options source-validation <value>
source-validation source-validation
[strict | loose |
disable]
continues on next page

21.1. Configuration Commands 1325

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall firewall.xml.in: Nothing found in VyOS
global-options firewall global-options
state-policy state-policy established
established action action
[accept | drop |
reject]
× set firewall firewall.xml.in: Nothing found in VyOS
global-options firewall global-options
state-policy state-policy established
established log log
× set firewall firewall.xml.in: Nothing found in VyOS
global-options firewall global-options
state-policy state-policy established
established log-level
log-level [emerg
| alert | crit | err
| warn | notice |
info | debug]
× set firewall firewall.xml.in: Nothing found in VyOS
global-options firewall global-options
state-policy invalid state-policy invalid action
action [accept |
drop | reject]
× set firewall firewall.xml.in: Nothing found in VyOS
global-options firewall global-options
state-policy invalid state-policy invalid log
log
× set firewall firewall.xml.in: Nothing found in VyOS
global-options firewall global-options
state-policy invalid state-policy invalid log-
log-level [emerg | level
alert | crit | err |
warn | notice | info
| debug]
× set firewall firewall.xml.in: Nothing found in VyOS
global-options firewall global-options
state-policy related state-policy related action
action [accept |
drop | reject]
× set firewall firewall.xml.in: Nothing found in VyOS
global-options firewall global-options
state-policy related state-policy related log
log
continues on next page

21.1. Configuration Commands 1326

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall firewall.xml.in: Nothing found in VyOS
global-options firewall global-options
state-policy related state-policy related log-
log-level [emerg | level
alert | crit | err |
warn | notice | info
| debug]
✓ set firewall firewall.xml.in: firewall global-options
global-options firewall global-options syn-cookies <value>
syn-cookies [enable syn-cookies
| disable]
× set firewall Nothing found in XML Nothing found in VyOS
global-options Definitions
timeout icmp
<1-21474836>
× set firewall Nothing found in XML Nothing found in VyOS
global-options Definitions
timeout other
<1-21474836>
× set firewall Nothing found in XML Nothing found in VyOS
global-options Definitions
timeout tcp close
<1-21474836>
× set firewall Nothing found in XML Nothing found in VyOS
global-options Definitions
timeout tcp
close-wait
<1-21474836>
× set firewall Nothing found in XML Nothing found in VyOS
global-options Definitions
timeout tcp
established
<1-21474836>
× set firewall Nothing found in XML Nothing found in VyOS
global-options Definitions
timeout tcp fin-wait
<1-21474836>
× set firewall Nothing found in XML Nothing found in VyOS
global-options Definitions
timeout tcp last-ack
<1-21474836>
× set firewall Nothing found in XML Nothing found in VyOS
global-options Definitions
timeout tcp syn-recv
<1-21474836>
× set firewall Nothing found in XML Nothing found in VyOS
global-options Definitions
timeout tcp syn-sent
<1-21474836>
continues on next page

21.1. Configuration Commands 1327

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall Nothing found in XML Nothing found in VyOS
global-options Definitions
timeout tcp
time-wait
<1-21474836>
× set firewall Nothing found in XML Nothing found in VyOS
global-options Definitions
timeout udp other
<1-21474836>
× set firewall Nothing found in XML Nothing found in VyOS
global-options Definitions
timeout udp stream
<1-21474836>
✓ set firewall firewall.xml.in: firewall global-options
global-options firewall global-options twa-hazards-protection
twa-hazards-protection twa-hazards-protection <value>
[enable | disable]
✓ set firewall group firewall.xml.in: firewall group address-
address-group <name> firewall group address- group <text> address
address [address | group <address-group> <value>
address range] address
✓ set firewall group firewall.xml.in: firewall group address-
address-group <name> firewall group address- group <text> description
description <text> group <address-group> <value>
description
× not yet documented firewall.xml.in: firewall group address-
firewall group address- group <text> include
group <address-group> <value>
include
✓ set firewall group firewall.xml.in: firewall group domain-
domain-group <name> firewall group domain- group <text> address
address <domain> group <domain-group> <value>
address
✓ set firewall group firewall.xml.in: firewall group domain-
domain-group <name> firewall group domain- group <text> description
description <text> group <domain-group> <value>
description
× set firewall group Nothing found in XML Nothing found in VyOS
dynamic-group Definitions
address-group
<name>
× set firewall group firewall.xml.in: Nothing found in VyOS
dynamic-group firewall group dynamic-
address-group <name> group address-group
description <text> <address-group> descrip-
tion
continues on next page

21.1. Configuration Commands 1328

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall group Nothing found in XML Nothing found in VyOS
dynamic-group Definitions
ipv6-address-group
<name>
× set firewall group firewall.xml.in: Nothing found in VyOS
dynamic-group firewall group dynamic-
ipv6-address-group group ipv6-address-group
<name> description <ipv6-address-group> de-
<text> scription
✓ set firewall group firewall.xml.in: firewall group interface-
interface-group firewall group interface- group <text> description
<name> description group <interface-group> <value>
<text> description
× not yet documented firewall.xml.in: firewall group interface-
firewall group interface- group <text> include
group <interface-group> <value>
include
✓ set firewall group firewall.xml.in: firewall group interface-
interface-group firewall group interface- group <text> interface
<name> interface group <interface-group> <value>
<text> interface
✓ set firewall group firewall.xml.in: firewall group ipv6-
ipv6-address-group firewall group ipv6- address-group <text>
<name> address address-group <ipv6- address <value>
<address> address-group> address
✓ set firewall group firewall.xml.in: firewall group ipv6-
ipv6-address-group firewall group ipv6- address-group <text>
<name> description address-group <ipv6- description <value>
<text> address-group> descrip-
tion
× not yet documented firewall.xml.in: firewall group ipv6-
firewall group ipv6- address-group <text>
address-group <ipv6- include <value>
address-group> include
✓ set firewall group firewall.xml.in: firewall group ipv6-
ipv6-network-group firewall group ipv6- network-group <text>
<name> description network-group <ipv6- description <value>
<text> network-group> descrip-
tion
× not yet documented firewall.xml.in: firewall group ipv6-
firewall group ipv6- network-group <text>
network-group <ipv6- include <value>
network-group> include
✓ set firewall group firewall.xml.in: firewall group ipv6-
ipv6-network-group firewall group ipv6- network-group <text>
<name> network network-group <ipv6- network <value>
<CIDR> network-group> network
continues on next page

21.1. Configuration Commands 1329

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall group firewall.xml.in: firewall group mac-
mac-group <name> firewall group mac-group group <text> description
description <text> <mac-group> description <value>
× not yet documented firewall.xml.in: firewall group mac-group
firewall group mac-group <text> include <value>
<mac-group> include
✓ set firewall firewall.xml.in: firewall group mac-group
group mac-group firewall group mac- <text> mac-address
<name> mac-address group <mac-group> <value>
<mac-address> mac-address
✓ set firewall group firewall.xml.in: firewall group network-
network-group <name> firewall group network- group <text> description
description <text> group <network-group> <value>
description
× not yet documented firewall.xml.in: firewall group network-
firewall group network- group <text> include
group <network-group> <value>
include
✓ set firewall group firewall.xml.in: firewall group network-
network-group <name> firewall group network- group <text> network
network <CIDR> group <network-group> <value>
network
✓ set firewall group firewall.xml.in: firewall group port-
port-group <name> firewall group port-group group <text> description
description <text> <port-group> description <value>
× not yet documented firewall.xml.in: firewall group port-group
firewall group port-group <text> include <value>
<port-group> include
✓ set firewall group firewall.xml.in: firewall group port-group
port-group <name> firewall group port-group <text> port <value>
port [portname <port-group> port
| portnumber |
startport-endport]
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
... Definitions
× set firewall Nothing found in XML Nothing found in VyOS
ipv4 [input | Definitions
forward] filter rule
<1-999999> action
synproxy
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
[forward | input Definitions
| output] filter
rule <1-999999>
add-address-to-group
destination-address
address-group
<name>
continues on next page

21.1. Configuration Commands 1330

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
[forward | input Definitions
| output] filter
rule <1-999999>
add-address-to-group
source-address
address-group
<name>
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
[forward | input Definitions
| output] filter
rule <1-999999>
add-address-to-group
[destination-address
| source-address]
timeout <timeout>
× set firewall Nothing found in XML Nothing found in VyOS
ipv4 [input | Definitions
forward] filter rule
<1-999999> protocol
tcp
× set firewall Nothing found in XML Nothing found in VyOS
ipv4 [input | Definitions
forward] filter rule
<1-999999> synproxy
tcp mss <501-65535>
× set firewall Nothing found in XML Nothing found in VyOS
ipv4 [input | Definitions
forward] filter rule
<1-999999> synproxy
tcp window-scale
<1-14>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter firewall ipv4 forward filter default-action <value>
default-action default-action
[accept | drop]
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
forward filter firewall ipv4 forward filter
default-log default-log
× not yet documented firewall.xml.in: firewall ipv4 forward filter
firewall ipv4 forward filter description <value>
description
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter rule firewall ipv4 forward filter rule <text> action <value>
<1-999999> action rule <rule> action
[accept | continue |
drop | jump | queue
| reject | return |
synproxy]
continues on next page

21.1. Configuration Commands 1331

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 forward filter
rule <rule> add-address-
to-group destination-
address address-group
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 forward filter
rule <rule> add-address-
to-group destination-
address timeout
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 forward filter
rule <rule> add-address-
to-group source-address
address-group
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 forward filter
rule <rule> add-address-
to-group source-address
timeout
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward filter ter rule <text> connection-
rule <1-999999> rule <rule> connection- mark <value>
connection-mark mark
<1-2147483647>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward filter ter rule <text> connection-
rule <1-999999> rule <rule> connection- status nat <value>
connection-status status nat
nat [destination |
source]
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
forward filter firewall ipv4 forward fil-
rule <1-999999> ter rule <rule> conntrack-
conntrack-helper helper
<module>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward filter ter rule <text> description
rule <1-999999> rule <rule> description <value>
description <text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter firewall ipv4 forward filter rule <text> destination ad-
rule <1-999999> rule <rule> destination ad- dress <value>
destination dress
address [address
| addressrange |
CIDR]
continues on next page

21.1. Configuration Commands 1332

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination address-mask <value>
destination address-mask
address-mask
[address]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination fqdn <value>
destination fqdn fqdn
<fqdn>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward fil- ter rule <text> destina-
rule <1-999999> ter rule <rule> destination tion geoip country-code
destination geoip geoip country-code <value>
country-code
<country>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination geoip inverse-match
destination geoip geoip inverse-match
inverse-match
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward fil- ter rule <text> destina-
rule <1-999999> ter rule <rule> destination tion group address-group
destination group group address-group <value>
address-group <name
| !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward fil- ter rule <text> destina-
rule <1-999999> ter rule <rule> destination tion group domain-group
destination group group domain-group <value>
domain-group <name |
!name>
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
forward filter firewall ipv4 forward filter
rule <1-999999> rule <rule> destination
destination group group dynamic-address-
dynamic-address-group group
<name | !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination group mac-group <value>
destination group group mac-group
mac-group <name |
!name>
continues on next page

21.1. Configuration Commands 1333

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward fil- ter rule <text> destina-
rule <1-999999> ter rule <rule> destination tion group network-group
destination group group network-group <value>
network-group <name
| !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination group port-group <value>
destination group group port-group
port-group <name |
!name>
× not yet documented firewall.xml.in: firewall ipv4 forward fil-
firewall ipv4 forward fil- ter rule <text> destination
ter rule <rule> destination mac-address <value>
mac-address
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination port <value>
destination port port
[1-65535 | portname
| start-end]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter rule firewall ipv4 forward filter rule <text> disable
<1-999999> disable rule <rule> disable
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter rule firewall ipv4 forward filter rule <text> dscp <value>
<1-999999> dscp rule <rule> dscp
[0-63 | start-end]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter firewall ipv4 forward filter rule <text> dscp-exclude
rule <1-999999> rule <rule> dscp-exclude <value>
dscp-exclude [0-63 |
start-end]
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
forward filter Definitions
rule <1-999999>
fragment [match-frag
| match-non-frag]
× not yet documented firewall.xml.in: firewall ipv4 forward fil-
firewall ipv4 forward fil- ter rule <text> fragment
ter rule <rule> fragment match-frag
match-frag
× not yet documented firewall.xml.in: firewall ipv4 forward fil-
firewall ipv4 forward fil- ter rule <text> fragment
ter rule <rule> fragment match-non-frag
match-non-frag
continues on next page

21.1. Configuration Commands 1334

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
forward filter Definitions
rule <1-999999>
icmp [code | type]
<0-255>
× not yet documented firewall.xml.in: firewall ipv4 forward fil-
firewall ipv4 forward filter ter rule <text> icmp code
rule <rule> icmp code <value>
× not yet documented firewall.xml.in: firewall ipv4 forward fil-
firewall ipv4 forward filter ter rule <text> icmp type
rule <rule> icmp type <value>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter rule firewall ipv4 forward fil- ter rule <text> icmp type-
<1-999999> icmp ter rule <rule> icmp type- name <value>
type-name <text> name
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
forward filter firewall ipv4 forward fil-
rule <1-999999> ter rule <rule> inbound-
inbound-interface interface group
group <iface_group>
× not yet documented Nothing found in XML firewall ipv4 forward
Definitions filter rule <text> inbound-
interface interface-group
<value>
× not yet documented Nothing found in XML firewall ipv4 forward
Definitions filter rule <text> inbound-
interface interface-name
<value>
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
forward filter firewall ipv4 forward fil-
rule <1-999999> ter rule <rule> inbound-
inbound-interface interface name
name <iface>
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
forward filter Definitions
rule <1-999999>
ipsec [match-ipsec |
match-none]
× not yet documented firewall.xml.in: firewall ipv4 forward filter
firewall ipv4 forward filter rule <text> ipsec match-
rule <rule> ipsec match- ipsec
ipsec
× not yet documented firewall.xml.in: firewall ipv4 forward filter
firewall ipv4 forward filter rule <text> ipsec match-
rule <rule> ipsec match- none
none
continues on next page

21.1. Configuration Commands 1335

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward filter ter rule <text> jump-target
rule <1-999999> rule <rule> jump-target <value>
jump-target <text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward filter ter rule <text> limit burst
rule <1-999999> rule <rule> limit burst <value>
limit burst
<0-4294967295>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter rule firewall ipv4 forward filter ter rule <text> limit rate
<1-999999> limit rule <rule> limit rate <value>
rate <text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter rule firewall ipv4 forward filter rule <text> log <value>
<1-999999> log rule <rule> log
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward fil- ter rule <text> log-options
rule <1-999999> ter rule <rule> log-options group <value>
log-options group group
<0-65535>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward fil- ter rule <text> log-options
rule <1-999999> ter rule <rule> log-options level <value>
log-options level level
[emerg | alert |
crit | err | warn
| notice | info |
debug]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward fil- ter rule <text> log-options
rule <1-999999> ter rule <rule> log-options queue-threshold <value>
log-options queue-threshold
queue-threshold
<0-65535>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward fil- ter rule <text> log-options
rule <1-999999> ter rule <rule> log-options snapshot-length <value>
log-options snapshot-length
snapshot-length
<0-9000>
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 forward filter
rule <rule> mark
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 forward filter
rule <rule> offload-target
continues on next page

21.1. Configuration Commands 1336

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
forward filter firewall ipv4 forward fil-
rule <1-999999> ter rule <rule> outbound-
outbound-interface interface group
group <iface_group>
× not yet documented Nothing found in XML firewall ipv4 forward filter
Definitions rule <text> outbound-
interface interface-group
<value>
× not yet documented Nothing found in XML firewall ipv4 forward filter
Definitions rule <text> outbound-
interface interface-name
<value>
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
forward filter firewall ipv4 forward fil-
rule <1-999999> ter rule <rule> outbound-
outbound-interface interface name
name <iface>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter firewall ipv4 forward filter rule <text> packet-length
rule <1-999999> rule <rule> packet-length <value>
packet-length
<text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter firewall ipv4 forward filter rule <text> packet-length-
rule <1-999999> rule <rule> packet-length- exclude <value>
packet-length-exclude exclude
<text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward filter ter rule <text> packet-type
rule <1-999999> rule <rule> packet-type <value>
packet-type
[broadcast | host
| multicast | other]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter rule firewall ipv4 forward filter ter rule <text> protocol
<1-999999> protocol rule <rule> protocol <value>
[<text> | <0-255> |
all | tcp_udp]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter rule firewall ipv4 forward filter rule <text> queue <value>
<1-999999> queue rule <rule> queue
<0-65535>
× not yet documented firewall.xml.in: firewall ipv4 forward filter
firewall ipv4 forward filter rule <text> queue-options
rule <rule> queue-options <value>
continues on next page

21.1. Configuration Commands 1337

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
forward filter Definitions
rule <1-999999>
queue-options
bypass
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
forward filter Definitions
rule <1-999999>
queue-options
fanout
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter rule firewall ipv4 forward filter rule <text> recent count
<1-999999> recent rule <rule> recent count <value>
count <1-255>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward filter ter rule <text> recent time
rule <1-999999> rule <rule> recent time <value>
recent time <second
| minute | hour>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter rule firewall ipv4 forward filter rule <text> source address
<1-999999> source rule <rule> source address <value>
address [address |
addressrange | CIDR]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward
forward filter firewall ipv4 forward filter rule <text> source
rule <1-999999> filter rule <rule> source address-mask <value>
source address-mask address-mask
[address]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter rule firewall ipv4 forward filter ter rule <text> source fqdn
<1-999999> source rule <rule> source fqdn <value>
fqdn <fqdn>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter rule firewall ipv4 forward filter rule <text> source geoip
<1-999999> source rule <rule> source geoip country-code <value>
geoip country-code country-code
<country>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter rule firewall ipv4 forward filter rule <text> source geoip
<1-999999> source rule <rule> source geoip inverse-match
geoip inverse-match inverse-match
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter rule firewall ipv4 forward filter rule <text> source group
<1-999999> source rule <rule> source group address-group <value>
group address-group address-group
<name | !name>
continues on next page

21.1. Configuration Commands 1338

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter rule firewall ipv4 forward filter rule <text> source group
<1-999999> source rule <rule> source group domain-group <value>
group domain-group domain-group
<name | !name>
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
forward filter firewall ipv4 forward filter
rule <1-999999> rule <rule> source group
source group dynamic-address-group
dynamic-address-group
<name | !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter rule firewall ipv4 forward filter rule <text> source group
<1-999999> source rule <rule> source group mac-group <value>
group mac-group mac-group
<name | !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter rule firewall ipv4 forward filter rule <text> source group
<1-999999> source rule <rule> source group network-group <value>
group network-group network-group
<name | !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter rule firewall ipv4 forward filter rule <text> source group
<1-999999> source rule <rule> source group port-group <value>
group port-group port-group
<name | !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward filter ter rule <text> source mac-
rule <1-999999> rule <rule> source mac- address <value>
source mac-address address
<mac-address>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward fil-
forward filter firewall ipv4 forward filter ter rule <text> source port
rule <1-999999> rule <rule> source port <value>
source port [1-65535
| portname |
start-end]
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
forward filter firewall ipv4 forward filter
rule <1-999999> rule <rule> state
state [established
| invalid | new |
related]
× not yet documented Nothing found in XML firewall ipv4 forward fil-
Definitions ter rule <text> state estab-
lished <value>
× not yet documented Nothing found in XML firewall ipv4 forward fil-
Definitions ter rule <text> state invalid
<value>
continues on next page

21.1. Configuration Commands 1339

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented Nothing found in XML firewall ipv4 forward fil-
Definitions ter rule <text> state new
<value>
× not yet documented Nothing found in XML firewall ipv4 forward fil-
Definitions ter rule <text> state related
<value>
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 forward filter
rule <rule> synproxy tcp
mss
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 forward filter
rule <rule> synproxy tcp
window-scale
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
forward filter rule Definitions
<1-999999> tcp flags
[not] <text>
× not yet documented firewall.xml.in: firewall ipv4 forward filter
firewall ipv4 forward filter rule <text> tcp flags ack
rule <rule> tcp flags ack
× not yet documented firewall.xml.in: firewall ipv4 forward filter
firewall ipv4 forward filter rule <text> tcp flags cwr
rule <rule> tcp flags cwr
× not yet documented firewall.xml.in: firewall ipv4 forward filter
firewall ipv4 forward filter rule <text> tcp flags ecn
rule <rule> tcp flags ecn
× not yet documented firewall.xml.in: firewall ipv4 forward filter
firewall ipv4 forward filter rule <text> tcp flags fin
rule <rule> tcp flags fin
× not yet documented firewall.xml.in: firewall ipv4 forward fil-
firewall ipv4 forward filter ter rule <text> tcp flags not
rule <rule> tcp flags not ack
ack
× not yet documented firewall.xml.in: firewall ipv4 forward fil-
firewall ipv4 forward filter ter rule <text> tcp flags not
rule <rule> tcp flags not cwr
cwr
× not yet documented firewall.xml.in: firewall ipv4 forward fil-
firewall ipv4 forward filter ter rule <text> tcp flags not
rule <rule> tcp flags not ecn
ecn
× not yet documented firewall.xml.in: firewall ipv4 forward filter
firewall ipv4 forward filter rule <text> tcp flags not fin
rule <rule> tcp flags not
fin
continues on next page

21.1. Configuration Commands 1340

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: firewall ipv4 forward fil-
firewall ipv4 forward filter ter rule <text> tcp flags not
rule <rule> tcp flags not psh
psh
× not yet documented firewall.xml.in: firewall ipv4 forward filter
firewall ipv4 forward filter rule <text> tcp flags not rst
rule <rule> tcp flags not rst
× not yet documented firewall.xml.in: firewall ipv4 forward fil-
firewall ipv4 forward filter ter rule <text> tcp flags not
rule <rule> tcp flags not syn
syn
× not yet documented firewall.xml.in: firewall ipv4 forward fil-
firewall ipv4 forward filter ter rule <text> tcp flags not
rule <rule> tcp flags not urg
urg
× not yet documented firewall.xml.in: firewall ipv4 forward filter
firewall ipv4 forward filter rule <text> tcp flags psh
rule <rule> tcp flags psh
× not yet documented firewall.xml.in: firewall ipv4 forward filter
firewall ipv4 forward filter rule <text> tcp flags rst
rule <rule> tcp flags rst
× not yet documented firewall.xml.in: firewall ipv4 forward filter
firewall ipv4 forward filter rule <text> tcp flags syn
rule <rule> tcp flags syn
× not yet documented firewall.xml.in: firewall ipv4 forward filter
firewall ipv4 forward filter rule <text> tcp flags urg
rule <rule> tcp flags urg
× not yet documented firewall.xml.in: firewall ipv4 forward fil-
firewall ipv4 forward filter ter rule <text> tcp mss
rule <rule> tcp mss <value>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter rule firewall ipv4 forward filter rule <text> time startdate
<1-999999> time rule <rule> time startdate <value>
startdate <text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter rule firewall ipv4 forward filter rule <text> time starttime
<1-999999> time rule <rule> time starttime <value>
starttime <text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter rule firewall ipv4 forward filter rule <text> time stopdate
<1-999999> time rule <rule> time stopdate <value>
stopdate <text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter rule firewall ipv4 forward filter rule <text> time stoptime
<1-999999> time rule <rule> time stoptime <value>
stoptime <text>
continues on next page

21.1. Configuration Commands 1341

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 forward filter
forward filter rule firewall ipv4 forward filter rule <text> time weekdays
<1-999999> time rule <rule> time weekdays <value>
weekdays <text>
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
forward filter rule Definitions
<1-999999> ttl <eq |
gt | lt> <0-255>
× not yet documented firewall.xml.in: firewall ipv4 forward filter
firewall ipv4 forward filter rule <text> ttl eq <value>
rule <rule> ttl eq
× not yet documented firewall.xml.in: firewall ipv4 forward filter
firewall ipv4 forward filter rule <text> ttl gt <value>
rule <rule> ttl gt
× not yet documented firewall.xml.in: firewall ipv4 forward filter
firewall ipv4 forward filter rule <text> ttl lt <value>
rule <rule> ttl lt
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter default-action <value>
default-action default-action
[accept | drop]
× set firewall firewall.xml.in: Nothing found in VyOS
ipv4 input filter firewall ipv4 input filter
default-log default-log
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter description <value>
description
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> action <value>
<1-999999> action rule <rule> action
[accept | continue |
drop | jump | queue
| reject | return |
synproxy]
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 input filter
rule <rule> add-address-
to-group destination-
address address-group
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 input filter
rule <rule> add-address-
to-group destination-
address timeout
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 input filter
rule <rule> add-address-
to-group source-address
address-group
continues on next page

21.1. Configuration Commands 1342

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 input filter
rule <rule> add-address-
to-group source-address
timeout
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> connection-
rule <1-999999> rule <rule> connection- mark <value>
connection-mark mark
<1-2147483647>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> connection-
rule <1-999999> rule <rule> connection- status nat <value>
connection-status status nat
nat [destination |
source]
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
input filter firewall ipv4 input filter
rule <1-999999> rule <rule> conntrack-
conntrack-helper helper
<module>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> description
rule <1-999999> rule <rule> description <value>
description <text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> destination ad-
rule <1-999999> rule <rule> destination ad- dress <value>
destination dress
address [address
| addressrange |
CIDR]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> destination
rule <1-999999> rule <rule> destination address-mask <value>
destination address-mask
address-mask
[address]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> destination
rule <1-999999> rule <rule> destination fqdn <value>
destination fqdn fqdn
<fqdn>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> destination
rule <1-999999> rule <rule> destination geoip country-code
destination geoip geoip country-code <value>
country-code
<country>
continues on next page

21.1. Configuration Commands 1343

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> destination
rule <1-999999> rule <rule> destination geoip inverse-match
destination geoip geoip inverse-match
inverse-match
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> destination
rule <1-999999> rule <rule> destination group address-group
destination group group address-group <value>
address-group <name
| !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> destination
rule <1-999999> rule <rule> destination group domain-group
destination group group domain-group <value>
domain-group <name |
!name>
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
input filter firewall ipv4 input filter
rule <1-999999> rule <rule> destination
destination group group dynamic-address-
dynamic-address-group group
<name | !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> destination
rule <1-999999> rule <rule> destination group mac-group <value>
destination group group mac-group
mac-group <name |
!name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> destination
rule <1-999999> rule <rule> destination group network-group
destination group group network-group <value>
network-group <name
| !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> destination
rule <1-999999> rule <rule> destination group port-group <value>
destination group group port-group
port-group <name |
!name>
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> destination
rule <rule> destination mac-address <value>
mac-address
continues on next page

21.1. Configuration Commands 1344

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> destination
rule <1-999999> rule <rule> destination port <value>
destination port port
[1-65535 | portname
| start-end]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> disable
<1-999999> disable rule <rule> disable
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> dscp <value>
<1-999999> dscp rule <rule> dscp
[0-63 | start-end]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> dscp-exclude
rule <1-999999> rule <rule> dscp-exclude <value>
dscp-exclude [0-63 |
start-end]
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
input filter rule Definitions
<1-999999> fragment
[match-frag |
match-non-frag]
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> fragment
rule <rule> fragment match-frag
match-frag
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> fragment
rule <rule> fragment match-non-frag
match-non-frag
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
input filter rule Definitions
<1-999999> icmp
[code | type]
<0-255>
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> icmp code
rule <rule> icmp code <value>
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> icmp type
rule <rule> icmp type <value>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> icmp type-
<1-999999> icmp rule <rule> icmp type- name <value>
type-name <text> name
continues on next page

21.1. Configuration Commands 1345

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
input filter firewall ipv4 input filter
rule <1-999999> rule <rule> inbound-
inbound-interface interface group
group <iface_group>
× not yet documented Nothing found in XML firewall ipv4 input filter
Definitions rule <text> inbound-
interface interface-group
<value>
× not yet documented Nothing found in XML firewall ipv4 input filter
Definitions rule <text> inbound-
interface interface-name
<value>
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
input filter firewall ipv4 input filter
rule <1-999999> rule <rule> inbound-
inbound-interface interface name
name <iface>
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
input filter rule Definitions
<1-999999> ipsec
[match-ipsec |
match-none]
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> ipsec match-
rule <rule> ipsec match- ipsec
ipsec
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> ipsec match-
rule <rule> ipsec match- none
none
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> jump-target
rule <1-999999> rule <rule> jump-target <value>
jump-target <text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> limit burst
rule <1-999999> rule <rule> limit burst <value>
limit burst
<0-4294967295>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> limit rate
<1-999999> limit rule <rule> limit rate <value>
rate <text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> log <value>
<1-999999> log rule <rule> log
continues on next page

21.1. Configuration Commands 1346

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> log-options
rule <1-999999> rule <rule> log-options group <value>
log-options group group
<0-65535>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> log-options
rule <1-999999> rule <rule> log-options level <value>
log-options level level
[emerg | alert |
crit | err | warn
| notice | info |
debug]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> log-options
rule <1-999999> rule <rule> log-options queue-threshold <value>
log-options queue-threshold
queue-threshold
<0-65535>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> log-options
rule <1-999999> rule <rule> log-options snapshot-length <value>
log-options snapshot-length
snapshot-length
<0-9000>
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 input filter
rule <rule> mark
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> packet-length
rule <1-999999> rule <rule> packet-length <value>
packet-length
<text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> packet-length-
rule <1-999999> rule <rule> packet-length- exclude <value>
packet-length-exclude exclude
<text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> packet-type
rule <1-999999> rule <rule> packet-type <value>
packet-type
[broadcast | host
| multicast | other]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input fil-
input filter rule firewall ipv4 input filter ter rule <text> protocol
<1-999999> protocol rule <rule> protocol <value>
[<text> | <0-255> |
all | tcp_udp]
continues on next page

21.1. Configuration Commands 1347

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> queue <value>
<1-999999> queue rule <rule> queue
<0-65535>
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> queue-options
rule <rule> queue-options <value>
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
input filter Definitions
rule <1-999999>
queue-options
bypass
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
input filter Definitions
rule <1-999999>
queue-options
fanout
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> recent count
<1-999999> recent rule <rule> recent count <value>
count <1-255>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> recent time
<1-999999> recent rule <rule> recent time <value>
time <second |
minute | hour>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> source address
<1-999999> source rule <rule> source address <value>
address [address |
addressrange | CIDR]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input fil-
input filter firewall ipv4 input fil- ter rule <text> source
rule <1-999999> ter rule <rule> source address-mask <value>
source address-mask address-mask
[address]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> source fqdn
<1-999999> source rule <rule> source fqdn <value>
fqdn <fqdn>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> source geoip
<1-999999> source rule <rule> source geoip country-code <value>
geoip country-code country-code
<country>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> source geoip
<1-999999> source rule <rule> source geoip inverse-match
geoip inverse-match inverse-match
continues on next page

21.1. Configuration Commands 1348

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> source group
<1-999999> source rule <rule> source group address-group <value>
group address-group address-group
<name | !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> source group
<1-999999> source rule <rule> source group domain-group <value>
group domain-group domain-group
<name | !name>
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
input filter firewall ipv4 input filter
rule <1-999999> rule <rule> source group
source group dynamic-address-group
dynamic-address-group
<name | !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> source group
<1-999999> source rule <rule> source group mac-group <value>
group mac-group mac-group
<name | !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> source group
<1-999999> source rule <rule> source group network-group <value>
group network-group network-group
<name | !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> source group
<1-999999> source rule <rule> source group port-group <value>
group port-group port-group
<name | !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter firewall ipv4 input filter rule <text> source mac-
rule <1-999999> rule <rule> source mac- address <value>
source mac-address address
<mac-address>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> source port
<1-999999> source rule <rule> source port <value>
port [1-65535
| portname |
start-end]
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
input filter rule firewall ipv4 input filter
<1-999999> state rule <rule> state
[established |
invalid | new |
related]
continues on next page

21.1. Configuration Commands 1349

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented Nothing found in XML firewall ipv4 input filter
Definitions rule <text> state estab-
lished <value>
× not yet documented Nothing found in XML firewall ipv4 input filter
Definitions rule <text> state invalid
<value>
× not yet documented Nothing found in XML firewall ipv4 input filter
Definitions rule <text> state new
<value>
× not yet documented Nothing found in XML firewall ipv4 input filter
Definitions rule <text> state related
<value>
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 input filter
rule <rule> synproxy tcp
mss
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 input filter
rule <rule> synproxy tcp
window-scale
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
input filter rule Definitions
<1-999999> tcp flags
[not] <text>
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> tcp flags ack
rule <rule> tcp flags ack
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> tcp flags cwr
rule <rule> tcp flags cwr
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> tcp flags ecn
rule <rule> tcp flags ecn
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> tcp flags fin
rule <rule> tcp flags fin
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> tcp flags not
rule <rule> tcp flags not ack
ack
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> tcp flags not
rule <rule> tcp flags not cwr
cwr
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> tcp flags not
rule <rule> tcp flags not ecn
ecn
continues on next page

21.1. Configuration Commands 1350

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> tcp flags not fin
rule <rule> tcp flags not
fin
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> tcp flags not
rule <rule> tcp flags not psh
psh
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> tcp flags not rst
rule <rule> tcp flags not rst
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> tcp flags not
rule <rule> tcp flags not syn
syn
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> tcp flags not
rule <rule> tcp flags not urg
urg
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> tcp flags psh
rule <rule> tcp flags psh
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> tcp flags rst
rule <rule> tcp flags rst
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> tcp flags syn
rule <rule> tcp flags syn
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> tcp flags urg
rule <rule> tcp flags urg
× not yet documented firewall.xml.in: firewall ipv4 input fil-
firewall ipv4 input filter ter rule <text> tcp mss
rule <rule> tcp mss <value>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> time startdate
<1-999999> time rule <rule> time startdate <value>
startdate <text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> time starttime
<1-999999> time rule <rule> time starttime <value>
starttime <text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> time stopdate
<1-999999> time rule <rule> time stopdate <value>
stopdate <text>
continues on next page

21.1. Configuration Commands 1351

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> time stoptime
<1-999999> time rule <rule> time stoptime <value>
stoptime <text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 input filter
input filter rule firewall ipv4 input filter rule <text> time weekdays
<1-999999> time rule <rule> time weekdays <value>
weekdays <text>
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
input filter rule Definitions
<1-999999> ttl <eq |
gt | lt> <0-255>
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> ttl eq <value>
rule <rule> ttl eq
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> ttl gt <value>
rule <rule> ttl gt
× not yet documented firewall.xml.in: firewall ipv4 input filter
firewall ipv4 input filter rule <text> ttl lt <value>
rule <rule> ttl lt
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name default-action <value>
default-action <name> default-action
[accept | drop
| jump | queue |
reject | return]
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name default-jump-target
default-jump-target <name> default-jump- <value>
<text> target
× set firewall firewall.xml.in: Nothing found in VyOS
ipv4 name <name> firewall ipv4 name
default-log <name> default-log
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name description <value>
description <text> <name> description
× not yet documented Nothing found in XML firewall ipv4 name <text>
Definitions enable-default-log
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> action <value>
<1-999999> action <name> rule <rule>
[accept | continue | action
drop | jump | queue
| reject | return]
continues on next page

21.1. Configuration Commands 1352

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall firewall.xml.in: Nothing found in VyOS
ipv4 name <name> firewall ipv4 name
rule <1-999999> <name> rule <rule>
add-address-to-group add-address-to-group
destination-address destination-address
address-group address-group
<name>
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 name
<name> rule <rule>
add-address-to-group
destination-address time-
out
× set firewall firewall.xml.in: Nothing found in VyOS
ipv4 name <name> firewall ipv4 name
rule <1-999999> <name> rule <rule>
add-address-to-group add-address-to-group
source-address source-address address-
address-group group
<name>
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 name
<name> rule <rule>
add-address-to-group
source-address timeout
× set firewall Nothing found in XML Nothing found in VyOS
ipv4 name <name> Definitions
rule <1-999999>
add-address-to-group
[destination-address
| source-address]
timeout <timeout>
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> connection-
rule <1-999999> <name> rule <rule> mark <value>
connection-mark connection-mark
<1-2147483647>
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> connection-
rule <1-999999> <name> rule <rule> status nat <value>
connection-status connection-status nat
nat [destination |
source]
× set firewall firewall.xml.in: Nothing found in VyOS
ipv4 name <name> firewall ipv4 name
rule <1-999999> <name> rule <rule>
conntrack-helper conntrack-helper
<module>
continues on next page

21.1. Configuration Commands 1353

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> description
rule <1-999999> <name> rule <rule> <value>
description <text> description
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> destination ad-
rule <1-999999> <name> rule <rule> dress <value>
destination destination address
address [address
| addressrange |
CIDR]
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> destination
rule <1-999999> <name> rule <rule> address-mask <value>
destination destination address-mask
address-mask
[address]
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> destination
rule <1-999999> <name> rule <rule> fqdn <value>
destination fqdn destination fqdn
<fqdn>
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> destination
rule <1-999999> <name> rule <rule> desti- geoip country-code
destination geoip nation geoip country-code <value>
country-code
<country>
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> destination
rule <1-999999> <name> rule <rule> geoip inverse-match
destination geoip destination geoip inverse-
inverse-match match
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> destination
rule <1-999999> <name> rule <rule> group address-group
destination group destination group address- <value>
address-group <name group
| !name>
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> destination
rule <1-999999> <name> rule <rule> group domain-group
destination group destination group domain- <value>
domain-group <name | group
!name>
continues on next page

21.1. Configuration Commands 1354

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall firewall.xml.in: Nothing found in VyOS
ipv4 name <name> firewall ipv4 name
rule <1-999999> <name> rule <rule> des-
destination group tination group dynamic-
dynamic-address-group address-group
<name | !name>
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> destination
rule <1-999999> <name> rule <rule> desti- group mac-group <value>
destination group nation group mac-group
mac-group <name |
!name>
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> destination
rule <1-999999> <name> rule <rule> des- group network-group
destination group tination group network- <value>
network-group <name group
| !name>
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> destination
rule <1-999999> <name> rule <rule> desti- group port-group <value>
destination group nation group port-group
port-group <name |
!name>
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> destination
<name> rule <rule> mac-address <value>
destination mac-address
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> destination
rule <1-999999> <name> rule <rule> port <value>
destination port destination port
[1-65535 | portname
| start-end]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> disable
<1-999999> disable <name> rule <rule>
disable
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> dscp <value>
<1-999999> dscp <name> rule <rule> dscp
[0-63 | start-end]
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> dscp-exclude
rule <1-999999> <name> rule <rule> <value>
dscp-exclude [0-63 | dscp-exclude
start-end]
continues on next page

21.1. Configuration Commands 1355

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
name <name> rule Definitions
<1-999999> fragment
[match-frag |
match-non-frag]
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> fragment
<name> rule <rule> match-frag
fragment match-frag
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> fragment
<name> rule <rule> match-non-frag
fragment match-non-frag
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
name <name> rule Definitions
<1-999999> icmp
[code | type]
<0-255>
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> icmp code
<name> rule <rule> icmp <value>
code
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> icmp type
<name> rule <rule> icmp <value>
type
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> icmp type-
<1-999999> icmp <name> rule <rule> icmp name <value>
type-name <text> type-name
× set firewall firewall.xml.in: Nothing found in VyOS
ipv4 name <name> firewall ipv4 name
rule <1-999999> <name> rule <rule>
inbound-interface inbound-interface group
group <iface_group>
× not yet documented Nothing found in XML firewall ipv4 name <text>
Definitions rule <text> inbound-
interface interface-group
<value>
× not yet documented Nothing found in XML firewall ipv4 name <text>
Definitions rule <text> inbound-
interface interface-name
<value>
× set firewall firewall.xml.in: Nothing found in VyOS
ipv4 name <name> firewall ipv4 name
rule <1-999999> <name> rule <rule>
inbound-interface inbound-interface name
name <iface>
continues on next page

21.1. Configuration Commands 1356

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
name <name> rule Definitions
<1-999999> ipsec
[match-ipsec |
match-none]
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> ipsec match-
<name> rule <rule> ipsec ipsec
match-ipsec
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> ipsec match-
<name> rule <rule> ipsec none
match-none
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> jump-target
rule <1-999999> <name> rule <rule> <value>
jump-target <text> jump-target
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> limit burst
rule <1-999999> <name> rule <rule> limit <value>
limit burst burst
<0-4294967295>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> limit rate
<1-999999> limit <name> rule <rule> limit <value>
rate <text> rate
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> log <value>
<1-999999> log <name> rule <rule> log
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> log-options
rule <1-999999> <name> rule <rule> group <value>
log-options group log-options group
<0-65535>
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> log-options
rule <1-999999> <name> rule <rule> level <value>
log-options level log-options level
[emerg | alert |
crit | err | warn
| notice | info |
debug]
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> log-options
rule <1-999999> <name> rule <rule> log- queue-threshold <value>
log-options options queue-threshold
queue-threshold
<0-65535>
continues on next page

21.1. Configuration Commands 1357

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> log-options
rule <1-999999> <name> rule <rule> log- snapshot-length <value>
log-options options snapshot-length
snapshot-length
<0-9000>
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 name
<name> rule <rule> mark
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 name
<name> rule <rule>
offload-target
× set firewall firewall.xml.in: Nothing found in VyOS
ipv4 name <name> firewall ipv4 name
rule <1-999999> <name> rule <rule>
outbound-interface outbound-interface group
group <iface_group>
× not yet documented Nothing found in XML firewall ipv4 name <text>
Definitions rule <text> outbound-
interface interface-group
<value>
× not yet documented Nothing found in XML firewall ipv4 name <text>
Definitions rule <text> outbound-
interface interface-name
<value>
× set firewall firewall.xml.in: Nothing found in VyOS
ipv4 name <name> firewall ipv4 name
rule <1-999999> <name> rule <rule>
outbound-interface outbound-interface name
name <iface>
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> packet-length
rule <1-999999> <name> rule <rule> <value>
packet-length packet-length
<text>
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> packet-length-
rule <1-999999> <name> rule <rule> exclude <value>
packet-length-exclude packet-length-exclude
<text>
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> packet-type
rule <1-999999> <name> rule <rule> <value>
packet-type packet-type
[broadcast | host
| multicast | other]
continues on next page

21.1. Configuration Commands 1358

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> protocol
<1-999999> protocol <name> rule <rule> <value>
[<text> | <0-255> | protocol
all | tcp_udp]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> queue <value>
<1-999999> queue <name> rule <rule>
<0-65535> queue
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> queue-options
<name> rule <rule> <value>
queue-options
× set firewall Nothing found in XML Nothing found in VyOS
ipv4 name <name> Definitions
rule <1-999999>
queue-options
bypass
× set firewall Nothing found in XML Nothing found in VyOS
ipv4 name <name> Definitions
rule <1-999999>
queue-options
fanout
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> recent count
<1-999999> recent <name> rule <rule> <value>
count <1-255> recent count
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> recent time
<1-999999> recent <name> rule <rule> <value>
time <second | recent time
minute | hour>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> source address
<1-999999> source <name> rule <rule> <value>
address [address | source address
addressrange | CIDR]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name
name <name> rule firewall ipv4 name <text> rule <text> source
<1-999999> source <name> rule <rule> address-mask <value>
address-mask source address-mask
[address]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> source fqdn
<1-999999> source <name> rule <rule> <value>
fqdn <fqdn> source fqdn
continues on next page

21.1. Configuration Commands 1359

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> source geoip
<1-999999> source <name> rule <rule> country-code <value>
geoip country-code source geoip country-code
<country>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> source geoip
<1-999999> source <name> rule <rule> inverse-match
geoip inverse-match source geoip inverse-
match
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> source group
<1-999999> source <name> rule <rule> address-group <value>
group address-group source group address-
<name | !name> group
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> source group
<1-999999> source <name> rule <rule> domain-group <value>
group domain-group source group domain-
<name | !name> group
× set firewall firewall.xml.in: Nothing found in VyOS
ipv4 name <name> firewall ipv4 name
rule <1-999999> <name> rule <rule>
source group source group dynamic-
dynamic-address-group address-group
<name | !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> source group
<1-999999> source <name> rule <rule> mac-group <value>
group mac-group source group mac-group
<name | !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> source group
<1-999999> source <name> rule <rule> network-group <value>
group network-group source group network-
<name | !name> group
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> source group
<1-999999> source <name> rule <rule> port-group <value>
group port-group source group port-group
<name | !name>
✓ set firewall firewall.xml.in: firewall ipv4 name <text>
ipv4 name <name> firewall ipv4 name rule <text> source mac-
rule <1-999999> <name> rule <rule> address <value>
source mac-address source mac-address
<mac-address>
continues on next page

21.1. Configuration Commands 1360

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> source port
<1-999999> source <name> rule <rule> <value>
port [1-65535 source port
| portname |
start-end]
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
name <name> rule firewall ipv4 name
<1-999999> state <name> rule <rule> state
[established |
invalid | new |
related]
× not yet documented Nothing found in XML firewall ipv4 name <text>
Definitions rule <text> state estab-
lished <value>
× not yet documented Nothing found in XML firewall ipv4 name <text>
Definitions rule <text> state invalid
<value>
× not yet documented Nothing found in XML firewall ipv4 name <text>
Definitions rule <text> state new
<value>
× not yet documented Nothing found in XML firewall ipv4 name <text>
Definitions rule <text> state related
<value>
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 name
<name> rule <rule>
synproxy tcp mss
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 name
<name> rule <rule> syn-
proxy tcp window-scale
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
name <name> rule Definitions
<1-999999> tcp flags
[not] <text>
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> tcp flags ack
<name> rule <rule> tcp
flags ack
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> tcp flags cwr
<name> rule <rule> tcp
flags cwr
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> tcp flags ecn
<name> rule <rule> tcp
flags ecn
continues on next page

21.1. Configuration Commands 1361

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> tcp flags fin
<name> rule <rule> tcp
flags fin
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> tcp flags not
<name> rule <rule> tcp ack
flags not ack
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> tcp flags not
<name> rule <rule> tcp cwr
flags not cwr
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> tcp flags not
<name> rule <rule> tcp ecn
flags not ecn
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> tcp flags not fin
<name> rule <rule> tcp
flags not fin
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> tcp flags not
<name> rule <rule> tcp psh
flags not psh
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> tcp flags not rst
<name> rule <rule> tcp
flags not rst
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> tcp flags not
<name> rule <rule> tcp syn
flags not syn
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> tcp flags not
<name> rule <rule> tcp urg
flags not urg
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> tcp flags psh
<name> rule <rule> tcp
flags psh
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> tcp flags rst
<name> rule <rule> tcp
flags rst
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> tcp flags syn
<name> rule <rule> tcp
flags syn
continues on next page

21.1. Configuration Commands 1362

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> tcp flags urg
<name> rule <rule> tcp
flags urg
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> tcp mss
<name> rule <rule> tcp <value>
mss
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> time startdate
<1-999999> time <name> rule <rule> time <value>
startdate <text> startdate
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> time starttime
<1-999999> time <name> rule <rule> time <value>
starttime <text> starttime
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> time stopdate
<1-999999> time <name> rule <rule> time <value>
stopdate <text> stopdate
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> time stoptime
<1-999999> time <name> rule <rule> time <value>
stoptime <text> stoptime
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 name <text>
name <name> rule firewall ipv4 name rule <text> time weekdays
<1-999999> time <name> rule <rule> time <value>
weekdays <text> weekdays
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
name <name> rule Definitions
<1-999999> ttl <eq |
gt | lt> <0-255>
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> ttl eq <value>
<name> rule <rule> ttl eq
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> ttl gt <value>
<name> rule <rule> ttl gt
× not yet documented firewall.xml.in: firewall ipv4 name <text>
firewall ipv4 name rule <text> ttl lt <value>
<name> rule <rule> ttl lt
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter firewall ipv4 output filter default-action <value>
default-action default-action
[accept | drop]
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
output filter firewall ipv4 output filter
default-log default-log
continues on next page

21.1. Configuration Commands 1363

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter description <value>
description
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter rule firewall ipv4 output filter rule <text> action <value>
<1-999999> action rule <rule> action
[accept | continue |
drop | jump | queue
| reject | return]
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 output filter
rule <rule> add-address-
to-group destination-
address address-group
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 output filter
rule <rule> add-address-
to-group destination-
address timeout
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 output filter
rule <rule> add-address-
to-group source-address
address-group
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 output filter
rule <rule> add-address-
to-group source-address
timeout
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output filter ter rule <text> connection-
rule <1-999999> rule <rule> connection- mark <value>
connection-mark mark
<1-2147483647>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output filter ter rule <text> connection-
rule <1-999999> rule <rule> connection- status nat <value>
connection-status status nat
nat [destination |
source]
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
output filter firewall ipv4 output fil-
rule <1-999999> ter rule <rule> conntrack-
conntrack-helper helper
<module>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output filter ter rule <text> description
rule <1-999999> rule <rule> description <value>
description <text>
continues on next page

21.1. Configuration Commands 1364

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter firewall ipv4 output filter rule <text> destination ad-
rule <1-999999> rule <rule> destination ad- dress <value>
destination dress
address [address
| addressrange |
CIDR]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination address-mask <value>
destination address-mask
address-mask
[address]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination fqdn <value>
destination fqdn fqdn
<fqdn>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output fil- ter rule <text> destina-
rule <1-999999> ter rule <rule> destination tion geoip country-code
destination geoip geoip country-code <value>
country-code
<country>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination geoip inverse-match
destination geoip geoip inverse-match
inverse-match
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output fil- ter rule <text> destina-
rule <1-999999> ter rule <rule> destination tion group address-group
destination group group address-group <value>
address-group <name
| !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output fil- ter rule <text> destina-
rule <1-999999> ter rule <rule> destination tion group domain-group
destination group group domain-group <value>
domain-group <name |
!name>
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
output filter firewall ipv4 output filter
rule <1-999999> rule <rule> destination
destination group group dynamic-address-
dynamic-address-group group
<name | !name>
continues on next page

21.1. Configuration Commands 1365

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination group mac-group <value>
destination group group mac-group
mac-group <name |
!name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output fil- ter rule <text> destina-
rule <1-999999> ter rule <rule> destination tion group network-group
destination group group network-group <value>
network-group <name
| !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination group port-group <value>
destination group group port-group
port-group <name |
!name>
× not yet documented firewall.xml.in: firewall ipv4 output fil-
firewall ipv4 output fil- ter rule <text> destination
ter rule <rule> destination mac-address <value>
mac-address
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination port <value>
destination port port
[1-65535 | portname
| start-end]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter rule firewall ipv4 output filter rule <text> disable
<1-999999> disable rule <rule> disable
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter rule firewall ipv4 output filter rule <text> dscp <value>
<1-999999> dscp rule <rule> dscp
[0-63 | start-end]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter firewall ipv4 output filter rule <text> dscp-exclude
rule <1-999999> rule <rule> dscp-exclude <value>
dscp-exclude [0-63 |
start-end]
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
output filter Definitions
rule <1-999999>
fragment [match-frag
| match-non-frag]
× not yet documented firewall.xml.in: firewall ipv4 output fil-
firewall ipv4 output fil- ter rule <text> fragment
ter rule <rule> fragment match-frag
match-frag
continues on next page

21.1. Configuration Commands 1366

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: firewall ipv4 output fil-
firewall ipv4 output fil- ter rule <text> fragment
ter rule <rule> fragment match-non-frag
match-non-frag
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
output filter Definitions
rule <1-999999>
icmp [code | type]
<0-255>
× not yet documented firewall.xml.in: firewall ipv4 output fil-
firewall ipv4 output filter ter rule <text> icmp code
rule <rule> icmp code <value>
× not yet documented firewall.xml.in: firewall ipv4 output fil-
firewall ipv4 output filter ter rule <text> icmp type
rule <rule> icmp type <value>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter rule firewall ipv4 output fil- ter rule <text> icmp type-
<1-999999> icmp ter rule <rule> icmp type- name <value>
type-name <text> name
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
output filter rule Definitions
<1-999999> ipsec
[match-ipsec |
match-none]
× not yet documented Nothing found in XML firewall ipv4 output filter
Definitions rule <text> ipsec match-
ipsec
× not yet documented Nothing found in XML firewall ipv4 output filter
Definitions rule <text> ipsec match-
none
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output filter ter rule <text> jump-target
rule <1-999999> rule <rule> jump-target <value>
jump-target <text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output filter ter rule <text> limit burst
rule <1-999999> rule <rule> limit burst <value>
limit burst
<0-4294967295>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter rule firewall ipv4 output filter ter rule <text> limit rate
<1-999999> limit rule <rule> limit rate <value>
rate <text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter rule firewall ipv4 output filter rule <text> log <value>
<1-999999> log rule <rule> log
continues on next page

21.1. Configuration Commands 1367

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output fil- ter rule <text> log-options
rule <1-999999> ter rule <rule> log-options group <value>
log-options group group
<0-65535>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output fil- ter rule <text> log-options
rule <1-999999> ter rule <rule> log-options level <value>
log-options level level
[emerg | alert |
crit | err | warn
| notice | info |
debug]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output fil- ter rule <text> log-options
rule <1-999999> ter rule <rule> log-options queue-threshold <value>
log-options queue-threshold
queue-threshold
<0-65535>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output fil- ter rule <text> log-options
rule <1-999999> ter rule <rule> log-options snapshot-length <value>
log-options snapshot-length
snapshot-length
<0-9000>
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 output filter
rule <rule> mark
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
output filter firewall ipv4 output fil-
rule <1-999999> ter rule <rule> outbound-
outbound-interface interface group
group <iface_group>
× not yet documented Nothing found in XML firewall ipv4 output filter
Definitions rule <text> outbound-
interface interface-group
<value>
× not yet documented Nothing found in XML firewall ipv4 output filter
Definitions rule <text> outbound-
interface interface-name
<value>
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
output filter firewall ipv4 output fil-
rule <1-999999> ter rule <rule> outbound-
outbound-interface interface name
name <iface>
continues on next page

21.1. Configuration Commands 1368

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter firewall ipv4 output filter rule <text> packet-length
rule <1-999999> rule <rule> packet-length <value>
packet-length
<text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter firewall ipv4 output filter rule <text> packet-length-
rule <1-999999> rule <rule> packet-length- exclude <value>
packet-length-exclude exclude
<text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output filter ter rule <text> packet-type
rule <1-999999> rule <rule> packet-type <value>
packet-type
[broadcast | host
| multicast | other]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter rule firewall ipv4 output filter ter rule <text> protocol
<1-999999> protocol rule <rule> protocol <value>
[<text> | <0-255> |
all | tcp_udp]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter rule firewall ipv4 output filter rule <text> queue <value>
<1-999999> queue rule <rule> queue
<0-65535>
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter rule <text> queue-options
rule <rule> queue-options <value>
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
output filter Definitions
rule <1-999999>
queue-options
bypass
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
output filter Definitions
rule <1-999999>
queue-options
fanout
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter rule firewall ipv4 output filter rule <text> recent count
<1-999999> recent rule <rule> recent count <value>
count <1-255>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter rule firewall ipv4 output filter ter rule <text> recent time
<1-999999> recent rule <rule> recent time <value>
time <second |
minute | hour>
continues on next page

21.1. Configuration Commands 1369

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter rule firewall ipv4 output filter rule <text> source address
<1-999999> source rule <rule> source address <value>
address [address |
addressrange | CIDR]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter firewall ipv4 output fil- ter rule <text> source
rule <1-999999> ter rule <rule> source address-mask <value>
source address-mask address-mask
[address]
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter rule firewall ipv4 output filter rule <text> source fqdn
<1-999999> source rule <rule> source fqdn <value>
fqdn <fqdn>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter rule firewall ipv4 output filter rule <text> source geoip
<1-999999> source rule <rule> source geoip country-code <value>
geoip country-code country-code
<country>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter rule firewall ipv4 output filter rule <text> source geoip
<1-999999> source rule <rule> source geoip inverse-match
geoip inverse-match inverse-match
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter rule firewall ipv4 output filter rule <text> source group
<1-999999> source rule <rule> source group address-group <value>
group address-group address-group
<name | !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter rule firewall ipv4 output filter rule <text> source group
<1-999999> source rule <rule> source group domain-group <value>
group domain-group domain-group
<name | !name>
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
output filter firewall ipv4 output filter
rule <1-999999> rule <rule> source group
source group dynamic-address-group
dynamic-address-group
<name | !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter rule firewall ipv4 output filter rule <text> source group
<1-999999> source rule <rule> source group mac-group <value>
group mac-group mac-group
<name | !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter rule firewall ipv4 output filter rule <text> source group
<1-999999> source rule <rule> source group network-group <value>
group network-group network-group
<name | !name>
continues on next page

21.1. Configuration Commands 1370

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter rule firewall ipv4 output filter rule <text> source group
<1-999999> source rule <rule> source group port-group <value>
group port-group port-group
<name | !name>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter firewall ipv4 output filter rule <text> source mac-
rule <1-999999> rule <rule> source mac- address <value>
source mac-address address
<mac-address>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output fil-
output filter rule firewall ipv4 output filter ter rule <text> source port
<1-999999> source rule <rule> source port <value>
port [1-65535
| portname |
start-end]
× set firewall ipv4 firewall.xml.in: Nothing found in VyOS
output filter rule firewall ipv4 output filter
<1-999999> state rule <rule> state
[established |
invalid | new |
related]
× not yet documented Nothing found in XML firewall ipv4 output fil-
Definitions ter rule <text> state estab-
lished <value>
× not yet documented Nothing found in XML firewall ipv4 output filter
Definitions rule <text> state invalid
<value>
× not yet documented Nothing found in XML firewall ipv4 output fil-
Definitions ter rule <text> state new
<value>
× not yet documented Nothing found in XML firewall ipv4 output filter
Definitions rule <text> state related
<value>
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 output filter
rule <rule> synproxy tcp
mss
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv4 output filter
rule <rule> synproxy tcp
window-scale
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
output filter rule Definitions
<1-999999> tcp flags
[not] <text>
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter rule <text> tcp flags ack
rule <rule> tcp flags ack
continues on next page

21.1. Configuration Commands 1371

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter rule <text> tcp flags cwr
rule <rule> tcp flags cwr
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter rule <text> tcp flags ecn
rule <rule> tcp flags ecn
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter rule <text> tcp flags fin
rule <rule> tcp flags fin
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter rule <text> tcp flags not
rule <rule> tcp flags not ack
ack
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter rule <text> tcp flags not
rule <rule> tcp flags not cwr
cwr
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter rule <text> tcp flags not
rule <rule> tcp flags not ecn
ecn
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter rule <text> tcp flags not fin
rule <rule> tcp flags not
fin
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter rule <text> tcp flags not
rule <rule> tcp flags not psh
psh
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter rule <text> tcp flags not rst
rule <rule> tcp flags not rst
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter rule <text> tcp flags not
rule <rule> tcp flags not syn
syn
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter rule <text> tcp flags not
rule <rule> tcp flags not urg
urg
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter rule <text> tcp flags psh
rule <rule> tcp flags psh
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter rule <text> tcp flags rst
rule <rule> tcp flags rst
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter rule <text> tcp flags syn
rule <rule> tcp flags syn
continues on next page

21.1. Configuration Commands 1372

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter rule <text> tcp flags urg
rule <rule> tcp flags urg
× not yet documented firewall.xml.in: firewall ipv4 output fil-
firewall ipv4 output filter ter rule <text> tcp mss
rule <rule> tcp mss <value>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter rule firewall ipv4 output filter rule <text> time startdate
<1-999999> time rule <rule> time startdate <value>
startdate <text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter rule firewall ipv4 output filter rule <text> time starttime
<1-999999> time rule <rule> time starttime <value>
starttime <text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter rule firewall ipv4 output filter rule <text> time stopdate
<1-999999> time rule <rule> time stopdate <value>
stopdate <text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter rule firewall ipv4 output filter rule <text> time stoptime
<1-999999> time rule <rule> time stoptime <value>
stoptime <text>
✓ set firewall ipv4 firewall.xml.in: firewall ipv4 output filter
output filter rule firewall ipv4 output filter rule <text> time weekdays
<1-999999> time rule <rule> time weekdays <value>
weekdays <text>
× set firewall ipv4 Nothing found in XML Nothing found in VyOS
output filter rule Definitions
<1-999999> ttl <eq |
gt | lt> <0-255>
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter rule <text> ttl eq <value>
rule <rule> ttl eq
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter rule <text> ttl gt <value>
rule <rule> ttl gt
× not yet documented firewall.xml.in: firewall ipv4 output filter
firewall ipv4 output filter rule <text> ttl lt <value>
rule <rule> ttl lt
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
... Definitions
× set firewall Nothing found in XML Nothing found in VyOS
ipv6 [input | Definitions
forward] filter rule
<1-999999> action
synproxy
continues on next page

21.1. Configuration Commands 1373

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
[forward | input Definitions
| output] filter
rule <1-999999>
add-address-to-group
destination-address
address-group
<name>
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
[forward | input Definitions
| output] filter
rule <1-999999>
add-address-to-group
source-address
address-group
<name>
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
[forward | input Definitions
| output] filter
rule <1-999999>
add-address-to-group
[destination-address
| source-address]
timeout <timeout>
× set firewall Nothing found in XML Nothing found in VyOS
ipv6 [input | Definitions
forward] filter rule
<1-999999> protocol
tcp
× set firewall Nothing found in XML Nothing found in VyOS
ipv6 [input | Definitions
forward] filter rule
<1-999999> synproxy
tcp mss <501-65535>
× set firewall Nothing found in XML Nothing found in VyOS
ipv6 [input | Definitions
forward] filter rule
<1-999999> synproxy
tcp window-scale
<1-14>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter firewall ipv6 forward filter default-action <value>
default-action default-action
[accept | drop]
× set firewall ipv6 firewall.xml.in: Nothing found in VyOS
forward filter firewall ipv6 forward filter
default-log default-log
continues on next page

21.1. Configuration Commands 1374

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: firewall ipv6 forward filter
firewall ipv6 forward filter description <value>
description
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter rule firewall ipv6 forward filter rule <text> action <value>
<1-999999> action rule <rule> action
[accept | continue |
drop | jump | queue
| reject | return |
synproxy]
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 forward filter
rule <rule> add-address-
to-group destination-
address address-group
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 forward filter
rule <rule> add-address-
to-group destination-
address timeout
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 forward filter
rule <rule> add-address-
to-group source-address
address-group
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 forward filter
rule <rule> add-address-
to-group source-address
timeout
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward filter ter rule <text> connection-
rule <1-999999> rule <rule> connection- mark <value>
connection-mark mark
<1-2147483647>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward filter ter rule <text> connection-
rule <1-999999> rule <rule> connection- status nat <value>
connection-status status nat
nat [destination |
source]
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 forward fil-
ter rule <rule> conntrack-
helper
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward filter ter rule <text> description
rule <1-999999> rule <rule> description <value>
description <text>
continues on next page

21.1. Configuration Commands 1375

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter firewall ipv6 forward filter rule <text> destination ad-
rule <1-999999> rule <rule> destination ad- dress <value>
destination dress
address [address
| addressrange |
CIDR]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination address-mask <value>
destination address-mask
address-mask
[address]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination fqdn <value>
destination fqdn fqdn
<fqdn>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward fil- ter rule <text> destina-
rule <1-999999> ter rule <rule> destination tion geoip country-code
destination geoip geoip country-code <value>
country-code
<country>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination geoip inverse-match
destination geoip geoip inverse-match
inverse-match
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward fil- ter rule <text> destina-
rule <1-999999> ter rule <rule> destination tion group address-group
destination group group address-group <value>
address-group <name
| !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward fil- ter rule <text> destina-
rule <1-999999> ter rule <rule> destination tion group domain-group
destination group group domain-group <value>
domain-group <name |
!name>
× set firewall ipv6 firewall.xml.in: Nothing found in VyOS
forward filter firewall ipv6 forward filter
rule <1-999999> rule <rule> destination
destination group group dynamic-address-
dynamic-address-group group
<name | !name>
continues on next page

21.1. Configuration Commands 1376

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination group mac-group <value>
destination group group mac-group
mac-group <name |
!name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward fil- ter rule <text> destina-
rule <1-999999> ter rule <rule> destination tion group network-group
destination group group network-group <value>
network-group <name
| !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination group port-group <value>
destination group group port-group
port-group <name |
!name>
× not yet documented firewall.xml.in: firewall ipv6 forward fil-
firewall ipv6 forward fil- ter rule <text> destination
ter rule <rule> destination mac-address <value>
mac-address
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination port <value>
destination port port
[1-65535 | portname
| start-end]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter rule firewall ipv6 forward filter rule <text> disable
<1-999999> disable rule <rule> disable
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter rule firewall ipv6 forward filter rule <text> dscp <value>
<1-999999> dscp rule <rule> dscp
[0-63 | start-end]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter firewall ipv6 forward filter rule <text> dscp-exclude
rule <1-999999> rule <rule> dscp-exclude <value>
dscp-exclude [0-63 |
start-end]
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
forward filter Definitions
rule <1-999999>
fragment [match-frag
| match-non-frag]
× not yet documented firewall.xml.in: firewall ipv6 forward fil-
firewall ipv6 forward fil- ter rule <text> fragment
ter rule <rule> fragment match-frag
match-frag
continues on next page

21.1. Configuration Commands 1377

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: firewall ipv6 forward fil-
firewall ipv6 forward fil- ter rule <text> fragment
ter rule <rule> fragment match-non-frag
match-non-frag
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
forward filter Definitions
rule <1-999999>
hop-limit <eq | gt |
lt> <0-255>
× not yet documented firewall.xml.in: firewall ipv6 forward fil-
firewall ipv6 forward filter ter rule <text> hop-limit
rule <rule> hop-limit eq eq <value>
× not yet documented firewall.xml.in: firewall ipv6 forward fil-
firewall ipv6 forward filter ter rule <text> hop-limit gt
rule <rule> hop-limit gt <value>
× not yet documented firewall.xml.in: firewall ipv6 forward fil-
firewall ipv6 forward filter ter rule <text> hop-limit lt
rule <rule> hop-limit lt <value>
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
forward filter Definitions
rule <1-999999>
icmpv6 [code | type]
<0-255>
× not yet documented firewall.xml.in: firewall ipv6 forward filter
firewall ipv6 forward filter rule <text> icmpv6 code
rule <rule> icmpv6 code <value>
× not yet documented firewall.xml.in: firewall ipv6 forward filter
firewall ipv6 forward filter rule <text> icmpv6 type
rule <rule> icmpv6 type <value>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter rule firewall ipv6 forward filter rule <text> icmpv6 type-
<1-999999> icmpv6 rule <rule> icmpv6 type- name <value>
type-name <text> name
× set firewall ipv6 firewall.xml.in: Nothing found in VyOS
forward filter firewall ipv6 forward fil-
rule <1-999999> ter rule <rule> inbound-
inbound-interface interface group
group <iface_group>
× not yet documented Nothing found in XML firewall ipv6 forward
Definitions filter rule <text> inbound-
interface interface-group
<value>
× not yet documented Nothing found in XML firewall ipv6 forward
Definitions filter rule <text> inbound-
interface interface-name
<value>
continues on next page

21.1. Configuration Commands 1378

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall ipv6 firewall.xml.in: Nothing found in VyOS
forward filter firewall ipv6 forward fil-
rule <1-999999> ter rule <rule> inbound-
inbound-interface interface name
name <iface>
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
forward filter Definitions
rule <1-999999>
ipsec [match-ipsec |
match-none]
× not yet documented firewall.xml.in: firewall ipv6 forward filter
firewall ipv6 forward filter rule <text> ipsec match-
rule <rule> ipsec match- ipsec
ipsec
× not yet documented firewall.xml.in: firewall ipv6 forward filter
firewall ipv6 forward filter rule <text> ipsec match-
rule <rule> ipsec match- none
none
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward filter ter rule <text> jump-target
rule <1-999999> rule <rule> jump-target <value>
jump-target <text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward filter ter rule <text> limit burst
rule <1-999999> rule <rule> limit burst <value>
limit burst
<0-4294967295>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter rule firewall ipv6 forward filter ter rule <text> limit rate
<1-999999> limit rule <rule> limit rate <value>
rate <text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter rule firewall ipv6 forward filter rule <text> log <value>
<1-999999> log rule <rule> log
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward fil- ter rule <text> log-options
rule <1-999999> ter rule <rule> log-options group <value>
log-options group group
<0-65535>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward fil- ter rule <text> log-options
rule <1-999999> ter rule <rule> log-options level <value>
log-options level level
[emerg | alert |
crit | err | warn
| notice | info |
debug]
continues on next page

21.1. Configuration Commands 1379

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward fil- ter rule <text> log-options
rule <1-999999> ter rule <rule> log-options queue-threshold <value>
log-options queue-threshold
queue-threshold
<0-65535>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward fil- ter rule <text> log-options
rule <1-999999> ter rule <rule> log-options snapshot-length <value>
log-options snapshot-length
snapshot-length
<0-9000>
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 forward filter
rule <rule> mark
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 forward filter
rule <rule> offload-target
× set firewall ipv6 firewall.xml.in: Nothing found in VyOS
forward filter firewall ipv6 forward fil-
rule <1-999999> ter rule <rule> outbound-
outbound-interface interface group
group <iface_group>
× not yet documented Nothing found in XML firewall ipv6 forward filter
Definitions rule <text> outbound-
interface interface-group
<value>
× not yet documented Nothing found in XML firewall ipv6 forward filter
Definitions rule <text> outbound-
interface interface-name
<value>
× set firewall ipv6 firewall.xml.in: Nothing found in VyOS
forward filter firewall ipv6 forward fil-
rule <1-999999> ter rule <rule> outbound-
outbound-interface interface name
name <iface>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter firewall ipv6 forward filter rule <text> packet-length
rule <1-999999> rule <rule> packet-length <value>
packet-length
<text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter firewall ipv6 forward filter rule <text> packet-length-
rule <1-999999> rule <rule> packet-length- exclude <value>
packet-length-exclude exclude
<text>
continues on next page

21.1. Configuration Commands 1380

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward filter ter rule <text> packet-type
rule <1-999999> rule <rule> packet-type <value>
packet-type
[broadcast | host
| multicast | other]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter rule firewall ipv6 forward filter ter rule <text> protocol
<1-999999> protocol rule <rule> protocol <value>
[<text> | <0-255> |
all | tcp_udp]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter rule firewall ipv6 forward filter rule <text> queue <value>
<1-999999> queue rule <rule> queue
<0-65535>
× not yet documented firewall.xml.in: firewall ipv6 forward filter
firewall ipv6 forward filter rule <text> queue-options
rule <rule> queue-options <value>
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
forward filter Definitions
rule <1-999999>
queue-options
bypass
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
forward filter Definitions
rule <1-999999>
queue-options
fanout
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter rule firewall ipv6 forward filter rule <text> recent count
<1-999999> recent rule <rule> recent count <value>
count <1-255>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward filter ter rule <text> recent time
rule <1-999999> rule <rule> recent time <value>
recent time <second
| minute | hour>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter rule firewall ipv6 forward filter rule <text> source address
<1-999999> source rule <rule> source address <value>
address [address |
addressrange | CIDR]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward
forward filter firewall ipv6 forward filter rule <text> source
rule <1-999999> filter rule <rule> source address-mask <value>
source address-mask address-mask
[address]
continues on next page

21.1. Configuration Commands 1381

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter rule firewall ipv6 forward filter ter rule <text> source fqdn
<1-999999> source rule <rule> source fqdn <value>
fqdn <fqdn>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter rule firewall ipv6 forward filter rule <text> source geoip
<1-999999> source rule <rule> source geoip country-code <value>
geoip country-code country-code
<country>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter rule firewall ipv6 forward filter rule <text> source geoip
<1-999999> source rule <rule> source geoip inverse-match
geoip inverse-match inverse-match
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter rule firewall ipv6 forward filter rule <text> source group
<1-999999> source rule <rule> source group address-group <value>
group address-group address-group
<name | !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter rule firewall ipv6 forward filter rule <text> source group
<1-999999> source rule <rule> source group domain-group <value>
group domain-group domain-group
<name | !name>
× set firewall ipv6 firewall.xml.in: Nothing found in VyOS
forward filter firewall ipv6 forward filter
rule <1-999999> rule <rule> source group
source group dynamic-address-group
dynamic-address-group
<name | !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter rule firewall ipv6 forward filter rule <text> source group
<1-999999> source rule <rule> source group mac-group <value>
group mac-group mac-group
<name | !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter rule firewall ipv6 forward filter rule <text> source group
<1-999999> source rule <rule> source group network-group <value>
group network-group network-group
<name | !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter rule firewall ipv6 forward filter rule <text> source group
<1-999999> source rule <rule> source group port-group <value>
group port-group port-group
<name | !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward filter ter rule <text> source mac-
rule <1-999999> rule <rule> source mac- address <value>
source mac-address address
<mac-address>
continues on next page

21.1. Configuration Commands 1382

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward fil-
forward filter firewall ipv6 forward filter ter rule <text> source port
rule <1-999999> rule <rule> source port <value>
source port [1-65535
| portname |
start-end]
× set firewall ipv6 firewall.xml.in: Nothing found in VyOS
forward filter firewall ipv6 forward filter
rule <1-999999> rule <rule> state
state [established
| invalid | new |
related]
× not yet documented Nothing found in XML firewall ipv6 forward fil-
Definitions ter rule <text> state estab-
lished <value>
× not yet documented Nothing found in XML firewall ipv6 forward fil-
Definitions ter rule <text> state invalid
<value>
× not yet documented Nothing found in XML firewall ipv6 forward fil-
Definitions ter rule <text> state new
<value>
× not yet documented Nothing found in XML firewall ipv6 forward fil-
Definitions ter rule <text> state related
<value>
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 forward filter
rule <rule> synproxy tcp
mss
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 forward filter
rule <rule> synproxy tcp
window-scale
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
forward filter rule Definitions
<1-999999> tcp flags
[not] <text>
× not yet documented firewall.xml.in: firewall ipv6 forward filter
firewall ipv6 forward filter rule <text> tcp flags ack
rule <rule> tcp flags ack
× not yet documented firewall.xml.in: firewall ipv6 forward filter
firewall ipv6 forward filter rule <text> tcp flags cwr
rule <rule> tcp flags cwr
× not yet documented firewall.xml.in: firewall ipv6 forward filter
firewall ipv6 forward filter rule <text> tcp flags ecn
rule <rule> tcp flags ecn
× not yet documented firewall.xml.in: firewall ipv6 forward filter
firewall ipv6 forward filter rule <text> tcp flags fin
rule <rule> tcp flags fin
continues on next page

21.1. Configuration Commands 1383

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: firewall ipv6 forward fil-
firewall ipv6 forward filter ter rule <text> tcp flags not
rule <rule> tcp flags not ack
ack
× not yet documented firewall.xml.in: firewall ipv6 forward fil-
firewall ipv6 forward filter ter rule <text> tcp flags not
rule <rule> tcp flags not cwr
cwr
× not yet documented firewall.xml.in: firewall ipv6 forward fil-
firewall ipv6 forward filter ter rule <text> tcp flags not
rule <rule> tcp flags not ecn
ecn
× not yet documented firewall.xml.in: firewall ipv6 forward filter
firewall ipv6 forward filter rule <text> tcp flags not fin
rule <rule> tcp flags not
fin
× not yet documented firewall.xml.in: firewall ipv6 forward fil-
firewall ipv6 forward filter ter rule <text> tcp flags not
rule <rule> tcp flags not psh
psh
× not yet documented firewall.xml.in: firewall ipv6 forward filter
firewall ipv6 forward filter rule <text> tcp flags not rst
rule <rule> tcp flags not rst
× not yet documented firewall.xml.in: firewall ipv6 forward fil-
firewall ipv6 forward filter ter rule <text> tcp flags not
rule <rule> tcp flags not syn
syn
× not yet documented firewall.xml.in: firewall ipv6 forward fil-
firewall ipv6 forward filter ter rule <text> tcp flags not
rule <rule> tcp flags not urg
urg
× not yet documented firewall.xml.in: firewall ipv6 forward filter
firewall ipv6 forward filter rule <text> tcp flags psh
rule <rule> tcp flags psh
× not yet documented firewall.xml.in: firewall ipv6 forward filter
firewall ipv6 forward filter rule <text> tcp flags rst
rule <rule> tcp flags rst
× not yet documented firewall.xml.in: firewall ipv6 forward filter
firewall ipv6 forward filter rule <text> tcp flags syn
rule <rule> tcp flags syn
× not yet documented firewall.xml.in: firewall ipv6 forward filter
firewall ipv6 forward filter rule <text> tcp flags urg
rule <rule> tcp flags urg
× not yet documented firewall.xml.in: firewall ipv6 forward fil-
firewall ipv6 forward filter ter rule <text> tcp mss
rule <rule> tcp mss <value>
continues on next page

21.1. Configuration Commands 1384

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter rule firewall ipv6 forward filter rule <text> time startdate
<1-999999> time rule <rule> time startdate <value>
startdate <text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter rule firewall ipv6 forward filter rule <text> time starttime
<1-999999> time rule <rule> time starttime <value>
starttime <text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter rule firewall ipv6 forward filter rule <text> time stopdate
<1-999999> time rule <rule> time stopdate <value>
stopdate <text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter rule firewall ipv6 forward filter rule <text> time stoptime
<1-999999> time rule <rule> time stoptime <value>
stoptime <text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 forward filter
forward filter rule firewall ipv6 forward filter rule <text> time weekdays
<1-999999> time rule <rule> time weekdays <value>
weekdays <text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter default-action <value>
default-action default-action
[accept | drop]
× set firewall firewall.xml.in: Nothing found in VyOS
ipv6 input filter firewall ipv6 input filter
default-log default-log
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter description <value>
description
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> action <value>
<1-999999> action rule <rule> action
[accept | continue |
drop | jump | queue
| reject | return |
synproxy]
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 input filter
rule <rule> add-address-
to-group destination-
address address-group
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 input filter
rule <rule> add-address-
to-group destination-
address timeout
continues on next page

21.1. Configuration Commands 1385

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 input filter
rule <rule> add-address-
to-group source-address
address-group
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 input filter
rule <rule> add-address-
to-group source-address
timeout
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> connection-
rule <1-999999> rule <rule> connection- mark <value>
connection-mark mark
<1-2147483647>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> connection-
rule <1-999999> rule <rule> connection- status nat <value>
connection-status status nat
nat [destination |
source]
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 input filter
rule <rule> conntrack-
helper
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> description
rule <1-999999> rule <rule> description <value>
description <text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> destination ad-
rule <1-999999> rule <rule> destination ad- dress <value>
destination dress
address [address
| addressrange |
CIDR]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> destination
rule <1-999999> rule <rule> destination address-mask <value>
destination address-mask
address-mask
[address]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> destination
rule <1-999999> rule <rule> destination fqdn <value>
destination fqdn fqdn
<fqdn>
continues on next page

21.1. Configuration Commands 1386

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> destination
rule <1-999999> rule <rule> destination geoip country-code
destination geoip geoip country-code <value>
country-code
<country>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> destination
rule <1-999999> rule <rule> destination geoip inverse-match
destination geoip geoip inverse-match
inverse-match
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> destination
rule <1-999999> rule <rule> destination group address-group
destination group group address-group <value>
address-group <name
| !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> destination
rule <1-999999> rule <rule> destination group domain-group
destination group group domain-group <value>
domain-group <name |
!name>
× set firewall ipv6 firewall.xml.in: Nothing found in VyOS
input filter firewall ipv6 input filter
rule <1-999999> rule <rule> destination
destination group group dynamic-address-
dynamic-address-group group
<name | !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> destination
rule <1-999999> rule <rule> destination group mac-group <value>
destination group group mac-group
mac-group <name |
!name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> destination
rule <1-999999> rule <rule> destination group network-group
destination group group network-group <value>
network-group <name
| !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> destination
rule <1-999999> rule <rule> destination group port-group <value>
destination group group port-group
port-group <name |
!name>
continues on next page

21.1. Configuration Commands 1387

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> destination
rule <rule> destination mac-address <value>
mac-address
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> destination
rule <1-999999> rule <rule> destination port <value>
destination port port
[1-65535 | portname
| start-end]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> disable
<1-999999> disable rule <rule> disable
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> dscp <value>
<1-999999> dscp rule <rule> dscp
[0-63 | start-end]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> dscp-exclude
rule <1-999999> rule <rule> dscp-exclude <value>
dscp-exclude [0-63 |
start-end]
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
input filter rule Definitions
<1-999999> fragment
[match-frag |
match-non-frag]
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> fragment
rule <rule> fragment match-frag
match-frag
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> fragment
rule <rule> fragment match-non-frag
match-non-frag
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
input filter rule Definitions
<1-999999> hop-limit
<eq | gt | lt>
<0-255>
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> hop-limit eq
rule <rule> hop-limit eq <value>
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> hop-limit gt
rule <rule> hop-limit gt <value>
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> hop-limit lt
rule <rule> hop-limit lt <value>
continues on next page

21.1. Configuration Commands 1388

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
input filter rule Definitions
<1-999999> icmpv6
[code | type]
<0-255>
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> icmpv6 code
rule <rule> icmpv6 code <value>
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> icmpv6 type
rule <rule> icmpv6 type <value>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> icmpv6 type-
<1-999999> icmpv6 rule <rule> icmpv6 type- name <value>
type-name <text> name
× set firewall ipv6 firewall.xml.in: Nothing found in VyOS
input filter firewall ipv6 input filter
rule <1-999999> rule <rule> inbound-
inbound-interface interface group
group <iface_group>
× not yet documented Nothing found in XML firewall ipv6 input filter
Definitions rule <text> inbound-
interface interface-group
<value>
× not yet documented Nothing found in XML firewall ipv6 input filter
Definitions rule <text> inbound-
interface interface-name
<value>
× set firewall ipv6 firewall.xml.in: Nothing found in VyOS
input filter firewall ipv6 input filter
rule <1-999999> rule <rule> inbound-
inbound-interface interface name
name <iface>
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
input filter rule Definitions
<1-999999> ipsec
[match-ipsec |
match-none]
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> ipsec match-
rule <rule> ipsec match- ipsec
ipsec
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> ipsec match-
rule <rule> ipsec match- none
none
continues on next page

21.1. Configuration Commands 1389

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> jump-target
rule <1-999999> rule <rule> jump-target <value>
jump-target <text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> limit burst
rule <1-999999> rule <rule> limit burst <value>
limit burst
<0-4294967295>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> limit rate
<1-999999> limit rule <rule> limit rate <value>
rate <text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> log <value>
<1-999999> log rule <rule> log
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> log-options
rule <1-999999> rule <rule> log-options group <value>
log-options group group
<0-65535>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> log-options
rule <1-999999> rule <rule> log-options level <value>
log-options level level
[emerg | alert |
crit | err | warn
| notice | info |
debug]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> log-options
rule <1-999999> rule <rule> log-options queue-threshold <value>
log-options queue-threshold
queue-threshold
<0-65535>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> log-options
rule <1-999999> rule <rule> log-options snapshot-length <value>
log-options snapshot-length
snapshot-length
<0-9000>
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 input filter
rule <rule> mark
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> packet-length
rule <1-999999> rule <rule> packet-length <value>
packet-length
<text>
continues on next page

21.1. Configuration Commands 1390

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> packet-length-
rule <1-999999> rule <rule> packet-length- exclude <value>
packet-length-exclude exclude
<text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> packet-type
rule <1-999999> rule <rule> packet-type <value>
packet-type
[broadcast | host
| multicast | other]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input fil-
input filter rule firewall ipv6 input filter ter rule <text> protocol
<1-999999> protocol rule <rule> protocol <value>
[<text> | <0-255> |
all | tcp_udp]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> queue <value>
<1-999999> queue rule <rule> queue
<0-65535>
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> queue-options
rule <rule> queue-options <value>
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
input filter Definitions
rule <1-999999>
queue-options
bypass
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
input filter Definitions
rule <1-999999>
queue-options
fanout
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> recent count
<1-999999> recent rule <rule> recent count <value>
count <1-255>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> recent time
<1-999999> recent rule <rule> recent time <value>
time <second |
minute | hour>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> source address
<1-999999> source rule <rule> source address <value>
address [address |
addressrange | CIDR]
continues on next page

21.1. Configuration Commands 1391

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input fil-
input filter firewall ipv6 input fil- ter rule <text> source
rule <1-999999> ter rule <rule> source address-mask <value>
source address-mask address-mask
[address]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> source fqdn
<1-999999> source rule <rule> source fqdn <value>
fqdn <fqdn>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> source geoip
<1-999999> source rule <rule> source geoip country-code <value>
geoip country-code country-code
<country>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> source geoip
<1-999999> source rule <rule> source geoip inverse-match
geoip inverse-match inverse-match
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> source group
<1-999999> source rule <rule> source group address-group <value>
group address-group address-group
<name | !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> source group
<1-999999> source rule <rule> source group domain-group <value>
group domain-group domain-group
<name | !name>
× set firewall ipv6 firewall.xml.in: Nothing found in VyOS
input filter firewall ipv6 input filter
rule <1-999999> rule <rule> source group
source group dynamic-address-group
dynamic-address-group
<name | !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> source group
<1-999999> source rule <rule> source group mac-group <value>
group mac-group mac-group
<name | !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> source group
<1-999999> source rule <rule> source group network-group <value>
group network-group network-group
<name | !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> source group
<1-999999> source rule <rule> source group port-group <value>
group port-group port-group
<name | !name>
continues on next page

21.1. Configuration Commands 1392

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter firewall ipv6 input filter rule <text> source mac-
rule <1-999999> rule <rule> source mac- address <value>
source mac-address address
<mac-address>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> source port
<1-999999> source rule <rule> source port <value>
port [1-65535
| portname |
start-end]
× set firewall ipv6 firewall.xml.in: Nothing found in VyOS
input filter rule firewall ipv6 input filter
<1-999999> state rule <rule> state
[established |
invalid | new |
related]
× not yet documented Nothing found in XML firewall ipv6 input filter
Definitions rule <text> state estab-
lished <value>
× not yet documented Nothing found in XML firewall ipv6 input filter
Definitions rule <text> state invalid
<value>
× not yet documented Nothing found in XML firewall ipv6 input filter
Definitions rule <text> state new
<value>
× not yet documented Nothing found in XML firewall ipv6 input filter
Definitions rule <text> state related
<value>
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 input filter
rule <rule> synproxy tcp
mss
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 input filter
rule <rule> synproxy tcp
window-scale
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
input filter rule Definitions
<1-999999> tcp flags
[not] <text>
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> tcp flags ack
rule <rule> tcp flags ack
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> tcp flags cwr
rule <rule> tcp flags cwr
continues on next page

21.1. Configuration Commands 1393

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> tcp flags ecn
rule <rule> tcp flags ecn
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> tcp flags fin
rule <rule> tcp flags fin
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> tcp flags not
rule <rule> tcp flags not ack
ack
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> tcp flags not
rule <rule> tcp flags not cwr
cwr
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> tcp flags not
rule <rule> tcp flags not ecn
ecn
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> tcp flags not fin
rule <rule> tcp flags not
fin
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> tcp flags not
rule <rule> tcp flags not psh
psh
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> tcp flags not rst
rule <rule> tcp flags not rst
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> tcp flags not
rule <rule> tcp flags not syn
syn
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> tcp flags not
rule <rule> tcp flags not urg
urg
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> tcp flags psh
rule <rule> tcp flags psh
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> tcp flags rst
rule <rule> tcp flags rst
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> tcp flags syn
rule <rule> tcp flags syn
× not yet documented firewall.xml.in: firewall ipv6 input filter
firewall ipv6 input filter rule <text> tcp flags urg
rule <rule> tcp flags urg
continues on next page

21.1. Configuration Commands 1394

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: firewall ipv6 input fil-
firewall ipv6 input filter ter rule <text> tcp mss
rule <rule> tcp mss <value>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> time startdate
<1-999999> time rule <rule> time startdate <value>
startdate <text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> time starttime
<1-999999> time rule <rule> time starttime <value>
starttime <text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> time stopdate
<1-999999> time rule <rule> time stopdate <value>
stopdate <text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> time stoptime
<1-999999> time rule <rule> time stoptime <value>
stoptime <text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 input filter
input filter rule firewall ipv6 input filter rule <text> time weekdays
<1-999999> time rule <rule> time weekdays <value>
weekdays <text>
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name default-action <value>
default-action <name> default-action
[accept | drop
| jump | queue |
reject | return]
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name default-jump-target
default-jump-target <name> default-jump- <value>
<text> target
× set firewall firewall.xml.in: Nothing found in VyOS
ipv6 name <name> firewall ipv6 name
default-log <name> default-log
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name description <value>
description <text> <name> description
× not yet documented Nothing found in XML firewall ipv6 name <text>
Definitions enable-default-log
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> action <value>
<1-999999> action <name> rule <rule>
[accept | continue | action
drop | jump | queue
| reject | return]
continues on next page

21.1. Configuration Commands 1395

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall firewall.xml.in: Nothing found in VyOS
ipv6 name <name> firewall ipv6 name
rule <1-999999> <name> rule <rule>
add-address-to-group add-address-to-group
destination-address destination-address
address-group address-group
<name>
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 name
<name> rule <rule>
add-address-to-group
destination-address time-
out
× set firewall firewall.xml.in: Nothing found in VyOS
ipv6 name <name> firewall ipv6 name
rule <1-999999> <name> rule <rule>
add-address-to-group add-address-to-group
source-address source-address address-
address-group group
<name>
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 name
<name> rule <rule>
add-address-to-group
source-address timeout
× set firewall Nothing found in XML Nothing found in VyOS
ipv6 name <name> Definitions
rule <1-999999>
add-address-to-group
[destination-address
| source-address]
timeout <timeout>
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> connection-
rule <1-999999> <name> rule <rule> mark <value>
connection-mark connection-mark
<1-2147483647>
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> connection-
rule <1-999999> <name> rule <rule> status nat <value>
connection-status connection-status nat
nat [destination |
source]
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 name
<name> rule <rule>
conntrack-helper
continues on next page

21.1. Configuration Commands 1396

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> description
rule <1-999999> <name> rule <rule> <value>
description <text> description
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> destination ad-
rule <1-999999> <name> rule <rule> dress <value>
destination destination address
address [address
| addressrange |
CIDR]
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> destination
rule <1-999999> <name> rule <rule> address-mask <value>
destination destination address-mask
address-mask
[address]
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> destination
rule <1-999999> <name> rule <rule> fqdn <value>
destination fqdn destination fqdn
<fqdn>
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> destination
rule <1-999999> <name> rule <rule> desti- geoip country-code
destination geoip nation geoip country-code <value>
country-code
<country>
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> destination
rule <1-999999> <name> rule <rule> geoip inverse-match
destination geoip destination geoip inverse-
inverse-match match
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> destination
rule <1-999999> <name> rule <rule> group address-group
destination group destination group address- <value>
address-group <name group
| !name>
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> destination
rule <1-999999> <name> rule <rule> group domain-group
destination group destination group domain- <value>
domain-group <name | group
!name>
continues on next page

21.1. Configuration Commands 1397

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall firewall.xml.in: Nothing found in VyOS
ipv6 name <name> firewall ipv6 name
rule <1-999999> <name> rule <rule> des-
destination group tination group dynamic-
dynamic-address-group address-group
<name | !name>
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> destination
rule <1-999999> <name> rule <rule> desti- group mac-group <value>
destination group nation group mac-group
mac-group <name |
!name>
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> destination
rule <1-999999> <name> rule <rule> des- group network-group
destination group tination group network- <value>
network-group <name group
| !name>
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> destination
rule <1-999999> <name> rule <rule> desti- group port-group <value>
destination group nation group port-group
port-group <name |
!name>
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> destination
<name> rule <rule> mac-address <value>
destination mac-address
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> destination
rule <1-999999> <name> rule <rule> port <value>
destination port destination port
[1-65535 | portname
| start-end]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> disable
<1-999999> disable <name> rule <rule>
disable
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> dscp <value>
<1-999999> dscp <name> rule <rule> dscp
[0-63 | start-end]
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> dscp-exclude
rule <1-999999> <name> rule <rule> <value>
dscp-exclude [0-63 | dscp-exclude
start-end]
continues on next page

21.1. Configuration Commands 1398

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
name <name> rule Definitions
<1-999999> fragment
[match-frag |
match-non-frag]
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> fragment
<name> rule <rule> match-frag
fragment match-frag
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> fragment
<name> rule <rule> match-non-frag
fragment match-non-frag
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
name <name> rule Definitions
<1-999999> hop-limit
<eq | gt | lt>
<0-255>
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> hop-limit eq
<name> rule <rule> <value>
hop-limit eq
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> hop-limit gt
<name> rule <rule> <value>
hop-limit gt
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> hop-limit lt
<name> rule <rule> <value>
hop-limit lt
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
name <name> rule Definitions
<1-999999> icmpv6
[code | type]
<0-255>
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> icmpv6 code
<name> rule <rule> <value>
icmpv6 code
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> icmpv6 type
<name> rule <rule> <value>
icmpv6 type
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> icmpv6 type-
<1-999999> icmpv6 <name> rule <rule> name <value>
type-name <text> icmpv6 type-name
continues on next page

21.1. Configuration Commands 1399

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall firewall.xml.in: Nothing found in VyOS
ipv6 name <name> firewall ipv6 name
rule <1-999999> <name> rule <rule>
inbound-interface inbound-interface group
group <iface_group>
× not yet documented Nothing found in XML firewall ipv6 name <text>
Definitions rule <text> inbound-
interface interface-group
<value>
× not yet documented Nothing found in XML firewall ipv6 name <text>
Definitions rule <text> inbound-
interface interface-name
<value>
× set firewall firewall.xml.in: Nothing found in VyOS
ipv6 name <name> firewall ipv6 name
rule <1-999999> <name> rule <rule>
inbound-interface inbound-interface name
name <iface>
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
name <name> rule Definitions
<1-999999> ipsec
[match-ipsec |
match-none]
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> ipsec match-
<name> rule <rule> ipsec ipsec
match-ipsec
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> ipsec match-
<name> rule <rule> ipsec none
match-none
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> jump-target
rule <1-999999> <name> rule <rule> <value>
jump-target <text> jump-target
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> limit burst
rule <1-999999> <name> rule <rule> limit <value>
limit burst burst
<0-4294967295>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> limit rate
<1-999999> limit <name> rule <rule> limit <value>
rate <text> rate
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> log <value>
<1-999999> log <name> rule <rule> log
continues on next page

21.1. Configuration Commands 1400

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> log-options
rule <1-999999> <name> rule <rule> group <value>
log-options group log-options group
<0-65535>
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> log-options
rule <1-999999> <name> rule <rule> level <value>
log-options level log-options level
[emerg | alert |
crit | err | warn
| notice | info |
debug]
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> log-options
rule <1-999999> <name> rule <rule> log- queue-threshold <value>
log-options options queue-threshold
queue-threshold
<0-65535>
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> log-options
rule <1-999999> <name> rule <rule> log- snapshot-length <value>
log-options options snapshot-length
snapshot-length
<0-9000>
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 name
<name> rule <rule> mark
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 name
<name> rule <rule>
offload-target
× set firewall firewall.xml.in: Nothing found in VyOS
ipv6 name <name> firewall ipv6 name
rule <1-999999> <name> rule <rule>
outbound-interface outbound-interface group
group <iface_group>
× not yet documented Nothing found in XML firewall ipv6 name <text>
Definitions rule <text> outbound-
interface interface-group
<value>
× not yet documented Nothing found in XML firewall ipv6 name <text>
Definitions rule <text> outbound-
interface interface-name
<value>
continues on next page

21.1. Configuration Commands 1401

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall firewall.xml.in: Nothing found in VyOS
ipv6 name <name> firewall ipv6 name
rule <1-999999> <name> rule <rule>
outbound-interface outbound-interface name
name <iface>
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> packet-length
rule <1-999999> <name> rule <rule> <value>
packet-length packet-length
<text>
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> packet-length-
rule <1-999999> <name> rule <rule> exclude <value>
packet-length-exclude packet-length-exclude
<text>
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> packet-type
rule <1-999999> <name> rule <rule> <value>
packet-type packet-type
[broadcast | host
| multicast | other]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> protocol
<1-999999> protocol <name> rule <rule> <value>
[<text> | <0-255> | protocol
all | tcp_udp]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> queue <value>
<1-999999> queue <name> rule <rule>
<0-65535> queue
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> queue-options
<name> rule <rule> <value>
queue-options
× set firewall Nothing found in XML Nothing found in VyOS
ipv6 name <name> Definitions
rule <1-999999>
queue-options
bypass
× set firewall Nothing found in XML Nothing found in VyOS
ipv6 name <name> Definitions
rule <1-999999>
queue-options
fanout
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> recent count
<1-999999> recent <name> rule <rule> <value>
count <1-255> recent count
continues on next page

21.1. Configuration Commands 1402

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> recent time
<1-999999> recent <name> rule <rule> <value>
time <second | recent time
minute | hour>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> source address
<1-999999> source <name> rule <rule> <value>
address [address | source address
addressrange | CIDR]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name
name <name> rule firewall ipv6 name <text> rule <text> source
<1-999999> source <name> rule <rule> address-mask <value>
address-mask source address-mask
[address]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> source fqdn
<1-999999> source <name> rule <rule> <value>
fqdn <fqdn> source fqdn
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> source geoip
<1-999999> source <name> rule <rule> country-code <value>
geoip country-code source geoip country-code
<country>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> source geoip
<1-999999> source <name> rule <rule> inverse-match
geoip inverse-match source geoip inverse-
match
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> source group
<1-999999> source <name> rule <rule> address-group <value>
group address-group source group address-
<name | !name> group
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> source group
<1-999999> source <name> rule <rule> domain-group <value>
group domain-group source group domain-
<name | !name> group
× set firewall firewall.xml.in: Nothing found in VyOS
ipv6 name <name> firewall ipv6 name
rule <1-999999> <name> rule <rule>
source group source group dynamic-
dynamic-address-group address-group
<name | !name>
continues on next page

21.1. Configuration Commands 1403

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> source group
<1-999999> source <name> rule <rule> mac-group <value>
group mac-group source group mac-group
<name | !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> source group
<1-999999> source <name> rule <rule> network-group <value>
group network-group source group network-
<name | !name> group
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> source group
<1-999999> source <name> rule <rule> port-group <value>
group port-group source group port-group
<name | !name>
✓ set firewall firewall.xml.in: firewall ipv6 name <text>
ipv6 name <name> firewall ipv6 name rule <text> source mac-
rule <1-999999> <name> rule <rule> address <value>
source mac-address source mac-address
<mac-address>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> source port
<1-999999> source <name> rule <rule> <value>
port [1-65535 source port
| portname |
start-end]
× set firewall ipv6 firewall.xml.in: Nothing found in VyOS
name <name> rule firewall ipv6 name
<1-999999> state <name> rule <rule> state
[established |
invalid | new |
related]
× not yet documented Nothing found in XML firewall ipv6 name <text>
Definitions rule <text> state estab-
lished <value>
× not yet documented Nothing found in XML firewall ipv6 name <text>
Definitions rule <text> state invalid
<value>
× not yet documented Nothing found in XML firewall ipv6 name <text>
Definitions rule <text> state new
<value>
× not yet documented Nothing found in XML firewall ipv6 name <text>
Definitions rule <text> state related
<value>
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 name
<name> rule <rule>
synproxy tcp mss
continues on next page

21.1. Configuration Commands 1404

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 name
<name> rule <rule> syn-
proxy tcp window-scale
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
name <name> rule Definitions
<1-999999> tcp flags
[not] <text>
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> tcp flags ack
<name> rule <rule> tcp
flags ack
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> tcp flags cwr
<name> rule <rule> tcp
flags cwr
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> tcp flags ecn
<name> rule <rule> tcp
flags ecn
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> tcp flags fin
<name> rule <rule> tcp
flags fin
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> tcp flags not
<name> rule <rule> tcp ack
flags not ack
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> tcp flags not
<name> rule <rule> tcp cwr
flags not cwr
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> tcp flags not
<name> rule <rule> tcp ecn
flags not ecn
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> tcp flags not fin
<name> rule <rule> tcp
flags not fin
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> tcp flags not
<name> rule <rule> tcp psh
flags not psh
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> tcp flags not rst
<name> rule <rule> tcp
flags not rst
continues on next page

21.1. Configuration Commands 1405

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> tcp flags not
<name> rule <rule> tcp syn
flags not syn
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> tcp flags not
<name> rule <rule> tcp urg
flags not urg
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> tcp flags psh
<name> rule <rule> tcp
flags psh
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> tcp flags rst
<name> rule <rule> tcp
flags rst
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> tcp flags syn
<name> rule <rule> tcp
flags syn
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> tcp flags urg
<name> rule <rule> tcp
flags urg
× not yet documented firewall.xml.in: firewall ipv6 name <text>
firewall ipv6 name rule <text> tcp mss
<name> rule <rule> tcp <value>
mss
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> time startdate
<1-999999> time <name> rule <rule> time <value>
startdate <text> startdate
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> time starttime
<1-999999> time <name> rule <rule> time <value>
starttime <text> starttime
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> time stopdate
<1-999999> time <name> rule <rule> time <value>
stopdate <text> stopdate
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> time stoptime
<1-999999> time <name> rule <rule> time <value>
stoptime <text> stoptime
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 name <text>
name <name> rule firewall ipv6 name rule <text> time weekdays
<1-999999> time <name> rule <rule> time <value>
weekdays <text> weekdays
continues on next page

21.1. Configuration Commands 1406

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter firewall ipv6 output filter default-action <value>
default-action default-action
[accept | drop]
× set firewall ipv6 firewall.xml.in: Nothing found in VyOS
output filter firewall ipv6 output filter
default-log default-log
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter description <value>
description
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> action <value>
<1-999999> action rule <rule> action
[accept | continue |
drop | jump | queue
| reject | return]
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 output filter
rule <rule> add-address-
to-group destination-
address address-group
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 output filter
rule <rule> add-address-
to-group destination-
address timeout
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 output filter
rule <rule> add-address-
to-group source-address
address-group
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 output filter
rule <rule> add-address-
to-group source-address
timeout
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output filter ter rule <text> connection-
rule <1-999999> rule <rule> connection- mark <value>
connection-mark mark
<1-2147483647>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output filter ter rule <text> connection-
rule <1-999999> rule <rule> connection- status nat <value>
connection-status status nat
nat [destination |
source]
continues on next page

21.1. Configuration Commands 1407

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 output fil-
ter rule <rule> conntrack-
helper
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output filter ter rule <text> description
rule <1-999999> rule <rule> description <value>
description <text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter firewall ipv6 output filter rule <text> destination ad-
rule <1-999999> rule <rule> destination ad- dress <value>
destination dress
address [address
| addressrange |
CIDR]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination address-mask <value>
destination address-mask
address-mask
[address]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination fqdn <value>
destination fqdn fqdn
<fqdn>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output fil- ter rule <text> destina-
rule <1-999999> ter rule <rule> destination tion geoip country-code
destination geoip geoip country-code <value>
country-code
<country>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination geoip inverse-match
destination geoip geoip inverse-match
inverse-match
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output fil- ter rule <text> destina-
rule <1-999999> ter rule <rule> destination tion group address-group
destination group group address-group <value>
address-group <name
| !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output fil- ter rule <text> destina-
rule <1-999999> ter rule <rule> destination tion group domain-group
destination group group domain-group <value>
domain-group <name |
!name>
continues on next page

21.1. Configuration Commands 1408

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall ipv6 firewall.xml.in: Nothing found in VyOS
output filter firewall ipv6 output filter
rule <1-999999> rule <rule> destination
destination group group dynamic-address-
dynamic-address-group group
<name | !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination group mac-group <value>
destination group group mac-group
mac-group <name |
!name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output fil- ter rule <text> destina-
rule <1-999999> ter rule <rule> destination tion group network-group
destination group group network-group <value>
network-group <name
| !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination group port-group <value>
destination group group port-group
port-group <name |
!name>
× not yet documented firewall.xml.in: firewall ipv6 output fil-
firewall ipv6 output fil- ter rule <text> destination
ter rule <rule> destination mac-address <value>
mac-address
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output fil- ter rule <text> destination
rule <1-999999> ter rule <rule> destination port <value>
destination port port
[1-65535 | portname
| start-end]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> disable
<1-999999> disable rule <rule> disable
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> dscp <value>
<1-999999> dscp rule <rule> dscp
[0-63 | start-end]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter firewall ipv6 output filter rule <text> dscp-exclude
rule <1-999999> rule <rule> dscp-exclude <value>
dscp-exclude [0-63 |
start-end]
continues on next page

21.1. Configuration Commands 1409

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
output filter Definitions
rule <1-999999>
fragment [match-frag
| match-non-frag]
× not yet documented firewall.xml.in: firewall ipv6 output fil-
firewall ipv6 output fil- ter rule <text> fragment
ter rule <rule> fragment match-frag
match-frag
× not yet documented firewall.xml.in: firewall ipv6 output fil-
firewall ipv6 output fil- ter rule <text> fragment
ter rule <rule> fragment match-non-frag
match-non-frag
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
output filter rule Definitions
<1-999999> hop-limit
<eq | gt | lt>
<0-255>
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> hop-limit eq
rule <rule> hop-limit eq <value>
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> hop-limit gt
rule <rule> hop-limit gt <value>
× not yet documented firewall.xml.in: firewall ipv6 output fil-
firewall ipv6 output filter ter rule <text> hop-limit lt
rule <rule> hop-limit lt <value>
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
output filter Definitions
rule <1-999999>
icmpv6 [code | type]
<0-255>
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> icmpv6 code
rule <rule> icmpv6 code <value>
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> icmpv6 type
rule <rule> icmpv6 type <value>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> icmpv6 type-
<1-999999> icmpv6 rule <rule> icmpv6 type- name <value>
type-name <text> name
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
output filter rule Definitions
<1-999999> ipsec
[match-ipsec |
match-none]
continues on next page

21.1. Configuration Commands 1410

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented Nothing found in XML firewall ipv6 output filter
Definitions rule <text> ipsec match-
ipsec
× not yet documented Nothing found in XML firewall ipv6 output filter
Definitions rule <text> ipsec match-
none
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output filter ter rule <text> jump-target
rule <1-999999> rule <rule> jump-target <value>
jump-target <text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output filter ter rule <text> limit burst
rule <1-999999> rule <rule> limit burst <value>
limit burst
<0-4294967295>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter rule firewall ipv6 output filter ter rule <text> limit rate
<1-999999> limit rule <rule> limit rate <value>
rate <text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> log <value>
<1-999999> log rule <rule> log
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output fil- ter rule <text> log-options
rule <1-999999> ter rule <rule> log-options group <value>
log-options group group
<0-65535>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output fil- ter rule <text> log-options
rule <1-999999> ter rule <rule> log-options level <value>
log-options level level
[emerg | alert |
crit | err | warn
| notice | info |
debug]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output fil- ter rule <text> log-options
rule <1-999999> ter rule <rule> log-options queue-threshold <value>
log-options queue-threshold
queue-threshold
<0-65535>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output fil- ter rule <text> log-options
rule <1-999999> ter rule <rule> log-options snapshot-length <value>
log-options snapshot-length
snapshot-length
<0-9000>
continues on next page

21.1. Configuration Commands 1411

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 output filter
rule <rule> mark
× set firewall ipv6 firewall.xml.in: Nothing found in VyOS
output filter firewall ipv6 output fil-
rule <1-999999> ter rule <rule> outbound-
outbound-interface interface group
group <iface_group>
× not yet documented Nothing found in XML firewall ipv6 output filter
Definitions rule <text> outbound-
interface interface-group
<value>
× not yet documented Nothing found in XML firewall ipv6 output filter
Definitions rule <text> outbound-
interface interface-name
<value>
× set firewall ipv6 firewall.xml.in: Nothing found in VyOS
output filter firewall ipv6 output fil-
rule <1-999999> ter rule <rule> outbound-
outbound-interface interface name
name <iface>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter firewall ipv6 output filter rule <text> packet-length
rule <1-999999> rule <rule> packet-length <value>
packet-length
<text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter firewall ipv6 output filter rule <text> packet-length-
rule <1-999999> rule <rule> packet-length- exclude <value>
packet-length-exclude exclude
<text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output filter ter rule <text> packet-type
rule <1-999999> rule <rule> packet-type <value>
packet-type
[broadcast | host
| multicast | other]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter rule firewall ipv6 output filter ter rule <text> protocol
<1-999999> protocol rule <rule> protocol <value>
[<text> | <0-255> |
all | tcp_udp]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> queue <value>
<1-999999> queue rule <rule> queue
<0-65535>
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> queue-options
rule <rule> queue-options <value>
continues on next page

21.1. Configuration Commands 1412

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
output filter Definitions
rule <1-999999>
queue-options
bypass
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
output filter Definitions
rule <1-999999>
queue-options
fanout
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> recent count
<1-999999> recent rule <rule> recent count <value>
count <1-255>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter rule firewall ipv6 output filter ter rule <text> recent time
<1-999999> recent rule <rule> recent time <value>
time <second |
minute | hour>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> source address
<1-999999> source rule <rule> source address <value>
address [address |
addressrange | CIDR]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter firewall ipv6 output fil- ter rule <text> source
rule <1-999999> ter rule <rule> source address-mask <value>
source address-mask address-mask
[address]
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> source fqdn
<1-999999> source rule <rule> source fqdn <value>
fqdn <fqdn>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> source geoip
<1-999999> source rule <rule> source geoip country-code <value>
geoip country-code country-code
<country>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> source geoip
<1-999999> source rule <rule> source geoip inverse-match
geoip inverse-match inverse-match
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> source group
<1-999999> source rule <rule> source group address-group <value>
group address-group address-group
<name | !name>
continues on next page

21.1. Configuration Commands 1413

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> source group
<1-999999> source rule <rule> source group domain-group <value>
group domain-group domain-group
<name | !name>
× set firewall ipv6 firewall.xml.in: Nothing found in VyOS
output filter firewall ipv6 output filter
rule <1-999999> rule <rule> source group
source group dynamic-address-group
dynamic-address-group
<name | !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> source group
<1-999999> source rule <rule> source group mac-group <value>
group mac-group mac-group
<name | !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> source group
<1-999999> source rule <rule> source group network-group <value>
group network-group network-group
<name | !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> source group
<1-999999> source rule <rule> source group port-group <value>
group port-group port-group
<name | !name>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter firewall ipv6 output filter rule <text> source mac-
rule <1-999999> rule <rule> source mac- address <value>
source mac-address address
<mac-address>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output fil-
output filter rule firewall ipv6 output filter ter rule <text> source port
<1-999999> source rule <rule> source port <value>
port [1-65535
| portname |
start-end]
× set firewall ipv6 firewall.xml.in: Nothing found in VyOS
output filter rule firewall ipv6 output filter
<1-999999> state rule <rule> state
[established |
invalid | new |
related]
× not yet documented Nothing found in XML firewall ipv6 output fil-
Definitions ter rule <text> state estab-
lished <value>
× not yet documented Nothing found in XML firewall ipv6 output filter
Definitions rule <text> state invalid
<value>
continues on next page

21.1. Configuration Commands 1414

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented Nothing found in XML firewall ipv6 output fil-
Definitions ter rule <text> state new
<value>
× not yet documented Nothing found in XML firewall ipv6 output filter
Definitions rule <text> state related
<value>
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 output filter
rule <rule> synproxy tcp
mss
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall ipv6 output filter
rule <rule> synproxy tcp
window-scale
× set firewall ipv6 Nothing found in XML Nothing found in VyOS
output filter rule Definitions
<1-999999> tcp flags
[not] <text>
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> tcp flags ack
rule <rule> tcp flags ack
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> tcp flags cwr
rule <rule> tcp flags cwr
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> tcp flags ecn
rule <rule> tcp flags ecn
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> tcp flags fin
rule <rule> tcp flags fin
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> tcp flags not
rule <rule> tcp flags not ack
ack
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> tcp flags not
rule <rule> tcp flags not cwr
cwr
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> tcp flags not
rule <rule> tcp flags not ecn
ecn
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> tcp flags not fin
rule <rule> tcp flags not
fin
continues on next page

21.1. Configuration Commands 1415

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> tcp flags not
rule <rule> tcp flags not psh
psh
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> tcp flags not rst
rule <rule> tcp flags not rst
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> tcp flags not
rule <rule> tcp flags not syn
syn
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> tcp flags not
rule <rule> tcp flags not urg
urg
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> tcp flags psh
rule <rule> tcp flags psh
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> tcp flags rst
rule <rule> tcp flags rst
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> tcp flags syn
rule <rule> tcp flags syn
× not yet documented firewall.xml.in: firewall ipv6 output filter
firewall ipv6 output filter rule <text> tcp flags urg
rule <rule> tcp flags urg
× not yet documented firewall.xml.in: firewall ipv6 output fil-
firewall ipv6 output filter ter rule <text> tcp mss
rule <rule> tcp mss <value>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> time startdate
<1-999999> time rule <rule> time startdate <value>
startdate <text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> time starttime
<1-999999> time rule <rule> time starttime <value>
starttime <text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> time stopdate
<1-999999> time rule <rule> time stopdate <value>
stopdate <text>
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> time stoptime
<1-999999> time rule <rule> time stoptime <value>
stoptime <text>
continues on next page

21.1. Configuration Commands 1416

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set firewall ipv6 firewall.xml.in: firewall ipv6 output filter
output filter rule firewall ipv6 output filter rule <text> time weekdays
<1-999999> time rule <rule> time weekdays <value>
weekdays <text>
× set firewall zone Nothing found in XML Nothing found in VyOS
... Definitions
× set firewall firewall.xml.in: Nothing found in VyOS
zone <name> firewall zone <zone>
default-action [drop default-action
| reject]
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall zone <zone>
default-log
× set firewall zone firewall.xml.in: Nothing found in VyOS
<name> description firewall zone <zone> de-
scription
× set firewall zone firewall.xml.in: Nothing found in VyOS
<name> from <name> firewall zone <zone>
firewall ipv6-name from <from> firewall
<rule-set> ipv6-name
× set firewall zone firewall.xml.in: Nothing found in VyOS
<name> from <name> firewall zone <zone> from
firewall name <from> firewall name
<rule-set>
× set firewall zone firewall.xml.in: Nothing found in VyOS
<name> interface firewall zone <zone> inter-
<interface> face
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall zone <zone>
intra-zone-filtering action
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall zone <zone>
intra-zone-filtering fire-
wall ipv6-name
× not yet documented firewall.xml.in: Nothing found in VyOS
firewall zone <zone>
intra-zone-filtering fire-
wall name
× set firewall zone firewall.xml.in: Nothing found in VyOS
<name> local-zone firewall zone <zone>
local-zone
× generate system Nothing found in XML Nothing found in VyOS
login username Definitions
<username> otp-key
hotp-time rate-limit
<1-10> rate-time
<15-600> window-size
<1-21>
continues on next page

21.1. Configuration Commands 1417

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented high-availability.xml.in: high-availability disable
high-availability disable
× not yet documented high-availability.xml.in: high-availability virtual-
high-availability virtual- server <text> address
server <virtual-server> <value>
address
× not yet documented high-availability.xml.in: high-availability virtual-
high-availability virtual- server <text> algorithm
server <virtual-server> <value>
algorithm
× not yet documented high-availability.xml.in: high-availability virtual-
high-availability virtual- server <text> delay-loop
server <virtual-server> <value>
delay-loop
× not yet documented high-availability.xml.in: high-availability virtual-
high-availability virtual- server <text> forward-
server <virtual-server> method <value>
forward-method
× not yet documented high-availability.xml.in: high-availability virtual-
high-availability virtual- server <text> fwmark
server <virtual-server> <value>
fwmark
× not yet documented high-availability.xml.in: high-availability virtual-
high-availability virtual- server <text> persistence-
server <virtual-server> timeout <value>
persistence-timeout
× not yet documented high-availability.xml.in: high-availability virtual-
high-availability virtual- server <text> port <value>
server <virtual-server>
port
× not yet documented high-availability.xml.in: high-availability virtual-
high-availability virtual- server <text> protocol
server <virtual-server> <value>
protocol
× not yet documented high-availability.xml.in: high-availability virtual-
high-availability virtual- server <text> real-server
server <virtual-server> <text> connection-timeout
real-server <real-server> <value>
connection-timeout
× not yet documented high-availability.xml.in: high-availability virtual-
high-availability virtual- server <text> real-server
server <virtual-server> <text> health-check script
real-server <real-server> <value>
health-check script
× not yet documented high-availability.xml.in: high-availability virtual-
high-availability virtual- server <text> real-server
server <virtual-server> <text> port <value>
real-server <real-server>
port
continues on next page

21.1. Configuration Commands 1418

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set high-availability.xml.in: high-availability vrrp
high-availability high-availability vrrp global-parameters garp
vrrp global-parameters garp interval <value>
global-parameters interval
garp interval <0.
000-1000>
✓ set high-availability.xml.in: high-availability vrrp
high-availability high-availability vrrp global-parameters garp
vrrp global-parameters garp master-delay <value>
global-parameters master-delay
garp master-delay
<1-255>
✓ set high-availability.xml.in: high-availability vrrp
high-availability high-availability vrrp global-parameters garp
vrrp global-parameters garp master-refresh <value>
global-parameters master-refresh
garp master-refresh
<1-600>
✓ set high-availability.xml.in: high-availability vrrp
high-availability high-availability vrrp global-parameters garp
vrrp global-parameters garp master-refresh-repeat
global-parameters master-refresh-repeat <value>
garp
master-refresh-repeat
<1-600>
✓ set high-availability.xml.in: high-availability vrrp
high-availability high-availability vrrp global-parameters garp
vrrp global-parameters garp master-repeat <value>
global-parameters master-repeat
garp master-repeat
<1-600>
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp global-parameters startup-
global-parameters startup- delay <value>
delay
× set Nothing found in XML Nothing found in VyOS
high-availability Definitions
vrrp
global-parameters
startup_delay
<1-600>
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp global-parameters version
global-parameters version <value>
× set Nothing found in XML Nothing found in VyOS
high-availability Definitions
vrrp
global-parameters
version 2|3
continues on next page

21.1. Configuration Commands 1419

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> address
group <group> address <text> interface <value>
<address> interface
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> advertise-
group <group> advertise- interval <value>
interval
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> authentica-
group <group> authenti- tion password <value>
cation password
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> authentica-
group <group> authenti- tion type <value>
cation type
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> description
group <group> descrip- <value>
tion
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> disable
group <group> disable
× not yet documented Nothing found in XML high-availability vrrp
Definitions group <text> excluded-
address <value>
× not yet documented high-availability.xml.in: Nothing found in VyOS
high-availability vrrp
group <group> excluded-
address <excluded-
address> interface
✓ set high-availability.xml.in: high-availability vrrp
high-availability high-availability vrrp group <text> garp interval
vrrp group <name> group <group> garp <value>
garp interval <0. interval
000-1000>
✓ set high-availability.xml.in: high-availability vrrp
high-availability high-availability vrrp group <text> garp master-
vrrp group <name> group <group> garp delay <value>
garp master-delay master-delay
<1-255>
✓ set high-availability.xml.in: high-availability vrrp
high-availability high-availability vrrp group <text> garp master-
vrrp group <name> group <group> garp refresh <value>
garp master-refresh master-refresh
<1-600>
continues on next page

21.1. Configuration Commands 1420

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set high-availability.xml.in: high-availability vrrp
high-availability high-availability vrrp group <text> garp master-
vrrp group group <group> garp refresh-repeat <value>
<name> garp master-refresh-repeat
master-refresh-repeat
<1-600>
✓ set high-availability.xml.in: high-availability vrrp
high-availability high-availability vrrp group <text> garp master-
vrrp group <name> group <group> garp repeat <value>
garp master-repeat master-repeat
<1-600>
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> health-check
group <group> health- failure-count <value>
check failure-count
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> health-check
group <group> health- interval <value>
check interval
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> health-check
group <group> health- ping <value>
check ping
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> health-check
group <group> health- script <value>
check script
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> hello-
group <group> hello- source-address <value>
source-address
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> interface
group <group> interface <value>
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> no-preempt
group <group> no-
preempt
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> peer-address
group <group> peer- <value>
address
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> preempt-
group <group> preempt- delay <value>
delay
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> priority
group <group> priority <value>
continues on next page

21.1. Configuration Commands 1421

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> rfc3768-
group <group> rfc3768- compatibility
compatibility
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> track
group <group> track exclude-vrrp-interface
exclude-vrrp-interface
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> track inter-
group <group> track face <value>
interface
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> transition-
group <group> transition- script backup <value>
script backup
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> transition-
group <group> transition- script fault <value>
script fault
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> transition-
group <group> transition- script master <value>
script master
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> transition-
group <group> transition- script stop <value>
script stop
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp group <text> vrid <value>
group <group> vrid
× not yet documented high-availability.xml.in: Nothing found in VyOS
high-availability vrrp
snmp
× not yet documented high-availability.xml.in: Nothing found in VyOS
high-availability vrrp
sync-group <sync-group>
health-check failure-count
× not yet documented high-availability.xml.in: Nothing found in VyOS
high-availability vrrp
sync-group <sync-group>
health-check interval
× not yet documented high-availability.xml.in: Nothing found in VyOS
high-availability vrrp
sync-group <sync-group>
health-check ping
continues on next page

21.1. Configuration Commands 1422

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented high-availability.xml.in: Nothing found in VyOS
high-availability vrrp
sync-group <sync-group>
health-check script
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp sync-group <text> mem-
sync-group <sync-group> ber <value>
member
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp sync-group <text>
sync-group <sync-group> transition-script backup
transition-script backup <value>
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp sync-group <text>
sync-group <sync-group> transition-script fault
transition-script fault <value>
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp sync-group <text>
sync-group <sync-group> transition-script mas-
transition-script master ter <value>
× not yet documented high-availability.xml.in: high-availability vrrp
high-availability vrrp sync-group <text>
sync-group <sync-group> transition-script stop
transition-script stop <value>
× set interface Nothing found in XML Nothing found in VyOS
ethernet <interface> Definitions
ring-buffer rx
<value>
× set interface Nothing found in XML Nothing found in VyOS
ethernet <interface> Definitions
ring-buffer tx
<value>
× set interfaces Nothing found in XML Nothing found in VyOS
bonding <interface> Definitions
evpn es-id
<<1-16777215|10-byte
ID>
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: address <value>
address <address | interfaces bonding <bond-
dhcp | dhcpv6> ing> address
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: arp-monitor interval
arp-monitor interval interfaces bonding <bond- <value>
<time> ing> arp-monitor interval
✓ set interfaces inter- interfaces bonding
bonding <interface> faces_bonding.xml.in: <text> arp-monitor
arp-monitor target interfaces bonding <bond- target <value>
<address> ing> arp-monitor target
continues on next page

21.1. Configuration Commands 1423

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: description <value>
description interfaces bonding <bond-
<description> ing> description
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: dhcp-options client-id
dhcp-options interfaces bonding <bond- <value>
client-id ing> dhcp-options client-
<description> id
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: dhcp-options default-
dhcp-options interfaces bonding <bond- route-distance <value>
default-route-distance ing> dhcp-options default-
<distance> route-distance
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: dhcp-options host-name
dhcp-options interfaces bonding <bond- <value>
host-name ing> dhcp-options host-
<hostname> name
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: dhcp-options mtu
interfaces bonding <bond-
ing> dhcp-options mtu
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: dhcp-options no-default-
dhcp-options interfaces bonding <bond- route
no-default-route ing> dhcp-options no-
default-route
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: dhcp-options reject
dhcp-options reject interfaces bonding <bond- <value>
<address> ing> dhcp-options reject
× set interfaces inter- Nothing found in VyOS
bonding <interface> faces_bonding.xml.in:
dhcp-options interfaces bonding <bond-
user-class <string> ing> dhcp-options user-
class
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: dhcp-options vendor-
dhcp-options interfaces bonding <bond- class-id <value>
vendor-class-id ing> dhcp-options vendor-
<vendor-id> class-id
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: dhcpv6-options duid
dhcpv6-options duid interfaces bonding <bond- <value>
<duid> ing> dhcpv6-options duid
continues on next page

21.1. Configuration Commands 1424

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: dhcpv6-options no-release
dhcpv6-options interfaces bonding <bond-
no-release ing> dhcpv6-options no-
release
✓ set interfaces inter- interfaces bonding
bonding <interface> faces_bonding.xml.in: <text> dhcpv6-options
dhcpv6-options interfaces bonding <bond- parameters-only
parameters-only ing> dhcpv6-options
parameters-only
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: dhcpv6-options pd <text>
dhcpv6-options interfaces bonding <bond- interface <text> address
pd <id> interface ing> dhcpv6-options pd <value>
<delegatee> address <pd> interface <inter-
<address> face> address
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: dhcpv6-options pd <text>
dhcpv6-options interfaces bonding <bond- interface <text> sla-id
pd <id> interface ing> dhcpv6-options pd <value>
<delegatee> sla-id <pd> interface <inter-
<id> face> sla-id
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: dhcpv6-options pd <text>
dhcpv6-options interfaces bonding <bond- length <value>
pd <id> length ing> dhcpv6-options pd
<length> <pd> length
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: dhcpv6-options rapid-
dhcpv6-options interfaces bonding <bond- commit
rapid-commit ing> dhcpv6-options
rapid-commit
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: dhcpv6-options temporary
dhcpv6-options interfaces bonding <bond-
temporary ing> dhcpv6-options tem-
porary
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: disable
disable interfaces bonding <bond-
ing> disable
× set interfaces Nothing found in XML Nothing found in VyOS
bonding <interface> Definitions
disable-flow-control
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: disable-link-detect
disable-link-detect interfaces bonding <bond-
ing> disable-link-detect
continues on next page

21.1. Configuration Commands 1425

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set interfaces inter- Nothing found in VyOS
bonding <interface> faces_bonding.xml.in:
evpn es-df-pref interfaces bonding <bond-
<1-65535> ing> evpn es-df-pref
× not yet documented inter- Nothing found in VyOS
faces_bonding.xml.in:
interfaces bonding <bond-
ing> evpn es-id
× set interfaces inter- Nothing found in VyOS
bonding <interface> faces_bonding.xml.in:
evpn es-sys-mac interfaces bonding <bond-
<xx:xx:xx:xx:xx:xx> ing> evpn es-sys-mac
× set interfaces inter- Nothing found in VyOS
bonding <interface> faces_bonding.xml.in:
evpn uplink interfaces bonding <bond-
ing> evpn uplink
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: hash-policy <value>
hash-policy interfaces bonding <bond-
<policy> ing> hash-policy
× set interfaces Nothing found in XML Nothing found in VyOS
bondinging Definitions
<interface>
mirror egress
<monitor-interface>
× set interfaces Nothing found in XML Nothing found in VyOS
bondinging Definitions
<interface>
mirror ingress
<monitor-interface>
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: ip adjust-mss <value>
ip adjust-mss <mss | interfaces bonding <bond-
clamp-mss-to-pmtu> ing> ip adjust-mss
✓ set interfaces inter- interfaces bonding <text>
bonding faces_bonding.xml.in: ip arp-cache-timeout
<interface> ip interfaces bonding <bond- <value>
arp-cache-timeout ing> ip arp-cache-timeout
✓ set interfaces inter- interfaces bonding <text>
bonding faces_bonding.xml.in: ip disable-arp-filter
<interface> ip interfaces bonding <bond-
disable-arp-filter ing> ip disable-arp-filter
✓ set interfaces inter- interfaces bonding <text>
bonding faces_bonding.xml.in: ip disable-forwarding
<interface> ip interfaces bonding <bond-
disable-forwarding ing> ip disable-forwarding
continues on next page

21.1. Configuration Commands 1426

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces bonding <text>
bonding faces_bonding.xml.in: ip enable-arp-accept
<interface> ip interfaces bonding <bond-
enable-arp-accept ing> ip enable-arp-accept
✓ set interfaces inter- interfaces bonding <text>
bonding faces_bonding.xml.in: ip enable-arp-announce
<interface> ip interfaces bonding <bond-
enable-arp-announce ing> ip enable-arp-
announce
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: ip enable-arp-ignore
ip enable-arp-ignore interfaces bonding <bond-
ing> ip enable-arp-ignore
✓ set interfaces inter- interfaces bonding <text>
bonding faces_bonding.xml.in: ip enable-directed-
<interface> ip interfaces bonding <bond- broadcast
enable-directed-broadcast
ing> ip enable-directed-
broadcast
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: ip enable-proxy-arp
ip enable-proxy-arp interfaces bonding <bond-
ing> ip enable-proxy-arp
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: ip proxy-arp-pvlan
ip proxy-arp-pvlan interfaces bonding <bond-
ing> ip proxy-arp-pvlan
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: ip source-validation
ip source-validation interfaces bonding <bond- <value>
<strict | loose | ing> ip source-validation
disable>
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: ipv6 accept-dad <value>
ipv6 accept-dad interfaces bonding <bond-
<1-3> ing> ipv6 accept-dad
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: ipv6 address autoconf
ipv6 address interfaces bonding <bond-
autoconf ing> ipv6 address auto-
conf
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: ipv6 address eui64
ipv6 address eui64 interfaces bonding <bond- <value>
<prefix> ing> ipv6 address eui64
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: ipv6 address no-default-
ipv6 address interfaces bonding <bond- link-local
no-default-link-local ing> ipv6 address no-
default-link-local
continues on next page

21.1. Configuration Commands 1427

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces bonding <text>
bonding faces_bonding.xml.in: ipv6 adjust-mss <value>
<interface> ipv6 interfaces bonding <bond-
adjust-mss <mss | ing> ipv6 adjust-mss
clamp-mss-to-pmtu>
× not yet documented inter- Nothing found in VyOS
faces_bonding.xml.in:
interfaces bonding <bond-
ing> ipv6 base-reachable-
time
✓ set interfaces inter- interfaces bonding <text>
bonding faces_bonding.xml.in: ipv6 disable-forwarding
<interface> ipv6 interfaces bonding
disable-forwarding <bonding> ipv6 disable-
forwarding
✓ set interfaces inter- interfaces bonding <text>
bonding faces_bonding.xml.in: ipv6 dup-addr-detect-
<interface> ipv6 interfaces bonding <bond- transmits <value>
dup-addr-detect-transmits
ing> ipv6 dup-addr-
<n> detect-transmits
× not yet documented inter- Nothing found in VyOS
faces_bonding.xml.in:
interfaces bonding
<bonding> ipv6 source-
validation
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: lacp-rate <value>
lacp-rate interfaces bonding <bond-
<slow|fast> ing> lacp-rate
✓ set interfaces inter- interfaces bonding <text>
bonding faces_bonding.xml.in: mac <value>
<interface> mac interfaces bonding <bond-
<xx:xx:xx:xx:xx:xx> ing> mac
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: member interface <value>
member interface interfaces bonding <bond-
<member> ing> member interface
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: mii-mon-interval <value>
interfaces bonding <bond-
ing> mii-mon-interval
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: min-links <value>
min-links <0-16> interfaces bonding <bond-
ing> min-links
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: mirror egress <value>
interfaces bonding <bond-
ing> mirror egress
continues on next page

21.1. Configuration Commands 1428

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: mirror ingress <value>
interfaces bonding <bond-
ing> mirror ingress
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: mode <value>
mode <802.3ad | interfaces bonding <bond-
active-backup ing> mode
| broadcast |
round-robin |
transmit-load-balance
|
adaptive-load-balance
| xor-hash>
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: mtu <value>
mtu <mtu> interfaces bonding <bond-
ing> mtu
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: primary <value>
primary <interface> interfaces bonding <bond-
ing> primary
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: redirect <value>
interfaces bonding <bond-
ing> redirect
× set interfaces Nothing found in XML Nothing found in VyOS
bonding <interface> Definitions
system-mac <mac
address>
× set interfaces Nothing found in XML Nothing found in VyOS
bonding <interface> Definitions
vif <vlan-id>
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> address
interfaces bonding <bond- <value>
ing> vif-s <vif-s> address
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> description
interfaces bonding <bond- <value>
ing> vif-s <vif-s> descrip-
tion
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> dhcp-options
interfaces bonding <bond- client-id <value>
ing> vif-s <vif-s> dhcp-
options client-id
continues on next page

21.1. Configuration Commands 1429

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> dhcp-options
interfaces bonding <bond- default-route-distance
ing> vif-s <vif-s> dhcp- <value>
options default-route-
distance
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> dhcp-options
interfaces bonding <bond- host-name <value>
ing> vif-s <vif-s> dhcp-
options host-name
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> dhcp-options
interfaces bonding <bond- mtu
ing> vif-s <vif-s> dhcp-
options mtu
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> dhcp-options
interfaces bonding <bond- no-default-route
ing> vif-s <vif-s> dhcp-
options no-default-route
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> dhcp-options
interfaces bonding <bond- reject <value>
ing> vif-s <vif-s> dhcp-
options reject
× not yet documented inter- Nothing found in VyOS
faces_bonding.xml.in:
interfaces bonding <bond-
ing> vif-s <vif-s> dhcp-
options user-class
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> dhcp-options
interfaces bonding <bond- vendor-class-id <value>
ing> vif-s <vif-s> dhcp-
options vendor-class-id
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> dhcpv6-
interfaces bonding <bond- options duid <value>
ing> vif-s <vif-s> dhcpv6-
options duid
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> dhcpv6-
interfaces bonding <bond- options no-release
ing> vif-s <vif-s> dhcpv6-
options no-release
continues on next page

21.1. Configuration Commands 1430

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> dhcpv6-
interfaces bonding <bond- options parameters-only
ing> vif-s <vif-s> dhcpv6-
options parameters-only
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> dhcpv6-
interfaces bonding <bond- options pd <text> in-
ing> vif-s <vif-s> dhcpv6- terface <text> address
options pd <pd> interface <value>
<interface> address
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> dhcpv6-
interfaces bonding <bond- options pd <text> in-
ing> vif-s <vif-s> dhcpv6- terface <text> sla-id
options pd <pd> interface <value>
<interface> sla-id
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> dhcpv6-
interfaces bonding <bond- options pd <text> length
ing> vif-s <vif-s> dhcpv6- <value>
options pd <pd> length
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> dhcpv6-
interfaces bonding <bond- options rapid-commit
ing> vif-s <vif-s> dhcpv6-
options rapid-commit
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> dhcpv6-
interfaces bonding <bond- options temporary
ing> vif-s <vif-s> dhcpv6-
options temporary
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> disable
interfaces bonding <bond-
ing> vif-s <vif-s> disable
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> disable-link-
interfaces bonding <bond- detect
ing> vif-s <vif-s> disable-
link-detect
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> ip adjust-mss
interfaces bonding <bond- <value>
ing> vif-s <vif-s> ip
adjust-mss
continues on next page

21.1. Configuration Commands 1431

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> ip arp-cache-
interfaces bonding <bond- timeout <value>
ing> vif-s <vif-s> ip arp-
cache-timeout
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> ip disable-arp-
interfaces bonding <bond- filter
ing> vif-s <vif-s> ip
disable-arp-filter
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> ip disable-
interfaces bonding <bond- forwarding
ing> vif-s <vif-s> ip
disable-forwarding
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> ip enable-arp-
interfaces bonding <bond- accept
ing> vif-s <vif-s> ip
enable-arp-accept
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> ip enable-arp-
interfaces bonding <bond- announce
ing> vif-s <vif-s> ip
enable-arp-announce
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> ip enable-arp-
interfaces bonding <bond- ignore
ing> vif-s <vif-s> ip
enable-arp-ignore
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> ip enable-
interfaces bonding <bond- directed-broadcast
ing> vif-s <vif-s> ip
enable-directed-broadcast
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> ip enable-
interfaces bonding <bond- proxy-arp
ing> vif-s <vif-s> ip
enable-proxy-arp
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> ip proxy-arp-
interfaces bonding <bond- pvlan
ing> vif-s <vif-s> ip
proxy-arp-pvlan
continues on next page

21.1. Configuration Commands 1432

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> ip source-
interfaces bonding <bond- validation <value>
ing> vif-s <vif-s> ip
source-validation
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> ipv6 accept-
interfaces bonding <bond- dad <value>
ing> vif-s <vif-s> ipv6
accept-dad
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> ipv6 address
interfaces bonding <bond- autoconf
ing> vif-s <vif-s> ipv6 ad-
dress autoconf
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> ipv6 address
interfaces bonding <bond- eui64 <value>
ing> vif-s <vif-s> ipv6 ad-
dress eui64
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> ipv6 address
interfaces bonding <bond- no-default-link-local
ing> vif-s <vif-s> ipv6 ad-
dress no-default-link-local
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> ipv6 adjust-
interfaces bonding <bond- mss <value>
ing> vif-s <vif-s> ipv6
adjust-mss
× not yet documented inter- Nothing found in VyOS
faces_bonding.xml.in:
interfaces bonding <bond-
ing> vif-s <vif-s> ipv6
base-reachable-time
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> ipv6 disable-
interfaces bonding <bond- forwarding
ing> vif-s <vif-s> ipv6
disable-forwarding
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> ipv6 dup-
interfaces bonding <bond- addr-detect-transmits
ing> vif-s <vif-s> ipv6 <value>
dup-addr-detect-transmits
continues on next page

21.1. Configuration Commands 1433

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- Nothing found in VyOS
faces_bonding.xml.in:
interfaces bonding <bond-
ing> vif-s <vif-s> ipv6
source-validation
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> mac <value>
interfaces bonding <bond-
ing> vif-s <vif-s> mac
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> mirror egress
interfaces bonding <bond- <value>
ing> vif-s <vif-s> mirror
egress
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> mirror ingress
interfaces bonding <bond- <value>
ing> vif-s <vif-s> mirror
ingress
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> mtu <value>
interfaces bonding <bond-
ing> vif-s <vif-s> mtu
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> protocol
interfaces bonding <bond- <value>
ing> vif-s <vif-s> protocol
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> redirect
interfaces bonding <bond- <value>
ing> vif-s <vif-s> redirect
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- address <value>
ing> vif-s <vif-s> vif-c
<vif-c> address
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- description <value>
ing> vif-s <vif-s> vif-c
<vif-c> description
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- dhcp-options client-id
ing> vif-s <vif-s> vif-c <value>
<vif-c> dhcp-options
client-id
continues on next page

21.1. Configuration Commands 1434

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- dhcp-options default-
ing> vif-s <vif-s> vif-c route-distance <value>
<vif-c> dhcp-options
default-route-distance
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- dhcp-options host-name
ing> vif-s <vif-s> vif-c <value>
<vif-c> dhcp-options
host-name
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- dhcp-options mtu
ing> vif-s <vif-s> vif-c
<vif-c> dhcp-options mtu
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- dhcp-options no-default-
ing> vif-s <vif-s> vif-c route
<vif-c> dhcp-options no-
default-route
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- dhcp-options reject
ing> vif-s <vif-s> vif-c <value>
<vif-c> dhcp-options re-
ject
× not yet documented inter- Nothing found in VyOS
faces_bonding.xml.in:
interfaces bonding <bond-
ing> vif-s <vif-s> vif-c
<vif-c> dhcp-options user-
class
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- dhcp-options vendor-
ing> vif-s <vif-s> vif-c class-id <value>
<vif-c> dhcp-options
vendor-class-id
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- dhcpv6-options duid
ing> vif-s <vif-s> vif-c <value>
<vif-c> dhcpv6-options
duid
continues on next page

21.1. Configuration Commands 1435

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- dhcpv6-options no-release
ing> vif-s <vif-s> vif-c
<vif-c> dhcpv6-options
no-release
× not yet documented inter- interfaces bonding
faces_bonding.xml.in: <text> vif-s <text> vif-c
interfaces bonding <bond- <text> dhcpv6-options
ing> vif-s <vif-s> vif-c parameters-only
<vif-c> dhcpv6-options
parameters-only
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- dhcpv6-options pd <text>
ing> vif-s <vif-s> vif-c interface <text> address
<vif-c> dhcpv6-options <value>
pd <pd> interface <inter-
face> address
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- dhcpv6-options pd <text>
ing> vif-s <vif-s> vif-c interface <text> sla-id
<vif-c> dhcpv6-options <value>
pd <pd> interface <inter-
face> sla-id
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- dhcpv6-options pd <text>
ing> vif-s <vif-s> vif-c length <value>
<vif-c> dhcpv6-options
pd <pd> length
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- dhcpv6-options rapid-
ing> vif-s <vif-s> vif-c commit
<vif-c> dhcpv6-options
rapid-commit
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- dhcpv6-options temporary
ing> vif-s <vif-s> vif-c
<vif-c> dhcpv6-options
temporary
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- disable
ing> vif-s <vif-s> vif-c
<vif-c> disable
continues on next page

21.1. Configuration Commands 1436

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- disable-link-detect
ing> vif-s <vif-s> vif-c
<vif-c> disable-link-
detect
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text> ip
interfaces bonding <bond- adjust-mss <value>
ing> vif-s <vif-s> vif-c
<vif-c> ip adjust-mss
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- ip arp-cache-timeout
ing> vif-s <vif-s> vif-c <value>
<vif-c> ip arp-cache-
timeout
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text> ip
interfaces bonding <bond- disable-arp-filter
ing> vif-s <vif-s> vif-c
<vif-c> ip disable-arp-
filter
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text> ip
interfaces bonding <bond- disable-forwarding
ing> vif-s <vif-s> vif-c
<vif-c> ip disable-
forwarding
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text> ip
interfaces bonding <bond- enable-arp-accept
ing> vif-s <vif-s> vif-c
<vif-c> ip enable-arp-
accept
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text> ip
interfaces bonding <bond- enable-arp-announce
ing> vif-s <vif-s> vif-c
<vif-c> ip enable-arp-
announce
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text> ip
interfaces bonding <bond- enable-arp-ignore
ing> vif-s <vif-s> vif-c
<vif-c> ip enable-arp-
ignore
continues on next page

21.1. Configuration Commands 1437

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text> ip
interfaces bonding enable-directed-broadcast
<bonding> vif-s <vif-
s> vif-c <vif-c> ip
enable-directed-broadcast
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text> ip
interfaces bonding <bond- enable-proxy-arp
ing> vif-s <vif-s> vif-c
<vif-c> ip enable-proxy-
arp
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text> ip
interfaces bonding <bond- proxy-arp-pvlan
ing> vif-s <vif-s> vif-c
<vif-c> ip proxy-arp-
pvlan
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text> ip
interfaces bonding source-validation <value>
<bonding> vif-s <vif-
s> vif-c <vif-c> ip
source-validation
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- ipv6 accept-dad <value>
ing> vif-s <vif-s> vif-c
<vif-c> ipv6 accept-dad
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- ipv6 address autoconf
ing> vif-s <vif-s> vif-c
<vif-c> ipv6 address auto-
conf
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- ipv6 address eui64
ing> vif-s <vif-s> vif-c <value>
<vif-c> ipv6 address eui64
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- ipv6 address no-default-
ing> vif-s <vif-s> vif-c link-local
<vif-c> ipv6 address no-
default-link-local
continues on next page

21.1. Configuration Commands 1438

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- ipv6 adjust-mss <value>
ing> vif-s <vif-s> vif-c
<vif-c> ipv6 adjust-mss
× not yet documented inter- Nothing found in VyOS
faces_bonding.xml.in:
interfaces bonding <bond-
ing> vif-s <vif-s> vif-c
<vif-c> ipv6 base-
reachable-time
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- ipv6 disable-forwarding
ing> vif-s <vif-s> vif-c
<vif-c> ipv6 disable-
forwarding
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- ipv6 dup-addr-detect-
ing> vif-s <vif-s> vif-c transmits <value>
<vif-c> ipv6 dup-addr-
detect-transmits
× not yet documented inter- Nothing found in VyOS
faces_bonding.xml.in:
interfaces bonding <bond-
ing> vif-s <vif-s> vif-c
<vif-c> ipv6 source-
validation
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- mac <value>
ing> vif-s <vif-s> vif-c
<vif-c> mac
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- mirror egress <value>
ing> vif-s <vif-s> vif-c
<vif-c> mirror egress
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- mirror ingress <value>
ing> vif-s <vif-s> vif-c
<vif-c> mirror ingress
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- mtu <value>
ing> vif-s <vif-s> vif-c
<vif-c> mtu
continues on next page

21.1. Configuration Commands 1439

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- redirect <value>
ing> vif-s <vif-s> vif-c
<vif-c> redirect
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vif-c <text>
interfaces bonding <bond- vrf <value>
ing> vif-s <vif-s> vif-c
<vif-c> vrf
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif-s <text> vrf <value>
interfaces bonding <bond-
ing> vif-s <vif-s> vrf
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> address <value>
vif <vlan-id> interfaces bonding <bond-
address <address ing> vif <vif> address
| dhcp | dhcpv6>
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> description
vif <vlan-id> interfaces bonding <bond- <value>
description ing> vif <vif> description
<description>
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> dhcp-options
vif <vlan-id> interfaces bonding <bond- client-id <value>
dhcp-options ing> vif <vif> dhcp-
client-id options client-id
<description>
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> dhcp-options
vif <vlan-id> interfaces bonding default-route-distance
dhcp-options <bonding> vif <vif> <value>
default-route-distance dhcp-options default-
<distance> route-distance
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> dhcp-options
vif <vlan-id> interfaces bonding <bond- host-name <value>
dhcp-options ing> vif <vif> dhcp-
host-name options host-name
<hostname>
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif <text> dhcp-options
interfaces bonding <bond- mtu
ing> vif <vif> dhcp-
options mtu
continues on next page

21.1. Configuration Commands 1440

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> dhcp-options
vif <vlan-id> interfaces bonding <bond- no-default-route
dhcp-options ing> vif <vif> dhcp-
no-default-route options no-default-route
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> dhcp-options re-
vif <vlan-id> interfaces bonding <bond- ject <value>
dhcp-options reject ing> vif <vif> dhcp-
<address> options reject
× set interfaces inter- Nothing found in VyOS
bonding <interface> faces_bonding.xml.in:
vif <vlan-id> interfaces bonding <bond-
dhcp-options ing> vif <vif> dhcp-
user-class <string> options user-class
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> dhcp-options
vif <vlan-id> interfaces bonding <bond- vendor-class-id <value>
dhcp-options ing> vif <vif> dhcp-
vendor-class-id options vendor-class-id
<vendor-id>
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces bonding <bond- duid <value>
dhcpv6-options duid ing> vif <vif> dhcpv6-
<duid> options duid
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces bonding <bond- no-release
dhcpv6-options ing> vif <vif> dhcpv6-
no-release options no-release
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces bonding <bond- parameters-only
dhcpv6-options ing> vif <vif> dhcpv6-
parameters-only options parameters-only
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces bonding <bond- pd <text> interface <text>
dhcpv6-options ing> vif <vif> dhcpv6- address <value>
pd <id> interface options pd <pd> interface
<delegatee> address <interface> address
<address>
continues on next page

21.1. Configuration Commands 1441

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces bonding <bond- pd <text> interface <text>
dhcpv6-options ing> vif <vif> dhcpv6- sla-id <value>
pd <id> interface options pd <pd> interface
<delegatee> sla-id <interface> sla-id
<id>
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces bonding <bond- pd <text> length <value>
dhcpv6-options ing> vif <vif> dhcpv6-
pd <id> length options pd <pd> length
<length>
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces bonding <bond- rapid-commit
dhcpv6-options ing> vif <vif> dhcpv6-
rapid-commit options rapid-commit
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces bonding <bond- temporary
dhcpv6-options ing> vif <vif> dhcpv6-
temporary options temporary
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> disable
vif <vlan-id> interfaces bonding <bond-
disable ing> vif <vif> disable
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> disable-link-
vif <vlan-id> interfaces bonding <bond- detect
disable-link-detect ing> vif <vif> disable-
link-detect
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif <text> egress-qos
interfaces bonding <bond- <value>
ing> vif <vif> egress-qos
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif <text> ingress-qos
interfaces bonding <bond- <value>
ing> vif <vif> ingress-qos
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> ip adjust-mss
vif <vlan-id> ip interfaces bonding <bond- <value>
adjust-mss <mss | ing> vif <vif> ip adjust-
clamp-mss-to-pmtu> mss
continues on next page

21.1. Configuration Commands 1442

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> ip arp-cache-
vif <vlan-id> ip interfaces bonding <bond- timeout <value>
arp-cache-timeout ing> vif <vif> ip arp-
cache-timeout
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> ip disable-arp-
vif <vlan-id> ip interfaces bonding <bond- filter
disable-arp-filter ing> vif <vif> ip disable-
arp-filter
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> ip disable-
vif <vlan-id> ip interfaces bonding <bond- forwarding
disable-forwarding ing> vif <vif> ip disable-
forwarding
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> ip enable-arp-
vif <vlan-id> ip interfaces bonding <bond- accept
enable-arp-accept ing> vif <vif> ip enable-
arp-accept
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> ip enable-arp-
vif <vlan-id> ip interfaces bonding <bond- announce
enable-arp-announce ing> vif <vif> ip enable-
arp-announce
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> ip enable-arp-
vif <vlan-id> ip interfaces bonding <bond- ignore
enable-arp-ignore ing> vif <vif> ip enable-
arp-ignore
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> ip enable-
vif <vlan-id> ip interfaces bonding <bond- directed-broadcast
enable-directed-broadcast
ing> vif <vif> ip enable-
directed-broadcast
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> ip enable-proxy-
vif <vlan-id> ip interfaces bonding <bond- arp
enable-proxy-arp ing> vif <vif> ip enable-
proxy-arp
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> ip proxy-arp-
vif <vlan-id> ip interfaces bonding <bond- pvlan
proxy-arp-pvlan ing> vif <vif> ip proxy-
arp-pvlan
continues on next page

21.1. Configuration Commands 1443

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> ip source-
vif <vlan-id> ip interfaces bonding <bond- validation <value>
source-validation ing> vif <vif> ip source-
<strict | loose | validation
disable>
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> ipv6 accept-dad
vif <vlan-id> ipv6 interfaces bonding <bond- <value>
accept-dad <1-3> ing> vif <vif> ipv6 accept-
dad
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> ipv6 address au-
vif <vlan-id> ipv6 interfaces bonding <bond- toconf
address autoconf ing> vif <vif> ipv6 ad-
dress autoconf
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> ipv6 address
vif <vlan-id> interfaces bonding <bond- eui64 <value>
ipv6 address eui64 ing> vif <vif> ipv6 ad-
<prefix> dress eui64
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> ipv6 address no-
vif <vlan-id> interfaces bonding <bond- default-link-local
ipv6 address ing> vif <vif> ipv6 ad-
no-default-link-local dress no-default-link-local
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> ipv6 adjust-mss
vif <vlan-id> ipv6 interfaces bonding <bond- <value>
adjust-mss <mss | ing> vif <vif> ipv6 adjust-
clamp-mss-to-pmtu> mss
× not yet documented inter- Nothing found in VyOS
faces_bonding.xml.in:
interfaces bonding <bond-
ing> vif <vif> ipv6 base-
reachable-time
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> ipv6 disable-
vif <vlan-id> ipv6 interfaces bonding <bond- forwarding
disable-forwarding ing> vif <vif> ipv6
disable-forwarding
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> ipv6 dup-addr-
vif <vlan-id> ipv6 interfaces bonding <bond- detect-transmits <value>
dup-addr-detect-transmits
ing> vif <vif> ipv6 dup-
<n> addr-detect-transmits
continues on next page

21.1. Configuration Commands 1444

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- Nothing found in VyOS
faces_bonding.xml.in:
interfaces bonding <bond-
ing> vif <vif> ipv6
source-validation
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> mac <value>
vif <vlan-id> mac interfaces bonding <bond-
<xx:xx:xx:xx:xx:xx> ing> vif <vif> mac
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif <text> mirror egress
interfaces bonding <bond- <value>
ing> vif <vif> mirror
egress
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif <text> mirror ingress
interfaces bonding <bond- <value>
ing> vif <vif> mirror
ingress
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> mtu <value>
vif <vlan-id> mtu interfaces bonding <bond-
<mtu> ing> vif <vif> mtu
× not yet documented inter- interfaces bonding <text>
faces_bonding.xml.in: vif <text> redirect <value>
interfaces bonding <bond-
ing> vif <vif> redirect
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vif <text> vrf <value>
vif <vlan-id> vrf interfaces bonding <bond-
<vrf> ing> vif <vif> vrf
✓ set interfaces inter- interfaces bonding <text>
bonding <interface> faces_bonding.xml.in: vrf <value>
vrf <vrf> interfaces bonding <bond-
ing> vrf
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> address <value>
address <address | address
dhcp | dhcpv6>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> aging <value>
aging <time> aging
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> description <value>
description description
<description>
continues on next page

21.1. Configuration Commands 1445

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> dhcp-options client-id
dhcp-options dhcp-options client-id <value>
client-id
<description>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> dhcp-options default-
dhcp-options dhcp-options default- route-distance <value>
default-route-distance route-distance
<distance>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> dhcp-options host-name
dhcp-options dhcp-options host-name <value>
host-name
<hostname>
× not yet documented interfaces_bridge.xml.in: interfaces bridge <text>
interfaces bridge <bridge> dhcp-options mtu
dhcp-options mtu
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> dhcp-options no-default-
dhcp-options dhcp-options no-default- route
no-default-route route
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> dhcp-options reject
dhcp-options reject dhcp-options reject <value>
<address>
× set interfaces interfaces_bridge.xml.in: Nothing found in VyOS
bridge <interface> interfaces bridge <bridge>
dhcp-options dhcp-options user-class
user-class <string>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> dhcp-options vendor-
dhcp-options dhcp-options vendor- class-id <value>
vendor-class-id class-id
<vendor-id>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> dhcpv6-options duid
dhcpv6-options duid dhcpv6-options duid <value>
<duid>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> dhcpv6-options no-release
dhcpv6-options dhcpv6-options no-release
no-release
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge
bridge <interface> interfaces bridge <text> dhcpv6-options
dhcpv6-options <bridge> dhcpv6-options parameters-only
parameters-only parameters-only
continues on next page

21.1. Configuration Commands 1446

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> dhcpv6-options pd <text>
dhcpv6-options dhcpv6-options pd <pd> interface <text> address
pd <id> interface interface <interface> ad- <value>
<delegatee> address dress
<address>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> dhcpv6-options pd <text>
dhcpv6-options dhcpv6-options pd <pd> interface <text> sla-id
pd <id> interface interface <interface> sla- <value>
<delegatee> sla-id id
<id>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> dhcpv6-options pd <text>
dhcpv6-options dhcpv6-options pd <pd> length <value>
pd <id> length length
<length>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> dhcpv6-options rapid-
dhcpv6-options dhcpv6-options rapid- commit
rapid-commit commit
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> dhcpv6-options temporary
dhcpv6-options dhcpv6-options temporary
temporary
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> disable
disable disable
× set interfaces Nothing found in XML Nothing found in VyOS
bridge <interface> Definitions
disable-flow-control
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> disable-link-detect
disable-link-detect disable-link-detect
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> enable-vlan
enable-vlan enable-vlan
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> forwarding-delay <value>
forwarding-delay forwarding-delay
<delay>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> hello-time <value>
hello-time hello-time
<interval>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> igmp querier
igmp querier igmp querier
continues on next page

21.1. Configuration Commands 1447

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> igmp snooping
igmp snooping igmp snooping
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text> ip
bridge <interface> interfaces bridge <bridge> adjust-mss <value>
ip adjust-mss <mss | ip adjust-mss
clamp-mss-to-pmtu>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge interfaces bridge <bridge> ip arp-cache-timeout
<interface> ip ip arp-cache-timeout <value>
arp-cache-timeout
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text> ip
bridge interfaces bridge <bridge> disable-arp-filter
<interface> ip ip disable-arp-filter
disable-arp-filter
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text> ip
bridge interfaces bridge <bridge> disable-forwarding
<interface> ip ip disable-forwarding
disable-forwarding
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text> ip
bridge interfaces bridge <bridge> enable-arp-accept
<interface> ip ip enable-arp-accept
enable-arp-accept
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text> ip
bridge interfaces bridge <bridge> enable-arp-announce
<interface> ip ip enable-arp-announce
enable-arp-announce
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text> ip
bridge <interface> interfaces bridge <bridge> enable-arp-ignore
ip enable-arp-ignore ip enable-arp-ignore
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text> ip
bridge interfaces bridge <bridge> enable-directed-broadcast
<interface> ip ip enable-directed-
enable-directed-broadcast
broadcast
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text> ip
bridge <interface> interfaces bridge <bridge> enable-proxy-arp
ip enable-proxy-arp ip enable-proxy-arp
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text> ip
bridge <interface> interfaces bridge <bridge> proxy-arp-pvlan
ip proxy-arp-pvlan ip proxy-arp-pvlan
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text> ip
bridge <interface> interfaces bridge <bridge> source-validation <value>
ip source-validation ip source-validation
<strict | loose |
disable>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> ipv6 accept-dad <value>
ipv6 accept-dad ipv6 accept-dad
<1-3>
continues on next page

21.1. Configuration Commands 1448

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> ipv6 address autoconf
ipv6 address ipv6 address autoconf
autoconf
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> ipv6 address eui64
ipv6 address eui64 ipv6 address eui64 <value>
<prefix>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> ipv6 address no-default-
ipv6 address ipv6 address no-default- link-local
no-default-link-local link-local
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge interfaces bridge <bridge> ipv6 adjust-mss <value>
<interface> ipv6 ipv6 adjust-mss
adjust-mss <mss |
clamp-mss-to-pmtu>
× not yet documented interfaces_bridge.xml.in: Nothing found in VyOS
interfaces bridge <bridge>
ipv6 base-reachable-time
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge interfaces bridge <bridge> ipv6 disable-forwarding
<interface> ipv6 ipv6 disable-forwarding
disable-forwarding
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge interfaces bridge <bridge> ipv6 dup-addr-detect-
<interface> ipv6 ipv6 dup-addr-detect- transmits <value>
dup-addr-detect-transmits
transmits
<n>
× not yet documented interfaces_bridge.xml.in: Nothing found in VyOS
interfaces bridge <bridge>
ipv6 source-validation
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge interfaces bridge <bridge> mac <value>
<interface> mac mac
<xx:xx:xx:xx:xx:xx>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> max-age <value>
max-age <time> max-age
× set interfaces Nothing found in XML Nothing found in VyOS
bridge <interface> Definitions
member interface
<member>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> member interface <text>
member interface member interface <inter- allowed-vlan <value>
<member> face> allowed-vlan
allowed-vlan
<vlan-id>
continues on next page

21.1. Configuration Commands 1449

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> member interface <text>
member interface member interface <inter- cost <value>
<member> cost face> cost
<cost>
× not yet documented interfaces_bridge.xml.in: interfaces bridge <text>
interfaces bridge <bridge> member interface <text>
member interface <inter- isolated
face> isolated
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> member interface <text>
member interface member interface <inter- native-vlan <value>
<member> native-vlan face> native-vlan
<vlan-id>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> member interface <text>
member interface member interface <inter- priority <value>
<member> priority face> priority
<priority>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> mirror egress <value>
mirror egress mirror egress
<monitor-interface>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> mirror ingress <value>
mirror ingress mirror ingress
<monitor-interface>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> mtu <value>
mtu <mtu> mtu
× not yet documented interfaces_bridge.xml.in: interfaces bridge <text>
interfaces bridge <bridge> priority <value>
priority
× set interfaces interfaces_bridge.xml.in: Nothing found in VyOS
bridge <interface> interfaces bridge <bridge>
protocol <802. protocol
1ad|802.1q>
× not yet documented interfaces_bridge.xml.in: interfaces bridge <text>
interfaces bridge <bridge> redirect <value>
redirect
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> stp
stp stp
× set interfaces Nothing found in XML Nothing found in VyOS
bridge <interface> Definitions
vif <vlan-id>
continues on next page

21.1. Configuration Commands 1450

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> address <value>
vif <vlan-id> vif <vif> address
address <address
| dhcp | dhcpv6>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> description
vif <vlan-id> vif <vif> description <value>
description
<description>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> dhcp-options
vif <vlan-id> vif <vif> dhcp-options client-id <value>
dhcp-options client-id
client-id
<description>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> dhcp-options
vif <vlan-id> vif <vif> dhcp-options default-route-distance
dhcp-options default-route-distance <value>
default-route-distance
<distance>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> dhcp-options
vif <vlan-id> vif <vif> dhcp-options host-name <value>
dhcp-options host-name
host-name
<hostname>
× not yet documented interfaces_bridge.xml.in: interfaces bridge <text>
interfaces bridge <bridge> vif <text> dhcp-options
vif <vif> dhcp-options mtu
mtu
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> dhcp-options
vif <vlan-id> vif <vif> dhcp-options no- no-default-route
dhcp-options default-route
no-default-route
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> dhcp-options re-
vif <vlan-id> vif <vif> dhcp-options re- ject <value>
dhcp-options reject ject
<address>
× set interfaces interfaces_bridge.xml.in: Nothing found in VyOS
bridge <interface> interfaces bridge <bridge>
vif <vlan-id> vif <vif> dhcp-options
dhcp-options user-class
user-class <string>
continues on next page

21.1. Configuration Commands 1451

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> dhcp-options
vif <vlan-id> vif <vif> dhcp-options vendor-class-id <value>
dhcp-options vendor-class-id
vendor-class-id
<vendor-id>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> dhcpv6-options
vif <vlan-id> vif <vif> dhcpv6-options duid <value>
dhcpv6-options duid duid
<duid>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> dhcpv6-options
vif <vlan-id> vif <vif> dhcpv6-options no-release
dhcpv6-options no-release
no-release
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> dhcpv6-options
vif <vlan-id> vif <vif> dhcpv6-options parameters-only
dhcpv6-options parameters-only
parameters-only
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> dhcpv6-options
vif <vlan-id> vif <vif> dhcpv6-options pd <text> interface <text>
dhcpv6-options pd <pd> interface <inter- address <value>
pd <id> interface face> address
<delegatee> address
<address>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> dhcpv6-options
vif <vlan-id> vif <vif> dhcpv6-options pd <text> interface <text>
dhcpv6-options pd <pd> interface <inter- sla-id <value>
pd <id> interface face> sla-id
<delegatee> sla-id
<id>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> dhcpv6-options
vif <vlan-id> vif <vif> dhcpv6-options pd <text> length <value>
dhcpv6-options pd <pd> length
pd <id> length
<length>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> dhcpv6-options
vif <vlan-id> vif <vif> dhcpv6-options rapid-commit
dhcpv6-options rapid-commit
rapid-commit
continues on next page

21.1. Configuration Commands 1452

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> dhcpv6-options
vif <vlan-id> vif <vif> dhcpv6-options temporary
dhcpv6-options temporary
temporary
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> disable
vif <vlan-id> vif <vif> disable
disable
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> disable-link-
vif <vlan-id> vif <vif> disable-link- detect
disable-link-detect detect
× not yet documented interfaces_bridge.xml.in: interfaces bridge <text>
interfaces bridge <bridge> vif <text> egress-qos
vif <vif> egress-qos <value>
× not yet documented interfaces_bridge.xml.in: interfaces bridge <text>
interfaces bridge <bridge> vif <text> ingress-qos
vif <vif> ingress-qos <value>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> ip adjust-mss
vif <vlan-id> ip vif <vif> ip adjust-mss <value>
adjust-mss <mss |
clamp-mss-to-pmtu>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> ip arp-cache-
vif <vlan-id> ip vif <vif> ip arp-cache- timeout <value>
arp-cache-timeout timeout
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> ip disable-arp-
vif <vlan-id> ip vif <vif> ip disable-arp- filter
disable-arp-filter filter
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> ip disable-
vif <vlan-id> ip vif <vif> ip disable- forwarding
disable-forwarding forwarding
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> ip enable-arp-
vif <vlan-id> ip vif <vif> ip enable-arp- accept
enable-arp-accept accept
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> ip enable-arp-
vif <vlan-id> ip vif <vif> ip enable-arp- announce
enable-arp-announce announce
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> ip enable-arp-
vif <vlan-id> ip vif <vif> ip enable-arp- ignore
enable-arp-ignore ignore
continues on next page

21.1. Configuration Commands 1453

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> ip enable-
vif <vlan-id> ip vif <vif> ip enable- directed-broadcast
enable-directed-broadcast
directed-broadcast
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> ip enable-proxy-
vif <vlan-id> ip vif <vif> ip enable-proxy- arp
enable-proxy-arp arp
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> ip proxy-arp-
vif <vlan-id> ip vif <vif> ip proxy-arp- pvlan
proxy-arp-pvlan pvlan
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> ip source-
vif <vlan-id> ip vif <vif> ip source- validation <value>
source-validation validation
<strict | loose |
disable>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> ipv6 accept-dad
vif <vlan-id> ipv6 vif <vif> ipv6 accept-dad <value>
accept-dad <1-3>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> ipv6 address au-
vif <vlan-id> ipv6 vif <vif> ipv6 address au- toconf
address autoconf toconf
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> ipv6 address
vif <vlan-id> vif <vif> ipv6 address eui64 <value>
ipv6 address eui64 eui64
<prefix>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> ipv6 address no-
vif <vlan-id> vif <vif> ipv6 address no- default-link-local
ipv6 address default-link-local
no-default-link-local
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> ipv6 adjust-mss
vif <vlan-id> ipv6 vif <vif> ipv6 adjust-mss <value>
adjust-mss <mss |
clamp-mss-to-pmtu>
× not yet documented interfaces_bridge.xml.in: Nothing found in VyOS
interfaces bridge <bridge>
vif <vif> ipv6 base-
reachable-time
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> ipv6 disable-
vif <vlan-id> ipv6 vif <vif> ipv6 disable- forwarding
disable-forwarding forwarding
continues on next page

21.1. Configuration Commands 1454

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> ipv6 dup-addr-
vif <vlan-id> ipv6 vif <vif> ipv6 dup-addr- detect-transmits <value>
dup-addr-detect-transmits
detect-transmits
<n>
× not yet documented interfaces_bridge.xml.in: Nothing found in VyOS
interfaces bridge <bridge>
vif <vif> ipv6 source-
validation
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> mac <value>
vif <vlan-id> mac vif <vif> mac
<xx:xx:xx:xx:xx:xx>
× not yet documented interfaces_bridge.xml.in: interfaces bridge <text>
interfaces bridge <bridge> vif <text> mirror egress
vif <vif> mirror egress <value>
× not yet documented interfaces_bridge.xml.in: interfaces bridge <text>
interfaces bridge <bridge> vif <text> mirror ingress
vif <vif> mirror ingress <value>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> mtu <value>
vif <vlan-id> mtu vif <vif> mtu
<mtu>
× not yet documented interfaces_bridge.xml.in: interfaces bridge <text>
interfaces bridge <bridge> vif <text> redirect <value>
vif <vif> redirect
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vif <text> vrf <value>
vif <vlan-id> vrf vif <vif> vrf
<vrf>
✓ set interfaces interfaces_bridge.xml.in: interfaces bridge <text>
bridge <interface> interfaces bridge <bridge> vrf <value>
vrf <vrf> vrf
✓ set interfaces dummy interfaces_dummy.xml.in: interfaces dummy <text>
<interface> address interfaces dummy address <value>
<address> <dummy> address
✓ set interfaces interfaces_dummy.xml.in: interfaces dummy <text>
dummy <interface> interfaces dummy description <value>
description <dummy> description
<description>
✓ set interfaces dummy interfaces_dummy.xml.in: interfaces dummy <text>
<interface> disable interfaces dummy disable
<dummy> disable
× not yet documented interfaces_dummy.xml.in: interfaces dummy <text>
interfaces dummy ip disable-forwarding
<dummy> ip disable-
forwarding
continues on next page

21.1. Configuration Commands 1455

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_dummy.xml.in: interfaces dummy <text>
interfaces dummy ip source-validation
<dummy> ip source- <value>
validation
× not yet documented interfaces_dummy.xml.in: interfaces dummy <text>
interfaces dummy ipv6 address eui64
<dummy> ipv6 address <value>
eui64
× not yet documented interfaces_dummy.xml.in: interfaces dummy <text>
interfaces dummy ipv6 address no-default-
<dummy> ipv6 address link-local
no-default-link-local
× not yet documented interfaces_dummy.xml.in: interfaces dummy <text>
interfaces dummy ipv6 disable-forwarding
<dummy> ipv6 disable-
forwarding
× not yet documented interfaces_dummy.xml.in: interfaces dummy <text>
interfaces dummy mirror egress <value>
<dummy> mirror egress
× not yet documented interfaces_dummy.xml.in: interfaces dummy <text>
interfaces dummy mirror ingress <value>
<dummy> mirror ingress
× not yet documented interfaces_dummy.xml.in: interfaces dummy <text>
interfaces dummy mtu <value>
<dummy> mtu
× not yet documented interfaces_dummy.xml.in: interfaces dummy <text>
interfaces dummy netns <value>
<dummy> netns
× not yet documented interfaces_dummy.xml.in: interfaces dummy <text>
interfaces dummy redirect <value>
<dummy> redirect
✓ set interfaces dummy interfaces_dummy.xml.in: interfaces dummy <text>
<interface> vrf interfaces dummy vrf <value>
<vrf> <dummy> vrf
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: address <value>
address <address | interfaces ethernet <ether-
dhcp | dhcpv6> net> address
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: description <value>
description interfaces ethernet <ether-
<description> net> description
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: dhcp-options client-id
dhcp-options interfaces ethernet <ether- <value>
client-id net> dhcp-options client-
<description> id
continues on next page

21.1. Configuration Commands 1456

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: dhcp-options default-
dhcp-options interfaces ethernet <ether- route-distance <value>
default-route-distance net> dhcp-options default-
<distance> route-distance
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: dhcp-options host-name
dhcp-options interfaces ethernet <eth- <value>
host-name ernet> dhcp-options host-
<hostname> name
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: dhcp-options mtu
interfaces ethernet <ether-
net> dhcp-options mtu
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: dhcp-options no-default-
dhcp-options interfaces ethernet <eth- route
no-default-route ernet> dhcp-options no-
default-route
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: dhcp-options reject
dhcp-options reject interfaces ethernet <ether- <value>
<address> net> dhcp-options reject
× set interfaces inter- Nothing found in VyOS
ethernet <interface> faces_ethernet.xml.in:
dhcp-options interfaces ethernet <eth-
user-class <string> ernet> dhcp-options user-
class
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: dhcp-options vendor-
dhcp-options interfaces ethernet <ether- class-id <value>
vendor-class-id net> dhcp-options vendor-
<vendor-id> class-id
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: dhcpv6-options duid
dhcpv6-options duid interfaces ethernet <ether- <value>
<duid> net> dhcpv6-options duid
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: dhcpv6-options no-release
dhcpv6-options interfaces ethernet <ether-
no-release net> dhcpv6-options no-
release
✓ set interfaces inter- interfaces ethernet
ethernet <interface> faces_ethernet.xml.in: <text> dhcpv6-options
dhcpv6-options interfaces ethernet <eth- parameters-only
parameters-only ernet> dhcpv6-options
parameters-only
continues on next page

21.1. Configuration Commands 1457

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: dhcpv6-options pd <text>
dhcpv6-options interfaces ethernet <eth- interface <text> address
pd <id> interface ernet> dhcpv6-options <value>
<delegatee> address pd <pd> interface <inter-
<address> face> address
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: dhcpv6-options pd <text>
dhcpv6-options interfaces ethernet <eth- interface <text> sla-id
pd <id> interface ernet> dhcpv6-options <value>
<delegatee> sla-id pd <pd> interface <inter-
<id> face> sla-id
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: dhcpv6-options pd <text>
dhcpv6-options interfaces ethernet <eth- length <value>
pd <id> length ernet> dhcpv6-options pd
<length> <pd> length
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: dhcpv6-options rapid-
dhcpv6-options interfaces ethernet <eth- commit
rapid-commit ernet> dhcpv6-options
rapid-commit
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: dhcpv6-options temporary
dhcpv6-options interfaces ethernet <ether-
temporary net> dhcpv6-options tem-
porary
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: disable
disable interfaces ethernet <ether-
net> disable
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: disable-flow-control
disable-flow-control interfaces ethernet <ether-
net> disable-flow-control
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: disable-link-detect
disable-link-detect interfaces ethernet <ether-
net> disable-link-detect
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: duplex <value>
duplex <auto | full interfaces ethernet <ether-
| half> net> duplex
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: eapol ca-certificate
eapol ca-certificate interfaces ethernet <ether- <value>
<name> net> eapol ca-certificate
continues on next page

21.1. Configuration Commands 1458

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: eapol certificate <value>
eapol certificate interfaces ethernet <ether-
<name> net> eapol certificate
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: eapol passphrase <value>
interfaces ethernet <ether-
net> eapol passphrase
× set interfaces Nothing found in XML Nothing found in VyOS
ethernet <interface> Definitions
evpn uplink
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: hw-id <value>
interfaces ethernet <ether-
net> hw-id
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: ip adjust-mss <value>
ip adjust-mss <mss | interfaces ethernet <ether-
clamp-mss-to-pmtu> net> ip adjust-mss
✓ set interfaces inter- interfaces ethernet <text>
ethernet faces_ethernet.xml.in: ip arp-cache-timeout
<interface> ip interfaces ethernet <ether- <value>
arp-cache-timeout net> ip arp-cache-timeout
✓ set interfaces inter- interfaces ethernet <text>
ethernet faces_ethernet.xml.in: ip disable-arp-filter
<interface> ip interfaces ethernet <ether-
disable-arp-filter net> ip disable-arp-filter
✓ set interfaces inter- interfaces ethernet <text>
ethernet faces_ethernet.xml.in: ip disable-forwarding
<interface> ip interfaces ethernet <ether-
disable-forwarding net> ip disable-forwarding
✓ set interfaces inter- interfaces ethernet <text>
ethernet faces_ethernet.xml.in: ip enable-arp-accept
<interface> ip interfaces ethernet <ether-
enable-arp-accept net> ip enable-arp-accept
✓ set interfaces inter- interfaces ethernet <text>
ethernet faces_ethernet.xml.in: ip enable-arp-announce
<interface> ip interfaces ethernet <eth-
enable-arp-announce ernet> ip enable-arp-
announce
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: ip enable-arp-ignore
ip enable-arp-ignore interfaces ethernet <ether-
net> ip enable-arp-ignore
✓ set interfaces inter- interfaces ethernet <text>
ethernet faces_ethernet.xml.in: ip enable-directed-
<interface> ip interfaces ethernet <eth- broadcast
enable-directed-broadcast
ernet> ip enable-directed-
broadcast
continues on next page

21.1. Configuration Commands 1459

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: ip enable-proxy-arp
ip enable-proxy-arp interfaces ethernet <ether-
net> ip enable-proxy-arp
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: ip proxy-arp-pvlan
ip proxy-arp-pvlan interfaces ethernet <ether-
net> ip proxy-arp-pvlan
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: ip source-validation
ip source-validation interfaces ethernet <ether- <value>
<strict | loose | net> ip source-validation
disable>
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: ipv6 accept-dad <value>
ipv6 accept-dad interfaces ethernet <ether-
<1-3> net> ipv6 accept-dad
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: ipv6 address autoconf
ipv6 address interfaces ethernet <ether-
autoconf net> ipv6 address auto-
conf
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: ipv6 address eui64
ipv6 address eui64 interfaces ethernet <ether- <value>
<prefix> net> ipv6 address eui64
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: ipv6 address no-default-
ipv6 address interfaces ethernet <eth- link-local
no-default-link-local ernet> ipv6 address no-
default-link-local
✓ set interfaces inter- interfaces ethernet <text>
ethernet faces_ethernet.xml.in: ipv6 adjust-mss <value>
<interface> ipv6 interfaces ethernet <ether-
adjust-mss <mss | net> ipv6 adjust-mss
clamp-mss-to-pmtu>
× not yet documented inter- Nothing found in VyOS
faces_ethernet.xml.in:
interfaces ethernet <ether-
net> ipv6 base-reachable-
time
✓ set interfaces inter- interfaces ethernet <text>
ethernet faces_ethernet.xml.in: ipv6 disable-forwarding
<interface> ipv6 interfaces ethernet <eth-
disable-forwarding ernet> ipv6 disable-
forwarding
continues on next page

21.1. Configuration Commands 1460

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces ethernet <text>
ethernet faces_ethernet.xml.in: ipv6 dup-addr-detect-
<interface> ipv6 interfaces ethernet <ether- transmits <value>
dup-addr-detect-transmits
net> ipv6 dup-addr-detect-
<n> transmits
× not yet documented inter- Nothing found in VyOS
faces_ethernet.xml.in:
interfaces ethernet <eth-
ernet> ipv6 source-
validation
✓ set interfaces inter- interfaces ethernet <text>
ethernet faces_ethernet.xml.in: mac <value>
<interface> mac interfaces ethernet <ether-
<xx:xx:xx:xx:xx:xx> net> mac
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: mirror egress <value>
mirror egress interfaces ethernet <ether-
<monitor-interface> net> mirror egress
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: mirror ingress <value>
mirror ingress interfaces ethernet <ether-
<monitor-interface> net> mirror ingress
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: mtu <value>
mtu <mtu> interfaces ethernet <ether-
net> mtu
× set interfaces Nothing found in XML Nothing found in VyOS
ethernet <interface> Definitions
offload <gro | gso
| lro | rps | sg |
tso>
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: offload gro
interfaces ethernet <ether-
net> offload gro
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: offload gso
interfaces ethernet <ether-
net> offload gso
× not yet documented inter- Nothing found in VyOS
faces_ethernet.xml.in:
interfaces ethernet <ether-
net> offload hw-tc-offload
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: offload lro
interfaces ethernet <ether-
net> offload lro
continues on next page

21.1. Configuration Commands 1461

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: offload rfs
interfaces ethernet <ether-
net> offload rfs
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: offload rps
interfaces ethernet <ether-
net> offload rps
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: offload sg
interfaces ethernet <ether-
net> offload sg
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: offload tso
interfaces ethernet <ether-
net> offload tso
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: redirect <value>
interfaces ethernet <ether-
net> redirect
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: ring-buffer rx <value>
interfaces ethernet <ether-
net> ring-buffer rx
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: ring-buffer tx <value>
interfaces ethernet <ether-
net> ring-buffer tx
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: speed <value>
speed <auto | 10 | interfaces ethernet <ether-
100 | 1000 | 2500 | net> speed
5000 | 10000 | 25000
| 40000 | 50000 |
100000>
× set interfaces Nothing found in XML Nothing found in VyOS
ethernet <interface> Definitions
vif <vlan-id>
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> address
interfaces ethernet <ether- <value>
net> vif-s <vif-s> address
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> description
interfaces ethernet <ether- <value>
net> vif-s <vif-s> descrip-
tion
continues on next page

21.1. Configuration Commands 1462

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> dhcp-options
interfaces ethernet <ether- client-id <value>
net> vif-s <vif-s> dhcp-
options client-id
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> dhcp-options
interfaces ethernet <eth- default-route-distance
ernet> vif-s <vif-s> <value>
dhcp-options default-
route-distance
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> dhcp-options
interfaces ethernet <ether- host-name <value>
net> vif-s <vif-s> dhcp-
options host-name
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> dhcp-options
interfaces ethernet <ether- mtu
net> vif-s <vif-s> dhcp-
options mtu
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> dhcp-options
interfaces ethernet <ether- no-default-route
net> vif-s <vif-s> dhcp-
options no-default-route
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> dhcp-options
interfaces ethernet <ether- reject <value>
net> vif-s <vif-s> dhcp-
options reject
× not yet documented inter- Nothing found in VyOS
faces_ethernet.xml.in:
interfaces ethernet <ether-
net> vif-s <vif-s> dhcp-
options user-class
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> dhcp-options
interfaces ethernet <ether- vendor-class-id <value>
net> vif-s <vif-s> dhcp-
options vendor-class-id
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> dhcpv6-
interfaces ethernet <ether- options duid <value>
net> vif-s <vif-s> dhcpv6-
options duid
continues on next page

21.1. Configuration Commands 1463

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> dhcpv6-
interfaces ethernet <ether- options no-release
net> vif-s <vif-s> dhcpv6-
options no-release
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> dhcpv6-
interfaces ethernet <ether- options parameters-only
net> vif-s <vif-s> dhcpv6-
options parameters-only
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> dhcpv6-
interfaces ethernet <ether- options pd <text> in-
net> vif-s <vif-s> dhcpv6- terface <text> address
options pd <pd> interface <value>
<interface> address
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> dhcpv6-
interfaces ethernet <ether- options pd <text> in-
net> vif-s <vif-s> dhcpv6- terface <text> sla-id
options pd <pd> interface <value>
<interface> sla-id
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> dhcpv6-
interfaces ethernet <ether- options pd <text> length
net> vif-s <vif-s> dhcpv6- <value>
options pd <pd> length
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> dhcpv6-
interfaces ethernet <ether- options rapid-commit
net> vif-s <vif-s> dhcpv6-
options rapid-commit
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> dhcpv6-
interfaces ethernet <ether- options temporary
net> vif-s <vif-s> dhcpv6-
options temporary
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> disable
interfaces ethernet <ether-
net> vif-s <vif-s> disable
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> disable-link-
interfaces ethernet <ether- detect
net> vif-s <vif-s> disable-
link-detect
continues on next page

21.1. Configuration Commands 1464

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> ip adjust-mss
interfaces ethernet <eth- <value>
ernet> vif-s <vif-s> ip
adjust-mss
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> ip arp-cache-
interfaces ethernet <ether- timeout <value>
net> vif-s <vif-s> ip arp-
cache-timeout
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> ip disable-arp-
interfaces ethernet <eth- filter
ernet> vif-s <vif-s> ip
disable-arp-filter
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> ip disable-
interfaces ethernet <eth- forwarding
ernet> vif-s <vif-s> ip
disable-forwarding
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> ip enable-arp-
interfaces ethernet <eth- accept
ernet> vif-s <vif-s> ip
enable-arp-accept
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> ip enable-arp-
interfaces ethernet <eth- announce
ernet> vif-s <vif-s> ip
enable-arp-announce
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> ip enable-arp-
interfaces ethernet <eth- ignore
ernet> vif-s <vif-s> ip
enable-arp-ignore
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> ip enable-
interfaces ethernet <eth- directed-broadcast
ernet> vif-s <vif-s> ip
enable-directed-broadcast
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> ip enable-
interfaces ethernet <eth- proxy-arp
ernet> vif-s <vif-s> ip
enable-proxy-arp
continues on next page

21.1. Configuration Commands 1465

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> ip proxy-arp-
interfaces ethernet <eth- pvlan
ernet> vif-s <vif-s> ip
proxy-arp-pvlan
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> ip source-
interfaces ethernet <eth- validation <value>
ernet> vif-s <vif-s> ip
source-validation
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> ipv6 accept-
interfaces ethernet <eth- dad <value>
ernet> vif-s <vif-s> ipv6
accept-dad
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> ipv6 address
interfaces ethernet <ether- autoconf
net> vif-s <vif-s> ipv6 ad-
dress autoconf
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> ipv6 address
interfaces ethernet <ether- eui64 <value>
net> vif-s <vif-s> ipv6 ad-
dress eui64
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> ipv6 address
interfaces ethernet <ether- no-default-link-local
net> vif-s <vif-s> ipv6 ad-
dress no-default-link-local
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> ipv6 adjust-
interfaces ethernet <eth- mss <value>
ernet> vif-s <vif-s> ipv6
adjust-mss
× not yet documented inter- Nothing found in VyOS
faces_ethernet.xml.in:
interfaces ethernet <eth-
ernet> vif-s <vif-s> ipv6
base-reachable-time
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> ipv6 disable-
interfaces ethernet <eth- forwarding
ernet> vif-s <vif-s> ipv6
disable-forwarding
continues on next page

21.1. Configuration Commands 1466

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> ipv6 dup-
interfaces ethernet <eth- addr-detect-transmits
ernet> vif-s <vif-s> ipv6 <value>
dup-addr-detect-transmits
× not yet documented inter- Nothing found in VyOS
faces_ethernet.xml.in:
interfaces ethernet <eth-
ernet> vif-s <vif-s> ipv6
source-validation
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> mac <value>
interfaces ethernet <ether-
net> vif-s <vif-s> mac
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> mirror egress
interfaces ethernet <ether- <value>
net> vif-s <vif-s> mirror
egress
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> mirror ingress
interfaces ethernet <ether- <value>
net> vif-s <vif-s> mirror
ingress
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> mtu <value>
interfaces ethernet <ether-
net> vif-s <vif-s> mtu
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> protocol
interfaces ethernet <ether- <value>
net> vif-s <vif-s> protocol
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> redirect
interfaces ethernet <ether- <value>
net> vif-s <vif-s> redirect
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- address <value>
vif-c <vlan-id> ernet> vif-s <vif-s> vif-c
address <address | <vif-c> address
dhcp | dhcpv6>
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- description <value>
vif-c <vlan-id> ernet> vif-s <vif-s> vif-c
description <vif-c> description
<description>
continues on next page

21.1. Configuration Commands 1467

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- dhcp-options client-id
vif-c <vlan-id> ernet> vif-s <vif-s> vif-c <value>
dhcp-options <vif-c> dhcp-options
client-id client-id
<description>
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- dhcp-options default-
vif-c <vlan-id> ernet> vif-s <vif-s> vif-c route-distance <value>
dhcp-options <vif-c> dhcp-options
default-route-distance default-route-distance
<distance>
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- dhcp-options host-name
vif-c <vlan-id> ernet> vif-s <vif-s> vif-c <value>
dhcp-options <vif-c> dhcp-options
host-name host-name
<hostname>
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> vif-c <text>
interfaces ethernet <eth- dhcp-options mtu
ernet> vif-s <vif-s> vif-c
<vif-c> dhcp-options mtu
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- dhcp-options no-default-
vif-c <vlan-id> ernet> vif-s <vif-s> vif-c route
dhcp-options <vif-c> dhcp-options no-
no-default-route default-route
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- dhcp-options reject
vif-c <vlan-id> ernet> vif-s <vif-s> vif- <value>
dhcp-options reject c <vif-c> dhcp-options re-
<address> ject
× set interfaces inter- Nothing found in VyOS
ethernet <interface> faces_ethernet.xml.in:
vif-s <vlan-id> interfaces ethernet <eth-
vif-c <vlan-id> ernet> vif-s <vif-s> vif-c
dhcp-options <vif-c> dhcp-options user-
user-class <string> class
continues on next page

21.1. Configuration Commands 1468

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- dhcp-options vendor-
vif-c <vlan-id> ernet> vif-s <vif-s> vif-c class-id <value>
dhcp-options <vif-c> dhcp-options
vendor-class-id vendor-class-id
<vendor-id>
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- dhcpv6-options duid
vif-c <vlan-id> ernet> vif-s <vif-s> vif- <value>
dhcpv6-options duid c <vif-c> dhcpv6-options
<duid> duid
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- dhcpv6-options no-release
vif-c <vlan-id> ernet> vif-s <vif-s> vif-
dhcpv6-options c <vif-c> dhcpv6-options
no-release no-release
✓ set interfaces inter- interfaces ethernet
ethernet <interface> faces_ethernet.xml.in: <text> vif-s <text> vif-c
vif-s <vlan-id> interfaces ethernet <eth- <text> dhcpv6-options
vif-c <vlan-id> ernet> vif-s <vif-s> vif- parameters-only
dhcpv6-options c <vif-c> dhcpv6-options
parameters-only parameters-only
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- dhcpv6-options pd <text>
vif-c <vlan-id> ernet> vif-s <vif-s> vif- interface <text> address
dhcpv6-options c <vif-c> dhcpv6-options <value>
pd <id> interface pd <pd> interface <inter-
<delegatee> address face> address
<address>
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- dhcpv6-options pd <text>
vif-c <vlan-id> ernet> vif-s <vif-s> vif- interface <text> sla-id
dhcpv6-options c <vif-c> dhcpv6-options <value>
pd <id> interface pd <pd> interface <inter-
<delegatee> sla-id face> sla-id
<id>
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- dhcpv6-options pd <text>
vif-c <vlan-id> ernet> vif-s <vif-s> vif- length <value>
dhcpv6-options c <vif-c> dhcpv6-options
pd <id> length pd <pd> length
<length>
continues on next page

21.1. Configuration Commands 1469

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- dhcpv6-options rapid-
vif-c <vlan-id> ernet> vif-s <vif-s> vif- commit
dhcpv6-options c <vif-c> dhcpv6-options
rapid-commit rapid-commit
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- dhcpv6-options temporary
vif-c <vlan-id> ernet> vif-s <vif-s> vif-
dhcpv6-options c <vif-c> dhcpv6-options
temporary temporary
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- disable
vif-c <vlan-id> ernet> vif-s <vif-s> vif-c
disable <vif-c> disable
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- disable-link-detect
vif-c <vlan-id> ernet> vif-s <vif-s> vif-c
disable-link-detect <vif-c> disable-link-
detect
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text> ip
vif-s <vlan-id> interfaces ethernet <eth- adjust-mss <value>
vif-c <vlan-id> ip ernet> vif-s <vif-s> vif-c
adjust-mss <mss | <vif-c> ip adjust-mss
clamp-mss-to-pmtu>
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- ip arp-cache-timeout
vif-c <vlan-id> ip ernet> vif-s <vif-s> vif- <value>
arp-cache-timeout c <vif-c> ip arp-cache-
timeout
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text> ip
vif-s <vlan-id> interfaces ethernet <eth- disable-arp-filter
vif-c <vlan-id> ip ernet> vif-s <vif-s> vif-
disable-arp-filter c <vif-c> ip disable-arp-
filter
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text> ip
vif-s <vlan-id> interfaces ethernet <eth- disable-forwarding
vif-c <vlan-id> ip ernet> vif-s <vif-s>
disable-forwarding vif-c <vif-c> ip disable-
forwarding
continues on next page

21.1. Configuration Commands 1470

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text> ip
vif-s <vlan-id> interfaces ethernet <eth- enable-arp-accept
vif-c <vlan-id> ip ernet> vif-s <vif-s> vif-
enable-arp-accept c <vif-c> ip enable-arp-
accept
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text> ip
vif-s <vlan-id> interfaces ethernet <eth- enable-arp-announce
vif-c <vlan-id> ip ernet> vif-s <vif-s> vif-
enable-arp-announce c <vif-c> ip enable-arp-
announce
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text> ip
vif-s <vlan-id> interfaces ethernet <eth- enable-arp-ignore
vif-c <vlan-id> ip ernet> vif-s <vif-s> vif-
enable-arp-ignore c <vif-c> ip enable-arp-
ignore
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text> ip
vif-s <vlan-id> interfaces ethernet <eth- enable-directed-broadcast
vif-c <vlan-id> ip ernet> vif-s <vif-s>
enable-directed-broadcast
vif-c <vif-c> ip enable-
directed-broadcast
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text> ip
vif-s <vlan-id> interfaces ethernet <eth- enable-proxy-arp
vif-c <vlan-id> ip ernet> vif-s <vif-s> vif-
enable-proxy-arp c <vif-c> ip enable-proxy-
arp
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text> ip
vif-s <vlan-id> interfaces ethernet <eth- proxy-arp-pvlan
vif-c <vlan-id> ip ernet> vif-s <vif-s> vif-
proxy-arp-pvlan c <vif-c> ip proxy-arp-
pvlan
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text> ip
vif-s <vlan-id> interfaces ethernet <eth- source-validation <value>
vif-c <vlan-id> ip ernet> vif-s <vif-s>
source-validation vif-c <vif-c> ip source-
<strict | loose | validation
disable>
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- ipv6 accept-dad <value>
vif-c <vlan-id> ipv6 ernet> vif-s <vif-s> vif-c
accept-dad <1-3> <vif-c> ipv6 accept-dad
continues on next page

21.1. Configuration Commands 1471

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- ipv6 address autoconf
vif-c <vlan-id> ipv6 ernet> vif-s <vif-s> vif-c
address autoconf <vif-c> ipv6 address auto-
conf
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- ipv6 address eui64
vif-c <vlan-id> ernet> vif-s <vif-s> vif-c <value>
ipv6 address eui64 <vif-c> ipv6 address eui64
<prefix>
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- ipv6 address no-default-
vif-c <vlan-id> ernet> vif-s <vif-s> vif-c link-local
ipv6 address <vif-c> ipv6 address no-
no-default-link-local default-link-local
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- ipv6 adjust-mss <value>
vif-c <vlan-id> ipv6 ernet> vif-s <vif-s> vif-c
adjust-mss <mss | <vif-c> ipv6 adjust-mss
clamp-mss-to-pmtu>
× not yet documented inter- Nothing found in VyOS
faces_ethernet.xml.in:
interfaces ethernet <eth-
ernet> vif-s <vif-s>
vif-c <vif-c> ipv6 base-
reachable-time
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- ipv6 disable-forwarding
vif-c <vlan-id> ipv6 ernet> vif-s <vif-s> vif-
disable-forwarding c <vif-c> ipv6 disable-
forwarding
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- ipv6 dup-addr-detect-
vif-c <vlan-id> ipv6 ernet> vif-s <vif-s> vif- transmits <value>
dup-addr-detect-transmits
c <vif-c> ipv6 dup-addr-
<n> detect-transmits
× not yet documented inter- Nothing found in VyOS
faces_ethernet.xml.in:
interfaces ethernet <eth-
ernet> vif-s <vif-s> vif-
c <vif-c> ipv6 source-
validation
continues on next page

21.1. Configuration Commands 1472

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- mac <value>
vif-c <vlan-id> mac ernet> vif-s <vif-s> vif-c
<xx:xx:xx:xx:xx:xx> <vif-c> mac
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> vif-c <text>
interfaces ethernet <eth- mirror egress <value>
ernet> vif-s <vif-s> vif-c
<vif-c> mirror egress
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> vif-c <text>
interfaces ethernet <eth- mirror ingress <value>
ernet> vif-s <vif-s> vif-c
<vif-c> mirror ingress
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- mtu <value>
vif-c <vlan-id> mtu ernet> vif-s <vif-s> vif-c
<mtu> <vif-c> mtu
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> vif-c <text>
interfaces ethernet <eth- redirect <value>
ernet> vif-s <vif-s> vif-c
<vif-c> redirect
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces ethernet <eth- vrf <value>
vif-c <vlan-id> vrf ernet> vif-s <vif-s> vif-c
<vrf> <vif-c> vrf
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif-s <text> vrf <value>
interfaces ethernet <ether-
net> vif-s <vif-s> vrf
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> address <value>
vif <vlan-id> interfaces ethernet <ether-
address <address net> vif <vif> address
| dhcp | dhcpv6>
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> description
vif <vlan-id> interfaces ethernet <ether- <value>
description net> vif <vif> description
<description>
continues on next page

21.1. Configuration Commands 1473

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> dhcp-options
vif <vlan-id> interfaces ethernet <eth- client-id <value>
dhcp-options ernet> vif <vif> dhcp-
client-id options client-id
<description>
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> dhcp-options
vif <vlan-id> interfaces ethernet default-route-distance
dhcp-options <ethernet> vif <vif> <value>
default-route-distance dhcp-options default-
<distance> route-distance
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> dhcp-options
vif <vlan-id> interfaces ethernet <eth- host-name <value>
dhcp-options ernet> vif <vif> dhcp-
host-name options host-name
<hostname>
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif <text> dhcp-options
interfaces ethernet <eth- mtu
ernet> vif <vif> dhcp-
options mtu
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> dhcp-options
vif <vlan-id> interfaces ethernet <eth- no-default-route
dhcp-options ernet> vif <vif> dhcp-
no-default-route options no-default-route
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> dhcp-options re-
vif <vlan-id> interfaces ethernet <eth- ject <value>
dhcp-options reject ernet> vif <vif> dhcp-
<address> options reject
× set interfaces inter- Nothing found in VyOS
ethernet <interface> faces_ethernet.xml.in:
vif <vlan-id> interfaces ethernet <eth-
dhcp-options ernet> vif <vif> dhcp-
user-class <string> options user-class
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> dhcp-options
vif <vlan-id> interfaces ethernet <eth- vendor-class-id <value>
dhcp-options ernet> vif <vif> dhcp-
vendor-class-id options vendor-class-id
<vendor-id>
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces ethernet <eth- duid <value>
dhcpv6-options duid ernet> vif <vif> dhcpv6-
<duid> options duid
continues on next page

21.1. Configuration Commands 1474

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces ethernet <eth- no-release
dhcpv6-options ernet> vif <vif> dhcpv6-
no-release options no-release
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces ethernet <eth- parameters-only
dhcpv6-options ernet> vif <vif> dhcpv6-
parameters-only options parameters-only
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces ethernet <eth- pd <text> interface <text>
dhcpv6-options ernet> vif <vif> dhcpv6- address <value>
pd <id> interface options pd <pd> interface
<delegatee> address <interface> address
<address>
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces ethernet <eth- pd <text> interface <text>
dhcpv6-options ernet> vif <vif> dhcpv6- sla-id <value>
pd <id> interface options pd <pd> interface
<delegatee> sla-id <interface> sla-id
<id>
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces ethernet <eth- pd <text> length <value>
dhcpv6-options ernet> vif <vif> dhcpv6-
pd <id> length options pd <pd> length
<length>
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces ethernet <eth- rapid-commit
dhcpv6-options ernet> vif <vif> dhcpv6-
rapid-commit options rapid-commit
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces ethernet <eth- temporary
dhcpv6-options ernet> vif <vif> dhcpv6-
temporary options temporary
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> disable
vif <vlan-id> interfaces ethernet <ether-
disable net> vif <vif> disable
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> disable-link-
vif <vlan-id> interfaces ethernet <eth- detect
disable-link-detect ernet> vif <vif> disable-
link-detect
continues on next page

21.1. Configuration Commands 1475

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif <text> egress-qos
interfaces ethernet <ether- <value>
net> vif <vif> egress-qos
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif <text> ingress-qos
interfaces ethernet <ether- <value>
net> vif <vif> ingress-qos
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> ip adjust-mss
vif <vlan-id> ip interfaces ethernet <ether- <value>
adjust-mss <mss | net> vif <vif> ip adjust-
clamp-mss-to-pmtu> mss
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> ip arp-cache-
vif <vlan-id> ip interfaces ethernet <eth- timeout <value>
arp-cache-timeout ernet> vif <vif> ip arp-
cache-timeout
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> ip disable-arp-
vif <vlan-id> ip interfaces ethernet <ether- filter
disable-arp-filter net> vif <vif> ip disable-
arp-filter
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> ip disable-
vif <vlan-id> ip interfaces ethernet <ether- forwarding
disable-forwarding net> vif <vif> ip disable-
forwarding
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> ip enable-arp-
vif <vlan-id> ip interfaces ethernet <ether- accept
enable-arp-accept net> vif <vif> ip enable-
arp-accept
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> ip enable-arp-
vif <vlan-id> ip interfaces ethernet <ether- announce
enable-arp-announce net> vif <vif> ip enable-
arp-announce
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> ip enable-arp-
vif <vlan-id> ip interfaces ethernet <ether- ignore
enable-arp-ignore net> vif <vif> ip enable-
arp-ignore
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> ip enable-
vif <vlan-id> ip interfaces ethernet <ether- directed-broadcast
enable-directed-broadcast
net> vif <vif> ip enable-
directed-broadcast
continues on next page

21.1. Configuration Commands 1476

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> ip enable-proxy-
vif <vlan-id> ip interfaces ethernet <ether- arp
enable-proxy-arp net> vif <vif> ip enable-
proxy-arp
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> ip proxy-arp-
vif <vlan-id> ip interfaces ethernet <ether- pvlan
proxy-arp-pvlan net> vif <vif> ip proxy-
arp-pvlan
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> ip source-
vif <vlan-id> ip interfaces ethernet <ether- validation <value>
source-validation net> vif <vif> ip source-
<strict | loose | validation
disable>
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> ipv6 accept-dad
vif <vlan-id> ipv6 interfaces ethernet <ether- <value>
accept-dad <1-3> net> vif <vif> ipv6 accept-
dad
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> ipv6 address au-
vif <vlan-id> ipv6 interfaces ethernet <ether- toconf
address autoconf net> vif <vif> ipv6 ad-
dress autoconf
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> ipv6 address
vif <vlan-id> interfaces ethernet <ether- eui64 <value>
ipv6 address eui64 net> vif <vif> ipv6 ad-
<prefix> dress eui64
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> ipv6 address no-
vif <vlan-id> interfaces ethernet <ether- default-link-local
ipv6 address net> vif <vif> ipv6 ad-
no-default-link-local dress no-default-link-local
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> ipv6 adjust-mss
vif <vlan-id> ipv6 interfaces ethernet <ether- <value>
adjust-mss <mss | net> vif <vif> ipv6 adjust-
clamp-mss-to-pmtu> mss
× not yet documented inter- Nothing found in VyOS
faces_ethernet.xml.in:
interfaces ethernet <ether-
net> vif <vif> ipv6 base-
reachable-time
continues on next page

21.1. Configuration Commands 1477

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> ipv6 disable-
vif <vlan-id> ipv6 interfaces ethernet <eth- forwarding
disable-forwarding ernet> vif <vif> ipv6
disable-forwarding
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> ipv6 dup-addr-
vif <vlan-id> ipv6 interfaces ethernet <ether- detect-transmits <value>
dup-addr-detect-transmits
net> vif <vif> ipv6 dup-
<n> addr-detect-transmits
× not yet documented inter- Nothing found in VyOS
faces_ethernet.xml.in:
interfaces ethernet <ether-
net> vif <vif> ipv6 source-
validation
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> mac <value>
vif <vlan-id> mac interfaces ethernet <ether-
<xx:xx:xx:xx:xx:xx> net> vif <vif> mac
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif <text> mirror egress
interfaces ethernet <eth- <value>
ernet> vif <vif> mirror
egress
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif <text> mirror ingress
interfaces ethernet <eth- <value>
ernet> vif <vif> mirror
ingress
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> mtu <value>
vif <vlan-id> mtu interfaces ethernet <ether-
<mtu> net> vif <vif> mtu
× not yet documented inter- interfaces ethernet <text>
faces_ethernet.xml.in: vif <text> redirect <value>
interfaces ethernet <ether-
net> vif <vif> redirect
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vif <text> vrf <value>
vif <vlan-id> vrf interfaces ethernet <ether-
<vrf> net> vif <vif> vrf
✓ set interfaces inter- interfaces ethernet <text>
ethernet <interface> faces_ethernet.xml.in: vrf <value>
vrf <vrf> interfaces ethernet <ether-
net> vrf
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text>
geneve <interface> interfaces geneve <gen- address <value>
address <address> eve> address
continues on next page

21.1. Configuration Commands 1478

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text>
geneve <interface> interfaces geneve <gen- description <value>
description eve> description
<description>
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text>
geneve <interface> interfaces geneve <gen- disable
disable eve> disable
× set interfaces Nothing found in XML Nothing found in VyOS
geneve gnv0 remote Definitions
<address>
× set interfaces Nothing found in XML Nothing found in VyOS
geneve gnv0 vni Definitions
<vni>
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text> ip
geneve <interface> interfaces geneve <gen- adjust-mss <value>
ip adjust-mss <mss | eve> ip adjust-mss
clamp-mss-to-pmtu>
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text>
geneve interfaces geneve <gen- ip arp-cache-timeout
<interface> ip eve> ip arp-cache-timeout <value>
arp-cache-timeout
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text> ip
geneve interfaces geneve <gen- disable-arp-filter
<interface> ip eve> ip disable-arp-filter
disable-arp-filter
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text> ip
geneve interfaces geneve disable-forwarding
<interface> ip <geneve> ip disable-
disable-forwarding forwarding
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text> ip
geneve interfaces geneve <gen- enable-arp-accept
<interface> ip eve> ip enable-arp-accept
enable-arp-accept
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text> ip
geneve interfaces geneve <gen- enable-arp-announce
<interface> ip eve> ip enable-arp-
enable-arp-announce announce
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text> ip
geneve <interface> interfaces geneve <gen- enable-arp-ignore
ip enable-arp-ignore eve> ip enable-arp-ignore
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text> ip
geneve interfaces geneve <gen- enable-directed-broadcast
<interface> ip eve> ip enable-directed-
enable-directed-broadcast
broadcast
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text> ip
geneve <interface> interfaces geneve <gen- enable-proxy-arp
ip enable-proxy-arp eve> ip enable-proxy-arp
continues on next page

21.1. Configuration Commands 1479

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text> ip
geneve <interface> interfaces geneve <gen- proxy-arp-pvlan
ip proxy-arp-pvlan eve> ip proxy-arp-pvlan
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text> ip
geneve <interface> interfaces geneve <gen- source-validation <value>
ip source-validation eve> ip source-validation
<strict | loose |
disable>
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text>
geneve <interface> interfaces geneve <gen- ipv6 accept-dad <value>
ipv6 accept-dad eve> ipv6 accept-dad
<1-3>
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text>
geneve <interface> interfaces geneve <gen- ipv6 address autoconf
ipv6 address eve> ipv6 address auto-
autoconf conf
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text>
geneve <interface> interfaces geneve <gen- ipv6 address eui64
ipv6 address eui64 eve> ipv6 address eui64 <value>
<prefix>
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text>
geneve <interface> interfaces geneve <gen- ipv6 address no-default-
ipv6 address eve> ipv6 address no- link-local
no-default-link-local default-link-local
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text>
geneve interfaces geneve <gen- ipv6 adjust-mss <value>
<interface> ipv6 eve> ipv6 adjust-mss
adjust-mss <mss |
clamp-mss-to-pmtu>
× not yet documented interfaces_geneve.xml.in: Nothing found in VyOS
interfaces geneve <gen-
eve> ipv6 base-reachable-
time
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text>
geneve interfaces geneve <gen- ipv6 disable-forwarding
<interface> ipv6 eve> ipv6 disable-
disable-forwarding forwarding
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text>
geneve interfaces geneve <gen- ipv6 dup-addr-detect-
<interface> ipv6 eve> ipv6 dup-addr- transmits <value>
dup-addr-detect-transmits
detect-transmits
<n>
× not yet documented interfaces_geneve.xml.in: Nothing found in VyOS
interfaces geneve <gen-
eve> ipv6 source-
validation
continues on next page

21.1. Configuration Commands 1480

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text>
geneve interfaces geneve <gen- mac <value>
<interface> mac eve> mac
<xx:xx:xx:xx:xx:xx>
× not yet documented interfaces_geneve.xml.in: interfaces geneve <text>
interfaces geneve <gen- mirror egress <value>
eve> mirror egress
× not yet documented interfaces_geneve.xml.in: interfaces geneve <text>
interfaces geneve <gen- mirror ingress <value>
eve> mirror ingress
✓ set interfaces interfaces_geneve.xml.in: interfaces geneve <text>
geneve <interface> interfaces geneve <gen- mtu <value>
mtu <mtu> eve> mtu
× not yet documented interfaces_geneve.xml.in: interfaces geneve <text>
interfaces geneve <gen- parameters ip df <value>
eve> parameters ip df
× not yet documented interfaces_geneve.xml.in: interfaces geneve <text>
interfaces geneve <gen- parameters ip innerproto
eve> parameters ip
innerproto
× not yet documented interfaces_geneve.xml.in: interfaces geneve <text>
interfaces geneve <gen- parameters ip tos <value>
eve> parameters ip tos
× not yet documented interfaces_geneve.xml.in: interfaces geneve <text>
interfaces geneve <gen- parameters ip ttl <value>
eve> parameters ip ttl
× not yet documented interfaces_geneve.xml.in: interfaces geneve <text>
interfaces geneve <gen- parameters ipv6 flowlabel
eve> parameters ipv6 <value>
flowlabel
× not yet documented interfaces_geneve.xml.in: interfaces geneve <text>
interfaces geneve <gen- redirect <value>
eve> redirect
× not yet documented interfaces_geneve.xml.in: interfaces geneve <text>
interfaces geneve <gen- remote <value>
eve> remote
× not yet documented interfaces_geneve.xml.in: interfaces geneve <text>
interfaces geneve <gen- vni <value>
eve> vni
× not yet documented interfaces_input.xml.in: interfaces input <text> de-
interfaces input <input> scription <value>
description
× not yet documented interfaces_input.xml.in: interfaces input <text> dis-
interfaces input <input> able
disable
× not yet documented interfaces_input.xml.in: interfaces input <text>
interfaces input <input> redirect <value>
redirect
continues on next page

21.1. Configuration Commands 1481

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set interfaces Nothing found in XML Nothing found in VyOS
<inttype> Definitions
<intname> ip rip
authentication
md5 <id> password
<text>
× set interfaces Nothing found in XML Nothing found in VyOS
<inttype> Definitions
<intname> ip rip
authentication
plaintext-password
<text>
× set interfaces Nothing found in XML Nothing found in VyOS
<inttype> <intname> Definitions
ip rip split-horizon
disable
× set interfaces Nothing found in XML Nothing found in VyOS
<inttype> <intname> Definitions
ip rip split-horizon
poison-reverse
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> address <value>
address <address> address
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> description <value>
description description
<description>
× not yet documented interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
interfaces l2tpv3 <l2tpv3> destination-port <value>
destination-port
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> disable
disable disable
× set interfaces Nothing found in XML Nothing found in VyOS
l2tpv3 <interface> Definitions
disable-flow-control
× set interfaces Nothing found in XML Nothing found in VyOS
l2tpv3 <interface> Definitions
disable-link-detect
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> encapsulation <value>
encapsulation <udp | encapsulation
ip>
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text> ip
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> adjust-mss <value>
ip adjust-mss <mss | ip adjust-mss
clamp-mss-to-pmtu>
continues on next page

21.1. Configuration Commands 1482

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
l2tpv3 interfaces l2tpv3 <l2tpv3> ip arp-cache-timeout
<interface> ip ip arp-cache-timeout <value>
arp-cache-timeout
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text> ip
l2tpv3 interfaces l2tpv3 <l2tpv3> disable-arp-filter
<interface> ip ip disable-arp-filter
disable-arp-filter
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text> ip
l2tpv3 interfaces l2tpv3 <l2tpv3> disable-forwarding
<interface> ip ip disable-forwarding
disable-forwarding
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text> ip
l2tpv3 interfaces l2tpv3 <l2tpv3> enable-arp-accept
<interface> ip ip enable-arp-accept
enable-arp-accept
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text> ip
l2tpv3 interfaces l2tpv3 <l2tpv3> enable-arp-announce
<interface> ip ip enable-arp-announce
enable-arp-announce
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text> ip
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> enable-arp-ignore
ip enable-arp-ignore ip enable-arp-ignore
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text> ip
l2tpv3 interfaces l2tpv3 <l2tpv3> enable-directed-broadcast
<interface> ip ip enable-directed-
enable-directed-broadcast
broadcast
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text> ip
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> enable-proxy-arp
ip enable-proxy-arp ip enable-proxy-arp
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text> ip
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> proxy-arp-pvlan
ip proxy-arp-pvlan ip proxy-arp-pvlan
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text> ip
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> source-validation <value>
ip source-validation ip source-validation
<strict | loose |
disable>
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> ipv6 accept-dad <value>
ipv6 accept-dad ipv6 accept-dad
<1-3>
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> ipv6 address autoconf
ipv6 address ipv6 address autoconf
autoconf
continues on next page

21.1. Configuration Commands 1483

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> ipv6 address eui64
ipv6 address eui64 ipv6 address eui64 <value>
<prefix>
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> ipv6 address no-default-
ipv6 address ipv6 address no-default- link-local
no-default-link-local link-local
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
l2tpv3 interfaces l2tpv3 <l2tpv3> ipv6 adjust-mss <value>
<interface> ipv6 ipv6 adjust-mss
adjust-mss <mss |
clamp-mss-to-pmtu>
× not yet documented interfaces_l2tpv3.xml.in: Nothing found in VyOS
interfaces l2tpv3 <l2tpv3>
ipv6 base-reachable-time
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
l2tpv3 interfaces l2tpv3 <l2tpv3> ipv6 disable-forwarding
<interface> ipv6 ipv6 disable-forwarding
disable-forwarding
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
l2tpv3 interfaces l2tpv3 <l2tpv3> ipv6 dup-addr-detect-
<interface> ipv6 ipv6 dup-addr-detect- transmits <value>
dup-addr-detect-transmits
transmits
<n>
× not yet documented interfaces_l2tpv3.xml.in: Nothing found in VyOS
interfaces l2tpv3 <l2tpv3>
ipv6 source-validation
× set interfaces Nothing found in XML Nothing found in VyOS
l2tpv3 Definitions
<interface> mac
<xx:xx:xx:xx:xx:xx>
× not yet documented interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
interfaces l2tpv3 <l2tpv3> mirror egress <value>
mirror egress
× not yet documented interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
interfaces l2tpv3 <l2tpv3> mirror ingress <value>
mirror ingress
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> mtu <value>
mtu <mtu> mtu
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> peer-session-id <value>
peer-session-id peer-session-id
<id>
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> peer-tunnel-id <value>
peer-tunnel-id <id> peer-tunnel-id
continues on next page

21.1. Configuration Commands 1484

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> remote <value>
remote <address> remote
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> session-id <value>
session-id <id> session-id
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> source-address <value>
source-address source-address
<address>
× not yet documented interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
interfaces l2tpv3 <l2tpv3> source-port <value>
source-port
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> tunnel-id <value>
tunnel-id <id> tunnel-id
✓ set interfaces interfaces_l2tpv3.xml.in: interfaces l2tpv3 <text>
l2tpv3 <interface> interfaces l2tpv3 <l2tpv3> vrf <value>
vrf <vrf> vrf
✓ set interfaces inter- interfaces loopback <text>
loopback <interface> faces_loopback.xml.in: address <value>
address <address> interfaces loopback <loop-
back> address
✓ set interfaces inter- interfaces loopback <text>
loopback <interface> faces_loopback.xml.in: description <value>
description interfaces loopback <loop-
<description> back> description
× not yet documented inter- interfaces loopback <text>
faces_loopback.xml.in: ip source-validation
interfaces loopback <loop- <value>
back> ip source-validation
× not yet documented inter- interfaces loopback <text>
faces_loopback.xml.in: mirror egress <value>
interfaces loopback <loop-
back> mirror egress
× not yet documented inter- interfaces loopback <text>
faces_loopback.xml.in: mirror ingress <value>
interfaces loopback <loop-
back> mirror ingress
× not yet documented inter- interfaces loopback <text>
faces_loopback.xml.in: redirect <value>
interfaces loopback <loop-
back> redirect
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- address <value>
address <address | sec> address
dhcp | dhcpv6>
continues on next page

21.1. Configuration Commands 1485

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- description <value>
description sec> description
<description>
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- dhcp-options client-id
dhcp-options sec> dhcp-options client- <value>
client-id id
<description>
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- dhcp-options default-
dhcp-options sec> dhcp-options default- route-distance <value>
default-route-distance route-distance
<distance>
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- dhcp-options host-name
dhcp-options sec> dhcp-options host- <value>
host-name name
<hostname>
× not yet documented interfaces_macsec.xml.in: interfaces macsec <text>
interfaces macsec <mac- dhcp-options mtu
sec> dhcp-options mtu
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- dhcp-options no-default-
dhcp-options sec> dhcp-options no- route
no-default-route default-route
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- dhcp-options reject
dhcp-options reject sec> dhcp-options reject <value>
<address>
× set interfaces interfaces_macsec.xml.in: Nothing found in VyOS
macsec <interface> interfaces macsec <mac-
dhcp-options sec> dhcp-options user-
user-class <string> class
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- dhcp-options vendor-
dhcp-options sec> dhcp-options vendor- class-id <value>
vendor-class-id class-id
<vendor-id>
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- dhcpv6-options duid
dhcpv6-options duid sec> dhcpv6-options duid <value>
<duid>
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- dhcpv6-options no-release
dhcpv6-options sec> dhcpv6-options no-
no-release release
continues on next page

21.1. Configuration Commands 1486

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec
macsec <interface> interfaces macsec <mac- <text> dhcpv6-options
dhcpv6-options sec> dhcpv6-options parameters-only
parameters-only parameters-only
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- dhcpv6-options pd <text>
dhcpv6-options sec> dhcpv6-options pd interface <text> address
pd <id> interface <pd> interface <inter- <value>
<delegatee> address face> address
<address>
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- dhcpv6-options pd <text>
dhcpv6-options sec> dhcpv6-options pd interface <text> sla-id
pd <id> interface <pd> interface <inter- <value>
<delegatee> sla-id face> sla-id
<id>
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- dhcpv6-options pd <text>
dhcpv6-options sec> dhcpv6-options pd length <value>
pd <id> length <pd> length
<length>
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- dhcpv6-options rapid-
dhcpv6-options sec> dhcpv6-options commit
rapid-commit rapid-commit
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- dhcpv6-options temporary
dhcpv6-options sec> dhcpv6-options tem-
temporary porary
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- disable
disable sec> disable
× set interfaces Nothing found in XML Nothing found in VyOS
macsec <interface> Definitions
disable-flow-control
× set interfaces Nothing found in XML Nothing found in VyOS
macsec <interface> Definitions
disable-link-detect
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- ip adjust-mss <value>
ip adjust-mss <mss | sec> ip adjust-mss
clamp-mss-to-pmtu>
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec interfaces macsec <mac- ip arp-cache-timeout
<interface> ip sec> ip arp-cache-timeout <value>
arp-cache-timeout
continues on next page

21.1. Configuration Commands 1487

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec interfaces macsec <mac- ip disable-arp-filter
<interface> ip sec> ip disable-arp-filter
disable-arp-filter
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec interfaces macsec <mac- ip disable-forwarding
<interface> ip sec> ip disable-forwarding
disable-forwarding
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec interfaces macsec <mac- ip enable-arp-accept
<interface> ip sec> ip enable-arp-accept
enable-arp-accept
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec interfaces macsec <mac- ip enable-arp-announce
<interface> ip sec> ip enable-arp-
enable-arp-announce announce
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- ip enable-arp-ignore
ip enable-arp-ignore sec> ip enable-arp-ignore
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec interfaces macsec <mac- ip enable-directed-
<interface> ip sec> ip enable-directed- broadcast
enable-directed-broadcast
broadcast
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- ip enable-proxy-arp
ip enable-proxy-arp sec> ip enable-proxy-arp
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- ip proxy-arp-pvlan
ip proxy-arp-pvlan sec> ip proxy-arp-pvlan
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- ip source-validation
ip source-validation sec> ip source-validation <value>
<strict | loose |
disable>
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- ipv6 accept-dad <value>
ipv6 accept-dad sec> ipv6 accept-dad
<1-3>
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- ipv6 address autoconf
ipv6 address sec> ipv6 address auto-
autoconf conf
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- ipv6 address eui64
ipv6 address eui64 sec> ipv6 address eui64 <value>
<prefix>
continues on next page

21.1. Configuration Commands 1488

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- ipv6 address no-default-
ipv6 address sec> ipv6 address no- link-local
no-default-link-local default-link-local
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec interfaces macsec <mac- ipv6 adjust-mss <value>
<interface> ipv6 sec> ipv6 adjust-mss
adjust-mss <mss |
clamp-mss-to-pmtu>
× not yet documented interfaces_macsec.xml.in: Nothing found in VyOS
interfaces macsec <mac-
sec> ipv6 base-reachable-
time
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec interfaces macsec ipv6 disable-forwarding
<interface> ipv6 <macsec> ipv6 disable-
disable-forwarding forwarding
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec interfaces macsec <mac- ipv6 dup-addr-detect-
<interface> ipv6 sec> ipv6 dup-addr- transmits <value>
dup-addr-detect-transmits
detect-transmits
<n>
× not yet documented interfaces_macsec.xml.in: Nothing found in VyOS
interfaces macsec
<macsec> ipv6 source-
validation
× set interfaces Nothing found in XML Nothing found in VyOS
macsec Definitions
<interface> mac
<xx:xx:xx:xx:xx:xx>
× not yet documented interfaces_macsec.xml.in: interfaces macsec <text>
interfaces macsec <mac- mirror egress <value>
sec> mirror egress
× not yet documented interfaces_macsec.xml.in: interfaces macsec <text>
interfaces macsec <mac- mirror ingress <value>
sec> mirror ingress
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- mtu <value>
mtu <mtu> sec> mtu
× not yet documented interfaces_macsec.xml.in: interfaces macsec <text>
interfaces macsec <mac- redirect <value>
sec> redirect
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- security cipher <value>
security cipher sec> security cipher
<gcm-aes-128|gcm-aes-256>
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- security encrypt
security encrypt sec> security encrypt
continues on next page

21.1. Configuration Commands 1489

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- security mka cak <value>
security mka cak sec> security mka cak
<key>
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- security mka ckn <value>
security mka ckn sec> security mka ckn
<key>
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- security mka priority
security mka sec> security mka priority <value>
priority <priority>
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- security replay-window
security sec> security replay- <value>
replay-window window
<window>
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- security static key <value>
security static key sec> security static key
<key>
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- security static peer <text>
security static peer sec> security static peer disable
<peer> disable <peer> disable
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- security static peer <text>
security static peer sec> security static peer key <value>
<peer> key <key> <peer> key
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- security static peer <text>
security static sec> security static peer mac <value>
peer <peer> mac <mac <peer> mac
address>
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- source-interface <value>
source-interface sec> source-interface
<physical-source>
✓ set interfaces interfaces_macsec.xml.in: interfaces macsec <text>
macsec <interface> interfaces macsec <mac- vrf <value>
vrf <vrf> sec> vrf
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: authentication password
interfaces openvpn <open- <value>
vpn> authentication pass-
word
continues on next page

21.1. Configuration Commands 1490

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: authentication username
interfaces openvpn <open- <value>
vpn> authentication user-
name
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: description <value>
interfaces openvpn <open-
vpn> description
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: device-type <value>
interfaces openvpn <open-
vpn> device-type
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: disable
interfaces openvpn <open-
vpn> disable
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: encryption cipher <value>
interfaces openvpn <open-
vpn> encryption cipher
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: encryption ncp-ciphers
interfaces openvpn <value>
<openvpn> encryption
ncp-ciphers
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: hash <value>
interfaces openvpn <open-
vpn> hash
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: ip adjust-mss <value>
interfaces openvpn <open-
vpn> ip adjust-mss
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: ip arp-cache-timeout
interfaces openvpn <open- <value>
vpn> ip arp-cache-timeout
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: ip disable-arp-filter
interfaces openvpn <open-
vpn> ip disable-arp-filter
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: ip disable-forwarding
interfaces openvpn
<openvpn> ip disable-
forwarding
continues on next page

21.1. Configuration Commands 1491

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: ip enable-arp-accept
interfaces openvpn <open-
vpn> ip enable-arp-accept
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: ip enable-arp-announce
interfaces openvpn
<openvpn> ip enable-arp-
announce
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: ip enable-arp-ignore
interfaces openvpn <open-
vpn> ip enable-arp-ignore
× not yet documented inter- interfaces openvpn
faces_openvpn.xml.in: <text> ip enable-directed-
interfaces openvpn <open- broadcast
vpn> ip enable-directed-
broadcast
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: ip enable-proxy-arp
interfaces openvpn <open-
vpn> ip enable-proxy-arp
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: ip proxy-arp-pvlan
interfaces openvpn <open-
vpn> ip proxy-arp-pvlan
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: ip source-validation
interfaces openvpn <open- <value>
vpn> ip source-validation
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: ipv6 accept-dad <value>
interfaces openvpn <open-
vpn> ipv6 accept-dad
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: ipv6 address autoconf
interfaces openvpn <open-
vpn> ipv6 address auto-
conf
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: ipv6 address eui64
interfaces openvpn <open- <value>
vpn> ipv6 address eui64
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: ipv6 address no-default-
interfaces openvpn <open- link-local
vpn> ipv6 address no-
default-link-local
continues on next page

21.1. Configuration Commands 1492

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: ipv6 adjust-mss <value>
interfaces openvpn <open-
vpn> ipv6 adjust-mss
× not yet documented inter- Nothing found in VyOS
faces_openvpn.xml.in:
interfaces openvpn <open-
vpn> ipv6 base-reachable-
time
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: ipv6 disable-forwarding
interfaces openvpn
<openvpn> ipv6 disable-
forwarding
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: ipv6 dup-addr-detect-
interfaces openvpn transmits <value>
<openvpn> ipv6 dup-
addr-detect-transmits
× not yet documented inter- Nothing found in VyOS
faces_openvpn.xml.in:
interfaces openvpn
<openvpn> ipv6 source-
validation
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: keep-alive failure-count
interfaces openvpn <open- <value>
vpn> keep-alive failure-
count
× not yet documented inter- interfaces openvpn
faces_openvpn.xml.in: <text> keep-alive interval
interfaces openvpn <open- <value>
vpn> keep-alive interval
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: local-address <text>
interfaces openvpn <open- subnet-mask <value>
vpn> local-address <local-
address> subnet-mask
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: local-host <value>
interfaces openvpn <open-
vpn> local-host
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: local-port <value>
interfaces openvpn <open-
vpn> local-port
continues on next page

21.1. Configuration Commands 1493

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: mirror egress <value>
interfaces openvpn <open-
vpn> mirror egress
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: mirror ingress <value>
interfaces openvpn <open-
vpn> mirror ingress
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: mode <value>
interfaces openvpn <open-
vpn> mode
✓ set interfaces inter- interfaces openvpn <text>
openvpn <name> faces_openvpn.xml.in: offload dco
offload dco interfaces openvpn <open-
vpn> offload dco
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: openvpn-option <value>
interfaces openvpn <open-
vpn> openvpn-option
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: persistent-tunnel
interfaces openvpn <open-
vpn> persistent-tunnel
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: protocol <value>
interfaces openvpn <open-
vpn> protocol
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: redirect <value>
interfaces openvpn <open-
vpn> redirect
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: remote-address <value>
interfaces openvpn <open-
vpn> remote-address
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: remote-host <value>
interfaces openvpn <open-
vpn> remote-host
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: remote-port <value>
interfaces openvpn <open-
vpn> remote-port
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: replace-default-route local
interfaces openvpn <value>
<openvpn> replace-
default-route local
continues on next page

21.1. Configuration Commands 1494

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: server client-ip-pool dis-
interfaces openvpn <open- able
vpn> server client-ip-pool
disable
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: server client-ip-pool start
interfaces openvpn <open- <value>
vpn> server client-ip-pool
start
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: server client-ip-pool stop
interfaces openvpn <open- <value>
vpn> server client-ip-pool
stop
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: server client-ip-pool
interfaces openvpn <open- subnet-mask <value>
vpn> server client-ip-pool
subnet-mask
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: server client-ipv6-pool
interfaces openvpn <open- base <value>
vpn> server client-ipv6-
pool base
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: server client-ipv6-pool
interfaces openvpn <open- disable
vpn> server client-ipv6-
pool disable
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: server client <text> dis-
interfaces openvpn able
<openvpn> server client
<client> disable
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: server client <text> ip
interfaces openvpn <value>
<openvpn> server client
<client> ip
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: server client <text> push-
interfaces openvpn route <value>
<openvpn> server client
<client> push-route
continues on next page

21.1. Configuration Commands 1495

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: server client <text> subnet
interfaces openvpn <value>
<openvpn> server client
<client> subnet
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: server domain-name
interfaces openvpn <open- <value>
vpn> server domain-name
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: server max-connections
interfaces openvpn <value>
<openvpn> server max-
connections
✓ set interfaces inter- interfaces openvpn <text>
openvpn <interface> faces_openvpn.xml.in: server mfa totp challenge
server mfa totp interfaces openvpn <open- <value>
challenge <enable | vpn> server mfa totp chal-
disable> lenge
✓ set interfaces inter- interfaces openvpn <text>
openvpn <interface> faces_openvpn.xml.in: server mfa totp digits
server mfa totp interfaces openvpn <open- <value>
digits <1-65535> vpn> server mfa totp digits
✓ set interfaces inter- interfaces openvpn <text>
openvpn <interface> faces_openvpn.xml.in: server mfa totp drift
server mfa totp interfaces openvpn <open- <value>
drift <1-65535> vpn> server mfa totp drift
✓ set interfaces inter- interfaces openvpn <text>
openvpn <interface> faces_openvpn.xml.in: server mfa totp slop
server mfa totp slop interfaces openvpn <open- <value>
<1-65535> vpn> server mfa totp slop
✓ set interfaces inter- interfaces openvpn <text>
openvpn <interface> faces_openvpn.xml.in: server mfa totp step
server mfa totp step interfaces openvpn <open- <value>
<1-65535> vpn> server mfa totp step
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: server name-server
interfaces openvpn <open- <value>
vpn> server name-server
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: server push-route <text>
interfaces openvpn <open- metric <value>
vpn> server push-route
<push-route> metric
× not yet documented inter- interfaces openvpn
faces_openvpn.xml.in: <text> server reject-
interfaces openvpn unconfigured-clients
<openvpn> server reject-
unconfigured-clients
continues on next page

21.1. Configuration Commands 1496

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: server subnet <value>
interfaces openvpn <open-
vpn> server subnet
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: server topology <value>
interfaces openvpn <open-
vpn> server topology
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: shared-secret-key <value>
interfaces openvpn <open-
vpn> shared-secret-key
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: tls auth-key <value>
interfaces openvpn <open-
vpn> tls auth-key
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: tls ca-certificate <value>
interfaces openvpn <open-
vpn> tls ca-certificate
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: tls certificate <value>
interfaces openvpn <open-
vpn> tls certificate
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: tls crypt-key <value>
interfaces openvpn <open-
vpn> tls crypt-key
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: tls dh-params <value>
interfaces openvpn <open-
vpn> tls dh-params
× not yet documented inter- interfaces openvpn
faces_openvpn.xml.in: <text> tls peer-fingerprint
interfaces openvpn <open- <value>
vpn> tls peer-fingerprint
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: tls role <value>
interfaces openvpn <open-
vpn> tls role
× not yet documented inter- interfaces openvpn
faces_openvpn.xml.in: <text> tls tls-version-min
interfaces openvpn <open- <value>
vpn> tls tls-version-min
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: use-lzo-compression
interfaces openvpn <open-
vpn> use-lzo-compression
continues on next page

21.1. Configuration Commands 1497

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces openvpn <text>
faces_openvpn.xml.in: vrf <value>
interfaces openvpn <open-
vpn> vrf
× set interfaces Nothing found in XML Nothing found in VyOS
openvpn vtun10 Definitions
openvpn-option
'persist-key'
× set interfaces Nothing found in XML Nothing found in VyOS
openvpn vtun10 Definitions
openvpn-option 'push
keepalive 10 60'
× set interfaces Nothing found in XML Nothing found in VyOS
openvpn vtun10 Definitions
openvpn-option
'route-up &quot;/
config/auth/tun_up.
sh arg1&quot;'
✓ set interfaces interfaces_pppoe.xml.in: interfaces pppoe <text>
pppoe <interface> interfaces pppoe <pppoe> access-concentrator
access-concentrator access-concentrator <value>
<name>
✓ set interfaces interfaces_pppoe.xml.in: interfaces pppoe <text>
pppoe <interface> interfaces pppoe <pppoe> authentication password
authentication authentication password <value>
password <password>
✓ set interfaces interfaces_pppoe.xml.in: interfaces pppoe <text>
pppoe <interface> interfaces pppoe <pppoe> authentication username
authentication authentication username <value>
username <username>
✓ set interfaces interfaces_pppoe.xml.in: interfaces pppoe <text>
pppoe <interface> interfaces pppoe <pppoe> connect-on-demand
connect-on-demand connect-on-demand
✓ set interfaces interfaces_pppoe.xml.in: interfaces pppoe <text>
pppoe <interface> interfaces pppoe <pppoe> default-route-distance
default-route-distance default-route-distance <value>
<distance>
✓ set interfaces interfaces_pppoe.xml.in: interfaces pppoe <text>
pppoe <interface> interfaces pppoe <pppoe> description <value>
description description
<description>
× not yet documented interfaces_pppoe.xml.in: interfaces pppoe <text>
interfaces pppoe <pppoe> dhcpv6-options duid
dhcpv6-options duid <value>
× not yet documented interfaces_pppoe.xml.in: interfaces pppoe <text>
interfaces pppoe <pppoe> dhcpv6-options no-release
dhcpv6-options no-release
continues on next page

21.1. Configuration Commands 1498

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_pppoe.xml.in: interfaces pppoe
interfaces pppoe <pp- <text> dhcpv6-options
poe> dhcpv6-options parameters-only
parameters-only
✓ set interfaces interfaces_pppoe.xml.in: interfaces pppoe <text>
pppoe <interface> interfaces pppoe <pppoe> dhcpv6-options pd <text>
dhcpv6-options dhcpv6-options pd <pd> interface <text> address
pd <id> interface interface <interface> ad- <value>
<delegatee> address dress
<address>
✓ set interfaces interfaces_pppoe.xml.in: interfaces pppoe <text>
pppoe <interface> interfaces pppoe <pppoe> dhcpv6-options pd <text>
dhcpv6-options dhcpv6-options pd <pd> interface <text> sla-id
pd <id> interface interface <interface> sla- <value>
<delegatee> sla-id id
<id>
✓ set interfaces interfaces_pppoe.xml.in: interfaces pppoe <text>
pppoe <interface> interfaces pppoe <pppoe> dhcpv6-options pd <text>
dhcpv6-options dhcpv6-options pd <pd> length <value>
pd <id> length length
<length>
× not yet documented interfaces_pppoe.xml.in: interfaces pppoe <text>
interfaces pppoe <pp- dhcpv6-options rapid-
poe> dhcpv6-options commit
rapid-commit
× not yet documented interfaces_pppoe.xml.in: interfaces pppoe <text>
interfaces pppoe <pppoe> dhcpv6-options temporary
dhcpv6-options temporary
✓ set interfaces pppoe interfaces_pppoe.xml.in: interfaces pppoe <text>
<interface> disable interfaces pppoe <pppoe> disable
disable
✓ set interfaces pppoe interfaces_pppoe.xml.in: interfaces pppoe <text>
<interface> holdoff interfaces pppoe <pppoe> holdoff <value>
<time> holdoff
× not yet documented interfaces_pppoe.xml.in: interfaces pppoe <text>
interfaces pppoe <pppoe> host-uniq <value>
host-uniq
✓ set interfaces interfaces_pppoe.xml.in: interfaces pppoe <text>
pppoe <interface> interfaces pppoe <pppoe> idle-timeout <value>
idle-timeout <time> idle-timeout
✓ set interfaces interfaces_pppoe.xml.in: interfaces pppoe <text> ip
pppoe <interface> interfaces pppoe <pppoe> adjust-mss <value>
ip adjust-mss <mss | ip adjust-mss
clamp-mss-to-pmtu>
✓ set interfaces interfaces_pppoe.xml.in: interfaces pppoe <text> ip
pppoe <interface> ip interfaces pppoe <pppoe> disable-forwarding
disable-forwarding ip disable-forwarding
continues on next page

21.1. Configuration Commands 1499

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_pppoe.xml.in: interfaces pppoe <text> ip
pppoe <interface> interfaces pppoe <pppoe> source-validation <value>
ip source-validation ip source-validation
<strict | loose |
disable>
✓ set interfaces pppoe interfaces_pppoe.xml.in: interfaces pppoe <text>
<interface> ipv6 interfaces pppoe <pppoe> ipv6 address autoconf
address autoconf ipv6 address autoconf
✓ set interfaces pppoe interfaces_pppoe.xml.in: interfaces pppoe <text>
<interface> ipv6 interfaces pppoe <pppoe> ipv6 adjust-mss <value>
adjust-mss <mss | ipv6 adjust-mss
clamp-mss-to-pmtu>
✓ set interfaces pppoe interfaces_pppoe.xml.in: interfaces pppoe <text>
<interface> ipv6 interfaces pppoe <pppoe> ipv6 disable-forwarding
disable-forwarding ipv6 disable-forwarding
✓ set interfaces interfaces_pppoe.xml.in: interfaces pppoe <text>
pppoe <interface> interfaces pppoe <pppoe> local-address <value>
local-address local-address
<address>
× not yet documented interfaces_pppoe.xml.in: interfaces pppoe <text>
interfaces pppoe <pppoe> mirror egress <value>
mirror egress
× not yet documented interfaces_pppoe.xml.in: interfaces pppoe <text>
interfaces pppoe <pppoe> mirror ingress <value>
mirror ingress
× set interfaces pppoe interfaces_pppoe.xml.in: Nothing found in VyOS
<interface> mru interfaces pppoe <pppoe>
<mru> mru
✓ set interfaces pppoe interfaces_pppoe.xml.in: interfaces pppoe <text>
<interface> mtu interfaces pppoe <pppoe> mtu <value>
<mtu> mtu
✓ set interfaces interfaces_pppoe.xml.in: interfaces pppoe <text>
pppoe <interface> interfaces pppoe <pppoe> no-default-route
no-default-route no-default-route
✓ set interfaces interfaces_pppoe.xml.in: interfaces pppoe <text>
pppoe <interface> interfaces pppoe <pppoe> no-peer-dns
no-peer-dns no-peer-dns
× not yet documented interfaces_pppoe.xml.in: interfaces pppoe <text>
interfaces pppoe <pppoe> redirect <value>
redirect
✓ set interfaces interfaces_pppoe.xml.in: interfaces pppoe <text>
pppoe <interface> interfaces pppoe <pppoe> remote-address <value>
remote-address remote-address
<address>
✓ set interfaces interfaces_pppoe.xml.in: interfaces pppoe <text>
pppoe <interface> interfaces pppoe <pppoe> service-name <value>
service-name <name> service-name
continues on next page

21.1. Configuration Commands 1500

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_pppoe.xml.in: interfaces pppoe <text>
pppoe <interface> interfaces pppoe <pppoe> source-interface <value>
source-interface source-interface
<source-interface>
✓ set interfaces pppoe interfaces_pppoe.xml.in: interfaces pppoe <text>
<interface> vrf interfaces pppoe <pppoe> vrf <value>
<vrf> vrf
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> address <value>
<interface> address interfaces pseudo-ethernet
<address | dhcp | <pseudo-ethernet> ad-
dhcpv6> dress
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> description
<interface> interfaces pseudo-ethernet <value>
description <pseudo-ethernet> de-
<description> scription
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> dhcp-options
<interface> interfaces pseudo-ethernet client-id <value>
dhcp-options <pseudo-ethernet> dhcp-
client-id options client-id
<description>
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> dhcp-options
<interface> interfaces pseudo-ethernet default-route-distance
dhcp-options <pseudo-ethernet> dhcp- <value>
default-route-distance options default-route-
<distance> distance
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> dhcp-options host-
<interface> interfaces pseudo-ethernet name <value>
dhcp-options <pseudo-ethernet> dhcp-
host-name options host-name
<hostname>
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> dhcp-options mtu
interfaces pseudo-ethernet
<pseudo-ethernet> dhcp-
options mtu
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> dhcp-options no-
<interface> interfaces pseudo-ethernet default-route
dhcp-options <pseudo-ethernet> dhcp-
no-default-route options no-default-route
continues on next page

21.1. Configuration Commands 1501

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> dhcp-options reject
<interface> interfaces pseudo-ethernet <value>
dhcp-options reject <pseudo-ethernet> dhcp-
<address> options reject
× set interfaces interfaces_pseudo- Nothing found in VyOS
pseudo-ethernet ethernet.xml.in:
<interface> interfaces pseudo-ethernet
dhcp-options <pseudo-ethernet> dhcp-
user-class <string> options user-class
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> dhcp-options
<interface> interfaces pseudo-ethernet vendor-class-id <value>
dhcp-options <pseudo-ethernet> dhcp-
vendor-class-id options vendor-class-id
<vendor-id>
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> dhcpv6-options
<interface> interfaces pseudo-ethernet duid <value>
dhcpv6-options duid <pseudo-ethernet>
<duid> dhcpv6-options duid
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> dhcpv6-options no-
<interface> interfaces pseudo-ethernet release
dhcpv6-options <pseudo-ethernet>
no-release dhcpv6-options no-release
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> dhcpv6-options
<interface> interfaces pseudo- parameters-only
dhcpv6-options ethernet <pseudo-
parameters-only ethernet> dhcpv6-options
parameters-only
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> dhcpv6-options pd
<interface> interfaces pseudo-ethernet <text> interface <text> ad-
dhcpv6-options <pseudo-ethernet> dress <value>
pd <id> interface dhcpv6-options pd <pd>
<delegatee> address interface <interface>
<address> address
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> dhcpv6-options pd
<interface> interfaces pseudo-ethernet <text> interface <text>
dhcpv6-options <pseudo-ethernet> sla-id <value>
pd <id> interface dhcpv6-options pd <pd>
<delegatee> sla-id interface <interface>
<id> sla-id
continues on next page

21.1. Configuration Commands 1502

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> dhcpv6-options pd
<interface> interfaces pseudo-ethernet <text> length <value>
dhcpv6-options <pseudo-ethernet>
pd <id> length dhcpv6-options pd <pd>
<length> length
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> dhcpv6-options
<interface> interfaces pseudo-ethernet rapid-commit
dhcpv6-options <pseudo-ethernet>
rapid-commit dhcpv6-options rapid-
commit
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> dhcpv6-options
<interface> interfaces pseudo-ethernet temporary
dhcpv6-options <pseudo-ethernet>
temporary dhcpv6-options tem-
porary
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> disable
<interface> disable interfaces pseudo-ethernet
<pseudo-ethernet> disable
× set interfaces Nothing found in XML Nothing found in VyOS
pseudo-ethernet Definitions
<interface>
disable-flow-control
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> disable-link-detect
<interface> interfaces pseudo-ethernet
disable-link-detect <pseudo-ethernet>
disable-link-detect
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> ip adjust-mss
<interface> ip interfaces pseudo-ethernet <value>
adjust-mss <mss | <pseudo-ethernet> ip
clamp-mss-to-pmtu> adjust-mss
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> ip arp-cache-
<interface> ip interfaces pseudo-ethernet timeout <value>
arp-cache-timeout <pseudo-ethernet> ip arp-
cache-timeout
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> ip disable-arp-filter
<interface> ip interfaces pseudo-ethernet
disable-arp-filter <pseudo-ethernet> ip
disable-arp-filter
continues on next page

21.1. Configuration Commands 1503

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> ip disable-
<interface> ip interfaces pseudo-ethernet forwarding
disable-forwarding <pseudo-ethernet> ip
disable-forwarding
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> ip enable-arp-
<interface> ip interfaces pseudo-ethernet accept
enable-arp-accept <pseudo-ethernet> ip
enable-arp-accept
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> ip enable-arp-
<interface> ip interfaces pseudo-ethernet announce
enable-arp-announce <pseudo-ethernet> ip
enable-arp-announce
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> ip enable-arp-
<interface> ip interfaces pseudo-ethernet ignore
enable-arp-ignore <pseudo-ethernet> ip
enable-arp-ignore
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> ip enable-directed-
<interface> ip interfaces pseudo-ethernet broadcast
enable-directed-broadcast
<pseudo-ethernet> ip
enable-directed-broadcast
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> ip enable-proxy-
<interface> ip interfaces pseudo-ethernet arp
enable-proxy-arp <pseudo-ethernet> ip
enable-proxy-arp
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> ip proxy-arp-pvlan
<interface> ip interfaces pseudo-ethernet
proxy-arp-pvlan <pseudo-ethernet> ip
proxy-arp-pvlan
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> ip source-
<interface> ip interfaces pseudo-ethernet validation <value>
source-validation <pseudo-ethernet> ip
<strict | loose | source-validation
disable>
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> ipv6 accept-dad
<interface> ipv6 interfaces pseudo-ethernet <value>
accept-dad <1-3> <pseudo-ethernet> ipv6
accept-dad
continues on next page

21.1. Configuration Commands 1504

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> ipv6 address auto-
<interface> ipv6 interfaces pseudo-ethernet conf
address autoconf <pseudo-ethernet> ipv6
address autoconf
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> ipv6 address eui64
<interface> ipv6 interfaces pseudo-ethernet <value>
address eui64 <pseudo-ethernet> ipv6
<prefix> address eui64
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> ipv6 address no-
<interface> interfaces pseudo-ethernet default-link-local
ipv6 address <pseudo-ethernet> ipv6
no-default-link-local address no-default-link-
local
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> ipv6 adjust-mss
<interface> ipv6 interfaces pseudo-ethernet <value>
adjust-mss <mss | <pseudo-ethernet> ipv6
clamp-mss-to-pmtu> adjust-mss
× not yet documented interfaces_pseudo- Nothing found in VyOS
ethernet.xml.in:
interfaces pseudo-ethernet
<pseudo-ethernet> ipv6
base-reachable-time
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> ipv6 disable-
<interface> ipv6 interfaces pseudo-ethernet forwarding
disable-forwarding <pseudo-ethernet> ipv6
disable-forwarding
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> ipv6 dup-addr-
<interface> ipv6 interfaces pseudo-ethernet detect-transmits <value>
dup-addr-detect-transmits
<pseudo-ethernet> ipv6
<n> dup-addr-detect-transmits
× not yet documented interfaces_pseudo- Nothing found in VyOS
ethernet.xml.in:
interfaces pseudo-ethernet
<pseudo-ethernet> ipv6
source-validation
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> mac <value>
<interface> mac interfaces pseudo-ethernet
<xx:xx:xx:xx:xx:xx> <pseudo-ethernet> mac
continues on next page

21.1. Configuration Commands 1505

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> mirror egress
interfaces pseudo-ethernet <value>
<pseudo-ethernet> mirror
egress
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> mirror ingress
interfaces pseudo-ethernet <value>
<pseudo-ethernet> mirror
ingress
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> mode <value>
interfaces pseudo-ethernet
<pseudo-ethernet> mode
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> mtu <value>
<interface> mtu interfaces pseudo-ethernet
<mtu> <pseudo-ethernet> mtu
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> redirect <value>
interfaces pseudo-ethernet
<pseudo-ethernet> redi-
rect
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> source-interface
<interface> interfaces pseudo-ethernet <value>
source-interface <pseudo-ethernet>
<ethX> source-interface
× set interfaces Nothing found in XML Nothing found in VyOS
pseudo-ethernet Definitions
<interface> vif
<vlan-id>
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> address
interfaces pseudo-ethernet <value>
<pseudo-ethernet> vif-s
<vif-s> address
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> de-
interfaces pseudo-ethernet scription <value>
<pseudo-ethernet> vif-s
<vif-s> description
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> dhcp-
interfaces pseudo-ethernet options client-id <value>
<pseudo-ethernet> vif-s
<vif-s> dhcp-options
client-id
continues on next page

21.1. Configuration Commands 1506

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces pseudo-ethernet dhcp-options default-
<pseudo-ethernet> vif-s route-distance <value>
<vif-s> dhcp-options
default-route-distance
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces pseudo-ethernet dhcp-options host-name
<pseudo-ethernet> vif-s <value>
<vif-s> dhcp-options
host-name
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> dhcp-
interfaces pseudo-ethernet options mtu
<pseudo-ethernet> vif-s
<vif-s> dhcp-options mtu
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> dhcp-
interfaces pseudo-ethernet options no-default-route
<pseudo-ethernet> vif-s
<vif-s> dhcp-options
no-default-route
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> dhcp-
interfaces pseudo-ethernet options reject <value>
<pseudo-ethernet> vif-s
<vif-s> dhcp-options
reject
× not yet documented interfaces_pseudo- Nothing found in VyOS
ethernet.xml.in:
interfaces pseudo-ethernet
<pseudo-ethernet> vif-s
<vif-s> dhcp-options
user-class
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> dhcp-
interfaces pseudo-ethernet options vendor-class-id
<pseudo-ethernet> vif-s <value>
<vif-s> dhcp-options
vendor-class-id
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces pseudo-ethernet dhcpv6-options duid
<pseudo-ethernet> vif-s <value>
<vif-s> dhcpv6-options
duid
continues on next page

21.1. Configuration Commands 1507

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces pseudo-ethernet dhcpv6-options no-release
<pseudo-ethernet> vif-s
<vif-s> dhcpv6-options
no-release
× not yet documented interfaces_pseudo- interfaces pseudo-
ethernet.xml.in: ethernet <text> vif-s
interfaces pseudo-ethernet <text> dhcpv6-options
<pseudo-ethernet> vif-s parameters-only
<vif-s> dhcpv6-options
parameters-only
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces pseudo-ethernet dhcpv6-options pd <text>
<pseudo-ethernet> vif-s interface <text> address
<vif-s> dhcpv6-options <value>
pd <pd> interface <inter-
face> address
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces pseudo-ethernet dhcpv6-options pd <text>
<pseudo-ethernet> vif-s interface <text> sla-id
<vif-s> dhcpv6-options <value>
pd <pd> interface <inter-
face> sla-id
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces pseudo-ethernet dhcpv6-options pd <text>
<pseudo-ethernet> vif-s length <value>
<vif-s> dhcpv6-options
pd <pd> length
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces pseudo-ethernet dhcpv6-options rapid-
<pseudo-ethernet> vif-s commit
<vif-s> dhcpv6-options
rapid-commit
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces pseudo-ethernet dhcpv6-options tempo-
<pseudo-ethernet> vif-s rary
<vif-s> dhcpv6-options
temporary
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> disable
interfaces pseudo-ethernet
<pseudo-ethernet> vif-s
<vif-s> disable
continues on next page

21.1. Configuration Commands 1508

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces pseudo-ethernet disable-link-detect
<pseudo-ethernet> vif-s
<vif-s> disable-link-detect
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> ip
interfaces pseudo-ethernet adjust-mss <value>
<pseudo-ethernet> vif-s
<vif-s> ip adjust-mss
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> ip arp-
interfaces pseudo-ethernet cache-timeout <value>
<pseudo-ethernet> vif-s
<vif-s> ip arp-cache-
timeout
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> ip
interfaces pseudo-ethernet disable-arp-filter
<pseudo-ethernet> vif-s
<vif-s> ip disable-arp-
filter
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> ip
interfaces pseudo-ethernet disable-forwarding
<pseudo-ethernet> vif-s
<vif-s> ip disable-
forwarding
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> ip
interfaces pseudo-ethernet enable-arp-accept
<pseudo-ethernet> vif-s
<vif-s> ip enable-arp-
accept
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> ip
interfaces pseudo-ethernet enable-arp-announce
<pseudo-ethernet> vif-s
<vif-s> ip enable-arp-
announce
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> ip
interfaces pseudo-ethernet enable-arp-ignore
<pseudo-ethernet> vif-s
<vif-s> ip enable-arp-
ignore
continues on next page

21.1. Configuration Commands 1509

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> ip
interfaces pseudo-ethernet enable-directed-broadcast
<pseudo-ethernet> vif-
s <vif-s> ip enable-
directed-broadcast
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> ip
interfaces pseudo-ethernet enable-proxy-arp
<pseudo-ethernet> vif-s
<vif-s> ip enable-proxy-
arp
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> ip
interfaces pseudo-ethernet proxy-arp-pvlan
<pseudo-ethernet> vif-s
<vif-s> ip proxy-arp-pvlan
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> ip
interfaces pseudo-ethernet source-validation <value>
<pseudo-ethernet> vif-
s <vif-s> ip source-
validation
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> ipv6
interfaces pseudo-ethernet accept-dad <value>
<pseudo-ethernet> vif-s
<vif-s> ipv6 accept-dad
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> ipv6
interfaces pseudo-ethernet address autoconf
<pseudo-ethernet> vif-s
<vif-s> ipv6 address
autoconf
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> ipv6
interfaces pseudo-ethernet address eui64 <value>
<pseudo-ethernet> vif-s
<vif-s> ipv6 address eui64
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> ipv6
interfaces pseudo-ethernet address no-default-link-
<pseudo-ethernet> vif-s local
<vif-s> ipv6 address
no-default-link-local
continues on next page

21.1. Configuration Commands 1510

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> ipv6
interfaces pseudo-ethernet adjust-mss <value>
<pseudo-ethernet> vif-s
<vif-s> ipv6 adjust-mss
× not yet documented interfaces_pseudo- Nothing found in VyOS
ethernet.xml.in:
interfaces pseudo-ethernet
<pseudo-ethernet> vif-s
<vif-s> ipv6 base-
reachable-time
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> ipv6
interfaces pseudo-ethernet disable-forwarding
<pseudo-ethernet> vif-s
<vif-s> ipv6 disable-
forwarding
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> ipv6
interfaces pseudo-ethernet dup-addr-detect-transmits
<pseudo-ethernet> vif-s <value>
<vif-s> ipv6 dup-addr-
detect-transmits
× not yet documented interfaces_pseudo- Nothing found in VyOS
ethernet.xml.in:
interfaces pseudo-ethernet
<pseudo-ethernet> vif-s
<vif-s> ipv6 source-
validation
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> mac
interfaces pseudo-ethernet <value>
<pseudo-ethernet> vif-s
<vif-s> mac
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> mirror
interfaces pseudo-ethernet egress <value>
<pseudo-ethernet> vif-s
<vif-s> mirror egress
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> mirror
interfaces pseudo-ethernet ingress <value>
<pseudo-ethernet> vif-s
<vif-s> mirror ingress
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> mtu
interfaces pseudo-ethernet <value>
<pseudo-ethernet> vif-s
<vif-s> mtu
continues on next page

21.1. Configuration Commands 1511

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> proto-
interfaces pseudo-ethernet col <value>
<pseudo-ethernet> vif-s
<vif-s> protocol
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> redi-
interfaces pseudo-ethernet rect <value>
<pseudo-ethernet> vif-s
<vif-s> redirect
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> address <value>
<pseudo-ethernet> vif-s
<vif-s> vif-c <vif-c>
address
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-
interfaces pseudo-ethernet c <text> description
<pseudo-ethernet> vif-s <value>
<vif-s> vif-c <vif-c>
description
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-
interfaces pseudo-ethernet c <text> dhcp-options
<pseudo-ethernet> vif-s client-id <value>
<vif-s> vif-c <vif-c>
dhcp-options client-id
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-
interfaces pseudo-ethernet c <text> dhcp-options
<pseudo-ethernet> vif-s default-route-distance
<vif-s> vif-c <vif-c> <value>
dhcp-options default-
route-distance
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> dhcp-options host-
<pseudo-ethernet> vif-s name <value>
<vif-s> vif-c <vif-c>
dhcp-options host-name
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> dhcp-options mtu
<pseudo-ethernet> vif-s
<vif-s> vif-c <vif-c>
dhcp-options mtu
continues on next page

21.1. Configuration Commands 1512

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-
interfaces pseudo-ethernet c <text> dhcp-options no-
<pseudo-ethernet> vif-s default-route
<vif-s> vif-c <vif-c>
dhcp-options no-default-
route
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> dhcp-options reject
<pseudo-ethernet> vif-s <value>
<vif-s> vif-c <vif-c>
dhcp-options reject
× not yet documented interfaces_pseudo- Nothing found in VyOS
ethernet.xml.in:
interfaces pseudo-ethernet
<pseudo-ethernet> vif-s
<vif-s> vif-c <vif-c>
dhcp-options user-class
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-
interfaces pseudo-ethernet c <text> dhcp-options
<pseudo-ethernet> vif-s vendor-class-id <value>
<vif-s> vif-c <vif-c>
dhcp-options vendor-
class-id
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-
interfaces pseudo-ethernet c <text> dhcpv6-options
<pseudo-ethernet> vif-s duid <value>
<vif-s> vif-c <vif-c>
dhcpv6-options duid
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> dhcpv6-options no-
<pseudo-ethernet> vif-s release
<vif-s> vif-c <vif-c>
dhcpv6-options no-release
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-
interfaces pseudo-ethernet c <text> dhcpv6-options
<pseudo-ethernet> vif-s parameters-only
<vif-s> vif-c <vif-
c> dhcpv6-options
parameters-only
continues on next page

21.1. Configuration Commands 1513

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> dhcpv6-options pd
<pseudo-ethernet> vif-s <text> interface <text> ad-
<vif-s> vif-c <vif-c> dress <value>
dhcpv6-options pd <pd>
interface <interface>
address
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-
interfaces pseudo-ethernet c <text> dhcpv6-options
<pseudo-ethernet> vif-s pd <text> interface <text>
<vif-s> vif-c <vif-c> sla-id <value>
dhcpv6-options pd <pd>
interface <interface>
sla-id
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> dhcpv6-options pd
<pseudo-ethernet> vif-s <text> length <value>
<vif-s> vif-c <vif-c>
dhcpv6-options pd <pd>
length
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-
interfaces pseudo-ethernet c <text> dhcpv6-options
<pseudo-ethernet> vif-s rapid-commit
<vif-s> vif-c <vif-c>
dhcpv6-options rapid-
commit
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-
interfaces pseudo-ethernet c <text> dhcpv6-options
<pseudo-ethernet> vif- temporary
s <vif-s> vif-c <vif-c>
dhcpv6-options temporary
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> disable
<pseudo-ethernet> vif-s
<vif-s> vif-c <vif-c>
disable
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> disable-link-detect
<pseudo-ethernet> vif-s
<vif-s> vif-c <vif-c>
disable-link-detect
continues on next page

21.1. Configuration Commands 1514

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> ip adjust-mss
<pseudo-ethernet> vif-s <value>
<vif-s> vif-c <vif-c> ip
adjust-mss
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> ip arp-cache-
<pseudo-ethernet> vif-s timeout <value>
<vif-s> vif-c <vif-c> ip
arp-cache-timeout
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> ip disable-arp-filter
<pseudo-ethernet> vif-s
<vif-s> vif-c <vif-c> ip
disable-arp-filter
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces pseudo-ethernet vif-c <text> ip disable-
<pseudo-ethernet> vif-s forwarding
<vif-s> vif-c <vif-c> ip
disable-forwarding
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-
interfaces pseudo-ethernet c <text> ip enable-arp-
<pseudo-ethernet> vif-s accept
<vif-s> vif-c <vif-c> ip
enable-arp-accept
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-
interfaces pseudo-ethernet c <text> ip enable-arp-
<pseudo-ethernet> vif-s announce
<vif-s> vif-c <vif-c> ip
enable-arp-announce
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-
interfaces pseudo-ethernet c <text> ip enable-arp-
<pseudo-ethernet> vif-s ignore
<vif-s> vif-c <vif-c> ip
enable-arp-ignore
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> ip enable-directed-
<pseudo-ethernet> vif-s broadcast
<vif-s> vif-c <vif-c> ip
enable-directed-broadcast
continues on next page

21.1. Configuration Commands 1515

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-
interfaces pseudo-ethernet c <text> ip enable-proxy-
<pseudo-ethernet> vif-s arp
<vif-s> vif-c <vif-c> ip
enable-proxy-arp
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> ip proxy-arp-pvlan
<pseudo-ethernet> vif-s
<vif-s> vif-c <vif-c> ip
proxy-arp-pvlan
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces pseudo-ethernet vif-c <text> ip source-
<pseudo-ethernet> vif-s validation <value>
<vif-s> vif-c <vif-c> ip
source-validation
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-
interfaces pseudo-ethernet c <text> ipv6 accept-dad
<pseudo-ethernet> vif-s <value>
<vif-s> vif-c <vif-c> ipv6
accept-dad
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> ipv6 address auto-
<pseudo-ethernet> vif-s conf
<vif-s> vif-c <vif-c> ipv6
address autoconf
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> ipv6 address eui64
<pseudo-ethernet> vif-s <value>
<vif-s> vif-c <vif-c> ipv6
address eui64
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> ipv6 address no-
<pseudo-ethernet> vif-s default-link-local
<vif-s> vif-c <vif-c> ipv6
address no-default-link-
local
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-
interfaces pseudo-ethernet c <text> ipv6 adjust-mss
<pseudo-ethernet> vif-s <value>
<vif-s> vif-c <vif-c> ipv6
adjust-mss
continues on next page

21.1. Configuration Commands 1516

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_pseudo- Nothing found in VyOS
ethernet.xml.in:
interfaces pseudo-ethernet
<pseudo-ethernet> vif-s
<vif-s> vif-c <vif-c> ipv6
base-reachable-time
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> ipv6 disable-
<pseudo-ethernet> vif-s forwarding
<vif-s> vif-c <vif-c> ipv6
disable-forwarding
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-
interfaces pseudo-ethernet c <text> ipv6 dup-addr-
<pseudo-ethernet> vif-s detect-transmits <value>
<vif-s> vif-c <vif-c> ipv6
dup-addr-detect-transmits
× not yet documented interfaces_pseudo- Nothing found in VyOS
ethernet.xml.in:
interfaces pseudo-ethernet
<pseudo-ethernet> vif-s
<vif-s> vif-c <vif-c> ipv6
source-validation
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> mac <value>
<pseudo-ethernet> vif-s
<vif-s> vif-c <vif-c> mac
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> mirror egress
<pseudo-ethernet> vif-s <value>
<vif-s> vif-c <vif-c>
mirror egress
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-
interfaces pseudo-ethernet c <text> mirror ingress
<pseudo-ethernet> vif-s <value>
<vif-s> vif-c <vif-c>
mirror ingress
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> mtu <value>
<pseudo-ethernet> vif-s
<vif-s> vif-c <vif-c> mtu
continues on next page

21.1. Configuration Commands 1517

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> redirect <value>
<pseudo-ethernet> vif-s
<vif-s> vif-c <vif-c>
redirect
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces pseudo-ethernet <text> vrf <value>
<pseudo-ethernet> vif-s
<vif-s> vif-c <vif-c> vrf
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif-s <text> vrf
interfaces pseudo-ethernet <value>
<pseudo-ethernet> vif-s
<vif-s> vrf
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> address
<interface> vif interfaces pseudo-ethernet <value>
<vlan-id> address <pseudo-ethernet> vif
<address | dhcp | <vif> address
dhcpv6>
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> descrip-
<interface> interfaces pseudo-ethernet tion <value>
vif <vlan-id> <pseudo-ethernet> vif
description <vif> description
<description>
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> dhcp-
<interface> interfaces pseudo-ethernet options client-id <value>
vif <vlan-id> <pseudo-ethernet> vif
dhcp-options <vif> dhcp-options
client-id client-id
<description>
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> dhcp-
<interface> interfaces pseudo-ethernet options default-route-
vif <vlan-id> <pseudo-ethernet> vif distance <value>
dhcp-options <vif> dhcp-options
default-route-distance default-route-distance
<distance>
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> dhcp-
<interface> interfaces pseudo-ethernet options host-name
vif <vlan-id> <pseudo-ethernet> vif <value>
dhcp-options <vif> dhcp-options
host-name host-name
<hostname>
continues on next page

21.1. Configuration Commands 1518

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif <text> dhcp-
interfaces pseudo-ethernet options mtu
<pseudo-ethernet> vif
<vif> dhcp-options mtu
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> dhcp-
<interface> interfaces pseudo-ethernet options no-default-route
vif <vlan-id> <pseudo-ethernet> vif
dhcp-options <vif> dhcp-options
no-default-route no-default-route
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> dhcp-
<interface> interfaces pseudo-ethernet options reject <value>
vif <vlan-id> <pseudo-ethernet> vif
dhcp-options reject <vif> dhcp-options reject
<address>
× set interfaces interfaces_pseudo- Nothing found in VyOS
pseudo-ethernet ethernet.xml.in:
<interface> interfaces pseudo-ethernet
vif <vlan-id> <pseudo-ethernet> vif
dhcp-options <vif> dhcp-options
user-class <string> user-class
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> dhcp-
<interface> interfaces pseudo-ethernet options vendor-class-id
vif <vlan-id> <pseudo-ethernet> vif <value>
dhcp-options <vif> dhcp-options
vendor-class-id vendor-class-id
<vendor-id>
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> dhcpv6-
<interface> interfaces pseudo-ethernet options duid <value>
vif <vlan-id> <pseudo-ethernet> vif
dhcpv6-options duid <vif> dhcpv6-options
<duid> duid
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> dhcpv6-
<interface> interfaces pseudo-ethernet options no-release
vif <vlan-id> <pseudo-ethernet> vif
dhcpv6-options <vif> dhcpv6-options
no-release no-release
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> dhcpv6-
<interface> interfaces pseudo-ethernet options parameters-only
vif <vlan-id> <pseudo-ethernet> vif
dhcpv6-options <vif> dhcpv6-options
parameters-only parameters-only
continues on next page

21.1. Configuration Commands 1519

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> dhcpv6-
<interface> interfaces pseudo-ethernet options pd <text> interface
vif <vlan-id> <pseudo-ethernet> vif <text> address <value>
dhcpv6-options <vif> dhcpv6-options pd
pd <id> interface <pd> interface <inter-
<delegatee> address face> address
<address>
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> dhcpv6-
<interface> interfaces pseudo-ethernet options pd <text> interface
vif <vlan-id> <pseudo-ethernet> vif <text> sla-id <value>
dhcpv6-options <vif> dhcpv6-options pd
pd <id> interface <pd> interface <inter-
<delegatee> sla-id face> sla-id
<id>
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> dhcpv6-
<interface> interfaces pseudo-ethernet options pd <text> length
vif <vlan-id> <pseudo-ethernet> vif <value>
dhcpv6-options <vif> dhcpv6-options pd
pd <id> length <pd> length
<length>
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> dhcpv6-
<interface> interfaces pseudo-ethernet options rapid-commit
vif <vlan-id> <pseudo-ethernet> vif
dhcpv6-options <vif> dhcpv6-options
rapid-commit rapid-commit
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> dhcpv6-
<interface> interfaces pseudo-ethernet options temporary
vif <vlan-id> <pseudo-ethernet> vif
dhcpv6-options <vif> dhcpv6-options
temporary temporary
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> disable
<interface> vif interfaces pseudo-ethernet
<vlan-id> disable <pseudo-ethernet> vif
<vif> disable
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> disable-
<interface> interfaces pseudo-ethernet link-detect
vif <vlan-id> <pseudo-ethernet> vif
disable-link-detect <vif> disable-link-detect
continues on next page

21.1. Configuration Commands 1520

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif <text> egress-
interfaces pseudo-ethernet qos <value>
<pseudo-ethernet> vif
<vif> egress-qos
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif <text> ingress-
interfaces pseudo-ethernet qos <value>
<pseudo-ethernet> vif
<vif> ingress-qos
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> ip adjust-
<interface> vif interfaces pseudo-ethernet mss <value>
<vlan-id> ip <pseudo-ethernet> vif
adjust-mss <mss | <vif> ip adjust-mss
clamp-mss-to-pmtu>
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> ip arp-
<interface> vif interfaces pseudo-ethernet cache-timeout <value>
<vlan-id> ip <pseudo-ethernet> vif
arp-cache-timeout <vif> ip arp-cache-
timeout
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> ip
<interface> vif interfaces pseudo-ethernet disable-arp-filter
<vlan-id> ip <pseudo-ethernet> vif
disable-arp-filter <vif> ip disable-arp-filter
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> ip
<interface> vif interfaces pseudo-ethernet disable-forwarding
<vlan-id> ip <pseudo-ethernet>
disable-forwarding vif <vif> ip disable-
forwarding
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> ip
<interface> vif interfaces pseudo-ethernet enable-arp-accept
<vlan-id> ip <pseudo-ethernet> vif
enable-arp-accept <vif> ip enable-arp-
accept
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> ip
<interface> vif interfaces pseudo-ethernet enable-arp-announce
<vlan-id> ip <pseudo-ethernet> vif
enable-arp-announce <vif> ip enable-arp-
announce
continues on next page

21.1. Configuration Commands 1521

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> ip
<interface> vif interfaces pseudo-ethernet enable-arp-ignore
<vlan-id> ip <pseudo-ethernet> vif
enable-arp-ignore <vif> ip enable-arp-
ignore
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> ip
<interface> vif interfaces pseudo-ethernet enable-directed-broadcast
<vlan-id> ip <pseudo-ethernet> vif
enable-directed-broadcast
<vif> ip enable-directed-
broadcast
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> ip
<interface> vif interfaces pseudo-ethernet enable-proxy-arp
<vlan-id> ip <pseudo-ethernet> vif
enable-proxy-arp <vif> ip enable-proxy-arp
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> ip proxy-
<interface> vif interfaces pseudo-ethernet arp-pvlan
<vlan-id> ip <pseudo-ethernet> vif
proxy-arp-pvlan <vif> ip proxy-arp-pvlan
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> ip
<interface> vif interfaces pseudo-ethernet source-validation <value>
<vlan-id> ip <pseudo-ethernet> vif
source-validation <vif> ip source-validation
<strict | loose |
disable>
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> ipv6
<interface> vif interfaces pseudo-ethernet accept-dad <value>
<vlan-id> ipv6 <pseudo-ethernet> vif
accept-dad <1-3> <vif> ipv6 accept-dad
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> ipv6 ad-
<interface> vif interfaces pseudo-ethernet dress autoconf
<vlan-id> ipv6 <pseudo-ethernet> vif
address autoconf <vif> ipv6 address auto-
conf
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> ipv6 ad-
<interface> vif interfaces pseudo-ethernet dress eui64 <value>
<vlan-id> ipv6 <pseudo-ethernet> vif
address eui64 <vif> ipv6 address eui64
<prefix>
continues on next page

21.1. Configuration Commands 1522

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> ipv6 ad-
<interface> interfaces pseudo-ethernet dress no-default-link-local
vif <vlan-id> <pseudo-ethernet> vif
ipv6 address <vif> ipv6 address no-
no-default-link-local default-link-local
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> ipv6
<interface> vif interfaces pseudo-ethernet adjust-mss <value>
<vlan-id> ipv6 <pseudo-ethernet> vif
adjust-mss <mss | <vif> ipv6 adjust-mss
clamp-mss-to-pmtu>
× not yet documented interfaces_pseudo- Nothing found in VyOS
ethernet.xml.in:
interfaces pseudo-ethernet
<pseudo-ethernet>
vif <vif> ipv6 base-
reachable-time
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> ipv6
<interface> vif interfaces pseudo-ethernet disable-forwarding
<vlan-id> ipv6 <pseudo-ethernet> vif
disable-forwarding <vif> ipv6 disable-
forwarding
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> ipv6
<interface> vif interfaces pseudo-ethernet dup-addr-detect-transmits
<vlan-id> ipv6 <pseudo-ethernet> vif <value>
dup-addr-detect-transmits
<vif> ipv6 dup-addr-
<n> detect-transmits
× not yet documented interfaces_pseudo- Nothing found in VyOS
ethernet.xml.in:
interfaces pseudo-ethernet
<pseudo-ethernet> vif
<vif> ipv6 source-
validation
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> mac
<interface> vif interfaces pseudo-ethernet <value>
<vlan-id> mac <pseudo-ethernet> vif
<xx:xx:xx:xx:xx:xx> <vif> mac
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif <text> mirror
interfaces pseudo-ethernet egress <value>
<pseudo-ethernet> vif
<vif> mirror egress
continues on next page

21.1. Configuration Commands 1523

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif <text> mirror
interfaces pseudo-ethernet ingress <value>
<pseudo-ethernet> vif
<vif> mirror ingress
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> mtu
<interface> vif interfaces pseudo-ethernet <value>
<vlan-id> mtu <mtu> <pseudo-ethernet> vif
<vif> mtu
× not yet documented interfaces_pseudo- interfaces pseudo-ethernet
ethernet.xml.in: <text> vif <text> redirect
interfaces pseudo-ethernet <value>
<pseudo-ethernet> vif
<vif> redirect
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vif <text> vrf
<interface> vif interfaces pseudo-ethernet <value>
<vlan-id> vrf <vrf> <pseudo-ethernet> vif
<vif> vrf
✓ set interfaces interfaces_pseudo- interfaces pseudo-ethernet
pseudo-ethernet ethernet.xml.in: <text> vrf <value>
<interface> vrf interfaces pseudo-ethernet
<vrf> <pseudo-ethernet> vrf
× not yet documented interfaces_sstpc.xml.in: interfaces sstpc <text>
interfaces sstpc <sstpc> authentication password
authentication password <value>
× not yet documented interfaces_sstpc.xml.in: interfaces sstpc <text>
interfaces sstpc <sstpc> authentication username
authentication username <value>
✓ set interfaces interfaces_sstpc.xml.in: interfaces sstpc <text>
sstpc <interface> interfaces sstpc <sstpc> default-route-distance
default-route-distance default-route-distance <value>
<distance>
✓ set interfaces interfaces_sstpc.xml.in: interfaces sstpc <text> de-
sstpc <interface> interfaces sstpc <sstpc> scription <value>
description description
<description>
✓ set interfaces sstpc interfaces_sstpc.xml.in: interfaces sstpc <text> dis-
<interface> disable interfaces sstpc <sstpc> able
disable
× set interfaces Nothing found in XML Nothing found in VyOS
sstpc <interface> Definitions
ip adjust-mss <mss |
clamp-mss-to-pmtu>
× set interfaces Nothing found in XML Nothing found in VyOS
sstpc <interface> ip Definitions
disable-forwarding
continues on next page

21.1. Configuration Commands 1524

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set interfaces Nothing found in XML Nothing found in VyOS
sstpc <interface> Definitions
ip source-validation
<strict | loose |
disable>
✓ set interfaces sstpc interfaces_sstpc.xml.in: interfaces sstpc <text> mtu
<interface> mtu interfaces sstpc <sstpc> <value>
<mtu> mtu
✓ set interfaces interfaces_sstpc.xml.in: interfaces sstpc <text> no-
sstpc <interface> interfaces sstpc <sstpc> default-route
no-default-route no-default-route
✓ set interfaces interfaces_sstpc.xml.in: interfaces sstpc <text> no-
sstpc <interface> interfaces sstpc <sstpc> peer-dns
no-peer-dns no-peer-dns
× not yet documented interfaces_sstpc.xml.in: interfaces sstpc <text>
interfaces sstpc <sstpc> port <value>
port
✓ set interfaces sstpc interfaces_sstpc.xml.in: interfaces sstpc <text>
<interface> server interfaces sstpc <sstpc> server <value>
<address> server
× not yet documented interfaces_sstpc.xml.in: interfaces sstpc <text> ssl
interfaces sstpc <sstpc> ssl ca-certificate <value>
ca-certificate
✓ set interfaces sstpc interfaces_sstpc.xml.in: interfaces sstpc <text> vrf
<interface> vrf interfaces sstpc <sstpc> <value>
<vrf> vrf
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> 6rd-prefix <value>
6rd-prefix
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> 6rd-relay-prefix <value>
6rd-relay-prefix
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text>
tunnel <interface> interfaces tunnel <tunnel> address <value>
address <address> address
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text>
tunnel <interface> interfaces tunnel <tunnel> description <value>
description description
<description>
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text>
tunnel <interface> interfaces tunnel <tunnel> disable
disable disable
× set interfaces Nothing found in XML Nothing found in VyOS
tunnel <interface> Definitions
disable-flow-control
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text>
tunnel <interface> interfaces tunnel <tunnel> disable-link-detect
disable-link-detect disable-link-detect
continues on next page

21.1. Configuration Commands 1525

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> enable-multicast
enable-multicast
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> encapsulation <value>
encapsulation
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text> ip
tunnel <interface> interfaces tunnel <tunnel> adjust-mss <value>
ip adjust-mss <mss | ip adjust-mss
clamp-mss-to-pmtu>
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text>
tunnel interfaces tunnel <tunnel> ip arp-cache-timeout
<interface> ip ip arp-cache-timeout <value>
arp-cache-timeout
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text> ip
tunnel interfaces tunnel <tunnel> disable-arp-filter
<interface> ip ip disable-arp-filter
disable-arp-filter
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text> ip
tunnel interfaces tunnel <tunnel> disable-forwarding
<interface> ip ip disable-forwarding
disable-forwarding
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text> ip
tunnel interfaces tunnel <tunnel> enable-arp-accept
<interface> ip ip enable-arp-accept
enable-arp-accept
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text> ip
tunnel interfaces tunnel <tunnel> enable-arp-announce
<interface> ip ip enable-arp-announce
enable-arp-announce
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text> ip
tunnel <interface> interfaces tunnel <tunnel> enable-arp-ignore
ip enable-arp-ignore ip enable-arp-ignore
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text> ip
tunnel interfaces tunnel <tunnel> enable-directed-broadcast
<interface> ip ip enable-directed-
enable-directed-broadcast
broadcast
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text> ip
tunnel <interface> interfaces tunnel <tunnel> enable-proxy-arp
ip enable-proxy-arp ip enable-proxy-arp
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text> ip
tunnel <interface> interfaces tunnel <tunnel> proxy-arp-pvlan
ip proxy-arp-pvlan ip proxy-arp-pvlan
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text> ip
tunnel <interface> interfaces tunnel <tunnel> source-validation <value>
ip source-validation ip source-validation
<strict | loose |
disable>
continues on next page

21.1. Configuration Commands 1526

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text>
tunnel <interface> interfaces tunnel <tunnel> ipv6 accept-dad <value>
ipv6 accept-dad ipv6 accept-dad
<1-3>
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text>
tunnel <interface> interfaces tunnel <tunnel> ipv6 address autoconf
ipv6 address ipv6 address autoconf
autoconf
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text>
tunnel <interface> interfaces tunnel <tunnel> ipv6 address eui64
ipv6 address eui64 ipv6 address eui64 <value>
<prefix>
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text>
tunnel <interface> interfaces tunnel <tunnel> ipv6 address no-default-
ipv6 address ipv6 address no-default- link-local
no-default-link-local link-local
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text>
tunnel interfaces tunnel <tunnel> ipv6 adjust-mss <value>
<interface> ipv6 ipv6 adjust-mss
adjust-mss <mss |
clamp-mss-to-pmtu>
× not yet documented interfaces_tunnel.xml.in: Nothing found in VyOS
interfaces tunnel <tunnel>
ipv6 base-reachable-time
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text>
tunnel interfaces tunnel <tunnel> ipv6 disable-forwarding
<interface> ipv6 ipv6 disable-forwarding
disable-forwarding
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text>
tunnel interfaces tunnel <tunnel> ipv6 dup-addr-detect-
<interface> ipv6 ipv6 dup-addr-detect- transmits <value>
dup-addr-detect-transmits
transmits
<n>
× not yet documented interfaces_tunnel.xml.in: Nothing found in VyOS
interfaces tunnel <tunnel>
ipv6 source-validation
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> mirror egress <value>
mirror egress
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> mirror ingress <value>
mirror ingress
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text>
tunnel <interface> interfaces tunnel <tunnel> mtu <value>
mtu <mtu> mtu
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> parameters erspan direc-
parameters erspan direc- tion <value>
tion
continues on next page

21.1. Configuration Commands 1527

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> parameters erspan hw-id
parameters erspan hw-id <value>
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> parameters erspan index
parameters erspan index <value>
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> parameters erspan version
parameters erspan version <value>
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> parameters ip ignore-df
parameters ip ignore-df
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> parameters ip key <value>
parameters ip key
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> parameters ip no-pmtu-
parameters ip no-pmtu- discovery
discovery
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> parameters ip tos <value>
parameters ip tos
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> parameters ip ttl <value>
parameters ip ttl
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tun- parameters ipv6 en-
nel> parameters ipv6 caplimit <value>
encaplimit
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> parameters ipv6 flowlabel
parameters ipv6 flowlabel <value>
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> parameters ipv6 hoplimit
parameters ipv6 hoplimit <value>
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> parameters ipv6 tclass
parameters ipv6 tclass <value>
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> redirect <value>
redirect
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> remote <value>
remote
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> source-address <value>
source-address
continues on next page

21.1. Configuration Commands 1528

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_tunnel.xml.in: interfaces tunnel <text>
interfaces tunnel <tunnel> source-interface <value>
source-interface
✓ set interfaces interfaces_tunnel.xml.in: interfaces tunnel <text>
tunnel <interface> interfaces tunnel <tunnel> vrf <value>
vrf <vrf> vrf
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> address <value>
<interface> address interfaces virtual-ethernet
<address | dhcp | <virtual-ethernet> address
dhcpv6>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> description
<interface> interfaces virtual-ethernet <value>
description <virtual-ethernet> de-
<description> scription
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> dhcp-options
interfaces virtual-ethernet client-id <value>
<virtual-ethernet> dhcp-
options client-id
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> dhcp-options
interfaces virtual-ethernet default-route-distance
<virtual-ethernet> dhcp- <value>
options default-route-
distance
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> dhcp-options host-
interfaces virtual-ethernet name <value>
<virtual-ethernet> dhcp-
options host-name
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> dhcp-options mtu
interfaces virtual-ethernet
<virtual-ethernet> dhcp-
options mtu
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> dhcp-options no-
interfaces virtual-ethernet default-route
<virtual-ethernet> dhcp-
options no-default-route
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> dhcp-options reject
interfaces virtual-ethernet <value>
<virtual-ethernet> dhcp-
options reject
continues on next page

21.1. Configuration Commands 1529

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_virtual- Nothing found in VyOS
ethernet.xml.in:
interfaces virtual-ethernet
<virtual-ethernet> dhcp-
options user-class
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> dhcp-options
interfaces virtual-ethernet vendor-class-id <value>
<virtual-ethernet> dhcp-
options vendor-class-id
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> dhcpv6-options
interfaces virtual-ethernet duid <value>
<virtual-ethernet>
dhcpv6-options duid
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> dhcpv6-options no-
interfaces virtual-ethernet release
<virtual-ethernet>
dhcpv6-options no-release
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> dhcpv6-options
interfaces virtual- parameters-only
ethernet <virtual-
ethernet> dhcpv6-options
parameters-only
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> dhcpv6-options pd
interfaces virtual-ethernet <text> interface <text> ad-
<virtual-ethernet> dress <value>
dhcpv6-options pd <pd>
interface <interface>
address
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> dhcpv6-options pd
interfaces virtual-ethernet <text> interface <text>
<virtual-ethernet> sla-id <value>
dhcpv6-options pd <pd>
interface <interface>
sla-id
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> dhcpv6-options pd
interfaces virtual-ethernet <text> length <value>
<virtual-ethernet>
dhcpv6-options pd <pd>
length
continues on next page

21.1. Configuration Commands 1530

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> dhcpv6-options
interfaces virtual-ethernet rapid-commit
<virtual-ethernet>
dhcpv6-options rapid-
commit
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> dhcpv6-options
interfaces virtual-ethernet temporary
<virtual-ethernet>
dhcpv6-options tem-
porary
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> disable
<interface> disable interfaces virtual-ethernet
<virtual-ethernet> disable
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> peer-name <value>
interfaces virtual-ethernet
<virtual-ethernet> peer-
name
× set interfaces Nothing found in XML Nothing found in VyOS
virtual-ethernet Definitions
<interface> vif
<vlan-id>
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> address
interfaces virtual-ethernet <value>
<virtual-ethernet> vif-s
<vif-s> address
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> de-
interfaces virtual-ethernet scription <value>
<virtual-ethernet> vif-s
<vif-s> description
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> dhcp-
interfaces virtual-ethernet options client-id <value>
<virtual-ethernet> vif-s
<vif-s> dhcp-options
client-id
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces virtual-ethernet dhcp-options default-
<virtual-ethernet> vif-s route-distance <value>
<vif-s> dhcp-options
default-route-distance
continues on next page

21.1. Configuration Commands 1531

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces virtual-ethernet dhcp-options host-name
<virtual-ethernet> vif-s <value>
<vif-s> dhcp-options
host-name
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> dhcp-
interfaces virtual-ethernet options mtu
<virtual-ethernet> vif-s
<vif-s> dhcp-options mtu
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> dhcp-
interfaces virtual-ethernet options no-default-route
<virtual-ethernet> vif-s
<vif-s> dhcp-options
no-default-route
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> dhcp-
interfaces virtual-ethernet options reject <value>
<virtual-ethernet> vif-s
<vif-s> dhcp-options
reject
× not yet documented interfaces_virtual- Nothing found in VyOS
ethernet.xml.in:
interfaces virtual-ethernet
<virtual-ethernet> vif-s
<vif-s> dhcp-options
user-class
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> dhcp-
interfaces virtual-ethernet options vendor-class-id
<virtual-ethernet> vif-s <value>
<vif-s> dhcp-options
vendor-class-id
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces virtual-ethernet dhcpv6-options duid
<virtual-ethernet> vif-s <value>
<vif-s> dhcpv6-options
duid
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces virtual-ethernet dhcpv6-options no-release
<virtual-ethernet> vif-s
<vif-s> dhcpv6-options
no-release
continues on next page

21.1. Configuration Commands 1532

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_virtual- interfaces virtual-
ethernet.xml.in: ethernet <text> vif-s
interfaces virtual-ethernet <text> dhcpv6-options
<virtual-ethernet> vif-s parameters-only
<vif-s> dhcpv6-options
parameters-only
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces virtual-ethernet dhcpv6-options pd <text>
<virtual-ethernet> vif-s interface <text> address
<vif-s> dhcpv6-options <value>
pd <pd> interface <inter-
face> address
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces virtual-ethernet dhcpv6-options pd <text>
<virtual-ethernet> vif-s interface <text> sla-id
<vif-s> dhcpv6-options <value>
pd <pd> interface <inter-
face> sla-id
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces virtual-ethernet dhcpv6-options pd <text>
<virtual-ethernet> vif-s length <value>
<vif-s> dhcpv6-options
pd <pd> length
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces virtual-ethernet dhcpv6-options rapid-
<virtual-ethernet> vif-s commit
<vif-s> dhcpv6-options
rapid-commit
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces virtual-ethernet dhcpv6-options tempo-
<virtual-ethernet> vif-s rary
<vif-s> dhcpv6-options
temporary
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> disable
interfaces virtual-ethernet
<virtual-ethernet> vif-s
<vif-s> disable
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text>
interfaces virtual-ethernet disable-link-detect
<virtual-ethernet> vif-s
<vif-s> disable-link-detect
continues on next page

21.1. Configuration Commands 1533

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> ip
interfaces virtual-ethernet adjust-mss <value>
<virtual-ethernet> vif-s
<vif-s> ip adjust-mss
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> ip arp-
interfaces virtual-ethernet cache-timeout <value>
<virtual-ethernet> vif-s
<vif-s> ip arp-cache-
timeout
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> ip
interfaces virtual-ethernet disable-arp-filter
<virtual-ethernet> vif-s
<vif-s> ip disable-arp-
filter
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> ip
interfaces virtual-ethernet disable-forwarding
<virtual-ethernet> vif-s
<vif-s> ip disable-
forwarding
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> ip
interfaces virtual-ethernet enable-arp-accept
<virtual-ethernet> vif-s
<vif-s> ip enable-arp-
accept
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> ip
interfaces virtual-ethernet enable-arp-announce
<virtual-ethernet> vif-s
<vif-s> ip enable-arp-
announce
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> ip
interfaces virtual-ethernet enable-arp-ignore
<virtual-ethernet> vif-s
<vif-s> ip enable-arp-
ignore
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> ip
interfaces virtual-ethernet enable-directed-broadcast
<virtual-ethernet> vif-
s <vif-s> ip enable-
directed-broadcast
continues on next page

21.1. Configuration Commands 1534

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> ip
interfaces virtual-ethernet enable-proxy-arp
<virtual-ethernet> vif-s
<vif-s> ip enable-proxy-
arp
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> ip
interfaces virtual-ethernet proxy-arp-pvlan
<virtual-ethernet> vif-s
<vif-s> ip proxy-arp-pvlan
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> ip
interfaces virtual-ethernet source-validation <value>
<virtual-ethernet> vif-
s <vif-s> ip source-
validation
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> ipv6
interfaces virtual-ethernet accept-dad <value>
<virtual-ethernet> vif-s
<vif-s> ipv6 accept-dad
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> ipv6
interfaces virtual-ethernet address autoconf
<virtual-ethernet> vif-s
<vif-s> ipv6 address
autoconf
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> ipv6
interfaces virtual-ethernet address eui64 <value>
<virtual-ethernet> vif-s
<vif-s> ipv6 address eui64
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> ipv6
interfaces virtual-ethernet address no-default-link-
<virtual-ethernet> vif-s local
<vif-s> ipv6 address
no-default-link-local
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> ipv6
interfaces virtual-ethernet adjust-mss <value>
<virtual-ethernet> vif-s
<vif-s> ipv6 adjust-mss
continues on next page

21.1. Configuration Commands 1535

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_virtual- Nothing found in VyOS
ethernet.xml.in:
interfaces virtual-ethernet
<virtual-ethernet> vif-s
<vif-s> ipv6 base-
reachable-time
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> ipv6
interfaces virtual-ethernet disable-forwarding
<virtual-ethernet> vif-s
<vif-s> ipv6 disable-
forwarding
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> ipv6
interfaces virtual-ethernet dup-addr-detect-transmits
<virtual-ethernet> vif-s <value>
<vif-s> ipv6 dup-addr-
detect-transmits
× not yet documented interfaces_virtual- Nothing found in VyOS
ethernet.xml.in:
interfaces virtual-ethernet
<virtual-ethernet> vif-s
<vif-s> ipv6 source-
validation
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> mac
interfaces virtual-ethernet <value>
<virtual-ethernet> vif-s
<vif-s> mac
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> mirror
interfaces virtual-ethernet egress <value>
<virtual-ethernet> vif-s
<vif-s> mirror egress
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> mirror
interfaces virtual-ethernet ingress <value>
<virtual-ethernet> vif-s
<vif-s> mirror ingress
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> mtu
interfaces virtual-ethernet <value>
<virtual-ethernet> vif-s
<vif-s> mtu
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> proto-
interfaces virtual-ethernet col <value>
<virtual-ethernet> vif-s
<vif-s> protocol
continues on next page

21.1. Configuration Commands 1536

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> redi-
interfaces virtual-ethernet rect <value>
<virtual-ethernet> vif-s
<vif-s> redirect
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-c
<interface> vif-s interfaces virtual-ethernet <text> address <value>
<vlan-id> vif-c <virtual-ethernet> vif-s
<vlan-id> address <vif-s> vif-c <vif-c>
<address | dhcp | address
dhcpv6>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-
<interface> interfaces virtual-ethernet c <text> description
vif-s <vlan-id> <virtual-ethernet> vif-s <value>
vif-c <vlan-id> <vif-s> vif-c <vif-c>
description description
<description>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-
<interface> interfaces virtual-ethernet c <text> dhcp-options
vif-s <vlan-id> <virtual-ethernet> vif-s client-id <value>
vif-c <vlan-id> <vif-s> vif-c <vif-c>
dhcp-options dhcp-options client-id
client-id
<description>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-
<interface> interfaces virtual-ethernet c <text> dhcp-options
vif-s <vlan-id> <virtual-ethernet> vif-s default-route-distance
vif-c <vlan-id> <vif-s> vif-c <vif-c> <value>
dhcp-options dhcp-options default-
default-route-distance route-distance
<distance>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-c
<interface> interfaces virtual-ethernet <text> dhcp-options host-
vif-s <vlan-id> <virtual-ethernet> vif-s name <value>
vif-c <vlan-id> <vif-s> vif-c <vif-c>
dhcp-options dhcp-options host-name
host-name
<hostname>
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces virtual-ethernet <text> dhcp-options mtu
<virtual-ethernet> vif-s
<vif-s> vif-c <vif-c>
dhcp-options mtu
continues on next page

21.1. Configuration Commands 1537

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-
<interface> interfaces virtual-ethernet c <text> dhcp-options no-
vif-s <vlan-id> <virtual-ethernet> vif-s default-route
vif-c <vlan-id> <vif-s> vif-c <vif-c>
dhcp-options dhcp-options no-default-
no-default-route route
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-c
<interface> interfaces virtual-ethernet <text> dhcp-options reject
vif-s <vlan-id> <virtual-ethernet> vif-s <value>
vif-c <vlan-id> <vif-s> vif-c <vif-c>
dhcp-options reject dhcp-options reject
<address>
× set interfaces interfaces_virtual- Nothing found in VyOS
virtual-ethernet ethernet.xml.in:
<interface> interfaces virtual-ethernet
vif-s <vlan-id> <virtual-ethernet> vif-s
vif-c <vlan-id> <vif-s> vif-c <vif-c>
dhcp-options dhcp-options user-class
user-class <string>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-
<interface> interfaces virtual-ethernet c <text> dhcp-options
vif-s <vlan-id> <virtual-ethernet> vif-s vendor-class-id <value>
vif-c <vlan-id> <vif-s> vif-c <vif-c>
dhcp-options dhcp-options vendor-
vendor-class-id class-id
<vendor-id>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-
<interface> interfaces virtual-ethernet c <text> dhcpv6-options
vif-s <vlan-id> <virtual-ethernet> vif-s duid <value>
vif-c <vlan-id> <vif-s> vif-c <vif-c>
dhcpv6-options duid dhcpv6-options duid
<duid>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-c
<interface> interfaces virtual-ethernet <text> dhcpv6-options no-
vif-s <vlan-id> <virtual-ethernet> vif-s release
vif-c <vlan-id> <vif-s> vif-c <vif-c>
dhcpv6-options dhcpv6-options no-release
no-release
continues on next page

21.1. Configuration Commands 1538

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-
<interface> interfaces virtual-ethernet c <text> dhcpv6-options
vif-s <vlan-id> <virtual-ethernet> vif-s parameters-only
vif-c <vlan-id> <vif-s> vif-c <vif-
dhcpv6-options c> dhcpv6-options
parameters-only parameters-only
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-c
<interface> interfaces virtual-ethernet <text> dhcpv6-options pd
vif-s <vlan-id> <virtual-ethernet> vif-s <text> interface <text> ad-
vif-c <vlan-id> <vif-s> vif-c <vif-c> dress <value>
dhcpv6-options dhcpv6-options pd <pd>
pd <id> interface interface <interface>
<delegatee> address address
<address>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-
<interface> interfaces virtual-ethernet c <text> dhcpv6-options
vif-s <vlan-id> <virtual-ethernet> vif-s pd <text> interface <text>
vif-c <vlan-id> <vif-s> vif-c <vif-c> sla-id <value>
dhcpv6-options dhcpv6-options pd <pd>
pd <id> interface interface <interface>
<delegatee> sla-id sla-id
<id>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-c
<interface> interfaces virtual-ethernet <text> dhcpv6-options pd
vif-s <vlan-id> <virtual-ethernet> vif-s <text> length <value>
vif-c <vlan-id> <vif-s> vif-c <vif-c>
dhcpv6-options dhcpv6-options pd <pd>
pd <id> length length
<length>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-
<interface> interfaces virtual-ethernet c <text> dhcpv6-options
vif-s <vlan-id> <virtual-ethernet> vif-s rapid-commit
vif-c <vlan-id> <vif-s> vif-c <vif-c>
dhcpv6-options dhcpv6-options rapid-
rapid-commit commit
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-
<interface> interfaces virtual-ethernet c <text> dhcpv6-options
vif-s <vlan-id> <virtual-ethernet> vif- temporary
vif-c <vlan-id> s <vif-s> vif-c <vif-c>
dhcpv6-options dhcpv6-options temporary
temporary
continues on next page

21.1. Configuration Commands 1539

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-c
<interface> vif-s interfaces virtual-ethernet <text> disable
<vlan-id> vif-c <virtual-ethernet> vif-s
<vlan-id> disable <vif-s> vif-c <vif-c>
disable
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-c
<interface> interfaces virtual-ethernet <text> disable-link-detect
vif-s <vlan-id> <virtual-ethernet> vif-s
vif-c <vlan-id> <vif-s> vif-c <vif-c>
disable-link-detect disable-link-detect
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-c
<interface> vif-s interfaces virtual-ethernet <text> ip adjust-mss
<vlan-id> vif-c <virtual-ethernet> vif-s <value>
<vlan-id> ip <vif-s> vif-c <vif-c> ip
adjust-mss <mss | adjust-mss
clamp-mss-to-pmtu>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-c
<interface> vif-s interfaces virtual-ethernet <text> ip arp-cache-
<vlan-id> vif-c <virtual-ethernet> vif-s timeout <value>
<vlan-id> ip <vif-s> vif-c <vif-c> ip
arp-cache-timeout arp-cache-timeout
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-c
<interface> vif-s interfaces virtual-ethernet <text> ip disable-arp-filter
<vlan-id> vif-c <virtual-ethernet> vif-s
<vlan-id> ip <vif-s> vif-c <vif-c> ip
disable-arp-filter disable-arp-filter
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text>
<interface> vif-s interfaces virtual-ethernet vif-c <text> ip disable-
<vlan-id> vif-c <virtual-ethernet> vif-s forwarding
<vlan-id> ip <vif-s> vif-c <vif-c> ip
disable-forwarding disable-forwarding
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-
<interface> vif-s interfaces virtual-ethernet c <text> ip enable-arp-
<vlan-id> vif-c <virtual-ethernet> vif-s accept
<vlan-id> ip <vif-s> vif-c <vif-c> ip
enable-arp-accept enable-arp-accept
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-
<interface> vif-s interfaces virtual-ethernet c <text> ip enable-arp-
<vlan-id> vif-c <virtual-ethernet> vif-s announce
<vlan-id> ip <vif-s> vif-c <vif-c> ip
enable-arp-announce enable-arp-announce
continues on next page

21.1. Configuration Commands 1540

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-
<interface> vif-s interfaces virtual-ethernet c <text> ip enable-arp-
<vlan-id> vif-c <virtual-ethernet> vif-s ignore
<vlan-id> ip <vif-s> vif-c <vif-c> ip
enable-arp-ignore enable-arp-ignore
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-c
<interface> vif-s interfaces virtual-ethernet <text> ip enable-directed-
<vlan-id> vif-c <virtual-ethernet> vif-s broadcast
<vlan-id> ip <vif-s> vif-c <vif-c> ip
enable-directed-broadcast
enable-directed-broadcast
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-
<interface> vif-s interfaces virtual-ethernet c <text> ip enable-proxy-
<vlan-id> vif-c <virtual-ethernet> vif-s arp
<vlan-id> ip <vif-s> vif-c <vif-c> ip
enable-proxy-arp enable-proxy-arp
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-c
<interface> vif-s interfaces virtual-ethernet <text> ip proxy-arp-pvlan
<vlan-id> vif-c <virtual-ethernet> vif-s
<vlan-id> ip <vif-s> vif-c <vif-c> ip
proxy-arp-pvlan proxy-arp-pvlan
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text>
<interface> vif-s interfaces virtual-ethernet vif-c <text> ip source-
<vlan-id> vif-c <virtual-ethernet> vif-s validation <value>
<vlan-id> ip <vif-s> vif-c <vif-c> ip
source-validation source-validation
<strict | loose |
disable>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-
<interface> vif-s interfaces virtual-ethernet c <text> ipv6 accept-dad
<vlan-id> vif-c <virtual-ethernet> vif-s <value>
<vlan-id> ipv6 <vif-s> vif-c <vif-c> ipv6
accept-dad <1-3> accept-dad
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-c
<interface> vif-s interfaces virtual-ethernet <text> ipv6 address auto-
<vlan-id> vif-c <virtual-ethernet> vif-s conf
<vlan-id> ipv6 <vif-s> vif-c <vif-c> ipv6
address autoconf address autoconf
continues on next page

21.1. Configuration Commands 1541

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-c
<interface> vif-s interfaces virtual-ethernet <text> ipv6 address eui64
<vlan-id> vif-c <virtual-ethernet> vif-s <value>
<vlan-id> ipv6 <vif-s> vif-c <vif-c> ipv6
address eui64 address eui64
<prefix>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-c
<interface> interfaces virtual-ethernet <text> ipv6 address no-
vif-s <vlan-id> <virtual-ethernet> vif-s default-link-local
vif-c <vlan-id> <vif-s> vif-c <vif-c> ipv6
ipv6 address address no-default-link-
no-default-link-local local
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-
<interface> vif-s interfaces virtual-ethernet c <text> ipv6 adjust-mss
<vlan-id> vif-c <virtual-ethernet> vif-s <value>
<vlan-id> ipv6 <vif-s> vif-c <vif-c> ipv6
adjust-mss <mss | adjust-mss
clamp-mss-to-pmtu>
× not yet documented interfaces_virtual- Nothing found in VyOS
ethernet.xml.in:
interfaces virtual-ethernet
<virtual-ethernet> vif-s
<vif-s> vif-c <vif-c> ipv6
base-reachable-time
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-c
<interface> vif-s interfaces virtual-ethernet <text> ipv6 disable-
<vlan-id> vif-c <virtual-ethernet> vif-s forwarding
<vlan-id> ipv6 <vif-s> vif-c <vif-c> ipv6
disable-forwarding disable-forwarding
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-
<interface> vif-s interfaces virtual-ethernet c <text> ipv6 dup-addr-
<vlan-id> vif-c <virtual-ethernet> vif-s detect-transmits <value>
<vlan-id> ipv6 <vif-s> vif-c <vif-c> ipv6
dup-addr-detect-transmits
dup-addr-detect-transmits
<n>
× not yet documented interfaces_virtual- Nothing found in VyOS
ethernet.xml.in:
interfaces virtual-ethernet
<virtual-ethernet> vif-s
<vif-s> vif-c <vif-c> ipv6
source-validation
continues on next page

21.1. Configuration Commands 1542

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-c
<interface> vif-s interfaces virtual-ethernet <text> mac <value>
<vlan-id> vif-c <virtual-ethernet> vif-s
<vlan-id> mac <vif-s> vif-c <vif-c> mac
<xx:xx:xx:xx:xx:xx>
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces virtual-ethernet <text> mirror egress
<virtual-ethernet> vif-s <value>
<vif-s> vif-c <vif-c>
mirror egress
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> vif-
interfaces virtual-ethernet c <text> mirror ingress
<virtual-ethernet> vif-s <value>
<vif-s> vif-c <vif-c>
mirror ingress
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-c
<interface> vif-s interfaces virtual-ethernet <text> mtu <value>
<vlan-id> vif-c <virtual-ethernet> vif-s
<vlan-id> mtu <mtu> <vif-s> vif-c <vif-c> mtu
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> vif-c
interfaces virtual-ethernet <text> redirect <value>
<virtual-ethernet> vif-s
<vif-s> vif-c <vif-c>
redirect
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif-s <text> vif-c
<interface> vif-s interfaces virtual-ethernet <text> vrf <value>
<vlan-id> vif-c <virtual-ethernet> vif-s
<vlan-id> vrf <vrf> <vif-s> vif-c <vif-c> vrf
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif-s <text> vrf
interfaces virtual-ethernet <value>
<virtual-ethernet> vif-s
<vif-s> vrf
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> address
<interface> vif interfaces virtual-ethernet <value>
<vlan-id> address <virtual-ethernet> vif
<address | dhcp | <vif> address
dhcpv6>
continues on next page

21.1. Configuration Commands 1543

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> descrip-
<interface> interfaces virtual-ethernet tion <value>
vif <vlan-id> <virtual-ethernet> vif
description <vif> description
<description>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> dhcp-
<interface> interfaces virtual-ethernet options client-id <value>
vif <vlan-id> <virtual-ethernet> vif
dhcp-options <vif> dhcp-options
client-id client-id
<description>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> dhcp-
<interface> interfaces virtual-ethernet options default-route-
vif <vlan-id> <virtual-ethernet> vif distance <value>
dhcp-options <vif> dhcp-options
default-route-distance default-route-distance
<distance>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> dhcp-
<interface> interfaces virtual-ethernet options host-name
vif <vlan-id> <virtual-ethernet> vif <value>
dhcp-options <vif> dhcp-options
host-name host-name
<hostname>
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif <text> dhcp-
interfaces virtual-ethernet options mtu
<virtual-ethernet> vif
<vif> dhcp-options mtu
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> dhcp-
<interface> interfaces virtual-ethernet options no-default-route
vif <vlan-id> <virtual-ethernet> vif
dhcp-options <vif> dhcp-options
no-default-route no-default-route
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> dhcp-
<interface> interfaces virtual-ethernet options reject <value>
vif <vlan-id> <virtual-ethernet> vif
dhcp-options reject <vif> dhcp-options reject
<address>
continues on next page

21.1. Configuration Commands 1544

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set interfaces interfaces_virtual- Nothing found in VyOS
virtual-ethernet ethernet.xml.in:
<interface> interfaces virtual-ethernet
vif <vlan-id> <virtual-ethernet> vif
dhcp-options <vif> dhcp-options
user-class <string> user-class
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> dhcp-
<interface> interfaces virtual-ethernet options vendor-class-id
vif <vlan-id> <virtual-ethernet> vif <value>
dhcp-options <vif> dhcp-options
vendor-class-id vendor-class-id
<vendor-id>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> dhcpv6-
<interface> interfaces virtual-ethernet options duid <value>
vif <vlan-id> <virtual-ethernet> vif
dhcpv6-options duid <vif> dhcpv6-options
<duid> duid
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> dhcpv6-
<interface> interfaces virtual-ethernet options no-release
vif <vlan-id> <virtual-ethernet> vif
dhcpv6-options <vif> dhcpv6-options
no-release no-release
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> dhcpv6-
<interface> interfaces virtual-ethernet options parameters-only
vif <vlan-id> <virtual-ethernet> vif
dhcpv6-options <vif> dhcpv6-options
parameters-only parameters-only
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> dhcpv6-
<interface> interfaces virtual-ethernet options pd <text> interface
vif <vlan-id> <virtual-ethernet> vif <text> address <value>
dhcpv6-options <vif> dhcpv6-options pd
pd <id> interface <pd> interface <inter-
<delegatee> address face> address
<address>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> dhcpv6-
<interface> interfaces virtual-ethernet options pd <text> interface
vif <vlan-id> <virtual-ethernet> vif <text> sla-id <value>
dhcpv6-options <vif> dhcpv6-options pd
pd <id> interface <pd> interface <inter-
<delegatee> sla-id face> sla-id
<id>
continues on next page

21.1. Configuration Commands 1545

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> dhcpv6-
<interface> interfaces virtual-ethernet options pd <text> length
vif <vlan-id> <virtual-ethernet> vif <value>
dhcpv6-options <vif> dhcpv6-options pd
pd <id> length <pd> length
<length>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> dhcpv6-
<interface> interfaces virtual-ethernet options rapid-commit
vif <vlan-id> <virtual-ethernet> vif
dhcpv6-options <vif> dhcpv6-options
rapid-commit rapid-commit
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> dhcpv6-
<interface> interfaces virtual-ethernet options temporary
vif <vlan-id> <virtual-ethernet> vif
dhcpv6-options <vif> dhcpv6-options
temporary temporary
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> disable
<interface> vif interfaces virtual-ethernet
<vlan-id> disable <virtual-ethernet> vif
<vif> disable
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> disable-
<interface> interfaces virtual-ethernet link-detect
vif <vlan-id> <virtual-ethernet> vif
disable-link-detect <vif> disable-link-detect
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif <text> egress-
interfaces virtual-ethernet qos <value>
<virtual-ethernet> vif
<vif> egress-qos
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif <text> ingress-
interfaces virtual-ethernet qos <value>
<virtual-ethernet> vif
<vif> ingress-qos
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> ip adjust-
<interface> vif interfaces virtual-ethernet mss <value>
<vlan-id> ip <virtual-ethernet> vif
adjust-mss <mss | <vif> ip adjust-mss
clamp-mss-to-pmtu>
continues on next page

21.1. Configuration Commands 1546

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> ip arp-
<interface> vif interfaces virtual-ethernet cache-timeout <value>
<vlan-id> ip <virtual-ethernet> vif
arp-cache-timeout <vif> ip arp-cache-
timeout
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> ip
<interface> vif interfaces virtual-ethernet disable-arp-filter
<vlan-id> ip <virtual-ethernet> vif
disable-arp-filter <vif> ip disable-arp-filter
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> ip
<interface> vif interfaces virtual-ethernet disable-forwarding
<vlan-id> ip <virtual-ethernet>
disable-forwarding vif <vif> ip disable-
forwarding
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> ip
<interface> vif interfaces virtual-ethernet enable-arp-accept
<vlan-id> ip <virtual-ethernet> vif
enable-arp-accept <vif> ip enable-arp-
accept
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> ip
<interface> vif interfaces virtual-ethernet enable-arp-announce
<vlan-id> ip <virtual-ethernet> vif
enable-arp-announce <vif> ip enable-arp-
announce
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> ip
<interface> vif interfaces virtual-ethernet enable-arp-ignore
<vlan-id> ip <virtual-ethernet> vif
enable-arp-ignore <vif> ip enable-arp-
ignore
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> ip
<interface> vif interfaces virtual-ethernet enable-directed-broadcast
<vlan-id> ip <virtual-ethernet> vif
enable-directed-broadcast
<vif> ip enable-directed-
broadcast
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> ip
<interface> vif interfaces virtual-ethernet enable-proxy-arp
<vlan-id> ip <virtual-ethernet> vif
enable-proxy-arp <vif> ip enable-proxy-arp
continues on next page

21.1. Configuration Commands 1547

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> ip proxy-
<interface> vif interfaces virtual-ethernet arp-pvlan
<vlan-id> ip <virtual-ethernet> vif
proxy-arp-pvlan <vif> ip proxy-arp-pvlan
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> ip
<interface> vif interfaces virtual-ethernet source-validation <value>
<vlan-id> ip <virtual-ethernet> vif
source-validation <vif> ip source-validation
<strict | loose |
disable>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> ipv6
<interface> vif interfaces virtual-ethernet accept-dad <value>
<vlan-id> ipv6 <virtual-ethernet> vif
accept-dad <1-3> <vif> ipv6 accept-dad
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> ipv6 ad-
<interface> vif interfaces virtual-ethernet dress autoconf
<vlan-id> ipv6 <virtual-ethernet> vif
address autoconf <vif> ipv6 address auto-
conf
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> ipv6 ad-
<interface> vif interfaces virtual-ethernet dress eui64 <value>
<vlan-id> ipv6 <virtual-ethernet> vif
address eui64 <vif> ipv6 address eui64
<prefix>
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> ipv6 ad-
<interface> interfaces virtual-ethernet dress no-default-link-local
vif <vlan-id> <virtual-ethernet> vif
ipv6 address <vif> ipv6 address no-
no-default-link-local default-link-local
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> ipv6
<interface> vif interfaces virtual-ethernet adjust-mss <value>
<vlan-id> ipv6 <virtual-ethernet> vif
adjust-mss <mss | <vif> ipv6 adjust-mss
clamp-mss-to-pmtu>
× not yet documented interfaces_virtual- Nothing found in VyOS
ethernet.xml.in:
interfaces virtual-ethernet
<virtual-ethernet>
vif <vif> ipv6 base-
reachable-time
continues on next page

21.1. Configuration Commands 1548

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> ipv6
<interface> vif interfaces virtual-ethernet disable-forwarding
<vlan-id> ipv6 <virtual-ethernet> vif
disable-forwarding <vif> ipv6 disable-
forwarding
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> ipv6
<interface> vif interfaces virtual-ethernet dup-addr-detect-transmits
<vlan-id> ipv6 <virtual-ethernet> vif <value>
dup-addr-detect-transmits
<vif> ipv6 dup-addr-
<n> detect-transmits
× not yet documented interfaces_virtual- Nothing found in VyOS
ethernet.xml.in:
interfaces virtual-ethernet
<virtual-ethernet> vif
<vif> ipv6 source-
validation
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> mac
<interface> vif interfaces virtual-ethernet <value>
<vlan-id> mac <virtual-ethernet> vif
<xx:xx:xx:xx:xx:xx> <vif> mac
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif <text> mirror
interfaces virtual-ethernet egress <value>
<virtual-ethernet> vif
<vif> mirror egress
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif <text> mirror
interfaces virtual-ethernet ingress <value>
<virtual-ethernet> vif
<vif> mirror ingress
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> mtu
<interface> vif interfaces virtual-ethernet <value>
<vlan-id> mtu <mtu> <virtual-ethernet> vif
<vif> mtu
× not yet documented interfaces_virtual- interfaces virtual-ethernet
ethernet.xml.in: <text> vif <text> redirect
interfaces virtual-ethernet <value>
<virtual-ethernet> vif
<vif> redirect
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vif <text> vrf
<interface> vif interfaces virtual-ethernet <value>
<vlan-id> vrf <vrf> <virtual-ethernet> vif
<vif> vrf
continues on next page

21.1. Configuration Commands 1549

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_virtual- interfaces virtual-ethernet
virtual-ethernet ethernet.xml.in: <text> vrf <value>
<interface> vrf interfaces virtual-ethernet
<vrf> <virtual-ethernet> vrf
× set interfaces Nothing found in XML Nothing found in VyOS
<dummy | ethernet Definitions
| bonding | bridge |
pppoe> <interface>
vrf <name>
× not yet documented interfaces_vti.xml.in: interfaces vti <text> ad-
interfaces vti <vti> ad- dress <value>
dress
× not yet documented interfaces_vti.xml.in: interfaces vti <text> de-
interfaces vti <vti> de- scription <value>
scription
× not yet documented interfaces_vti.xml.in: interfaces vti <text> dis-
interfaces vti <vti> disable able
× not yet documented interfaces_vti.xml.in: interfaces vti <text> ip
interfaces vti <vti> ip adjust-mss <value>
adjust-mss
× not yet documented interfaces_vti.xml.in: interfaces vti <text>
interfaces vti <vti> ip arp- ip arp-cache-timeout
cache-timeout <value>
× not yet documented interfaces_vti.xml.in: interfaces vti <text> ip
interfaces vti <vti> ip disable-arp-filter
disable-arp-filter
× not yet documented interfaces_vti.xml.in: interfaces vti <text> ip
interfaces vti <vti> ip disable-forwarding
disable-forwarding
× not yet documented interfaces_vti.xml.in: interfaces vti <text> ip
interfaces vti <vti> ip enable-arp-accept
enable-arp-accept
× not yet documented interfaces_vti.xml.in: interfaces vti <text> ip
interfaces vti <vti> ip enable-arp-announce
enable-arp-announce
× not yet documented interfaces_vti.xml.in: interfaces vti <text> ip
interfaces vti <vti> ip enable-arp-ignore
enable-arp-ignore
× not yet documented interfaces_vti.xml.in: interfaces vti <text> ip
interfaces vti <vti> ip enable-directed-broadcast
enable-directed-broadcast
× not yet documented interfaces_vti.xml.in: interfaces vti <text> ip
interfaces vti <vti> ip enable-proxy-arp
enable-proxy-arp
× not yet documented interfaces_vti.xml.in: interfaces vti <text> ip
interfaces vti <vti> ip proxy-arp-pvlan
proxy-arp-pvlan
continues on next page

21.1. Configuration Commands 1550

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_vti.xml.in: interfaces vti <text> ip
interfaces vti <vti> ip source-validation <value>
source-validation
× not yet documented interfaces_vti.xml.in: interfaces vti <text> ipv6
interfaces vti <vti> ipv6 accept-dad <value>
accept-dad
× not yet documented interfaces_vti.xml.in: interfaces vti <text> ipv6
interfaces vti <vti> ipv6 address autoconf
address autoconf
× not yet documented interfaces_vti.xml.in: interfaces vti <text> ipv6
interfaces vti <vti> ipv6 address eui64 <value>
address eui64
× not yet documented interfaces_vti.xml.in: interfaces vti <text> ipv6
interfaces vti <vti> ipv6 address no-default-link-
address no-default-link- local
local
× not yet documented interfaces_vti.xml.in: interfaces vti <text> ipv6
interfaces vti <vti> ipv6 adjust-mss <value>
adjust-mss
× not yet documented interfaces_vti.xml.in: Nothing found in VyOS
interfaces vti <vti> ipv6
base-reachable-time
× not yet documented interfaces_vti.xml.in: interfaces vti <text> ipv6
interfaces vti <vti> ipv6 disable-forwarding
disable-forwarding
× not yet documented interfaces_vti.xml.in: interfaces vti <text> ipv6
interfaces vti <vti> ipv6 dup-addr-detect-transmits
dup-addr-detect-transmits <value>
× not yet documented interfaces_vti.xml.in: Nothing found in VyOS
interfaces vti <vti> ipv6
source-validation
× not yet documented interfaces_vti.xml.in: interfaces vti <text> mir-
interfaces vti <vti> mirror ror egress <value>
egress
× not yet documented interfaces_vti.xml.in: interfaces vti <text> mir-
interfaces vti <vti> mirror ror ingress <value>
ingress
× not yet documented interfaces_vti.xml.in: interfaces vti <text> mtu
interfaces vti <vti> mtu <value>
× not yet documented interfaces_vti.xml.in: interfaces vti <text> redi-
interfaces vti <vti> redi- rect <value>
rect
× not yet documented interfaces_vti.xml.in: interfaces vti <text> vrf
interfaces vti <vti> vrf <value>
✓ set interfaces vxlan interfaces_vxlan.xml.in: interfaces vxlan <text> ad-
<interface> address interfaces vxlan <vxlan> dress <value>
<address> address
continues on next page

21.1. Configuration Commands 1551

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_vxlan.xml.in: interfaces vxlan <text> de-
vxlan <interface> interfaces vxlan <vxlan> scription <value>
description description
<description>
✓ set interfaces vxlan interfaces_vxlan.xml.in: interfaces vxlan <text>
<interface> disable interfaces vxlan <vxlan> disable
disable
× set interfaces Nothing found in XML Nothing found in VyOS
vxlan <interface> Definitions
disable-flow-control
× set interfaces Nothing found in XML Nothing found in VyOS
vxlan <interface> Definitions
disable-link-detect
× not yet documented Nothing found in XML interfaces vxlan <text> ex-
Definitions ternal
✓ set interfaces vxlan interfaces_vxlan.xml.in: interfaces vxlan <text>
<interface> gpe interfaces vxlan <vxlan> gpe
gpe
✓ set interfaces vxlan interfaces_vxlan.xml.in: interfaces vxlan <text>
<interface> group interfaces vxlan <vxlan> group <value>
<address> group
✓ set interfaces interfaces_vxlan.xml.in: interfaces vxlan <text> ip
vxlan <interface> interfaces vxlan <vxlan> adjust-mss <value>
ip adjust-mss <mss | ip adjust-mss
clamp-mss-to-pmtu>
✓ set interfaces interfaces_vxlan.xml.in: interfaces vxlan <text>
vxlan <interface> ip interfaces vxlan <vxlan> ip arp-cache-timeout
arp-cache-timeout ip arp-cache-timeout <value>
✓ set interfaces interfaces_vxlan.xml.in: interfaces vxlan <text> ip
vxlan <interface> ip interfaces vxlan <vxlan> disable-arp-filter
disable-arp-filter ip disable-arp-filter
✓ set interfaces interfaces_vxlan.xml.in: interfaces vxlan <text> ip
vxlan <interface> ip interfaces vxlan <vxlan> disable-forwarding
disable-forwarding ip disable-forwarding
✓ set interfaces interfaces_vxlan.xml.in: interfaces vxlan <text> ip
vxlan <interface> ip interfaces vxlan <vxlan> enable-arp-accept
enable-arp-accept ip enable-arp-accept
✓ set interfaces interfaces_vxlan.xml.in: interfaces vxlan <text> ip
vxlan <interface> ip interfaces vxlan <vxlan> enable-arp-announce
enable-arp-announce ip enable-arp-announce
✓ set interfaces interfaces_vxlan.xml.in: interfaces vxlan <text> ip
vxlan <interface> interfaces vxlan <vxlan> enable-arp-ignore
ip enable-arp-ignore ip enable-arp-ignore
✓ set interfaces interfaces_vxlan.xml.in: interfaces vxlan <text> ip
vxlan <interface> ip interfaces vxlan <vxlan> enable-directed-broadcast
enable-directed-broadcast
ip enable-directed-
broadcast
continues on next page

21.1. Configuration Commands 1552

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_vxlan.xml.in: interfaces vxlan <text> ip
vxlan <interface> interfaces vxlan <vxlan> enable-proxy-arp
ip enable-proxy-arp ip enable-proxy-arp
✓ set interfaces interfaces_vxlan.xml.in: interfaces vxlan <text> ip
vxlan <interface> interfaces vxlan <vxlan> proxy-arp-pvlan
ip proxy-arp-pvlan ip proxy-arp-pvlan
✓ set interfaces interfaces_vxlan.xml.in: interfaces vxlan <text> ip
vxlan <interface> interfaces vxlan <vxlan> source-validation <value>
ip source-validation ip source-validation
<strict | loose |
disable>
✓ set interfaces vxlan interfaces_vxlan.xml.in: interfaces vxlan <text>
<interface> ipv6 interfaces vxlan <vxlan> ipv6 accept-dad <value>
accept-dad <1-3> ipv6 accept-dad
✓ set interfaces vxlan interfaces_vxlan.xml.in: interfaces vxlan <text>
<interface> ipv6 interfaces vxlan <vxlan> ipv6 address autoconf
address autoconf ipv6 address autoconf
✓ set interfaces interfaces_vxlan.xml.in: interfaces vxlan <text>
vxlan <interface> interfaces vxlan <vxlan> ipv6 address eui64
ipv6 address eui64 ipv6 address eui64 <value>
<prefix>
✓ set interfaces interfaces_vxlan.xml.in: interfaces vxlan <text>
vxlan <interface> interfaces vxlan <vxlan> ipv6 address no-default-
ipv6 address ipv6 address no-default- link-local
no-default-link-local link-local
✓ set interfaces vxlan interfaces_vxlan.xml.in: interfaces vxlan <text>
<interface> ipv6 interfaces vxlan <vxlan> ipv6 adjust-mss <value>
adjust-mss <mss | ipv6 adjust-mss
clamp-mss-to-pmtu>
× not yet documented interfaces_vxlan.xml.in: Nothing found in VyOS
interfaces vxlan <vxlan>
ipv6 base-reachable-time
✓ set interfaces vxlan interfaces_vxlan.xml.in: interfaces vxlan <text>
<interface> ipv6 interfaces vxlan <vxlan> ipv6 disable-forwarding
disable-forwarding ipv6 disable-forwarding
✓ set interfaces vxlan interfaces_vxlan.xml.in: interfaces vxlan <text>
<interface> ipv6 interfaces vxlan <vxlan> ipv6 dup-addr-detect-
dup-addr-detect-transmits
ipv6 dup-addr-detect- transmits <value>
<n> transmits
× not yet documented interfaces_vxlan.xml.in: Nothing found in VyOS
interfaces vxlan <vxlan>
ipv6 source-validation
✓ set interfaces vxlan interfaces_vxlan.xml.in: interfaces vxlan <text>
<interface> mac interfaces vxlan <vxlan> mac <value>
<xx:xx:xx:xx:xx:xx> mac
× not yet documented interfaces_vxlan.xml.in: interfaces vxlan <text>
interfaces vxlan <vxlan> mirror egress <value>
mirror egress
continues on next page

21.1. Configuration Commands 1553

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented interfaces_vxlan.xml.in: interfaces vxlan <text>
interfaces vxlan <vxlan> mirror ingress <value>
mirror ingress
✓ set interfaces vxlan interfaces_vxlan.xml.in: interfaces vxlan <text>
<interface> mtu interfaces vxlan <vxlan> mtu <value>
<mtu> mtu
× set interfaces interfaces_vxlan.xml.in: Nothing found in VyOS
vxlan <interface> interfaces vxlan <vxlan>
parameters external parameters external
× not yet documented interfaces_vxlan.xml.in: interfaces vxlan <text> pa-
interfaces vxlan <vxlan> rameters ip df <value>
parameters ip df
× not yet documented interfaces_vxlan.xml.in: interfaces vxlan <text> pa-
interfaces vxlan <vxlan> rameters ip tos <value>
parameters ip tos
× not yet documented interfaces_vxlan.xml.in: interfaces vxlan <text> pa-
interfaces vxlan <vxlan> rameters ip ttl <value>
parameters ip ttl
× not yet documented interfaces_vxlan.xml.in: interfaces vxlan <text>
interfaces vxlan <vxlan> parameters ipv6 flowlabel
parameters ipv6 flowlabel <value>
× set interfaces interfaces_vxlan.xml.in: Nothing found in VyOS
vxlan <interface> interfaces vxlan <vxlan>
parameters parameters neighbor-
neighbor-suppress suppress
✓ set interfaces interfaces_vxlan.xml.in: interfaces vxlan <text> pa-
vxlan <interface> interfaces vxlan <vxlan> rameters nolearning
parameters parameters nolearning
nolearning
× set interfaces interfaces_vxlan.xml.in: Nothing found in VyOS
vxlan <interface> interfaces vxlan <vxlan>
parameters parameters vni-filter
vni-filter
✓ set interfaces vxlan interfaces_vxlan.xml.in: interfaces vxlan <text>
<interface> port interfaces vxlan <vxlan> port <value>
<port> port
× not yet documented interfaces_vxlan.xml.in: interfaces vxlan <text>
interfaces vxlan <vxlan> redirect <value>
redirect
✓ set interfaces vxlan interfaces_vxlan.xml.in: interfaces vxlan <text> re-
<interface> remote interfaces vxlan <vxlan> mote <value>
<address> remote
✓ set interfaces interfaces_vxlan.xml.in: interfaces vxlan <text>
vxlan <interface> interfaces vxlan <vxlan> source-address <value>
source-address source-address
<interface>
continues on next page

21.1. Configuration Commands 1554

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_vxlan.xml.in: interfaces vxlan <text>
vxlan <interface> interfaces vxlan <vxlan> source-interface <value>
source-interface source-interface
<interface>
× set interfaces interfaces_vxlan.xml.in: Nothing found in VyOS
vxlan <interface> interfaces vxlan <vxlan>
vlan-to-vni <vlan> vlan-to-vni <vlan-to-vni>
vni <vni> vni
✓ set interfaces vxlan interfaces_vxlan.xml.in: interfaces vxlan <text> vni
<interface> vni interfaces vxlan <vxlan> <value>
<number> vni
✓ set interfaces vxlan interfaces_vxlan.xml.in: interfaces vxlan <text> vrf
<interface> vrf interfaces vxlan <vxlan> <value>
<vrf> vrf
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> address <value>
interfaces wireguard
<wireguard> address
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> description
interfaces wireguard <value>
<wireguard> description
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> disable
interfaces wireguard
<wireguard> disable
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> fwmark <value>
interfaces wireguard
<wireguard> fwmark
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> ip adjust-mss
interfaces wireguard <value>
<wireguard> ip adjust-
mss
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> ip arp-cache-
interfaces wireguard timeout <value>
<wireguard> ip arp-
cache-timeout
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> ip disable-arp-filter
interfaces wireguard
<wireguard> ip disable-
arp-filter
continues on next page

21.1. Configuration Commands 1555

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> ip disable-
interfaces wireguard forwarding
<wireguard> ip disable-
forwarding
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> ip enable-arp-
interfaces wireguard accept
<wireguard> ip enable-
arp-accept
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> ip enable-arp-
interfaces wireguard announce
<wireguard> ip enable-
arp-announce
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> ip enable-arp-
interfaces wireguard ignore
<wireguard> ip enable-
arp-ignore
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> ip enable-directed-
interfaces wireguard broadcast
<wireguard> ip enable-
directed-broadcast
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> ip enable-proxy-
interfaces wireguard arp
<wireguard> ip enable-
proxy-arp
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> ip proxy-arp-pvlan
interfaces wireguard
<wireguard> ip proxy-
arp-pvlan
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> ip source-
interfaces wireguard validation <value>
<wireguard> ip source-
validation
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> ipv6 accept-dad
interfaces wireguard <value>
<wireguard> ipv6 accept-
dad
continues on next page

21.1. Configuration Commands 1556

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> ipv6 address
interfaces wireguard autoconf
<wireguard> ipv6 address
autoconf
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> ipv6 address eui64
interfaces wireguard <value>
<wireguard> ipv6 address
eui64
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> ipv6 address
interfaces wireguard no-default-link-local
<wireguard> ipv6 address
no-default-link-local
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> ipv6 adjust-mss
interfaces wireguard <value>
<wireguard> ipv6 adjust-
mss
× not yet documented inter- Nothing found in VyOS
faces_wireguard.xml.in:
interfaces wireguard
<wireguard> ipv6 base-
reachable-time
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> ipv6 disable-
interfaces wireguard forwarding
<wireguard> ipv6 disable-
forwarding
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> ipv6 dup-addr-
interfaces wireguard detect-transmits <value>
<wireguard> ipv6 dup-
addr-detect-transmits
× not yet documented inter- Nothing found in VyOS
faces_wireguard.xml.in:
interfaces wireguard
<wireguard> ipv6 source-
validation
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> mirror egress
interfaces wireguard <value>
<wireguard> mirror
egress
continues on next page

21.1. Configuration Commands 1557

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> mirror ingress
interfaces wireguard <value>
<wireguard> mirror
ingress
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> mtu <value>
interfaces wireguard
<wireguard> mtu
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> peer <text> address
interfaces wireguard <value>
<wireguard> peer <peer>
address
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> peer <text>
interfaces wireguard allowed-ips <value>
<wireguard> peer <peer>
allowed-ips
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> peer <text> de-
interfaces wireguard scription <value>
<wireguard> peer <peer>
description
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> peer <text> disable
interfaces wireguard
<wireguard> peer <peer>
disable
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> peer <text>
interfaces wireguard persistent-keepalive
<wireguard> peer <peer> <value>
persistent-keepalive
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> peer <text> port
interfaces wireguard <value>
<wireguard> peer <peer>
port
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> peer <text>
interfaces wireguard preshared-key <value>
<wireguard> peer <peer>
preshared-key
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> peer <text> public-
interfaces wireguard key <value>
<wireguard> peer <peer>
public-key
continues on next page

21.1. Configuration Commands 1558

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces wireguard
wireguard faces_wireguard.xml.in: <text> per-client-thread
<interface> interfaces wireguard
per-client-thread <wireguard> per-client-
thread
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> port <value>
interfaces wireguard
<wireguard> port
✓ set interfaces inter- interfaces wireguard
wireguard faces_wireguard.xml.in: <text> private-key
<interface> interfaces wireguard <value>
private-key <wireguard> private-key
<private-key>
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> redirect <value>
interfaces wireguard
<wireguard> redirect
× not yet documented inter- interfaces wireguard
faces_wireguard.xml.in: <text> vrf <value>
interfaces wireguard
<wireguard> vrf
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: address <value>
address <address | interfaces wireless <wire-
dhcp | dhcpv6> less> address
× set interfaces Nothing found in XML Nothing found in VyOS
wireless <interface> Definitions
capabilities he
antenna-pattern-fixed
× set interfaces Nothing found in XML Nothing found in VyOS
wireless <interface> Definitions
capabilities
he beamform
<single-user-beamformer
|
single-user-beamformee
|
multi-user-beamformer>
× set interfaces Nothing found in XML Nothing found in VyOS
wireless <interface> Definitions
capabilities he
bss-color <number>
× set interfaces Nothing found in XML Nothing found in VyOS
wireless <interface> Definitions
capabilities he
center-channel-freq
<freq-1 | freq-2>
<number>
continues on next page

21.1. Configuration Commands 1559

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set interfaces Nothing found in XML Nothing found in VyOS
wireless <interface> Definitions
capabilities he
channel-set-width
<number>
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities ht 40mhz-
capabilities ht interfaces wireless <wire- incapable
40mhz-incapable less> capabilities ht
40mhz-incapable
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities ht auto-
capabilities ht interfaces wireless <wire- powersave
auto-powersave less> capabilities ht auto-
powersave
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities ht channel-set-
capabilities ht interfaces wireless <wire- width <value>
channel-set-width less> capabilities ht
<ht20 | ht40+ | channel-set-width
ht40->
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities ht delayed-
capabilities ht interfaces wireless <wire- block-ack
delayed-block-ack less> capabilities ht
delayed-block-ack
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities ht dsss-cck-40
capabilities ht interfaces wireless <wire-
dsss-cck-40 less> capabilities ht dsss-
cck-40
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities ht greenfield
capabilities ht interfaces wireless <wire-
greenfield less> capabilities ht green-
field
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities ht ldpc
capabilities ht ldpc interfaces wireless <wire-
less> capabilities ht ldpc
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities ht lsig-
capabilities ht interfaces wireless <wire- protection
lsig-protection less> capabilities ht lsig-
protection
continues on next page

21.1. Configuration Commands 1560

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities ht max-amsdu
capabilities ht interfaces wireless <wire- <value>
max-amsdu <3839 | less> capabilities ht max-
7935> amsdu
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities ht short-gi
capabilities ht interfaces wireless <wire- <value>
short-gi <20 | 40> less> capabilities ht short-
gi
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities ht smps
capabilities ht smps interfaces wireless <wire- <value>
<static | dynamic> less> capabilities ht smps
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities ht stbc rx
capabilities ht stbc interfaces wireless <wire- <value>
rx <num> less> capabilities ht stbc rx
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities ht stbc tx
capabilities ht stbc interfaces wireless <wire-
tx less> capabilities ht stbc tx
× set interfaces Nothing found in XML Nothing found in VyOS
wireless <interface> Definitions
capabilities
require-he
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities require-ht
capabilities interfaces wireless <wire-
require-ht less> capabilities require-
ht
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities require-vht
capabilities interfaces wireless <wire-
require-vht less> capabilities require-
vht
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities vht antenna-
capabilities vht interfaces wireless <wire- count <value>
antenna-count less> capabilities vht
antenna-count
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities vht antenna-
capabilities vht interfaces wireless <wire- pattern-fixed
antenna-pattern-fixed less> capabilities vht
antenna-pattern-fixed
continues on next page

21.1. Configuration Commands 1561

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities vht beamform
capabilities interfaces wireless <wire- <value>
vht beamform less> capabilities vht
<single-user-beamformerbeamform
|
single-user-beamformee
|
multi-user-beamformer
|
multi-user-beamformee>
× set interfaces Nothing found in XML Nothing found in VyOS
wireless <interface> Definitions
capabilities vht
center-channel-freq
<freq-1 | freq-2>
<number>
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: capabilities vht center-
interfaces wireless <wire- channel-freq freq-1
less> capabilities vht <value>
center-channel-freq freq-1
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: capabilities vht center-
interfaces wireless <wire- channel-freq freq-2
less> capabilities vht <value>
center-channel-freq freq-2
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities vht channel-
capabilities vht interfaces wireless <wire- set-width <value>
channel-set-width <0 less> capabilities vht
| 1 | 2 | 3> channel-set-width
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities vht ldpc
capabilities vht interfaces wireless <wire-
ldpc less> capabilities vht ldpc
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities vht link-
capabilities vht interfaces wireless <wire- adaptation <value>
link-adaptation less> capabilities vht link-
adaptation
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities vht max-mpdu
capabilities vht interfaces wireless <wire- <value>
max-mpdu <value> less> capabilities vht max-
mpdu
continues on next page

21.1. Configuration Commands 1562

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities vht max-
capabilities interfaces wireless <wire- mpdu-exp <value>
vht max-mpdu-exp less> capabilities vht max-
<value> mpdu-exp
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities vht short-gi
capabilities vht interfaces wireless <wire- <value>
short-gi <80 | 160> less> capabilities vht
short-gi
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities vht stbc rx
capabilities vht interfaces wireless <wire- <value>
stbc rx <num> less> capabilities vht stbc
rx
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities vht stbc tx
capabilities vht interfaces wireless <wire-
stbc tx less> capabilities vht stbc
tx
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities vht tx-
capabilities vht interfaces wireless <wire- powersave
tx-powersave less> capabilities vht tx-
powersave
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: capabilities vht vht-cf
capabilities vht interfaces wireless <wire-
vht-cf less> capabilities vht vht-
cf
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: channel <value>
channel <number> interfaces wireless <wire-
less> channel
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: country-code <value>
interfaces wireless <wire-
less> country-code
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: description <value>
description interfaces wireless <wire-
<description> less> description
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: dhcp-options client-id
dhcp-options interfaces wireless <wire- <value>
client-id less> dhcp-options client-
<description> id
continues on next page

21.1. Configuration Commands 1563

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: dhcp-options default-
dhcp-options interfaces wireless <wire- route-distance <value>
default-route-distance less> dhcp-options
<distance> default-route-distance
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: dhcp-options host-name
dhcp-options interfaces wireless <wire- <value>
host-name less> dhcp-options host-
<hostname> name
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: dhcp-options mtu
interfaces wireless <wire-
less> dhcp-options mtu
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: dhcp-options no-default-
dhcp-options interfaces wireless <wire- route
no-default-route less> dhcp-options
no-default-route
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: dhcp-options reject
dhcp-options reject interfaces wireless <wire- <value>
<address> less> dhcp-options reject
× set interfaces inter- Nothing found in VyOS
wireless <interface> faces_wireless.xml.in:
dhcp-options interfaces wireless <wire-
user-class <string> less> dhcp-options user-
class
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: dhcp-options vendor-
dhcp-options interfaces wireless <wire- class-id <value>
vendor-class-id less> dhcp-options
<vendor-id> vendor-class-id
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: dhcpv6-options duid
dhcpv6-options duid interfaces wireless <wire- <value>
<duid> less> dhcpv6-options duid
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: dhcpv6-options no-release
dhcpv6-options interfaces wireless <wire-
no-release less> dhcpv6-options no-
release
✓ set interfaces inter- interfaces wireless
wireless <interface> faces_wireless.xml.in: <text> dhcpv6-options
dhcpv6-options interfaces wireless <wire- parameters-only
parameters-only less> dhcpv6-options
parameters-only
continues on next page

21.1. Configuration Commands 1564

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: dhcpv6-options pd <text>
dhcpv6-options interfaces wireless <wire- interface <text> address
pd <id> interface less> dhcpv6-options pd <value>
<delegatee> address <pd> interface <inter-
<address> face> address
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: dhcpv6-options pd <text>
dhcpv6-options interfaces wireless <wire- interface <text> sla-id
pd <id> interface less> dhcpv6-options pd <value>
<delegatee> sla-id <pd> interface <inter-
<id> face> sla-id
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: dhcpv6-options pd <text>
dhcpv6-options interfaces wireless <wire- length <value>
pd <id> length less> dhcpv6-options pd
<length> <pd> length
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: dhcpv6-options rapid-
dhcpv6-options interfaces wireless <wire- commit
rapid-commit less> dhcpv6-options
rapid-commit
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: dhcpv6-options temporary
dhcpv6-options interfaces wireless <wire-
temporary less> dhcpv6-options tem-
porary
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: disable
disable interfaces wireless <wire-
less> disable
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: disable-broadcast-ssid
disable-broadcast-ssid interfaces wireless <wire-
less> disable-broadcast-
ssid
× set interfaces Nothing found in XML Nothing found in VyOS
wireless <interface> Definitions
disable-flow-control
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: disable-link-detect
disable-link-detect interfaces wireless <wire-
less> disable-link-detect
× set interfaces Nothing found in XML Nothing found in VyOS
wireless <interface> Definitions
enable-bf-protection
continues on next page

21.1. Configuration Commands 1565

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: expunge-failing-stations
expunge-failing-stations
interfaces wireless <wire-
less> expunge-failing-
stations
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: hw-id <value>
interfaces wireless <wire-
less> hw-id
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: ip adjust-mss <value>
ip adjust-mss <mss | interfaces wireless <wire-
clamp-mss-to-pmtu> less> ip adjust-mss
✓ set interfaces inter- interfaces wireless <text>
wireless faces_wireless.xml.in: ip arp-cache-timeout
<interface> ip interfaces wireless <wire- <value>
arp-cache-timeout less> ip arp-cache-timeout
✓ set interfaces inter- interfaces wireless <text>
wireless faces_wireless.xml.in: ip disable-arp-filter
<interface> ip interfaces wireless <wire-
disable-arp-filter less> ip disable-arp-filter
✓ set interfaces inter- interfaces wireless <text>
wireless faces_wireless.xml.in: ip disable-forwarding
<interface> ip interfaces wireless
disable-forwarding <wireless> ip disable-
forwarding
✓ set interfaces inter- interfaces wireless <text>
wireless faces_wireless.xml.in: ip enable-arp-accept
<interface> ip interfaces wireless <wire-
enable-arp-accept less> ip enable-arp-accept
✓ set interfaces inter- interfaces wireless <text>
wireless faces_wireless.xml.in: ip enable-arp-announce
<interface> ip interfaces wireless <wire-
enable-arp-announce less> ip enable-arp-
announce
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: ip enable-arp-ignore
ip enable-arp-ignore interfaces wireless <wire-
less> ip enable-arp-ignore
✓ set interfaces inter- interfaces wireless <text>
wireless faces_wireless.xml.in: ip enable-directed-
<interface> ip interfaces wireless <wire- broadcast
enable-directed-broadcast
less> ip enable-directed-
broadcast
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: ip enable-proxy-arp
ip enable-proxy-arp interfaces wireless <wire-
less> ip enable-proxy-arp
continues on next page

21.1. Configuration Commands 1566

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: ip proxy-arp-pvlan
ip proxy-arp-pvlan interfaces wireless <wire-
less> ip proxy-arp-pvlan
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: ip source-validation
ip source-validation interfaces wireless <wire- <value>
<strict | loose | less> ip source-validation
disable>
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: ipv6 accept-dad <value>
ipv6 accept-dad interfaces wireless <wire-
<1-3> less> ipv6 accept-dad
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: ipv6 address autoconf
ipv6 address interfaces wireless <wire-
autoconf less> ipv6 address auto-
conf
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: ipv6 address eui64
ipv6 address eui64 interfaces wireless <wire- <value>
<prefix> less> ipv6 address eui64
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: ipv6 address no-default-
ipv6 address interfaces wireless <wire- link-local
no-default-link-local less> ipv6 address no-
default-link-local
✓ set interfaces inter- interfaces wireless <text>
wireless faces_wireless.xml.in: ipv6 adjust-mss <value>
<interface> ipv6 interfaces wireless <wire-
adjust-mss <mss | less> ipv6 adjust-mss
clamp-mss-to-pmtu>
× not yet documented inter- Nothing found in VyOS
faces_wireless.xml.in:
interfaces wireless <wire-
less> ipv6 base-reachable-
time
✓ set interfaces inter- interfaces wireless <text>
wireless faces_wireless.xml.in: ipv6 disable-forwarding
<interface> ipv6 interfaces wireless <wire-
disable-forwarding less> ipv6 disable-
forwarding
✓ set interfaces inter- interfaces wireless <text>
wireless faces_wireless.xml.in: ipv6 dup-addr-detect-
<interface> ipv6 interfaces wireless <wire- transmits <value>
dup-addr-detect-transmits
less> ipv6 dup-addr-
<n> detect-transmits
continues on next page

21.1. Configuration Commands 1567

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- Nothing found in VyOS
faces_wireless.xml.in:
interfaces wireless
<wireless> ipv6 source-
validation
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: isolate-stations
isolate-stations interfaces wireless <wire-
less> isolate-stations
✓ set interfaces inter- interfaces wireless <text>
wireless faces_wireless.xml.in: mac <value>
<interface> mac interfaces wireless <wire-
<xx:xx:xx:xx:xx:xx> less> mac
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: max-stations <value>
max-stations interfaces wireless <wire-
less> max-stations
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: mgmt-frame-protection
mgmt-frame-protection interfaces wireless <wire- <value>
less> mgmt-frame-
protection
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: mirror egress <value>
interfaces wireless <wire-
less> mirror egress
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: mirror ingress <value>
interfaces wireless <wire-
less> mirror ingress
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: mode <value>
mode <a | b | g | n interfaces wireless <wire-
| ac | ax> less> mode
× set interfaces Nothing found in XML Nothing found in VyOS
wireless <interface> Definitions
mtu <mtu>
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: per-client-thread
per-client-thread interfaces wireless <wire-
less> per-client-thread
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: physical-device <value>
physical-device interfaces wireless <wire-
<device> less> physical-device
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: redirect <value>
interfaces wireless <wire-
less> redirect
continues on next page

21.1. Configuration Commands 1568

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: reduce-transmit-power
reduce-transmit-power interfaces wireless <wire- <value>
<number> less> reduce-transmit-
power
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: security station-address
interfaces wireless <wire- accept mac <value>
less> security station-
address accept mac
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: security station-address
interfaces wireless <wire- deny mac <value>
less> security station-
address deny mac
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: security station-address
interfaces wireless <wire- mode <value>
less> security station-
address mode
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: security wep key <value>
interfaces wireless <wire-
less> security wep key
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: security wpa cipher
interfaces wireless <wire- <value>
less> security wpa cipher
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: security wpa group-cipher
interfaces wireless <wire- <value>
less> security wpa group-
cipher
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: security wpa mode
interfaces wireless <wire- <value>
less> security wpa mode
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: security wpa passphrase
interfaces wireless <wire- <value>
less> security wpa
passphrase
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: security wpa radius server
interfaces wireless <wire- <text> accounting
less> security wpa radius
server <server> account-
ing
continues on next page

21.1. Configuration Commands 1569

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: security wpa radius server
interfaces wireless <wire- <text> disable
less> security wpa radius
server <server> disable
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: security wpa radius server
interfaces wireless <wire- <text> key <value>
less> security wpa radius
server <server> key
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: security wpa radius server
interfaces wireless <wire- <text> port <value>
less> security wpa radius
server <server> port
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: security wpa radius
interfaces wireless <wire- source-address <value>
less> security wpa radius
source-address
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: ssid <value>
ssid <ssid> interfaces wireless <wire-
less> ssid
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: type <value>
type <access-point | interfaces wireless <wire-
station | monitor> less> type
× set interfaces Nothing found in XML Nothing found in VyOS
wireless <interface> Definitions
vif <vlan-id>
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> address
interfaces wireless <wire- <value>
less> vif-s <vif-s> address
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> description
interfaces wireless <wire- <value>
less> vif-s <vif-s>
description
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> dhcp-options
interfaces wireless <wire- client-id <value>
less> vif-s <vif-s> dhcp-
options client-id
continues on next page

21.1. Configuration Commands 1570

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> dhcp-options
interfaces wireless <wire- default-route-distance
less> vif-s <vif-s> <value>
dhcp-options default-
route-distance
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> dhcp-options
interfaces wireless <wire- host-name <value>
less> vif-s <vif-s> dhcp-
options host-name
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> dhcp-options
interfaces wireless <wire- mtu
less> vif-s <vif-s> dhcp-
options mtu
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> dhcp-options
interfaces wireless <wire- no-default-route
less> vif-s <vif-s> dhcp-
options no-default-route
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> dhcp-options
interfaces wireless <wire- reject <value>
less> vif-s <vif-s> dhcp-
options reject
× not yet documented inter- Nothing found in VyOS
faces_wireless.xml.in:
interfaces wireless <wire-
less> vif-s <vif-s> dhcp-
options user-class
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> dhcp-options
interfaces wireless <wire- vendor-class-id <value>
less> vif-s <vif-s> dhcp-
options vendor-class-id
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> dhcpv6-
interfaces wireless <wire- options duid <value>
less> vif-s <vif-s>
dhcpv6-options duid
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> dhcpv6-
interfaces wireless <wire- options no-release
less> vif-s <vif-s>
dhcpv6-options no-release
continues on next page

21.1. Configuration Commands 1571

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> dhcpv6-
interfaces wireless options parameters-only
<wireless> vif-s <vif-
s> dhcpv6-options
parameters-only
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> dhcpv6-
interfaces wireless <wire- options pd <text> in-
less> vif-s <vif-s> terface <text> address
dhcpv6-options pd <pd> <value>
interface <interface>
address
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> dhcpv6-
interfaces wireless <wire- options pd <text> in-
less> vif-s <vif-s> terface <text> sla-id
dhcpv6-options pd <pd> <value>
interface <interface>
sla-id
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> dhcpv6-
interfaces wireless <wire- options pd <text> length
less> vif-s <vif-s> <value>
dhcpv6-options pd <pd>
length
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> dhcpv6-
interfaces wireless <wire- options rapid-commit
less> vif-s <vif-s>
dhcpv6-options rapid-
commit
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> dhcpv6-
interfaces wireless <wire- options temporary
less> vif-s <vif-s>
dhcpv6-options tempo-
rary
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> disable
interfaces wireless <wire-
less> vif-s <vif-s> disable
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> disable-link-
interfaces wireless <wire- detect
less> vif-s <vif-s> disable-
link-detect
continues on next page

21.1. Configuration Commands 1572

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> ip adjust-mss
interfaces wireless <wire- <value>
less> vif-s <vif-s> ip
adjust-mss
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> ip arp-cache-
interfaces wireless <wire- timeout <value>
less> vif-s <vif-s> ip arp-
cache-timeout
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> ip disable-arp-
interfaces wireless <wire- filter
less> vif-s <vif-s> ip
disable-arp-filter
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> ip disable-
interfaces wireless <wire- forwarding
less> vif-s <vif-s> ip
disable-forwarding
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> ip enable-arp-
interfaces wireless <wire- accept
less> vif-s <vif-s> ip
enable-arp-accept
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> ip enable-arp-
interfaces wireless <wire- announce
less> vif-s <vif-s> ip
enable-arp-announce
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> ip enable-arp-
interfaces wireless <wire- ignore
less> vif-s <vif-s> ip
enable-arp-ignore
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> ip enable-
interfaces wireless <wire- directed-broadcast
less> vif-s <vif-s> ip
enable-directed-broadcast
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> ip enable-
interfaces wireless <wire- proxy-arp
less> vif-s <vif-s> ip
enable-proxy-arp
continues on next page

21.1. Configuration Commands 1573

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> ip proxy-arp-
interfaces wireless <wire- pvlan
less> vif-s <vif-s> ip
proxy-arp-pvlan
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> ip source-
interfaces wireless <wire- validation <value>
less> vif-s <vif-s> ip
source-validation
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> ipv6 accept-
interfaces wireless <wire- dad <value>
less> vif-s <vif-s> ipv6
accept-dad
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> ipv6 address
interfaces wireless <wire- autoconf
less> vif-s <vif-s> ipv6
address autoconf
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> ipv6 address
interfaces wireless <wire- eui64 <value>
less> vif-s <vif-s> ipv6
address eui64
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> ipv6 address
interfaces wireless <wire- no-default-link-local
less> vif-s <vif-s> ipv6
address no-default-link-
local
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> ipv6 adjust-
interfaces wireless <wire- mss <value>
less> vif-s <vif-s> ipv6
adjust-mss
× not yet documented inter- Nothing found in VyOS
faces_wireless.xml.in:
interfaces wireless <wire-
less> vif-s <vif-s> ipv6
base-reachable-time
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> ipv6 disable-
interfaces wireless <wire- forwarding
less> vif-s <vif-s> ipv6
disable-forwarding
continues on next page

21.1. Configuration Commands 1574

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> ipv6 dup-
interfaces wireless <wire- addr-detect-transmits
less> vif-s <vif-s> ipv6 <value>
dup-addr-detect-transmits
× not yet documented inter- Nothing found in VyOS
faces_wireless.xml.in:
interfaces wireless <wire-
less> vif-s <vif-s> ipv6
source-validation
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> mac <value>
interfaces wireless <wire-
less> vif-s <vif-s> mac
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> mirror egress
interfaces wireless <wire- <value>
less> vif-s <vif-s> mirror
egress
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> mirror ingress
interfaces wireless <wire- <value>
less> vif-s <vif-s> mirror
ingress
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> mtu <value>
interfaces wireless <wire-
less> vif-s <vif-s> mtu
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> protocol
interfaces wireless <wire- <value>
less> vif-s <vif-s> proto-
col
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> redirect
interfaces wireless <wire- <value>
less> vif-s <vif-s> redirect
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- address <value>
vif-c <vlan-id> less> vif-s <vif-s> vif-c
address <address | <vif-c> address
dhcp | dhcpv6>
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- description <value>
vif-c <vlan-id> less> vif-s <vif-s> vif-c
description <vif-c> description
<description>
continues on next page

21.1. Configuration Commands 1575

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- dhcp-options client-id
vif-c <vlan-id> less> vif-s <vif-s> vif-c <value>
dhcp-options <vif-c> dhcp-options
client-id client-id
<description>
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- dhcp-options default-
vif-c <vlan-id> less> vif-s <vif-s> vif-c route-distance <value>
dhcp-options <vif-c> dhcp-options
default-route-distance default-route-distance
<distance>
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- dhcp-options host-name
vif-c <vlan-id> less> vif-s <vif-s> vif-c <value>
dhcp-options <vif-c> dhcp-options
host-name host-name
<hostname>
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> vif-c <text>
interfaces wireless <wire- dhcp-options mtu
less> vif-s <vif-s> vif-c
<vif-c> dhcp-options mtu
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- dhcp-options no-default-
vif-c <vlan-id> less> vif-s <vif-s> vif-c route
dhcp-options <vif-c> dhcp-options no-
no-default-route default-route
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- dhcp-options reject
vif-c <vlan-id> less> vif-s <vif-s> vif-c <value>
dhcp-options reject <vif-c> dhcp-options re-
<address> ject
× set interfaces inter- Nothing found in VyOS
wireless <interface> faces_wireless.xml.in:
vif-s <vlan-id> interfaces wireless <wire-
vif-c <vlan-id> less> vif-s <vif-s> vif-c
dhcp-options <vif-c> dhcp-options user-
user-class <string> class
continues on next page

21.1. Configuration Commands 1576

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- dhcp-options vendor-
vif-c <vlan-id> less> vif-s <vif-s> vif-c class-id <value>
dhcp-options <vif-c> dhcp-options
vendor-class-id vendor-class-id
<vendor-id>
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- dhcpv6-options duid
vif-c <vlan-id> less> vif-s <vif-s> vif- <value>
dhcpv6-options duid c <vif-c> dhcpv6-options
<duid> duid
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- dhcpv6-options no-release
vif-c <vlan-id> less> vif-s <vif-s> vif-
dhcpv6-options c <vif-c> dhcpv6-options
no-release no-release
✓ set interfaces inter- interfaces wireless
wireless <interface> faces_wireless.xml.in: <text> vif-s <text> vif-c
vif-s <vlan-id> interfaces wireless <wire- <text> dhcpv6-options
vif-c <vlan-id> less> vif-s <vif-s> vif- parameters-only
dhcpv6-options c <vif-c> dhcpv6-options
parameters-only parameters-only
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- dhcpv6-options pd <text>
vif-c <vlan-id> less> vif-s <vif-s> vif- interface <text> address
dhcpv6-options c <vif-c> dhcpv6-options <value>
pd <id> interface pd <pd> interface <inter-
<delegatee> address face> address
<address>
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- dhcpv6-options pd <text>
vif-c <vlan-id> less> vif-s <vif-s> vif- interface <text> sla-id
dhcpv6-options c <vif-c> dhcpv6-options <value>
pd <id> interface pd <pd> interface <inter-
<delegatee> sla-id face> sla-id
<id>
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- dhcpv6-options pd <text>
vif-c <vlan-id> less> vif-s <vif-s> vif- length <value>
dhcpv6-options c <vif-c> dhcpv6-options
pd <id> length pd <pd> length
<length>
continues on next page

21.1. Configuration Commands 1577

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- dhcpv6-options rapid-
vif-c <vlan-id> less> vif-s <vif-s> vif- commit
dhcpv6-options c <vif-c> dhcpv6-options
rapid-commit rapid-commit
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- dhcpv6-options temporary
vif-c <vlan-id> less> vif-s <vif-s> vif-
dhcpv6-options c <vif-c> dhcpv6-options
temporary temporary
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- disable
vif-c <vlan-id> less> vif-s <vif-s> vif-c
disable <vif-c> disable
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- disable-link-detect
vif-c <vlan-id> less> vif-s <vif-s> vif-c
disable-link-detect <vif-c> disable-link-
detect
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text> ip
vif-s <vlan-id> interfaces wireless <wire- adjust-mss <value>
vif-c <vlan-id> ip less> vif-s <vif-s> vif-c
adjust-mss <mss | <vif-c> ip adjust-mss
clamp-mss-to-pmtu>
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- ip arp-cache-timeout
vif-c <vlan-id> ip less> vif-s <vif-s> vif- <value>
arp-cache-timeout c <vif-c> ip arp-cache-
timeout
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text> ip
vif-s <vlan-id> interfaces wireless <wire- disable-arp-filter
vif-c <vlan-id> ip less> vif-s <vif-s> vif-
disable-arp-filter c <vif-c> ip disable-arp-
filter
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text> ip
vif-s <vlan-id> interfaces wireless <wire- disable-forwarding
vif-c <vlan-id> ip less> vif-s <vif-s> vif-c
disable-forwarding <vif-c> ip disable-
forwarding
continues on next page

21.1. Configuration Commands 1578

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text> ip
vif-s <vlan-id> interfaces wireless <wire- enable-arp-accept
vif-c <vlan-id> ip less> vif-s <vif-s> vif-
enable-arp-accept c <vif-c> ip enable-arp-
accept
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text> ip
vif-s <vlan-id> interfaces wireless <wire- enable-arp-announce
vif-c <vlan-id> ip less> vif-s <vif-s> vif-
enable-arp-announce c <vif-c> ip enable-arp-
announce
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text> ip
vif-s <vlan-id> interfaces wireless <wire- enable-arp-ignore
vif-c <vlan-id> ip less> vif-s <vif-s> vif-
enable-arp-ignore c <vif-c> ip enable-arp-
ignore
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text> ip
vif-s <vlan-id> interfaces wireless <wire- enable-directed-broadcast
vif-c <vlan-id> ip less> vif-s <vif-s>
enable-directed-broadcast
vif-c <vif-c> ip enable-
directed-broadcast
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text> ip
vif-s <vlan-id> interfaces wireless <wire- enable-proxy-arp
vif-c <vlan-id> ip less> vif-s <vif-s> vif-c
enable-proxy-arp <vif-c> ip enable-proxy-
arp
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text> ip
vif-s <vlan-id> interfaces wireless <wire- proxy-arp-pvlan
vif-c <vlan-id> ip less> vif-s <vif-s> vif-
proxy-arp-pvlan c <vif-c> ip proxy-arp-
pvlan
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text> ip
vif-s <vlan-id> interfaces wireless <wire- source-validation <value>
vif-c <vlan-id> ip less> vif-s <vif-s>
source-validation vif-c <vif-c> ip source-
<strict | loose | validation
disable>
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- ipv6 accept-dad <value>
vif-c <vlan-id> ipv6 less> vif-s <vif-s> vif-c
accept-dad <1-3> <vif-c> ipv6 accept-dad
continues on next page

21.1. Configuration Commands 1579

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- ipv6 address autoconf
vif-c <vlan-id> ipv6 less> vif-s <vif-s> vif-c
address autoconf <vif-c> ipv6 address auto-
conf
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- ipv6 address eui64
vif-c <vlan-id> less> vif-s <vif-s> vif-c <value>
ipv6 address eui64 <vif-c> ipv6 address eui64
<prefix>
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- ipv6 address no-default-
vif-c <vlan-id> less> vif-s <vif-s> vif-c link-local
ipv6 address <vif-c> ipv6 address no-
no-default-link-local default-link-local
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- ipv6 adjust-mss <value>
vif-c <vlan-id> ipv6 less> vif-s <vif-s> vif-c
adjust-mss <mss | <vif-c> ipv6 adjust-mss
clamp-mss-to-pmtu>
× not yet documented inter- Nothing found in VyOS
faces_wireless.xml.in:
interfaces wireless <wire-
less> vif-s <vif-s> vif-c
<vif-c> ipv6 base-
reachable-time
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- ipv6 disable-forwarding
vif-c <vlan-id> ipv6 less> vif-s <vif-s> vif-
disable-forwarding c <vif-c> ipv6 disable-
forwarding
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- ipv6 dup-addr-detect-
vif-c <vlan-id> ipv6 less> vif-s <vif-s> vif- transmits <value>
dup-addr-detect-transmits
c <vif-c> ipv6 dup-addr-
<n> detect-transmits
× not yet documented inter- Nothing found in VyOS
faces_wireless.xml.in:
interfaces wireless <wire-
less> vif-s <vif-s> vif-
c <vif-c> ipv6 source-
validation
continues on next page

21.1. Configuration Commands 1580

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- mac <value>
vif-c <vlan-id> mac less> vif-s <vif-s> vif-c
<xx:xx:xx:xx:xx:xx> <vif-c> mac
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> vif-c <text>
interfaces wireless <wire- mirror egress <value>
less> vif-s <vif-s> vif-c
<vif-c> mirror egress
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> vif-c <text>
interfaces wireless <wire- mirror ingress <value>
less> vif-s <vif-s> vif-c
<vif-c> mirror ingress
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- mtu <value>
vif-c <vlan-id> mtu less> vif-s <vif-s> vif-c
<mtu> <vif-c> mtu
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> vif-c <text>
interfaces wireless <wire- redirect <value>
less> vif-s <vif-s> vif-c
<vif-c> redirect
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif-s <text> vif-c <text>
vif-s <vlan-id> interfaces wireless <wire- vrf <value>
vif-c <vlan-id> vrf less> vif-s <vif-s> vif-c
<vrf> <vif-c> vrf
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif-s <text> vrf <value>
interfaces wireless <wire-
less> vif-s <vif-s> vrf
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> address <value>
vif <vlan-id> interfaces wireless <wire-
address <address less> vif <vif> address
| dhcp | dhcpv6>
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> description
vif <vlan-id> interfaces wireless <wire- <value>
description less> vif <vif> description
<description>
continues on next page

21.1. Configuration Commands 1581

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> dhcp-options
vif <vlan-id> interfaces wireless <wire- client-id <value>
dhcp-options less> vif <vif> dhcp-
client-id options client-id
<description>
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> dhcp-options
vif <vlan-id> interfaces wireless default-route-distance
dhcp-options <wireless> vif <vif> <value>
default-route-distance dhcp-options default-
<distance> route-distance
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> dhcp-options
vif <vlan-id> interfaces wireless <wire- host-name <value>
dhcp-options less> vif <vif> dhcp-
host-name options host-name
<hostname>
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif <text> dhcp-options
interfaces wireless <wire- mtu
less> vif <vif> dhcp-
options mtu
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> dhcp-options
vif <vlan-id> interfaces wireless <wire- no-default-route
dhcp-options less> vif <vif> dhcp-
no-default-route options no-default-route
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> dhcp-options re-
vif <vlan-id> interfaces wireless <wire- ject <value>
dhcp-options reject less> vif <vif> dhcp-
<address> options reject
× set interfaces inter- Nothing found in VyOS
wireless <interface> faces_wireless.xml.in:
vif <vlan-id> interfaces wireless <wire-
dhcp-options less> vif <vif> dhcp-
user-class <string> options user-class
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> dhcp-options
vif <vlan-id> interfaces wireless <wire- vendor-class-id <value>
dhcp-options less> vif <vif> dhcp-
vendor-class-id options vendor-class-id
<vendor-id>
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces wireless <wire- duid <value>
dhcpv6-options duid less> vif <vif> dhcpv6-
<duid> options duid
continues on next page

21.1. Configuration Commands 1582

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces wireless <wire- no-release
dhcpv6-options less> vif <vif> dhcpv6-
no-release options no-release
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces wireless <wire- parameters-only
dhcpv6-options less> vif <vif> dhcpv6-
parameters-only options parameters-only
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces wireless <wire- pd <text> interface <text>
dhcpv6-options less> vif <vif> dhcpv6- address <value>
pd <id> interface options pd <pd> interface
<delegatee> address <interface> address
<address>
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces wireless <wire- pd <text> interface <text>
dhcpv6-options less> vif <vif> dhcpv6- sla-id <value>
pd <id> interface options pd <pd> interface
<delegatee> sla-id <interface> sla-id
<id>
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces wireless <wire- pd <text> length <value>
dhcpv6-options less> vif <vif> dhcpv6-
pd <id> length options pd <pd> length
<length>
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces wireless <wire- rapid-commit
dhcpv6-options less> vif <vif> dhcpv6-
rapid-commit options rapid-commit
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> dhcpv6-options
vif <vlan-id> interfaces wireless <wire- temporary
dhcpv6-options less> vif <vif> dhcpv6-
temporary options temporary
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> disable
vif <vlan-id> interfaces wireless <wire-
disable less> vif <vif> disable
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> disable-link-
vif <vlan-id> interfaces wireless <wire- detect
disable-link-detect less> vif <vif> disable-
link-detect
continues on next page

21.1. Configuration Commands 1583

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif <text> egress-qos
interfaces wireless <wire- <value>
less> vif <vif> egress-qos
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif <text> ingress-qos
interfaces wireless <wire- <value>
less> vif <vif> ingress-qos
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> ip adjust-mss
vif <vlan-id> ip interfaces wireless <wire- <value>
adjust-mss <mss | less> vif <vif> ip adjust-
clamp-mss-to-pmtu> mss
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> ip arp-cache-
vif <vlan-id> ip interfaces wireless <wire- timeout <value>
arp-cache-timeout less> vif <vif> ip arp-
cache-timeout
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> ip disable-arp-
vif <vlan-id> ip interfaces wireless <wire- filter
disable-arp-filter less> vif <vif> ip disable-
arp-filter
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> ip disable-
vif <vlan-id> ip interfaces wireless <wire- forwarding
disable-forwarding less> vif <vif> ip disable-
forwarding
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> ip enable-arp-
vif <vlan-id> ip interfaces wireless <wire- accept
enable-arp-accept less> vif <vif> ip enable-
arp-accept
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> ip enable-arp-
vif <vlan-id> ip interfaces wireless <wire- announce
enable-arp-announce less> vif <vif> ip enable-
arp-announce
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> ip enable-arp-
vif <vlan-id> ip interfaces wireless <wire- ignore
enable-arp-ignore less> vif <vif> ip enable-
arp-ignore
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> ip enable-
vif <vlan-id> ip interfaces wireless <wire- directed-broadcast
enable-directed-broadcast
less> vif <vif> ip enable-
directed-broadcast
continues on next page

21.1. Configuration Commands 1584

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> ip enable-proxy-
vif <vlan-id> ip interfaces wireless <wire- arp
enable-proxy-arp less> vif <vif> ip enable-
proxy-arp
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> ip proxy-arp-
vif <vlan-id> ip interfaces wireless <wire- pvlan
proxy-arp-pvlan less> vif <vif> ip proxy-
arp-pvlan
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> ip source-
vif <vlan-id> ip interfaces wireless <wire- validation <value>
source-validation less> vif <vif> ip source-
<strict | loose | validation
disable>
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> ipv6 accept-dad
vif <vlan-id> ipv6 interfaces wireless <wire- <value>
accept-dad <1-3> less> vif <vif> ipv6
accept-dad
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> ipv6 address au-
vif <vlan-id> ipv6 interfaces wireless <wire- toconf
address autoconf less> vif <vif> ipv6 ad-
dress autoconf
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> ipv6 address
vif <vlan-id> interfaces wireless <wire- eui64 <value>
ipv6 address eui64 less> vif <vif> ipv6 ad-
<prefix> dress eui64
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> ipv6 address no-
vif <vlan-id> interfaces wireless <wire- default-link-local
ipv6 address less> vif <vif> ipv6 ad-
no-default-link-local dress no-default-link-local
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> ipv6 adjust-mss
vif <vlan-id> ipv6 interfaces wireless <wire- <value>
adjust-mss <mss | less> vif <vif> ipv6
clamp-mss-to-pmtu> adjust-mss
× not yet documented inter- Nothing found in VyOS
faces_wireless.xml.in:
interfaces wireless <wire-
less> vif <vif> ipv6 base-
reachable-time
continues on next page

21.1. Configuration Commands 1585

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> ipv6 disable-
vif <vlan-id> ipv6 interfaces wireless <wire- forwarding
disable-forwarding less> vif <vif> ipv6
disable-forwarding
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> ipv6 dup-addr-
vif <vlan-id> ipv6 interfaces wireless <wire- detect-transmits <value>
dup-addr-detect-transmits
less> vif <vif> ipv6 dup-
<n> addr-detect-transmits
× not yet documented inter- Nothing found in VyOS
faces_wireless.xml.in:
interfaces wireless <wire-
less> vif <vif> ipv6
source-validation
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> mac <value>
vif <vlan-id> mac interfaces wireless <wire-
<xx:xx:xx:xx:xx:xx> less> vif <vif> mac
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif <text> mirror egress
interfaces wireless <wire- <value>
less> vif <vif> mirror
egress
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif <text> mirror ingress
interfaces wireless <wire- <value>
less> vif <vif> mirror
ingress
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> mtu <value>
vif <vlan-id> mtu interfaces wireless <wire-
<mtu> less> vif <vif> mtu
× not yet documented inter- interfaces wireless <text>
faces_wireless.xml.in: vif <text> redirect <value>
interfaces wireless <wire-
less> vif <vif> redirect
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vif <text> vrf <value>
vif <vlan-id> vrf interfaces wireless <wire-
<vrf> less> vif <vif> vrf
✓ set interfaces inter- interfaces wireless <text>
wireless <interface> faces_wireless.xml.in: vrf <value>
vrf <vrf> interfaces wireless <wire-
less> vrf
✓ set interfaces wwan interfaces_wwan.xml.in: interfaces wwan <text>
<interface> address interfaces wwan <wwan> address <value>
<address | dhcp | address
dhcpv6>
continues on next page

21.1. Configuration Commands 1586

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces wwan interfaces_wwan.xml.in: interfaces wwan <text>
<interface> apn interfaces wwan <wwan> apn <value>
<apn> apn
× not yet documented interfaces_wwan.xml.in: interfaces wwan <text>
interfaces wwan <wwan> authentication password
authentication password <value>
× not yet documented interfaces_wwan.xml.in: interfaces wwan <text>
interfaces wwan <wwan> authentication username
authentication username <value>
× not yet documented interfaces_wwan.xml.in: interfaces wwan <text>
interfaces wwan <wwan> connect-on-demand
connect-on-demand
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text>
wwan <interface> interfaces wwan <wwan> description <value>
description description
<description>
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text>
wwan <interface> interfaces wwan <wwan> dhcp-options client-id
dhcp-options dhcp-options client-id <value>
client-id
<description>
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text>
wwan <interface> interfaces wwan <wwan> dhcp-options default-
dhcp-options dhcp-options default- route-distance <value>
default-route-distance route-distance
<distance>
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text>
wwan <interface> interfaces wwan <wwan> dhcp-options host-name
dhcp-options dhcp-options host-name <value>
host-name
<hostname>
× not yet documented interfaces_wwan.xml.in: interfaces wwan <text>
interfaces wwan <wwan> dhcp-options mtu
dhcp-options mtu
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text>
wwan <interface> interfaces wwan <wwan> dhcp-options no-default-
dhcp-options dhcp-options no-default- route
no-default-route route
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text>
wwan <interface> interfaces wwan <wwan> dhcp-options reject
dhcp-options reject dhcp-options reject <value>
<address>
× set interfaces interfaces_wwan.xml.in: Nothing found in VyOS
wwan <interface> interfaces wwan <wwan>
dhcp-options dhcp-options user-class
user-class <string>
continues on next page

21.1. Configuration Commands 1587

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text>
wwan <interface> interfaces wwan <wwan> dhcp-options vendor-
dhcp-options dhcp-options vendor- class-id <value>
vendor-class-id class-id
<vendor-id>
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text>
wwan <interface> interfaces wwan <wwan> dhcpv6-options duid
dhcpv6-options duid dhcpv6-options duid <value>
<duid>
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text>
wwan <interface> interfaces wwan <wwan> dhcpv6-options no-release
dhcpv6-options dhcpv6-options no-release
no-release
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan
wwan <interface> interfaces wwan <text> dhcpv6-options
dhcpv6-options <wwan> dhcpv6-options parameters-only
parameters-only parameters-only
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text>
wwan <interface> interfaces wwan <wwan> dhcpv6-options pd <text>
dhcpv6-options dhcpv6-options pd <pd> interface <text> address
pd <id> interface interface <interface> ad- <value>
<delegatee> address dress
<address>
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text>
wwan <interface> interfaces wwan <wwan> dhcpv6-options pd <text>
dhcpv6-options dhcpv6-options pd <pd> interface <text> sla-id
pd <id> interface interface <interface> sla- <value>
<delegatee> sla-id id
<id>
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text>
wwan <interface> interfaces wwan <wwan> dhcpv6-options pd <text>
dhcpv6-options dhcpv6-options pd <pd> length <value>
pd <id> length length
<length>
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text>
wwan <interface> interfaces wwan <wwan> dhcpv6-options rapid-
dhcpv6-options dhcpv6-options rapid- commit
rapid-commit commit
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text>
wwan <interface> interfaces wwan <wwan> dhcpv6-options temporary
dhcpv6-options dhcpv6-options temporary
temporary
✓ set interfaces wwan interfaces_wwan.xml.in: interfaces wwan <text>
<interface> disable interfaces wwan <wwan> disable
disable
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text>
wwan <interface> interfaces wwan <wwan> disable-link-detect
disable-link-detect disable-link-detect
continues on next page

21.1. Configuration Commands 1588

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces wwan interfaces_wwan.xml.in: interfaces wwan <text> ip
<interface> ip interfaces wwan <wwan> adjust-mss <value>
adjust-mss <mss | ip adjust-mss
clamp-mss-to-pmtu>
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text>
wwan <interface> ip interfaces wwan <wwan> ip arp-cache-timeout
arp-cache-timeout ip arp-cache-timeout <value>
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text> ip
wwan <interface> ip interfaces wwan <wwan> disable-arp-filter
disable-arp-filter ip disable-arp-filter
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text> ip
wwan <interface> ip interfaces wwan <wwan> disable-forwarding
disable-forwarding ip disable-forwarding
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text> ip
wwan <interface> ip interfaces wwan <wwan> enable-arp-accept
enable-arp-accept ip enable-arp-accept
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text> ip
wwan <interface> ip interfaces wwan <wwan> enable-arp-announce
enable-arp-announce ip enable-arp-announce
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text> ip
wwan <interface> interfaces wwan <wwan> enable-arp-ignore
ip enable-arp-ignore ip enable-arp-ignore
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text> ip
wwan <interface> ip interfaces wwan <wwan> enable-directed-broadcast
enable-directed-broadcast
ip enable-directed-
broadcast
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text> ip
wwan <interface> interfaces wwan <wwan> enable-proxy-arp
ip enable-proxy-arp ip enable-proxy-arp
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text> ip
wwan <interface> interfaces wwan <wwan> proxy-arp-pvlan
ip proxy-arp-pvlan ip proxy-arp-pvlan
✓ set interfaces wwan interfaces_wwan.xml.in: interfaces wwan <text> ip
<interface> ip interfaces wwan <wwan> source-validation <value>
source-validation ip source-validation
<strict | loose |
disable>
✓ set interfaces wwan interfaces_wwan.xml.in: interfaces wwan <text>
<interface> ipv6 interfaces wwan <wwan> ipv6 accept-dad <value>
accept-dad <1-3> ipv6 accept-dad
✓ set interfaces wwan interfaces_wwan.xml.in: interfaces wwan <text>
<interface> ipv6 interfaces wwan <wwan> ipv6 address autoconf
address autoconf ipv6 address autoconf
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text>
wwan <interface> interfaces wwan <wwan> ipv6 address eui64
ipv6 address eui64 ipv6 address eui64 <value>
<prefix>
continues on next page

21.1. Configuration Commands 1589

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set interfaces interfaces_wwan.xml.in: interfaces wwan <text>
wwan <interface> interfaces wwan <wwan> ipv6 address no-default-
ipv6 address ipv6 address no-default- link-local
no-default-link-local link-local
✓ set interfaces wwan interfaces_wwan.xml.in: interfaces wwan <text>
<interface> ipv6 interfaces wwan <wwan> ipv6 adjust-mss <value>
adjust-mss <mss | ipv6 adjust-mss
clamp-mss-to-pmtu>
× not yet documented interfaces_wwan.xml.in: Nothing found in VyOS
interfaces wwan <wwan>
ipv6 base-reachable-time
✓ set interfaces wwan interfaces_wwan.xml.in: interfaces wwan <text>
<interface> ipv6 interfaces wwan <wwan> ipv6 disable-forwarding
disable-forwarding ipv6 disable-forwarding
✓ set interfaces wwan interfaces_wwan.xml.in: interfaces wwan <text>
<interface> ipv6 interfaces wwan <wwan> ipv6 dup-addr-detect-
dup-addr-detect-transmits
ipv6 dup-addr-detect- transmits <value>
<n> transmits
× not yet documented interfaces_wwan.xml.in: Nothing found in VyOS
interfaces wwan <wwan>
ipv6 source-validation
× not yet documented interfaces_wwan.xml.in: interfaces wwan <text>
interfaces wwan <wwan> mirror egress <value>
mirror egress
× not yet documented interfaces_wwan.xml.in: interfaces wwan <text>
interfaces wwan <wwan> mirror ingress <value>
mirror ingress
✓ set interfaces wwan interfaces_wwan.xml.in: interfaces wwan <text>
<interface> mtu interfaces wwan <wwan> mtu <value>
<mtu> mtu
× not yet documented interfaces_wwan.xml.in: interfaces wwan <text>
interfaces wwan <wwan> redirect <value>
redirect
✓ set interfaces wwan interfaces_wwan.xml.in: interfaces wwan <text> vrf
<interface> vrf interfaces wwan <wwan> <value>
<vrf> vrf
× load <URI> Nothing found in XML Nothing found in VyOS
Definitions
✓ set load-balancing load-balancing_reverse- load-balancing reverse-
reverse-proxy proxy.xml.in: proxy backend <text>
backend <name> load-balancing reverse- balance <value>
balance <balance> proxy backend <backend>
balance
× not yet documented load-balancing_reverse- load-balancing reverse-
proxy.xml.in: proxy backend <text>
load-balancing reverse- description <value>
proxy backend <backend>
description
continues on next page

21.1. Configuration Commands 1590

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set load-balancing Nothing found in XML Nothing found in VyOS
reverse-proxy Definitions
backend <name>
health-check
<protocol>
× set load-balancing Nothing found in XML Nothing found in VyOS
reverse-proxy Definitions
backend <name>
http-check
× set load-balancing Nothing found in XML Nothing found in VyOS
reverse-proxy Definitions
backend <name>
http-check expect
<condition>
× not yet documented load-balancing_reverse- Nothing found in VyOS
proxy.xml.in:
load-balancing reverse-
proxy backend <backend>
http-check expect status
× not yet documented load-balancing_reverse- Nothing found in VyOS
proxy.xml.in:
load-balancing reverse-
proxy backend <backend>
http-check expect string
× set load-balancing load-balancing_reverse- Nothing found in VyOS
reverse-proxy proxy.xml.in:
backend <name> load-balancing reverse-
http-check method proxy backend <backend>
<method> http-check method
× set load-balancing load-balancing_reverse- Nothing found in VyOS
reverse-proxy proxy.xml.in:
backend <name> load-balancing reverse-
http-check uri proxy backend <backend>
<path> http-check uri
× set load-balancing Nothing found in XML Nothing found in VyOS
reverse-proxy Definitions
backend <name>
http-response-headers
<header-name> value
<header-value>
✓ set load-balancing load-balancing_reverse- load-balancing reverse-
reverse-proxy proxy.xml.in: proxy backend <text>
backend <name> mode load-balancing reverse- mode <value>
<mode> proxy backend <backend>
mode
continues on next page

21.1. Configuration Commands 1591

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented load-balancing_reverse- load-balancing reverse-
proxy.xml.in: proxy backend <text>
load-balancing reverse- parameters http-check
proxy backend <backend>
parameters http-check
× not yet documented load-balancing_reverse- load-balancing reverse-
proxy.xml.in: proxy backend <text>
load-balancing reverse- rule <text> domain-name
proxy backend <backend> <value>
rule <rule> domain-name
× not yet documented load-balancing_reverse- load-balancing reverse-
proxy.xml.in: proxy backend <text>
load-balancing reverse- rule <text> set redirect-
proxy backend <backend> location <value>
rule <rule> set redirect-
location
× not yet documented load-balancing_reverse- load-balancing reverse-
proxy.xml.in: proxy backend <text> rule
load-balancing reverse- <text> set server <value>
proxy backend <backend>
rule <rule> set server
× not yet documented load-balancing_reverse- load-balancing reverse-
proxy.xml.in: proxy backend <text> rule
load-balancing reverse- <text> ssl <value>
proxy backend <backend>
rule <rule> ssl
× not yet documented load-balancing_reverse- load-balancing reverse-
proxy.xml.in: proxy backend <text>
load-balancing reverse- rule <text> url-path begin
proxy backend <backend> <value>
rule <rule> url-path begin
× not yet documented load-balancing_reverse- load-balancing reverse-
proxy.xml.in: proxy backend <text>
load-balancing reverse- rule <text> url-path end
proxy backend <backend> <value>
rule <rule> url-path end
× not yet documented load-balancing_reverse- load-balancing reverse-
proxy.xml.in: proxy backend <text>
load-balancing reverse- rule <text> url-path exact
proxy backend <backend> <value>
rule <rule> url-path exact
✓ set load-balancing load-balancing_reverse- load-balancing reverse-
reverse-proxy proxy.xml.in: proxy backend <text>
backend <name> load-balancing reverse- server <text> address
server <name> proxy backend <backend> <value>
address <x.x.x.x> server <server> address
continues on next page

21.1. Configuration Commands 1592

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented load-balancing_reverse- Nothing found in VyOS
proxy.xml.in:
load-balancing reverse-
proxy backend <backend>
server <server> backup
✓ set load-balancing load-balancing_reverse- load-balancing reverse-
reverse-proxy proxy.xml.in: proxy backend <text>
backend <name> load-balancing reverse- server <text> check
server <name> check proxy backend <backend>
server <server> check
✓ set load-balancing load-balancing_reverse- load-balancing reverse-
reverse-proxy proxy.xml.in: proxy backend <text>
backend <name> load-balancing reverse- server <text> port <value>
server <name> port proxy backend <backend>
<port> server <server> port
✓ set load-balancing load-balancing_reverse- load-balancing reverse-
reverse-proxy proxy.xml.in: proxy backend <text>
backend <name> load-balancing reverse- server <text> send-proxy
server <name> proxy backend <backend>
send-proxy server <server> send-
proxy
✓ set load-balancing load-balancing_reverse- load-balancing reverse-
reverse-proxy proxy.xml.in: proxy backend <text>
backend <name> load-balancing reverse- server <text> send-proxy-
server <name> proxy backend <backend> v2
send-proxy-v2 server <server> send-
proxy-v2
✓ set load-balancing load-balancing_reverse- load-balancing reverse-
reverse-proxy proxy.xml.in: proxy backend <text> ssl
backend <name> load-balancing reverse- ca-certificate <value>
ssl ca-certificate proxy backend <backend>
<ca-certificate> ssl ca-certificate
× set load-balancing load-balancing_reverse- Nothing found in VyOS
reverse-proxy proxy.xml.in:
backend <name> ssl load-balancing reverse-
no-verify proxy backend <backend>
ssl no-verify
× not yet documented load-balancing_reverse- load-balancing reverse-
proxy.xml.in: proxy backend <text>
load-balancing reverse- timeout check <value>
proxy backend <backend>
timeout check
× not yet documented load-balancing_reverse- load-balancing reverse-
proxy.xml.in: proxy backend <text>
load-balancing reverse- timeout connect <value>
proxy backend <backend>
timeout connect
continues on next page

21.1. Configuration Commands 1593

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented load-balancing_reverse- load-balancing reverse-
proxy.xml.in: proxy backend <text>
load-balancing reverse- timeout server <value>
proxy backend <backend>
timeout server
✓ set load-balancing load-balancing_reverse- load-balancing reverse-
reverse-proxy proxy.xml.in: proxy global-parameters
global-parameters load-balancing reverse- max-connections <value>
max-connections proxy global-parameters
<num> max-connections
✓ set load-balancing load-balancing_reverse- load-balancing reverse-
reverse-proxy proxy.xml.in: proxy global-parameters
global-parameters load-balancing reverse- ssl-bind-ciphers <value>
ssl-bind-ciphers proxy global-parameters
<ciphers> ssl-bind-ciphers
✓ set load-balancing load-balancing_reverse- load-balancing reverse-
reverse-proxy proxy.xml.in: proxy global-parameters
global-parameters load-balancing reverse- tls-version-min <value>
tls-version-min proxy global-parameters
<version> tls-version-min
✓ set load-balancing load-balancing_reverse- load-balancing reverse-
reverse-proxy proxy.xml.in: proxy service <text>
service <name> load-balancing reverse- backend <value>
backend <name> proxy service <service>
backend
× not yet documented load-balancing_reverse- load-balancing reverse-
proxy.xml.in: proxy service <text>
load-balancing reverse- description <value>
proxy service <service>
description
× set load-balancing Nothing found in XML Nothing found in VyOS
reverse-proxy Definitions
service <name>
http-response-headers
<header-name> value
<header-value>
✓ set load-balancing load-balancing_reverse- load-balancing reverse-
reverse-proxy proxy.xml.in: proxy service <text>
service <name> load-balancing reverse- listen-address <value>
listen-address proxy service <service>
<address> listen-address
✓ set load-balancing load-balancing_reverse- load-balancing reverse-
reverse-proxy proxy.xml.in: proxy service <text> mode
service <name> mode load-balancing reverse- <value>
<tcp|http> proxy service <service>
mode
continues on next page

21.1. Configuration Commands 1594

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set load-balancing load-balancing_reverse- load-balancing reverse-
reverse-proxy proxy.xml.in: proxy service <text> port
service <name> port load-balancing reverse- <value>
<port> proxy service <service>
port
× not yet documented load-balancing_reverse- load-balancing reverse-
proxy.xml.in: proxy service <text>
load-balancing reverse- redirect-http-to-https
proxy service <service>
redirect-http-to-https
✓ set load-balancing load-balancing_reverse- load-balancing reverse-
reverse-proxy proxy.xml.in: proxy service <text>
service <name> rule load-balancing reverse- rule <text> domain-name
<rule> domain-name proxy service <service> <value>
<name> rule <rule> domain-name
× set load-balancing Nothing found in XML Nothing found in VyOS
reverse-proxy Definitions
service <name>
rule <rule>
redirect-location
<url>
✓ set load-balancing load-balancing_reverse- load-balancing reverse-
reverse-proxy proxy.xml.in: proxy service <text>
service <name> rule load-balancing reverse- rule <text> set backend
<rule> set backend proxy service <service> <value>
<name> rule <rule> set backend
× not yet documented load-balancing_reverse- load-balancing reverse-
proxy.xml.in: proxy service <text>
load-balancing reverse- rule <text> set redirect-
proxy service <service> location <value>
rule <rule> set redirect-
location
✓ set load-balancing load-balancing_reverse- load-balancing reverse-
reverse-proxy proxy.xml.in: proxy service <text> rule
service <name> rule load-balancing reverse- <text> ssl <value>
<rule> ssl <sni> proxy service <service>
rule <rule> ssl
× set load-balancing Nothing found in XML Nothing found in VyOS
reverse-proxy Definitions
service <name> rule
<rule> url-path
<match> <url>
× not yet documented load-balancing_reverse- load-balancing reverse-
proxy.xml.in: proxy service <text> rule
load-balancing reverse- <text> url-path begin
proxy service <service> <value>
rule <rule> url-path begin
continues on next page

21.1. Configuration Commands 1595

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented load-balancing_reverse- load-balancing reverse-
proxy.xml.in: proxy service <text>
load-balancing reverse- rule <text> url-path end
proxy service <service> <value>
rule <rule> url-path end
× not yet documented load-balancing_reverse- load-balancing reverse-
proxy.xml.in: proxy service <text> rule
load-balancing reverse- <text> url-path exact
proxy service <service> <value>
rule <rule> url-path exact
✓ set load-balancing load-balancing_reverse- load-balancing reverse-
reverse-proxy proxy.xml.in: proxy service <text> ssl
service <name> ssl load-balancing reverse- certificate <value>
certificate <name> proxy service <service>
ssl certificate
× not yet documented load-balancing_reverse- Nothing found in VyOS
proxy.xml.in:
load-balancing reverse-
proxy service <service>
tcp-request inspect-delay
× not yet documented load-balancing_reverse- load-balancing reverse-
proxy.xml.in: proxy vrf <value>
load-balancing reverse-
proxy vrf
× not yet documented load- load-balancing wan
balancing_wan.xml.in: disable-source-nat
load-balancing wan
disable-source-nat
× not yet documented load- load-balancing wan
balancing_wan.xml.in: enable-local-traffic
load-balancing wan
enable-local-traffic
× not yet documented load- load-balancing wan flush-
balancing_wan.xml.in: connections
load-balancing wan flush-
connections
× not yet documented load- load-balancing wan hook
balancing_wan.xml.in: <value>
load-balancing wan hook
× not yet documented load- load-balancing wan
balancing_wan.xml.in: interface-health <text>
load-balancing wan failure-count <value>
interface-health
<interface-health> failure-
count
continues on next page

21.1. Configuration Commands 1596

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented load- load-balancing wan
balancing_wan.xml.in: interface-health <text>
load-balancing wan nexthop <value>
interface-health
<interface-health> nex-
thop
× not yet documented load- load-balancing wan
balancing_wan.xml.in: interface-health <text>
load-balancing wan success-count <value>
interface-health
<interface-health>
success-count
× not yet documented load- load-balancing wan
balancing_wan.xml.in: interface-health <text>
load-balancing wan test <text> resp-time
interface-health <value>
<interface-health> test
<test> resp-time
× not yet documented load- load-balancing wan
balancing_wan.xml.in: interface-health <text>
load-balancing wan test <text> target <value>
interface-health
<interface-health> test
<test> target
× not yet documented load- load-balancing wan
balancing_wan.xml.in: interface-health <text>
load-balancing wan test <text> test-script
interface-health <value>
<interface-health> test
<test> test-script
× not yet documented load- load-balancing wan
balancing_wan.xml.in: interface-health <text>
load-balancing wan test <text> ttl-limit
interface-health <value>
<interface-health> test
<test> ttl-limit
× not yet documented load- load-balancing wan
balancing_wan.xml.in: interface-health <text>
load-balancing wan test <text> type <value>
interface-health
<interface-health> test
<test> type
× not yet documented load- load-balancing wan
balancing_wan.xml.in: rule <text> description
load-balancing wan rule <value>
<rule> description
continues on next page

21.1. Configuration Commands 1597

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented load- load-balancing wan rule
balancing_wan.xml.in: <text> destination address
load-balancing wan rule <value>
<rule> destination address
× not yet documented load- load-balancing wan rule
balancing_wan.xml.in: <text> destination port
load-balancing wan rule <value>
<rule> destination port
× not yet documented load- load-balancing wan rule
balancing_wan.xml.in: <text> exclude
load-balancing wan rule
<rule> exclude
× not yet documented load- load-balancing wan rule
balancing_wan.xml.in: <text> failover
load-balancing wan rule
<rule> failover
× not yet documented load- load-balancing wan rule
balancing_wan.xml.in: <text> inbound-interface
load-balancing wan rule <value>
<rule> inbound-interface
× not yet documented load- load-balancing wan rule
balancing_wan.xml.in: <text> interface <text>
load-balancing wan weight <value>
rule <rule> interface
<interface> weight
× not yet documented load- load-balancing wan rule
balancing_wan.xml.in: <text> limit burst <value>
load-balancing wan rule
<rule> limit burst
× not yet documented load- load-balancing wan
balancing_wan.xml.in: rule <text> limit period
load-balancing wan rule <value>
<rule> limit period
× not yet documented load- load-balancing wan rule
balancing_wan.xml.in: <text> limit rate <value>
load-balancing wan rule
<rule> limit rate
× not yet documented load- load-balancing wan rule
balancing_wan.xml.in: <text> limit threshold
load-balancing wan rule <value>
<rule> limit threshold
× not yet documented load- load-balancing wan
balancing_wan.xml.in: rule <text> per-packet-
load-balancing wan balancing
rule <rule> per-packet-
balancing
continues on next page

21.1. Configuration Commands 1598

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented load- load-balancing wan rule
balancing_wan.xml.in: <text> protocol <value>
load-balancing wan rule
<rule> protocol
× not yet documented load- load-balancing wan rule
balancing_wan.xml.in: <text> source address
load-balancing wan rule <value>
<rule> source address
× not yet documented load- load-balancing wan
balancing_wan.xml.in: rule <text> source port
load-balancing wan rule <value>
<rule> source port
× not yet documented load- load-balancing wan
balancing_wan.xml.in: sticky-connections in-
load-balancing wan bound
sticky-connections in-
bound
× not yet documented nat64.xml.in: Nothing found in VyOS
nat64 source rule <rule>
description
× not yet documented nat64.xml.in: Nothing found in VyOS
nat64 source rule <rule>
disable
× not yet documented nat64.xml.in: Nothing found in VyOS
nat64 source rule <rule>
match mark
× not yet documented nat64.xml.in: Nothing found in VyOS
nat64 source rule <rule>
source prefix
× not yet documented nat64.xml.in: Nothing found in VyOS
nat64 source rule <rule>
translation pool <pool>
address
× not yet documented nat64.xml.in: Nothing found in VyOS
nat64 source rule <rule>
translation pool <pool>
description
× not yet documented nat64.xml.in: Nothing found in VyOS
nat64 source rule <rule>
translation pool <pool>
disable
× not yet documented nat64.xml.in: Nothing found in VyOS
nat64 source rule <rule>
translation pool <pool>
port
× not yet documented nat64.xml.in: Nothing found in VyOS
nat64 source rule <rule>
translation pool <pool>
protocol icmp
continues on next page

21.1. Configuration Commands 1599

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented nat64.xml.in: Nothing found in VyOS
nat64 source rule <rule>
translation pool <pool>
protocol tcp
× not yet documented nat64.xml.in: Nothing found in VyOS
nat64 source rule <rule>
translation pool <pool>
protocol udp
× not yet documented nat66.xml.in: nat66 destination rule
nat66 destination rule <text> description
<rule> description <value>
× not yet documented nat66.xml.in: nat66 destination rule
nat66 destination rule <text> destination address
<rule> destination address <value>
× not yet documented nat66.xml.in: nat66 destination rule
nat66 destination rule <text> destination port
<rule> destination port <value>
× not yet documented nat66.xml.in: nat66 destination rule
nat66 destination rule <text> disable
<rule> disable
× not yet documented nat66.xml.in: nat66 destination rule
nat66 destination rule <text> exclude
<rule> exclude
× not yet documented Nothing found in XML nat66 destination rule
Definitions <text> inbound-interface
<value>
× not yet documented nat66.xml.in: Nothing found in VyOS
nat66 destination rule
<rule> inbound-interface
name
× not yet documented nat66.xml.in: nat66 destination rule
nat66 destination rule <text> log
<rule> log
× not yet documented nat66.xml.in: nat66 destination rule
nat66 destination rule <text> protocol <value>
<rule> protocol
× not yet documented nat66.xml.in: nat66 destination rule
nat66 destination rule <text> source address
<rule> source address <value>
× not yet documented nat66.xml.in: nat66 destination rule
nat66 destination rule <text> source port
<rule> source port <value>
× not yet documented nat66.xml.in: nat66 destination rule
nat66 destination rule <text> translation address
<rule> translation address <value>
× not yet documented nat66.xml.in: nat66 destination rule
nat66 destination rule <text> translation port
<rule> translation port <value>
continues on next page

21.1. Configuration Commands 1600

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented nat66.xml.in: nat66 source rule <text>
nat66 source rule <rule> description <value>
description
× not yet documented nat66.xml.in: nat66 source rule <text>
nat66 source rule <rule> destination port <value>
destination port
× not yet documented nat66.xml.in: nat66 source rule <text>
nat66 source rule <rule> destination prefix <value>
destination prefix
× not yet documented nat66.xml.in: nat66 source rule <text>
nat66 source rule <rule> disable
disable
× not yet documented nat66.xml.in: nat66 source rule <text>
nat66 source rule <rule> exclude
exclude
× not yet documented nat66.xml.in: nat66 source rule <text>
nat66 source rule <rule> log
log
× not yet documented Nothing found in XML nat66 source rule <text>
Definitions outbound-interface
<value>
× not yet documented nat66.xml.in: Nothing found in VyOS
nat66 source rule <rule>
outbound-interface name
× not yet documented nat66.xml.in: nat66 source rule <text>
nat66 source rule <rule> protocol <value>
protocol
× not yet documented nat66.xml.in: nat66 source rule <text>
nat66 source rule <rule> source port <value>
source port
× not yet documented nat66.xml.in: nat66 source rule <text>
nat66 source rule <rule> source prefix <value>
source prefix
× not yet documented nat66.xml.in: nat66 source rule <text>
nat66 source rule <rule> translation address
translation address <value>
× not yet documented nat66.xml.in: nat66 source rule <text>
nat66 source rule <rule> translation port <value>
translation port
× set nat cgnat Nothing found in XML Nothing found in VyOS
log-allocation Definitions
× set nat cgnat pool Nothing found in XML Nothing found in VyOS
external <pool-name> Definitions
external-port-range
<port-range>
continues on next page

21.1. Configuration Commands 1601

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set nat cgnat pool Nothing found in XML Nothing found in VyOS
external <pool-name> Definitions
external-port-range
per-user-limit port
<num>
× set nat cgnat pool Nothing found in XML Nothing found in VyOS
external <pool-name> Definitions
range [address |
address range |
network] [seq]
× set nat cgnat pool Nothing found in XML Nothing found in VyOS
internal <pool-name> Definitions
range [address range
| network]
× set nat cgnat Nothing found in XML Nothing found in VyOS
pool rule <num> Definitions
source pool
<internal-pool-name>
× set nat cgnat Nothing found in XML Nothing found in VyOS
pool rule <num> Definitions
translation pool
<external-pool-name>
× not yet documented nat.xml.in: nat destination rule <text>
nat destination rule <rule> description <value>
description
× not yet documented nat.xml.in: nat destination rule
nat destination rule <rule> <text> destination address
destination address <value>
× not yet documented nat.xml.in: nat destination rule <text>
nat destination rule <rule> destination group address-
destination group address- group <value>
group
× not yet documented nat.xml.in: nat destination rule <text>
nat destination rule <rule> destination group domain-
destination group domain- group <value>
group
× not yet documented nat.xml.in: nat destination rule
nat destination rule <text> destination group
<rule> destination group mac-group <value>
mac-group
× not yet documented nat.xml.in: nat destination rule
nat destination rule <text> destination group
<rule> destination group network-group <value>
network-group
× not yet documented nat.xml.in: nat destination rule
nat destination rule <text> destination group
<rule> destination group port-group <value>
port-group
continues on next page

21.1. Configuration Commands 1602

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented nat.xml.in: nat destination rule <text>
nat destination rule <rule> destination port <value>
destination port
× not yet documented nat.xml.in: nat destination rule <text>
nat destination rule <rule> disable
disable
× not yet documented nat.xml.in: nat destination rule <text>
nat destination rule <rule> exclude
exclude
× not yet documented Nothing found in XML nat destination rule <text>
Definitions inbound-interface <value>
× not yet documented nat.xml.in: Nothing found in VyOS
nat destination rule <rule>
inbound-interface group
× not yet documented nat.xml.in: Nothing found in VyOS
nat destination rule <rule>
inbound-interface name
× not yet documented nat.xml.in: nat destination rule <text>
nat destination rule <rule> load-balance backend
load-balance backend <text> weight <value>
<backend> weight
× not yet documented nat.xml.in: nat destination rule
nat destination rule <rule> <text> load-balance hash
load-balance hash <value>
× not yet documented nat.xml.in: nat destination rule <text>
nat destination rule <rule> log
log
× not yet documented nat.xml.in: nat destination rule <text>
nat destination rule <rule> packet-type <value>
packet-type
× not yet documented nat.xml.in: nat destination rule <text>
nat destination rule <rule> protocol <value>
protocol
× not yet documented nat.xml.in: nat destination rule <text>
nat destination rule <rule> source address <value>
source address
× not yet documented nat.xml.in: nat destination rule <text>
nat destination rule <rule> source group address-
source group address- group <value>
group
× not yet documented nat.xml.in: nat destination rule <text>
nat destination rule <rule> source group domain-
source group domain- group <value>
group
× not yet documented nat.xml.in: nat destination rule <text>
nat destination rule <rule> source group mac-group
source group mac-group <value>
continues on next page

21.1. Configuration Commands 1603

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented nat.xml.in: nat destination rule <text>
nat destination rule <rule> source group network-
source group network- group <value>
group
× not yet documented nat.xml.in: nat destination rule <text>
nat destination rule <rule> source group port-group
source group port-group <value>
× not yet documented nat.xml.in: nat destination rule <text>
nat destination rule <rule> source port <value>
source port
× not yet documented nat.xml.in: nat destination rule
nat destination rule <rule> <text> translation address
translation address <value>
× not yet documented nat.xml.in: nat destination rule
nat destination rule <text> translation options
<rule> translation options address-mapping <value>
address-mapping
× not yet documented nat.xml.in: nat destination rule <text>
nat destination rule <rule> translation options port-
translation options port- mapping <value>
mapping
× not yet documented nat.xml.in: nat destination rule <text>
nat destination rule <rule> translation port <value>
translation port
× not yet documented nat.xml.in: nat destination rule <text>
nat destination rule <rule> translation redirect port
translation redirect port <value>
× set nat [source | Nothing found in XML Nothing found in VyOS
destination] rule Definitions
<rule> load-balance
backend <x.x.x.x>
weight <1-100>
× set nat [source Nothing found in XML Nothing found in VyOS
| destination] Definitions
rule <rule>
load-balance hash
[source-address |
destination-address
| source-port |
destination-port |
random]
× not yet documented nat.xml.in: nat source rule <text> de-
nat source rule <rule> de- scription <value>
scription
× not yet documented nat.xml.in: nat source rule <text> des-
nat source rule <rule> des- tination address <value>
tination address
continues on next page

21.1. Configuration Commands 1604

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented nat.xml.in: nat source rule <text>
nat source rule <rule> destination group address-
destination group address- group <value>
group
× not yet documented nat.xml.in: nat source rule <text>
nat source rule <rule> destination group domain-
destination group domain- group <value>
group
× not yet documented nat.xml.in: nat source rule <text> des-
nat source rule <rule> des- tination group mac-group
tination group mac-group <value>
× not yet documented nat.xml.in: nat source rule <text> des-
nat source rule <rule> des- tination group network-
tination group network- group <value>
group
× not yet documented nat.xml.in: nat source rule <text> des-
nat source rule <rule> des- tination group port-group
tination group port-group <value>
× not yet documented nat.xml.in: nat source rule <text> des-
nat source rule <rule> des- tination port <value>
tination port
× not yet documented nat.xml.in: nat source rule <text> dis-
nat source rule <rule> dis- able
able
× not yet documented nat.xml.in: nat source rule <text> ex-
nat source rule <rule> ex- clude
clude
× not yet documented nat.xml.in: nat source rule <text>
nat source rule <rule> load-balance backend
load-balance backend <text> weight <value>
<backend> weight
× not yet documented nat.xml.in: nat source rule <text>
nat source rule <rule> load-balance hash
load-balance hash <value>
× not yet documented nat.xml.in: nat source rule <text> log
nat source rule <rule> log
× not yet documented Nothing found in XML nat source rule <text>
Definitions outbound-interface
<value>
× not yet documented nat.xml.in: Nothing found in VyOS
nat source rule <rule>
outbound-interface group
× not yet documented nat.xml.in: Nothing found in VyOS
nat source rule <rule>
outbound-interface name
× not yet documented nat.xml.in: nat source rule <text>
nat source rule <rule> packet-type <value>
packet-type
continues on next page

21.1. Configuration Commands 1605

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented nat.xml.in: nat source rule <text> pro-
nat source rule <rule> pro- tocol <value>
tocol
× not yet documented nat.xml.in: nat source rule <text>
nat source rule <rule> source address <value>
source address
× not yet documented nat.xml.in: nat source rule <text>
nat source rule <rule> source group address-
source group address- group <value>
group
× not yet documented nat.xml.in: nat source rule <text>
nat source rule <rule> source group domain-
source group domain- group <value>
group
× not yet documented nat.xml.in: nat source rule <text>
nat source rule <rule> source group mac-group
source group mac-group <value>
× not yet documented nat.xml.in: nat source rule <text>
nat source rule <rule> source group network-
source group network- group <value>
group
× not yet documented nat.xml.in: nat source rule <text>
nat source rule <rule> source group port-group
source group port-group <value>
× not yet documented nat.xml.in: nat source rule <text>
nat source rule <rule> source port <value>
source port
× not yet documented nat.xml.in: nat source rule <text>
nat source rule <rule> translation address
translation address <value>
× not yet documented nat.xml.in: nat source rule <text>
nat source rule <rule> translation options
translation options address-mapping <value>
address-mapping
× not yet documented nat.xml.in: nat source rule <text>
nat source rule <rule> translation options port-
translation options port- mapping <value>
mapping
× not yet documented nat.xml.in: nat source rule <text>
nat source rule <rule> translation port <value>
translation port
× not yet documented nat.xml.in: nat static rule <text> de-
nat static rule <rule> de- scription <value>
scription
× not yet documented nat.xml.in: nat static rule <text> desti-
nat static rule <rule> des- nation address <value>
tination address
continues on next page

21.1. Configuration Commands 1606

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented nat.xml.in: nat static rule <text>
nat static rule <rule> inbound-interface <value>
inbound-interface
× not yet documented nat.xml.in: nat static rule <text> trans-
nat static rule <rule> trans- lation address <value>
lation address
× not yet documented netns.xml.in: netns name <text> de-
netns name <name> de- scription <value>
scription
✓ set pki ca <name> pki.xml.in: pki ca <text> certificate
certificate pki ca <ca> certificate <value>
✓ set pki ca <name> pki.xml.in: pki ca <text> crl <value>
crl pki ca <ca> crl
✓ set pki ca <name> pki.xml.in: pki ca <text> description
description pki ca <ca> description <value>
✓ set pki ca <name> pki.xml.in: pki ca <text> private key
private key pki ca <ca> private key <value>
✓ set pki ca pki.xml.in: pki ca <text> private
<name> private pki ca <ca> private password-protected
password-protected password-protected
× not yet documented pki.xml.in: pki ca <text> revoke
pki ca <ca> revoke
× set pki certificate pki.xml.in: Nothing found in VyOS
<name> acme pki certificate <certifi-
domain-name <name> cate> acme domain-name
× set pki certificate pki.xml.in: Nothing found in VyOS
<name> acme email pki certificate <certifi-
<address> cate> acme email
× set pki certificate pki.xml.in: Nothing found in VyOS
<name> acme pki certificate <certifi-
listen-address cate> acme listen-address
<address>
× set pki certificate pki.xml.in: Nothing found in VyOS
<name> acme pki certificate <certifi-
rsa-key-size <2048 | cate> acme rsa-key-size
3072 | 4096>
× set pki certificate pki.xml.in: Nothing found in VyOS
<name> acme url pki certificate <certifi-
<url> cate> acme url
✓ set pki certificate pki.xml.in: pki certificate <text> cer-
<name> certificate pki certificate <certifi- tificate <value>
cate> certificate
✓ set pki certificate pki.xml.in: pki certificate <text> de-
<name> description pki certificate <certifi- scription <value>
cate> description
✓ set pki certificate pki.xml.in: pki certificate <text> pri-
<name> private key pki certificate <certifi- vate key <value>
cate> private key
continues on next page

21.1. Configuration Commands 1607

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set pki certificate pki.xml.in: pki certificate <text> pri-
<name> private pki certificate <certifi- vate password-protected
password-protected cate> private password-
protected
✓ set pki certificate pki.xml.in: pki certificate <text> re-
<name> revoke pki certificate <certifi- voke
cate> revoke
× not yet documented pki.xml.in: pki dh <text> parameters
pki dh <dh> parameters <value>
× not yet documented pki.xml.in: pki key-pair <text> private
pki key-pair <key-pair> key <value>
private key
× not yet documented pki.xml.in: pki key-pair <text> private
pki key-pair <key- password-protected
pair> private password-
protected
× not yet documented pki.xml.in: pki key-pair <text> public
pki key-pair <key-pair> key <value>
public key
× not yet documented pki.xml.in: Nothing found in VyOS
pki openssh <openssh>
private key
× not yet documented pki.xml.in: Nothing found in VyOS
pki openssh <openssh>
private password-
protected
× not yet documented pki.xml.in: Nothing found in VyOS
pki openssh <openssh>
public key
× not yet documented pki.xml.in: Nothing found in VyOS
pki openssh <openssh>
public type
× not yet documented pki.xml.in: pki openvpn shared-secret
pki openvpn shared-secret <text> key <value>
<shared-secret> key
× not yet documented pki.xml.in: pki openvpn shared-secret
pki openvpn shared-secret <text> version <value>
<shared-secret> version
× not yet documented pki.xml.in: pki x509 default country
pki x509 default country <value>
× not yet documented pki.xml.in: pki x509 default locality
pki x509 default locality <value>
× not yet documented pki.xml.in: pki x509 default organiza-
pki x509 default organiza- tion <value>
tion
× not yet documented pki.xml.in: pki x509 default state
pki x509 default state <value>
continues on next page

21.1. Configuration Commands 1608

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set policy Nothing found in XML Nothing found in VyOS
access-list Definitions
<acl_number>
× set policy Nothing found in XML Nothing found in VyOS
access-list6 <text> Definitions
✓ set policy policy.xml.in: policy access-list6 <text>
access-list6 <text> policy access-list6 description <value>
description <text> <access-list6> description
✓ set policy policy.xml.in: policy access-list6 <text>
access-list6 policy access-list6 rule <text> action <value>
<text> rule <access-list6> rule
<1-65535> action <rule> action
<permit|deny>
× not yet documented policy.xml.in: policy access-list6 <text>
policy access-list6 rule <text> description
<access-list6> rule <value>
<rule> description
× set policy Nothing found in XML Nothing found in VyOS
access-list6 Definitions
<text> rule
<1-65535> source
<any|exact-match|network>
× not yet documented policy.xml.in: policy access-list6 <text>
policy access-list6 rule <text> source any
<access-list6> rule
<rule> source any
× not yet documented policy.xml.in: policy access-list6 <text>
policy access-list6 rule <text> source exact-
<access-list6> rule <rule> match
source exact-match
× not yet documented policy.xml.in: policy access-list6 <text>
policy access-list6 rule <text> source network
<access-list6> rule <value>
<rule> source network
✓ set policy policy.xml.in: policy access-list <text>
access-list policy access-list <access- description <value>
<acl_number> list> description
description <text>
× set policy Nothing found in XML Nothing found in VyOS
access-list Definitions
<acl_number>
rule <1-65535>
<destination|source>
<any|host|inverse-mask|network>
✓ set policy policy.xml.in: policy access-list <text>
access-list policy access-list <access- rule <text> action <value>
<acl_number> rule list> rule <rule> action
<1-65535> action
<permit|deny>
continues on next page

21.1. Configuration Commands 1609

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented policy.xml.in: policy access-list <text>
policy access-list <access- rule <text> description
list> rule <rule> descrip- <value>
tion
× not yet documented policy.xml.in: policy access-list <text>
policy access-list <access- rule <text> destination any
list> rule <rule> destina-
tion any
× not yet documented policy.xml.in: policy access-list <text>
policy access-list <access- rule <text> destination
list> rule <rule> destina- host <value>
tion host
× not yet documented policy.xml.in: policy access-list <text>
policy access-list <access- rule <text> destination
list> rule <rule> destina- inverse-mask <value>
tion inverse-mask
× not yet documented policy.xml.in: policy access-list <text>
policy access-list <access- rule <text> destination
list> rule <rule> destina- network <value>
tion network
× not yet documented policy.xml.in: policy access-list <text>
policy access-list <access- rule <text> source any
list> rule <rule> source
any
× not yet documented policy.xml.in: policy access-list <text>
policy access-list <access- rule <text> source host
list> rule <rule> source <value>
host
× not yet documented policy.xml.in: policy access-list <text>
policy access-list <access- rule <text> source inverse-
list> rule <rule> source mask <value>
inverse-mask
× not yet documented policy.xml.in: policy access-list <text>
policy access-list <access- rule <text> source network
list> rule <rule> source <value>
network
× set policy Nothing found in XML Nothing found in VyOS
as-path-list <text> Definitions
✓ set policy policy.xml.in: policy as-path-list <text>
as-path-list <text> policy as-path-list <as- description <value>
description <text> path-list> description
✓ set policy policy.xml.in: policy as-path-list <text>
as-path-list policy as-path-list <as- rule <text> action <value>
<text> rule path-list> rule <rule>
<1-65535> action action
<permit|deny>
continues on next page

21.1. Configuration Commands 1610

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set policy policy.xml.in: policy as-path-list <text>
as-path-list <text> policy as-path-list <as- rule <text> description
rule <1-65535> path-list> rule <rule> <value>
description <text> description
✓ set policy policy.xml.in: policy as-path-list <text>
as-path-list <text> policy as-path-list <as- rule <text> regex <value>
rule <1-65535> regex path-list> rule <rule>
<text> regex
× set policy Nothing found in XML Nothing found in VyOS
community-list Definitions
<text>
✓ set policy policy.xml.in: policy community-
community-list policy community-list list <text> description
<text> description <community-list> de- <value>
<text> scription
✓ set policy policy.xml.in: policy community-list
community-list policy community-list <text> rule <text> action
<text> rule <community-list> rule <value>
<1-65535> action <rule> action
<permit|deny>
✓ set policy policy.xml.in: policy community-list
community-list policy community-list <text> rule <text> de-
<text> rule <community-list> rule scription <value>
<1-65535> <rule> description
description <text>
✓ set policy policy.xml.in: policy community-list
community-list policy community-list <text> rule <text> regex
<text> rule <community-list> rule <value>
<1-65535> regex <rule> regex
<aa:nn|local-AS|no-advertise|no-export|internet|additive>
× set policy Nothing found in XML Nothing found in VyOS
extcommunity-list Definitions
<text>
✓ set policy policy.xml.in: policy extcommunity-
extcommunity-list policy extcommunity-list list <text> description
<text> description <extcommunity-list> <value>
<text> description
✓ set policy policy.xml.in: policy extcommunity-list
extcommunity-list policy extcommunity-list <text> rule <text> action
<text> rule <extcommunity-list> rule <value>
<1-65535> action <rule> action
<permit|deny>
✓ set policy policy.xml.in: policy extcommunity-list
extcommunity-list policy extcommunity-list <text> rule <text> descrip-
<text> rule <extcommunity-list> rule tion <value>
<1-65535> <rule> description
description <text>
continues on next page

21.1. Configuration Commands 1611

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set policy policy.xml.in: policy extcommunity-list
extcommunity-list policy extcommunity-list <text> rule <text> regex
<text> rule <extcommunity-list> rule <value>
<1-65535> regex <rule> regex
<text>
× set policy Nothing found in XML Nothing found in VyOS
large-community-list Definitions
<text>
✓ set policy policy.xml.in: policy large-community-
large-community-list policy large-community- list <text> description
<text> description list <large-community- <value>
<text> list> description
✓ set policy policy.xml.in: policy large-community-
large-community-list policy large-community- list <text> rule <text>
<text> rule list <large-community- action <value>
<1-65535> action list> rule <rule> action
<permit|deny>
✓ set policy policy.xml.in: policy large-community-
large-community-list policy large-community- list <text> rule <text>
<text> rule list <large-community- description <value>
<1-65535> list> rule <rule> descrip-
description <text> tion
✓ set policy policy.xml.in: policy large-community-
large-community-list policy large-community- list <text> rule <text>
<text> rule list <large-community- regex <value>
<1-65535> regex list> rule <rule> regex
<aa:nn:nn>
× set policy Nothing found in XML policy local-route6
local-route6 Definitions rule <text> destination
rule <1-32765> <value>
destination
<h:h:h:h:h:h:h:h
| h:h:h:h:h:h:h:h/
x>
× not yet documented policy_local-route.xml.in: Nothing found in VyOS
policy local-route6 rule
<rule> destination address
× not yet documented policy_local-route.xml.in: Nothing found in VyOS
policy local-route6 rule
<rule> destination port
× not yet documented policy_local-route.xml.in: policy local-route6 rule
policy local-route6 rule <text> fwmark <value>
<rule> fwmark
✓ set policy policy_local-route.xml.in: policy local-route6 rule
local-route6 policy local-route6 rule <text> inbound-interface
rule <1-32765> <rule> inbound-interface <value>
inbound-interface
<interface>
continues on next page

21.1. Configuration Commands 1612

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented policy_local-route.xml.in: Nothing found in VyOS
policy local-route6 rule
<rule> protocol
✓ set policy policy_local-route.xml.in: policy local-route6 rule
local-route6 rule policy local-route6 rule <text> set table <value>
<1-32765> set table <rule> set table
<1-200|main>
× set policy Nothing found in XML policy local-route6 rule
local-route6 rule Definitions <text> source <value>
<1-32765> source
<h:h:h:h:h:h:h:h |
h:h:h:h:h:h:h:h/x>
× not yet documented policy_local-route.xml.in: Nothing found in VyOS
policy local-route6 rule
<rule> source address
× not yet documented policy_local-route.xml.in: Nothing found in VyOS
policy local-route6 rule
<rule> source port
× set policy Nothing found in XML policy local-route rule
local-route Definitions <text> destination
rule <1-32765> <value>
destination <x.x.
x.x|x.x.x.x/x>
× not yet documented policy_local-route.xml.in: Nothing found in VyOS
policy local-route rule
<rule> destination address
× not yet documented policy_local-route.xml.in: Nothing found in VyOS
policy local-route rule
<rule> destination port
× not yet documented policy_local-route.xml.in: policy local-route rule
policy local-route rule <text> fwmark <value>
<rule> fwmark
✓ set policy policy_local-route.xml.in: policy local-route rule
local-route policy local-route rule <text> inbound-interface
rule <1-32765> <rule> inbound-interface <value>
inbound-interface
<interface>
× not yet documented policy_local-route.xml.in: Nothing found in VyOS
policy local-route rule
<rule> protocol
✓ set policy policy_local-route.xml.in: policy local-route rule
local-route rule policy local-route rule <text> set table <value>
<1-32765> set table <rule> set table
<1-200|main>
× set policy Nothing found in XML policy local-route rule
local-route rule Definitions <text> source <value>
<1-32765> source
<x.x.x.x|x.x.x.x/x>
continues on next page

21.1. Configuration Commands 1613

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented policy_local-route.xml.in: Nothing found in VyOS
policy local-route rule
<rule> source address
× not yet documented policy_local-route.xml.in: Nothing found in VyOS
policy local-route rule
<rule> source port
× set policy Nothing found in XML Nothing found in VyOS
prefix-list <text> Definitions
× set policy Nothing found in XML Nothing found in VyOS
prefix-list6 <text> Definitions
✓ set policy policy.xml.in: policy prefix-list6 <text>
prefix-list6 <text> policy prefix-list6 <prefix- description <value>
description <text> list6> description
✓ set policy policy.xml.in: policy prefix-list6 <text>
prefix-list6 policy prefix-list6 <prefix- rule <text> action <value>
<text> rule list6> rule <rule> action
<1-65535> action
<permit|deny>
✓ set policy policy.xml.in: policy prefix-list6 <text>
prefix-list6 <text> policy prefix-list6 <prefix- rule <text> description
rule <1-65535> list6> rule <rule> descrip- <value>
description <text> tion
✓ set policy policy.xml.in: policy prefix-list6 <text>
prefix-list6 <text> policy prefix-list6 <prefix- rule <text> ge <value>
rule <1-65535> ge list6> rule <rule> ge
<0-128>
✓ set policy policy.xml.in: policy prefix-list6 <text>
prefix-list6 <text> policy prefix-list6 <prefix- rule <text> le <value>
rule <1-65535> le list6> rule <rule> le
<0-128>
✓ set policy policy.xml.in: policy prefix-list6 <text>
prefix-list6 policy prefix-list6 <prefix- rule <text> prefix <value>
<text> rule list6> rule <rule> prefix
<1-65535> prefix
<h:h:h:h:h:h:h:h/x>
✓ set policy policy.xml.in: policy prefix-list <text>
prefix-list <text> policy prefix-list <prefix- description <value>
description <text> list> description
✓ set policy policy.xml.in: policy prefix-list <text>
prefix-list policy prefix-list <prefix- rule <text> action <value>
<text> rule list> rule <rule> action
<1-65535> action
<permit|deny>
✓ set policy policy.xml.in: policy prefix-list <text>
prefix-list <text> policy prefix-list <prefix- rule <text> description
rule <1-65535> list> rule <rule> descrip- <value>
description <text> tion
continues on next page

21.1. Configuration Commands 1614

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set policy policy.xml.in: policy prefix-list <text>
prefix-list <text> policy prefix-list <prefix- rule <text> ge <value>
rule <1-65535> ge list> rule <rule> ge
<0-32>
✓ set policy policy.xml.in: policy prefix-list <text>
prefix-list <text> policy prefix-list <prefix- rule <text> le <value>
rule <1-65535> le list> rule <rule> le
<0-32>
✓ set policy policy.xml.in: policy prefix-list <text>
prefix-list <text> policy prefix-list <prefix- rule <text> prefix <value>
rule <1-65535> list> rule <rule> prefix
prefix <x.x.x.x/
x>
× set policy route-map Nothing found in XML Nothing found in VyOS
<text> Definitions
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> description policy route-map <route- description <value>
<text> map> description
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> action <value>
<1-65535> action map> rule <rule> action
<permit|deny>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> call <value>
<1-65535> call map> rule <rule> call
<text>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> continue
<1-65535> continue map> rule <rule> continue <value>
<1-65535>
✓ set policy policy.xml.in: policy route-map <text>
route-map <text> policy route-map <route- rule <text> description
rule <1-65535> map> rule <rule> descrip- <value>
description <text> tion
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match as-path
<1-65535> match map> rule <rule> match <value>
as-path <text> as-path
✓ set policy policy.xml.in: policy route-map <text>
route-map <text> policy route-map <route- rule <text> match com-
rule <1-65535> map> rule <rule> match munity community-list
match community community community- <value>
community-list list
<text>
✓ set policy policy.xml.in: policy route-map <text>
route-map <text> policy route-map <route- rule <text> match commu-
rule <1-65535> map> rule <rule> match nity exact-match
match community community exact-match
exact-match
continues on next page

21.1. Configuration Commands 1615

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented policy.xml.in: policy route-map <text>
policy route-map <route- rule <text> match evpn
map> rule <rule> match default-route
evpn default-route
× not yet documented policy.xml.in: policy route-map <text>
policy route-map <route- rule <text> match evpn rd
map> rule <rule> match <value>
evpn rd
× not yet documented policy.xml.in: policy route-map <text>
policy route-map <route- rule <text> match evpn
map> rule <rule> match route-type <value>
evpn route-type
× not yet documented policy.xml.in: policy route-map <text>
policy route-map <route- rule <text> match evpn vni
map> rule <rule> match <value>
evpn vni
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match extcom-
<1-65535> match map> rule <rule> match munity <value>
extcommunity <text> extcommunity
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match inter-
<1-65535> match map> rule <rule> match face <value>
interface <text> interface
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match ip ad-
<1-65535> match ip map> rule <rule> match ip dress access-list <value>
address access-list address access-list
<1-2699>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match ip ad-
<1-65535> match ip map> rule <rule> match ip dress prefix-len <value>
address prefix-len address prefix-len
<0-32>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match ip ad-
<1-65535> match ip map> rule <rule> match ip dress prefix-list <value>
address prefix-list address prefix-list
<text>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match ip nex-
<1-65535> match ip map> rule <rule> match ip thop access-list <value>
nexthop access-list nexthop access-list
<1-2699>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match ip nex-
<1-65535> match map> rule <rule> match ip thop address <value>
ip nexthop address nexthop address
<x.x.x.x>
continues on next page

21.1. Configuration Commands 1616

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match ip nex-
<1-65535> match ip map> rule <rule> match ip thop prefix-len <value>
nexthop prefix-len nexthop prefix-len
<0-32>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match ip nex-
<1-65535> match ip map> rule <rule> match ip thop prefix-list <value>
nexthop prefix-list nexthop prefix-list
<text>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match ip nex-
<1-65535> match map> rule <rule> match ip thop type <value>
ip nexthop type nexthop type
<blackhole>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match ip route-
<1-65535> match map> rule <rule> match ip source access-list <value>
ip route-source route-source access-list
access-list
<1-2699>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match ip route-
<1-65535> match map> rule <rule> match ip source prefix-list <value>
ip route-source route-source prefix-list
prefix-list <text>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match ipv6 ad-
<1-65535> match ipv6 map> rule <rule> match dress access-list <value>
address access-list ipv6 address access-list
<text>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match ipv6 ad-
<1-65535> match ipv6 map> rule <rule> match dress prefix-len <value>
address prefix-len ipv6 address prefix-len
<0-128>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match ipv6 ad-
<1-65535> match ipv6 map> rule <rule> match dress prefix-list <value>
address prefix-list ipv6 address prefix-list
<text>
× set policy route-map Nothing found in XML Nothing found in VyOS
<text> rule Definitions
<1-65535> match
ipv6 nexthop
<h:h:h:h:h:h:h:h>
continues on next page

21.1. Configuration Commands 1617

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented policy.xml.in: policy route-map <text>
policy route-map <route- rule <text> match ipv6
map> rule <rule> match nexthop access-list
ipv6 nexthop access-list <value>
× not yet documented policy.xml.in: policy route-map <text>
policy route-map <route- rule <text> match ipv6
map> rule <rule> match nexthop address <value>
ipv6 nexthop address
× not yet documented policy.xml.in: policy route-map <text>
policy route-map <route- rule <text> match ipv6
map> rule <rule> match nexthop prefix-list
ipv6 nexthop prefix-list <value>
× not yet documented policy.xml.in: policy route-map <text>
policy route-map <route- rule <text> match ipv6
map> rule <rule> match nexthop type <value>
ipv6 nexthop type
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match
<1-65535> match map> rule <rule> match large-community large-
large-community large-community large- community-list <value>
large-community-list community-list
<text>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match local-
<1-65535> match map> rule <rule> match preference <value>
local-preference local-preference
<0-4294967295>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match metric
<1-65535> match map> rule <rule> match <value>
metric <1-65535> metric
✓ set policy policy.xml.in: policy route-map <text>
route-map <text> policy route-map <route- rule <text> match origin
rule <1-65535> map> rule <rule> match <value>
match origin origin
<egp|igp|incomplete>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match peer
<1-65535> match map> rule <rule> match <value>
peer <x.x.x.x> peer
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match protocol
<1-65535> match map> rule <rule> match <value>
protocol <protocol> protocol
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match rpki
<1-65535> match rpki map> rule <rule> match <value>
<invalid|notfound|valid>
rpki
continues on next page

21.1. Configuration Commands 1618

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> match tag
<1-65535> match map> rule <rule> match <value>
tag <1-65535> tag
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> on-match goto
<1-65535> on-match map> rule <rule> on- <value>
goto <1-65535> match goto
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> on-match next
<1-65535> on-match map> rule <rule> on-
next match next
× set policy route-map Nothing found in XML Nothing found in VyOS
<text> rule Definitions
<1-65535> set
aggregator <as|ip>
<1-4294967295|x.x.x.
x>
× not yet documented policy.xml.in: policy route-map <text>
policy route-map <route- rule <text> set aggregator
map> rule <rule> set ag- as <value>
gregator as
× not yet documented policy.xml.in: policy route-map <text>
policy route-map <route- rule <text> set aggregator
map> rule <rule> set ag- ip <value>
gregator ip
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set as-path ex-
<1-65535> set map> rule <rule> set as- clude <value>
as-path exclude path exclude
<1-4294967295 |
all>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set as-path
<1-65535> set map> rule <rule> set as- prepend <value>
as-path prepend path prepend
<1-4294967295>
✓ set policy policy.xml.in: policy route-map <text>
route-map <text> policy route-map <route- rule <text> set as-path
rule <1-65535> map> rule <rule> set as- prepend-last-as <value>
set as-path path prepend-last-as
prepend-last-as
<n>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set atomic-
<1-65535> set map> rule <rule> set aggregate
atomic-aggregate atomic-aggregate
continues on next page

21.1. Configuration Commands 1619

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set policy Nothing found in XML Nothing found in VyOS
route-map <text> Definitions
rule <1-65535>
set community
<add|replace>
<community>
× not yet documented policy.xml.in: policy route-map <text>
policy route-map <route- rule <text> set community
map> rule <rule> set com- add <value>
munity add
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set community
<1-65535> set map> rule <rule> set com- delete <value>
community delete munity delete
<text>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set community
<1-65535> set map> rule <rule> set com- none
community none munity none
× not yet documented policy.xml.in: policy route-map <text>
policy route-map <route- rule <text> set community
map> rule <rule> set com- replace <value>
munity replace
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set distance
<1-65535> set map> rule <rule> set dis- <value>
distance <0-255> tance
× not yet documented policy.xml.in: policy route-map <text>
policy route-map <route- rule <text> set evpn gate-
map> rule <rule> set evpn way ipv4 <value>
gateway ipv4
× not yet documented policy.xml.in: policy route-map <text>
policy route-map <route- rule <text> set evpn gate-
map> rule <rule> set evpn way ipv6 <value>
gateway ipv6
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set extcommu-
<1-65535> set map> rule <rule> set nity bandwidth <value>
extcommunity extcommunity bandwidth
bandwidth
<1-25600|cumulative|num-multipaths>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set extcom-
<1-65535> set map> rule <rule> set munity bandwidth-non-
extcommunity extcommunity bandwidth- transitive
bandwidth-non-transitive
non-transitive
continues on next page

21.1. Configuration Commands 1620

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set extcommu-
<1-65535> set map> rule <rule> set nity none
extcommunity none extcommunity none
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set extcommu-
<1-65535> set map> rule <rule> set nity rt <value>
extcommunity rt extcommunity rt
<text>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set extcommu-
<1-65535> set map> rule <rule> set nity soo <value>
extcommunity soo extcommunity soo
<text>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set ip-next-hop
<1-65535> set map> rule <rule> set ip- <value>
ip-next-hop <x.x. next-hop
x.x>
× set policy Nothing found in XML Nothing found in VyOS
route-map <text> Definitions
rule <1-65535>
set ip-next-hop
peer-address
× set policy Nothing found in XML Nothing found in VyOS
route-map <text> Definitions
rule <1-65535>
set ip-next-hop
unchanged
× set policy route-map Nothing found in XML Nothing found in VyOS
<text> rule Definitions
<1-65535> set
ipv6-next-hop
<global|local>
<h:h:h:h:h:h:h:h>
× not yet documented policy.xml.in: policy route-map <text>
policy route-map <route- rule <text> set ipv6-next-
map> rule <rule> set ipv6- hop global <value>
next-hop global
× not yet documented policy.xml.in: policy route-map <text>
policy route-map <route- rule <text> set ipv6-next-
map> rule <rule> set ipv6- hop local <value>
next-hop local
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set ipv6-next-
<1-65535> set map> rule <rule> set ipv6- hop peer-address
ipv6-next-hop next-hop peer-address
peer-address
continues on next page

21.1. Configuration Commands 1621

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set ipv6-next-
<1-65535> set map> rule <rule> set ipv6- hop prefer-global
ipv6-next-hop next-hop prefer-global
prefer-global
× not yet documented policy.xml.in: policy route-map <text>
policy route-map <route- rule <text> set l3vpn-
map> rule <rule> set nexthop encapsulation
l3vpn-nexthop encapsula- gre
tion gre
× set policy route-map Nothing found in XML Nothing found in VyOS
<text> rule Definitions
<1-65535> set
large-community
<add|replace>
<GA:LDP1:LDP2>
× not yet documented policy.xml.in: policy route-map <text>
policy route-map <route- rule <text> set large-
map> rule <rule> set community add <value>
large-community add
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set large-
<1-65535> set map> rule <rule> set community delete
large-community large-community delete <value>
delete <text>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set large-
<1-65535> set map> rule <rule> set community none
large-community large-community none
none
× not yet documented policy.xml.in: policy route-map <text>
policy route-map <route- rule <text> set large-
map> rule <rule> set community replace
large-community replace <value>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set local-
<1-65535> set map> rule <rule> set preference <value>
local-preference local-preference
<0-4294967295>
✓ set policy policy.xml.in: policy route-map <text>
route-map <text> policy route-map <route- rule <text> set metric
rule <1-65535> map> rule <rule> set met- <value>
set metric <+/ ric
-metric|0-4294967295|rtt|+rtt|-rtt>
✓ set policy policy.xml.in: policy route-map <text>
route-map <text> policy route-map <route- rule <text> set metric-type
rule <1-65535> map> rule <rule> set <value>
set metric-type metric-type
<type-1|type-2>
continues on next page

21.1. Configuration Commands 1622

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set origin
<1-65535> set origin map> rule <rule> set ori- <value>
<igp|egp|incomplete> gin
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set originator-
<1-65535> set map> rule <rule> set id <value>
originator-id <x. originator-id
x.x.x>
✓ set policy policy.xml.in: policy route-map <text>
route-map <text> policy route-map <route- rule <text> set src <value>
rule <1-65535> map> rule <rule> set src
set src <x.x.x.
x|h:h:h:h:h:h:h:h>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set table
<1-65535> set table map> rule <rule> set table <value>
<1-200>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set tag <value>
<1-65535> set tag map> rule <rule> set tag
<1-65535>
✓ set policy route-map policy.xml.in: policy route-map <text>
<text> rule policy route-map <route- rule <text> set weight
<1-65535> set weight map> rule <rule> set <value>
<0-4294967295> weight
× set policy route6 policy_route.xml.in: Nothing found in VyOS
<name> default-log policy route6 <route6>
default-log
✓ set policy route6 policy_route.xml.in: policy route6 <text> de-
<name> description policy route6 <route6> de- scription <value>
<text> scription
× not yet documented Nothing found in XML policy route6 <text>
Definitions enable-default-log
× not yet documented policy_route.xml.in: policy route6 <text> inter-
policy route6 <route6> in- face <value>
terface
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> action <value>
rule <rule> action
× set policy route6 Nothing found in XML Nothing found in VyOS
<name> rule <n> Definitions
action drop
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> policy route6 <route6> <text> connection-mark
connection-mark rule <rule> connection- <value>
<1-2147483647> mark
continues on next page

21.1. Configuration Commands 1623

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set policy route6 policy_route.xml.in: policy route6 <text>
<name> rule <n> policy route6 <route6> rule <text> description
description <text> rule <rule> description <value>
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> policy route6 <route6> <text> destination address
destination address rule <rule> destination <value>
<match_criteria> address
× set policy route6 Nothing found in XML Nothing found in VyOS
<name> rule <n> Definitions
destination group
<address-group|domain-group|mac-group|network-group|port-group>
<text>
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> destination group
rule <rule> destination address-group <value>
group address-group
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> destination group
rule <rule> destination domain-group <value>
group domain-group
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> destination group
rule <rule> destination mac-group <value>
group mac-group
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> destination group
rule <rule> destination network-group <value>
group network-group
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> destination group
rule <rule> destination port-group <value>
group port-group
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> policy route6 <route6> <text> destination port
destination port rule <rule> destination <value>
<match_criteria> port
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> policy route6 <route6> <text> disable
disable rule <rule> disable
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> dscp policy route6 <route6> <text> dscp <value>
<text> rule <rule> dscp
✓ set policy route6 policy_route.xml.in: policy route6 <text>
<name> rule <n> policy route6 <route6> rule <text> dscp-exclude
dscp-exclude <text> rule <rule> dscp-exclude <value>
× set policy route6 Nothing found in XML Nothing found in VyOS
<name> rule Definitions
<n> fragment
<match-grag|match-non-frag>
continues on next page

21.1. Configuration Commands 1624

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> fragment match-
rule <rule> fragment frag
match-frag
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> fragment match-
rule <rule> fragment non-frag
match-non-frag
× set policy route6 Nothing found in XML Nothing found in VyOS
rule <n> hop-limit Definitions
<eq | gt | lt>
<0-255>
× not yet documented policy_route.xml.in: policy route6 <text>
policy route6 <route6> rule <text> hop-limit eq
rule <rule> hop-limit eq <value>
× not yet documented policy_route.xml.in: policy route6 <text>
policy route6 <route6> rule <text> hop-limit gt
rule <rule> hop-limit gt <value>
× not yet documented policy_route.xml.in: policy route6 <text>
policy route6 <route6> rule <text> hop-limit lt
rule <rule> hop-limit lt <value>
× set policy route6 Nothing found in XML Nothing found in VyOS
<name> rule <n> Definitions
icmpv6 <code |
type>
× not yet documented policy_route.xml.in: policy route6 <text>
policy route6 <route6> rule <text> icmpv6 type
rule <rule> icmpv6 type <value>
× set policy route6 Nothing found in XML Nothing found in VyOS
<name> rule <n> Definitions
icmpv6 type-name
<text>
× set policy Nothing found in XML Nothing found in VyOS
route6 <name> Definitions
rule <n> ipsec
<match-ipsec|match-none>
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> ipsec match-ipsec
rule <rule> ipsec match-
ipsec
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> ipsec match-none
rule <rule> ipsec match-
none
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule policy route6 <route6> <text> limit burst <value>
<n> limit burst rule <rule> limit burst
<0-4294967295>
continues on next page

21.1. Configuration Commands 1625

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> policy route6 <route6> <text> limit rate <value>
limit rate <text> rule <rule> limit rate
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> log policy route6 <route6> <text> log <value>
<enable|disable> rule <rule> log
× not yet documented policy_route.xml.in: Nothing found in VyOS
policy route6 <route6>
rule <rule> mark
✓ set policy route6 policy_route.xml.in: policy route6 <text>
<name> rule <n> policy route6 <route6> rule <text> packet-length
packet-length rule <rule> packet-length <value>
<text>
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> policy route6 <route6> <text> packet-length-
packet-length-exclude rule <rule> packet-length- exclude <value>
<text> exclude
✓ set policy route6 policy_route.xml.in: policy route6 <text>
<name> rule policy route6 <route6> rule <text> packet-type
<n> packet-type rule <rule> packet-type <value>
[broadcast | host |
multicast | other]
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> policy route6 <route6> <text> protocol <value>
protocol <text | rule <rule> protocol
0-255 | tcp_udp |
all >
✓ set policy route6 policy_route.xml.in: policy route6 <text>
<name> rule <n> policy route6 <route6> rule <text> recent count
recent count rule <rule> recent count <value>
<1-255>
✓ set policy route6 policy_route.xml.in: policy route6 <text>
<name> rule policy route6 <route6> rule <text> recent time
<n> recent time rule <rule> recent time <value>
<1-4294967295>
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> policy route6 <route6> <text> set connection-
set connection-mark rule <rule> set mark <value>
<1-2147483647> connection-mark
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> set policy route6 <route6> <text> set dscp <value>
dscp <0-63> rule <rule> set dscp
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> set policy route6 <route6> <text> set mark <value>
mark <1-2147483647> rule <rule> set mark
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> policy route6 <route6> <text> set table <value>
set table <main | rule <rule> set table
1-200>
continues on next page

21.1. Configuration Commands 1626

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set policy route6 policy_route.xml.in: policy route6 <text>
<name> rule <n> set policy route6 <route6> rule <text> set tcp-mss
tcp-mss <500-1460> rule <rule> set tcp-mss <value>
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> policy route6 <route6> <text> source address
source address rule <rule> source address <value>
<match_criteria>
× set policy route6 Nothing found in XML Nothing found in VyOS
<name> rule <n> Definitions
source group
<address-group|domain-group|mac-group|network-group|port-group>
<text>
× not yet documented policy_route.xml.in: policy route6 <text>
policy route6 <route6> rule <text> source group
rule <rule> source group address-group <value>
address-group
× not yet documented policy_route.xml.in: policy route6 <text>
policy route6 <route6> rule <text> source group
rule <rule> source group domain-group <value>
domain-group
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> source group mac-
rule <rule> source group group <value>
mac-group
× not yet documented policy_route.xml.in: policy route6 <text>
policy route6 <route6> rule <text> source group
rule <rule> source group network-group <value>
network-group
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> source group port-
rule <rule> source group group <value>
port-group
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> source mac-address
rule <rule> source mac- <value>
address
× not yet documented policy_route.xml.in: policy route6 <text>
policy route6 <route6> rule <text> source port
rule <rule> source port <value>
× set policy route6 policy_route.xml.in: Nothing found in VyOS
<name> rule <n> policy route6 <route6>
state <established rule <rule> state
| invalid | new |
related>
× not yet documented Nothing found in XML policy route6 <text> rule
Definitions <text> state established
<value>
continues on next page

21.1. Configuration Commands 1627

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented Nothing found in XML policy route6 <text>
Definitions rule <text> state invalid
<value>
× not yet documented Nothing found in XML policy route6 <text> rule
Definitions <text> state new <value>
× not yet documented Nothing found in XML policy route6 <text>
Definitions rule <text> state related
<value>
× set policy route6 Nothing found in XML Nothing found in VyOS
<name> rule <n> tcp Definitions
flags <text>
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> tcp flags ack
rule <rule> tcp flags ack
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> tcp flags cwr
rule <rule> tcp flags cwr
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> tcp flags ecn
rule <rule> tcp flags ecn
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> tcp flags fin
rule <rule> tcp flags fin
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> tcp flags not ack
rule <rule> tcp flags not
ack
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> tcp flags not cwr
rule <rule> tcp flags not
cwr
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> tcp flags not ecn
rule <rule> tcp flags not
ecn
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> tcp flags not fin
rule <rule> tcp flags not
fin
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> tcp flags not psh
rule <rule> tcp flags not
psh
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> tcp flags not rst
rule <rule> tcp flags not
rst
continues on next page

21.1. Configuration Commands 1628

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> tcp flags not syn
rule <rule> tcp flags not
syn
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> tcp flags not urg
rule <rule> tcp flags not
urg
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> tcp flags psh
rule <rule> tcp flags psh
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> tcp flags rst
rule <rule> tcp flags rst
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> tcp flags syn
rule <rule> tcp flags syn
× not yet documented policy_route.xml.in: policy route6 <text> rule
policy route6 <route6> <text> tcp flags urg
rule <rule> tcp flags urg
× not yet documented Nothing found in XML policy route6 <text> rule
Definitions <text> tcp mss <value>
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> time policy route6 <route6> <text> time monthdays
monthdays <text> rule <rule> time month- <value>
days
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> time policy route6 <route6> <text> time startdate
startdate <text> rule <rule> time startdate <value>
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> time policy route6 <route6> <text> time starttime
starttime <text> rule <rule> time starttime <value>
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> time policy route6 <route6> <text> time stopdate
stopdate <text> rule <rule> time stopdate <value>
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> time policy route6 <route6> <text> time stoptime
stoptime <text> rule <rule> time stoptime <value>
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> time policy route6 <route6> <text> time utc
utc rule <rule> time utc
✓ set policy route6 policy_route.xml.in: policy route6 <text> rule
<name> rule <n> time policy route6 <route6> <text> time weekdays
weekdays <text> rule <rule> time weekdays <value>
× set policy route policy_route.xml.in: Nothing found in VyOS
<name> default-log policy route <route>
default-log
continues on next page

21.1. Configuration Commands 1629

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set policy route policy_route.xml.in: policy route <text> de-
<name> description policy route <route> de- scription <value>
<text> scription
× not yet documented Nothing found in XML policy route <text>
Definitions enable-default-log
× not yet documented policy_route.xml.in: policy route <text> inter-
policy route <route> inter- face <value>
face
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> action <value>
<rule> action
× set policy route Nothing found in XML Nothing found in VyOS
<name> rule <n> Definitions
action drop
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> policy route <route> rule <text> connection-mark
connection-mark <rule> connection-mark <value>
<1-2147483647>
✓ set policy route policy_route.xml.in: policy route <text>
<name> rule <n> policy route <route> rule rule <text> description
description <text> <rule> description <value>
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> policy route <route> rule <text> destination address
destination address <rule> destination address <value>
<match_criteria>
× set policy route Nothing found in XML Nothing found in VyOS
<name> rule <n> Definitions
destination group
<address-group|domain-group|mac-group|network-group|port-group>
<text>
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> destination group
<rule> destination group address-group <value>
address-group
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> destination group
<rule> destination group domain-group <value>
domain-group
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> destination group
<rule> destination group mac-group <value>
mac-group
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> destination group
<rule> destination group network-group <value>
network-group
continues on next page

21.1. Configuration Commands 1630

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> destination group
<rule> destination group port-group <value>
port-group
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> policy route <route> rule <text> destination port
destination port <rule> destination port <value>
<match_criteria>
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> policy route <route> rule <text> disable
disable <rule> disable
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> dscp policy route <route> rule <text> dscp <value>
<text> <rule> dscp
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> policy route <route> rule <text> dscp-exclude
dscp-exclude <text> <rule> dscp-exclude <value>
× set policy route Nothing found in XML Nothing found in VyOS
<name> rule Definitions
<n> fragment
<match-grag|match-non-frag>
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> fragment match-
<rule> fragment match- frag
frag
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> fragment match-
<rule> fragment match- non-frag
non-frag
× set policy route Nothing found in XML Nothing found in VyOS
<name> rule <n> icmp Definitions
<code | type>
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> icmp code <value>
<rule> icmp code
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> icmp type <value>
<rule> icmp type
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> icmp policy route <route> rule <text> icmp type-name
type-name <text> <rule> icmp type-name <value>
× set policy Nothing found in XML Nothing found in VyOS
route <name> Definitions
rule <n> ipsec
<match-ipsec|match-none>
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> ipsec match-ipsec
<rule> ipsec match-ipsec
continues on next page

21.1. Configuration Commands 1631

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> ipsec match-none
<rule> ipsec match-none
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule policy route <route> rule <text> limit burst <value>
<n> limit burst <rule> limit burst
<0-4294967295>
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> policy route <route> rule <text> limit rate <value>
limit rate <text> <rule> limit rate
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> log policy route <route> rule <text> log <value>
<enable|disable> <rule> log
× not yet documented policy_route.xml.in: Nothing found in VyOS
policy route <route> rule
<rule> mark
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> policy route <route> rule <text> packet-length
packet-length <rule> packet-length <value>
<text>
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> policy route <route> rule <text> packet-length-
packet-length-exclude <rule> packet-length- exclude <value>
<text> exclude
✓ set policy route policy_route.xml.in: policy route <text>
<name> rule policy route <route> rule rule <text> packet-type
<n> packet-type <rule> packet-type <value>
[broadcast | host |
multicast | other]
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> policy route <route> rule <text> protocol <value>
protocol <text | <rule> protocol
0-255 | tcp_udp |
all >
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> policy route <route> rule <text> recent count
recent count <rule> recent count <value>
<1-255>
✓ set policy route policy_route.xml.in: policy route <text>
<name> rule policy route <route> rule rule <text> recent time
<n> recent time <rule> recent time <value>
<1-4294967295>
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> policy route <route> rule <text> set connection-
set connection-mark <rule> set connection- mark <value>
<1-2147483647> mark
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> set policy route <route> rule <text> set dscp <value>
dscp <0-63> <rule> set dscp
continues on next page

21.1. Configuration Commands 1632

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> set policy route <route> rule <text> set mark <value>
mark <1-2147483647> <rule> set mark
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> policy route <route> rule <text> set table <value>
set table <main | <rule> set table
1-200>
✓ set policy route policy_route.xml.in: policy route <text>
<name> rule <n> set policy route <route> rule rule <text> set tcp-mss
tcp-mss <500-1460> <rule> set tcp-mss <value>
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> policy route <route> rule <text> source address
source address <rule> source address <value>
<match_criteria>
× set policy route Nothing found in XML Nothing found in VyOS
<name> rule <n> Definitions
source group
<address-group|domain-group|mac-group|network-group|port-group>
<text>
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> <text> source group
rule <rule> source group address-group <value>
address-group
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> <text> source group
rule <rule> source group domain-group <value>
domain-group
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> source group mac-
<rule> source group mac- group <value>
group
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> <text> source group
rule <rule> source group network-group <value>
network-group
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> source group port-
<rule> source group port- group <value>
group
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> <text> source mac-address
rule <rule> source mac- <value>
address
× not yet documented policy_route.xml.in: policy route <text>
policy route <route> rule rule <text> source port
<rule> source port <value>
continues on next page

21.1. Configuration Commands 1633

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set policy route policy_route.xml.in: Nothing found in VyOS
<name> rule <n> policy route <route> rule
state <established <rule> state
| invalid | new |
related>
× not yet documented Nothing found in XML policy route <text> rule
Definitions <text> state established
<value>
× not yet documented Nothing found in XML policy route <text>
Definitions rule <text> state invalid
<value>
× not yet documented Nothing found in XML policy route <text> rule
Definitions <text> state new <value>
× not yet documented Nothing found in XML policy route <text>
Definitions rule <text> state related
<value>
× set policy route Nothing found in XML Nothing found in VyOS
<name> rule <n> tcp Definitions
flags <text>
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> tcp flags ack
<rule> tcp flags ack
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> tcp flags cwr
<rule> tcp flags cwr
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> tcp flags ecn
<rule> tcp flags ecn
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> tcp flags fin
<rule> tcp flags fin
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> tcp flags not ack
<rule> tcp flags not ack
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> tcp flags not cwr
<rule> tcp flags not cwr
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> tcp flags not ecn
<rule> tcp flags not ecn
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> tcp flags not fin
<rule> tcp flags not fin
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> tcp flags not psh
<rule> tcp flags not psh
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> tcp flags not rst
<rule> tcp flags not rst
continues on next page

21.1. Configuration Commands 1634

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> tcp flags not syn
<rule> tcp flags not syn
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> tcp flags not urg
<rule> tcp flags not urg
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> tcp flags psh
<rule> tcp flags psh
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> tcp flags rst
<rule> tcp flags rst
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> tcp flags syn
<rule> tcp flags syn
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> tcp flags urg
<rule> tcp flags urg
× not yet documented Nothing found in XML policy route <text> rule
Definitions <text> tcp mss <value>
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> time policy route <route> rule <text> time monthdays
monthdays <text> <rule> time monthdays <value>
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> time policy route <route> rule <text> time startdate
startdate <text> <rule> time startdate <value>
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> time policy route <route> rule <text> time starttime
starttime <text> <rule> time starttime <value>
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> time policy route <route> rule <text> time stopdate
stopdate <text> <rule> time stopdate <value>
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> time policy route <route> rule <text> time stoptime
stoptime <text> <rule> time stoptime <value>
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> time policy route <route> rule <text> time utc
utc <rule> time utc
✓ set policy route policy_route.xml.in: policy route <text> rule
<name> rule <n> time policy route <route> rule <text> time weekdays
weekdays <text> <rule> time weekdays <value>
× set policy route Nothing found in XML Nothing found in VyOS
rule <n> ttl <eq | Definitions
gt | lt> <0-255>
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> ttl eq <value>
<rule> ttl eq
continues on next page

21.1. Configuration Commands 1635

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> ttl gt <value>
<rule> ttl gt
× not yet documented policy_route.xml.in: policy route <text> rule
policy route <route> rule <text> ttl lt <value>
<rule> ttl lt
× set protocols babel Nothing found in XML Nothing found in VyOS
distribute-list Definitions
<ipv4|ipv6>
access-list <in|out>
<number>
× set protocols babel Nothing found in XML Nothing found in VyOS
distribute-list Definitions
<ipv4|ipv6>
interface
<interface>
access-list <in|out>
<number>
× set protocols babel Nothing found in XML Nothing found in VyOS
distribute-list Definitions
<ipv4|ipv6>
interface
<interface>
prefix-list <in|out>
<name>
× not yet documented protocols_babel.xml.in: protocols babel distribute-
protocols babel distribute- list ipv4 access-list in
list ipv4 access-list in <value>
× not yet documented protocols_babel.xml.in: protocols babel distribute-
protocols babel distribute- list ipv4 access-list out
list ipv4 access-list out <value>
× not yet documented protocols_babel.xml.in: protocols babel distribute-
protocols babel distribute- list ipv4 interface <text>
list ipv4 interface <inter- access-list in <value>
face> access-list in
× not yet documented protocols_babel.xml.in: protocols babel distribute-
protocols babel distribute- list ipv4 interface <text>
list ipv4 interface <inter- access-list out <value>
face> access-list out
× not yet documented protocols_babel.xml.in: protocols babel distribute-
protocols babel distribute- list ipv4 interface <text>
list ipv4 interface <inter- prefix-list in <value>
face> prefix-list in
× not yet documented protocols_babel.xml.in: protocols babel distribute-
protocols babel distribute- list ipv4 interface <text>
list ipv4 interface <inter- prefix-list out <value>
face> prefix-list out
continues on next page

21.1. Configuration Commands 1636

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_babel.xml.in: protocols babel distribute-
protocols babel distribute- list ipv4 prefix-list in
list ipv4 prefix-list in <value>
× not yet documented protocols_babel.xml.in: protocols babel distribute-
protocols babel distribute- list ipv4 prefix-list out
list ipv4 prefix-list out <value>
× not yet documented protocols_babel.xml.in: protocols babel distribute-
protocols babel distribute- list ipv6 access-list in
list ipv6 access-list in <value>
× not yet documented protocols_babel.xml.in: protocols babel distribute-
protocols babel distribute- list ipv6 access-list out
list ipv6 access-list out <value>
× not yet documented protocols_babel.xml.in: protocols babel distribute-
protocols babel distribute- list ipv6 interface <text>
list ipv6 interface <inter- access-list in <value>
face> access-list in
× not yet documented protocols_babel.xml.in: protocols babel distribute-
protocols babel distribute- list ipv6 interface <text>
list ipv6 interface <inter- access-list out <value>
face> access-list out
× not yet documented protocols_babel.xml.in: protocols babel distribute-
protocols babel distribute- list ipv6 interface <text>
list ipv6 interface <inter- prefix-list in <value>
face> prefix-list in
× not yet documented protocols_babel.xml.in: protocols babel distribute-
protocols babel distribute- list ipv6 interface <text>
list ipv6 interface <inter- prefix-list out <value>
face> prefix-list out
× not yet documented protocols_babel.xml.in: protocols babel distribute-
protocols babel distribute- list ipv6 prefix-list in
list ipv6 prefix-list in <value>
× not yet documented protocols_babel.xml.in: protocols babel distribute-
protocols babel distribute- list ipv6 prefix-list out
list ipv6 prefix-list out <value>
× set protocols babel Nothing found in XML Nothing found in VyOS
distribute-list Definitions
<ipv4|ipv6>
prefix-list <in|out>
<name>
× set protocols Nothing found in XML Nothing found in VyOS
babel interface Definitions
<interface>
✓ set protocols protocols_babel.xml.in: protocols babel interface
babel interface protocols babel interface <text> channel <value>
<interface> channel <interface> channel
<1-254|interfering|noninterfering>
continues on next page

21.1. Configuration Commands 1637

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set protocols protocols_babel.xml.in: protocols babel interface
babel interface protocols babel interface <text> enable-timestamps
<interface> <interface> enable-
enable-timestamps timestamps
✓ set protocols protocols_babel.xml.in: protocols babel interface
babel interface protocols babel interface <text> hello-interval
<interface> <interface> hello-interval <value>
hello-interval
<milliseconds>
✓ set protocols protocols_babel.xml.in: protocols babel interface
babel interface protocols babel interface <text> max-rtt-penalty
<interface> <interface> max-rtt- <value>
max-rtt-penalty penalty
<milliseconds>
✓ set protocols protocols_babel.xml.in: protocols babel interface
babel interface protocols babel interface <text> rtt-decay <value>
<interface> <interface> rtt-decay
rtt-decay <1-256>
✓ set protocols protocols_babel.xml.in: protocols babel interface
babel interface protocols babel interface <text> rtt-max <value>
<interface> rtt-max <interface> rtt-max
<milliseconds>
✓ set protocols protocols_babel.xml.in: protocols babel interface
babel interface protocols babel interface <text> rtt-min <value>
<interface> rtt-min <interface> rtt-min
<milliseconds>
✓ set protocols protocols_babel.xml.in: protocols babel interface
babel interface protocols babel interface <text> rxcost <value>
<interface> rxcost <interface> rxcost
<1-65534>
✓ set protocols protocols_babel.xml.in: protocols babel inter-
babel interface protocols babel interface face <text> split-horizon
<interface> <interface> split-horizon <value>
split-horizon
<default|disable|enable>
✓ set protocols protocols_babel.xml.in: protocols babel interface
babel interface protocols babel interface <text> type <value>
<interface> type <interface> type
<auto|wired|wireless>
✓ set protocols protocols_babel.xml.in: protocols babel interface
babel interface protocols babel interface <text> update-interval
<interface> <interface> update- <value>
update-interval interval
<milliseconds>
✓ set protocols protocols_babel.xml.in: protocols babel parame-
babel parameters protocols babel parame- ters diversity
diversity ters diversity
continues on next page

21.1. Configuration Commands 1638

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set protocols protocols_babel.xml.in: protocols babel param-
babel parameters protocols babel parame- eters diversity-factor
diversity-factor ters diversity-factor <value>
<1-256>
✓ set protocols protocols_babel.xml.in: protocols babel parame-
babel parameters protocols babel parame- ters resend-delay <value>
resend-delay ters resend-delay
<milliseconds>
✓ set protocols protocols_babel.xml.in: protocols babel parame-
babel parameters protocols babel parame- ters smoothing-half-life
smoothing-half-life ters smoothing-half-life <value>
<seconds>
× set protocols Nothing found in XML Nothing found in VyOS
babel redistribute Definitions
<ipv4|ipv6> <route
source>
× not yet documented protocols_babel.xml.in: protocols babel redis-
protocols babel redis- tribute ipv4 bgp
tribute ipv4 bgp
× not yet documented protocols_babel.xml.in: protocols babel redis-
protocols babel redis- tribute ipv4 connected
tribute ipv4 connected
× not yet documented protocols_babel.xml.in: protocols babel redis-
protocols babel redis- tribute ipv4 eigrp
tribute ipv4 eigrp
× not yet documented protocols_babel.xml.in: protocols babel redis-
protocols babel redis- tribute ipv4 isis
tribute ipv4 isis
× not yet documented protocols_babel.xml.in: protocols babel redis-
protocols babel redis- tribute ipv4 kernel
tribute ipv4 kernel
× not yet documented protocols_babel.xml.in: protocols babel redis-
protocols babel redis- tribute ipv4 nhrp
tribute ipv4 nhrp
× not yet documented protocols_babel.xml.in: protocols babel redis-
protocols babel redis- tribute ipv4 ospf
tribute ipv4 ospf
× not yet documented protocols_babel.xml.in: protocols babel redis-
protocols babel redis- tribute ipv4 rip
tribute ipv4 rip
× not yet documented protocols_babel.xml.in: protocols babel redis-
protocols babel redis- tribute ipv4 static
tribute ipv4 static
× not yet documented protocols_babel.xml.in: protocols babel redis-
protocols babel redis- tribute ipv6 bgp
tribute ipv6 bgp
× not yet documented protocols_babel.xml.in: protocols babel redis-
protocols babel redis- tribute ipv6 connected
tribute ipv6 connected
continues on next page

21.1. Configuration Commands 1639

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_babel.xml.in: protocols babel redis-
protocols babel redis- tribute ipv6 isis
tribute ipv6 isis
× not yet documented protocols_babel.xml.in: protocols babel redis-
protocols babel redis- tribute ipv6 kernel
tribute ipv6 kernel
× not yet documented protocols_babel.xml.in: protocols babel redis-
protocols babel redis- tribute ipv6 nhrp
tribute ipv6 nhrp
× not yet documented protocols_babel.xml.in: protocols babel redis-
protocols babel redis- tribute ipv6 ospfv3
tribute ipv6 ospfv3
× not yet documented protocols_babel.xml.in: protocols babel redis-
protocols babel redis- tribute ipv6 ripng
tribute ipv6 ripng
× not yet documented protocols_babel.xml.in: protocols babel redis-
protocols babel redis- tribute ipv6 static
tribute ipv6 static
× set protocols bfd Nothing found in XML Nothing found in VyOS
peer <address> Definitions
✓ set protocols bfd protocols_bfd.xml.in: protocols bfd peer <text>
peer <address> protocols bfd peer <peer> echo-mode
echo-mode echo-mode
× set protocols bfd Nothing found in XML Nothing found in VyOS
peer <address> Definitions
interval [receive
| transmit]
<10-60000>
✓ set protocols bfd protocols_bfd.xml.in: protocols bfd peer <text>
peer <address> protocols bfd peer <peer> interval echo-interval
interval interval echo-interval <value>
echo-interval
<10-60000>
✓ set protocols bfd protocols_bfd.xml.in: protocols bfd peer
peer <address> protocols bfd peer <peer> <text> interval multi-
interval multiplier interval multiplier plier <value>
<2-255>
× not yet documented protocols_bfd.xml.in: protocols bfd peer <text>
protocols bfd peer <peer> interval receive <value>
interval receive
× not yet documented protocols_bfd.xml.in: protocols bfd peer <text>
protocols bfd peer <peer> interval transmit <value>
interval transmit
× set protocols bfd protocols_bfd.xml.in: Nothing found in VyOS
peer <address> protocols bfd peer <peer>
minimum-ttl <1-254> minimum-ttl
✓ set protocols bfd protocols_bfd.xml.in: protocols bfd peer <text>
peer <address> protocols bfd peer <peer> multihop
multihop multihop
continues on next page

21.1. Configuration Commands 1640

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bfd.xml.in: protocols bfd peer <text>
protocols bfd peer <peer> passive
passive
× not yet documented protocols_bfd.xml.in: protocols bfd peer <text>
protocols bfd peer <peer> profile <value>
profile
✓ set protocols bfd protocols_bfd.xml.in: protocols bfd peer <text>
peer <address> protocols bfd peer <peer> shutdown
shutdown shutdown
× set protocols bfd Nothing found in XML Nothing found in VyOS
peer <address> Definitions
source [address
<address> |
interface
<interface>]
× not yet documented protocols_bfd.xml.in: protocols bfd peer <text>
protocols bfd peer <peer> source address <value>
source address
× not yet documented protocols_bfd.xml.in: protocols bfd peer <text>
protocols bfd peer <peer> source interface <value>
source interface
× not yet documented protocols_bfd.xml.in: protocols bfd peer <text>
protocols bfd peer <peer> vrf <value>
vrf
× not yet documented protocols_bfd.xml.in: protocols bfd profile
protocols bfd profile <pro- <text> echo-mode
file> echo-mode
× not yet documented protocols_bfd.xml.in: protocols bfd profile
protocols bfd profile <pro- <text> interval echo-
file> interval echo-interval interval <value>
× not yet documented protocols_bfd.xml.in: protocols bfd profile
protocols bfd profile <pro- <text> interval multiplier
file> interval multiplier <value>
× not yet documented protocols_bfd.xml.in: protocols bfd profile
protocols bfd profile <pro- <text> interval receive
file> interval receive <value>
× not yet documented protocols_bfd.xml.in: protocols bfd profile
protocols bfd profile <pro- <text> interval transmit
file> interval transmit <value>
× not yet documented protocols_bfd.xml.in: Nothing found in VyOS
protocols bfd profile <pro-
file> minimum-ttl
× not yet documented protocols_bfd.xml.in: protocols bfd profile
protocols bfd profile <pro- <text> passive
file> passive
× not yet documented protocols_bfd.xml.in: protocols bfd profile
protocols bfd profile <pro- <text> shutdown
file> shutdown
continues on next page

21.1. Configuration Commands 1641

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set protocols bgp Nothing found in XML Nothing found in VyOS
address-family Definitions
<ipv4-unicast|ipv6-unicast>
aggregate-address
<prefix>
× set protocols bgp Nothing found in XML Nothing found in VyOS
address-family Definitions
<ipv4-unicast|ipv6-unicast>
aggregate-address
<prefix> as-set
× set protocols bgp Nothing found in XML Nothing found in VyOS
address-family Definitions
<ipv4-unicast|ipv6-unicast>
aggregate-address
<prefix>
summary-only
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-flowspec
family ipv4-flowspec local-install interface
local-install interface <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-labeled-
family ipv4-labeled- unicast aggregate-address
unicast aggregate-address <text> as-set
<aggregate-address>
as-set
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-labeled-
family ipv4-labeled- unicast aggregate-address
unicast aggregate-address <text> route-map <value>
<aggregate-address>
route-map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-labeled-
family ipv4-labeled- unicast aggregate-address
unicast aggregate-address <text> summary-only
<aggregate-address>
summary-only
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp address-
family ipv4-labeled-
unicast maximum-paths
ebgp
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp address-
family ipv4-labeled-
unicast maximum-paths
ibgp
continues on next page

21.1. Configuration Commands 1642

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-labeled-
family ipv4-labeled- unicast network <text>
unicast network <net- backdoor
work> backdoor
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-labeled-
family ipv4-labeled- unicast network <text>
unicast network <net- route-map <value>
work> route-map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-multicast
family ipv4-multicast aggregate-address <text>
aggregate-address as-set
<aggregate-address>
as-set
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-multicast
family ipv4-multicast aggregate-address <text>
aggregate-address route-map <value>
<aggregate-address>
route-map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-multicast
family ipv4-multicast aggregate-address <text>
aggregate-address summary-only
<aggregate-address>
summary-only
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-multicast
family ipv4-multicast distance external <value>
distance external
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-multicast
family ipv4-multicast distance internal <value>
distance internal
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-multicast
family ipv4-multicast distance local <value>
distance local
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-multicast
family ipv4-multicast distance prefix <text>
distance prefix <prefix> distance <value>
distance
continues on next page

21.1. Configuration Commands 1643

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-multicast
family ipv4-multicast network <text> backdoor
network <network>
backdoor
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-multicast
family ipv4-multicast network <text> route-map
network <network> <value>
route-map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast aggregate-address <text>
aggregate-address as-set
<aggregate-address>
as-set
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast aggregate-address <text>
aggregate-address route-map <value>
<aggregate-address>
route-map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast aggregate-address <text>
aggregate-address summary-only
<aggregate-address>
summary-only
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast distance external <value>
distance external
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast distance internal <value>
distance internal
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast distance local <value>
distance local
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast distance prefix <text>
distance prefix <prefix> distance <value>
distance
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast export
family ipv4-unicast export vpn
vpn
continues on next page

21.1. Configuration Commands 1644

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast import
family ipv4-unicast import vpn
vpn
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast import
family ipv4-unicast import vrf <value>
vrf
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast label
family ipv4-unicast label vpn allocation-mode
vpn allocation-mode per-nexthop
per-nexthop
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast label
family ipv4-unicast label vpn export <value>
vpn export
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast maximum-paths ebgp
maximum-paths ebgp <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast maximum-paths ibgp
maximum-paths ibgp <value>
✓ set protocols bgp protocols_bgp.xml.in: protocols bgp address-
address-family protocols bgp address- family ipv4-unicast
ipv4-unicast network family ipv4-unicast network <text> backdoor
<prefix> backdoor network <network>
backdoor
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast network <text> route-map
network <network> <value>
route-map
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp address-
family ipv4-unicast
nexthop vpn export
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast rd vpn
family ipv4-unicast rd vpn export <value>
export
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast redistribute babel metric
redistribute babel metric <value>
continues on next page

21.1. Configuration Commands 1645

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast redis-
family ipv4-unicast tribute babel route-map
redistribute babel route- <value>
map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast redistribute connected
redistribute connected metric <value>
metric
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast redistribute connected
redistribute connected route-map <value>
route-map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast redistribute isis metric
redistribute isis metric <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast redistribute isis route-map
redistribute isis route-map <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast redistribute kernel metric
redistribute kernel metric <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast redis-
family ipv4-unicast tribute kernel route-map
redistribute kernel route- <value>
map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast redistribute ospf metric
redistribute ospf metric <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast re-
family ipv4-unicast distribute ospf route-map
redistribute ospf route- <value>
map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast redistribute rip metric
redistribute rip metric <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast redistribute rip route-map
redistribute rip route-map <value>
continues on next page

21.1. Configuration Commands 1646

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast redistribute static metric
redistribute static metric <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast redis-
family ipv4-unicast tribute static route-map
redistribute static route- <value>
map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast redistribute table <value>
redistribute table
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast route-map vpn export
route-map vpn export <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast route-map vpn import
route-map vpn import <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast route-target vpn both
route-target vpn both <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast route-target vpn export
route-target vpn export <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-unicast
family ipv4-unicast route-target vpn import
route-target vpn import <value>
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp address-
family ipv4-unicast sid
vpn export
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-vpn network
family ipv4-vpn network <text> label <value>
<network> label
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv4-vpn network
family ipv4-vpn network <text> rd <value>
<network> rd
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-flowspec
family ipv6-flowspec local-install interface
local-install interface <value>
continues on next page

21.1. Configuration Commands 1647

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-labeled-
family ipv6-labeled- unicast aggregate-address
unicast aggregate-address <text> as-set
<aggregate-address>
as-set
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-labeled-
family ipv6-labeled- unicast aggregate-address
unicast aggregate-address <text> route-map <value>
<aggregate-address>
route-map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-labeled-
family ipv6-labeled- unicast aggregate-address
unicast aggregate-address <text> summary-only
<aggregate-address>
summary-only
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-labeled-
family ipv6-labeled- unicast network <text>
unicast network <net- backdoor
work> backdoor
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-labeled-
family ipv6-labeled- unicast network <text>
unicast network <net- route-map <value>
work> route-map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-multicast
family ipv6-multicast aggregate-address <text>
aggregate-address as-set
<aggregate-address>
as-set
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-multicast
family ipv6-multicast aggregate-address <text>
aggregate-address route-map <value>
<aggregate-address>
route-map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-multicast
family ipv6-multicast aggregate-address <text>
aggregate-address summary-only
<aggregate-address>
summary-only
continues on next page

21.1. Configuration Commands 1648

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-multicast
family ipv6-multicast distance external <value>
distance external
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-multicast
family ipv6-multicast distance internal <value>
distance internal
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-multicast
family ipv6-multicast distance local <value>
distance local
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-multicast
family ipv6-multicast distance prefix <text>
distance prefix <prefix> distance <value>
distance
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-multicast
family ipv6-multicast network <text> path-limit
network <network> <value>
path-limit
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-multicast
family ipv6-multicast network <text> route-map
network <network> <value>
route-map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast aggregate-address <text>
aggregate-address as-set
<aggregate-address>
as-set
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast aggregate-address <text>
aggregate-address route-map <value>
<aggregate-address>
route-map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast aggregate-address <text>
aggregate-address summary-only
<aggregate-address>
summary-only
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast distance external <value>
distance external
continues on next page

21.1. Configuration Commands 1649

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast distance internal <value>
distance internal
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast distance local <value>
distance local
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast distance prefix <text>
distance prefix <prefix> distance <value>
distance
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast export
family ipv6-unicast export vpn
vpn
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast import
family ipv6-unicast import vpn
vpn
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast import
family ipv6-unicast import vrf <value>
vrf
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast label
family ipv6-unicast label vpn allocation-mode
vpn allocation-mode per-nexthop
per-nexthop
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast label
family ipv6-unicast label vpn export <value>
vpn export
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast maximum-paths ebgp
maximum-paths ebgp <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast maximum-paths ibgp
maximum-paths ibgp <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast network <text> path-limit
network <network> <value>
path-limit
continues on next page

21.1. Configuration Commands 1650

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast network <text> route-map
network <network> <value>
route-map
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp address-
family ipv6-unicast
nexthop vpn export
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast rd vpn
family ipv6-unicast rd vpn export <value>
export
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast redistribute babel metric
redistribute babel metric <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast redis-
family ipv6-unicast tribute babel route-map
redistribute babel route- <value>
map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast redistribute connected
redistribute connected metric <value>
metric
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast redistribute connected
redistribute connected route-map <value>
route-map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast redistribute kernel metric
redistribute kernel metric <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast redis-
family ipv6-unicast tribute kernel route-map
redistribute kernel route- <value>
map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast redistribute ospfv3 metric
redistribute ospfv3 metric <value>
continues on next page

21.1. Configuration Commands 1651

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast redis-
family ipv6-unicast tribute ospfv3 route-map
redistribute ospfv3 route- <value>
map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast redistribute ripng metric
redistribute ripng metric <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast redis-
family ipv6-unicast tribute ripng route-map
redistribute ripng route- <value>
map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast redistribute static metric
redistribute static metric <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast redis-
family ipv6-unicast tribute static route-map
redistribute static route- <value>
map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast redistribute table <value>
redistribute table
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast route-map vpn export
route-map vpn export <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast route-map vpn import
route-map vpn import <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast route-target vpn both
route-target vpn both <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast route-target vpn export
route-target vpn export <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-unicast
family ipv6-unicast route-target vpn import
route-target vpn import <value>
continues on next page

21.1. Configuration Commands 1652

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp address-
family ipv6-unicast sid
vpn export
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-vpn network
family ipv6-vpn network <text> label <value>
<network> label
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family ipv6-vpn network
family ipv6-vpn network <text> rd <value>
<network> rd
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family l2vpn-evpn
family l2vpn-evpn advertise-all-vni
advertise-all-vni
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family l2vpn-evpn
family l2vpn-evpn advertise-default-gw
advertise-default-gw
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family l2vpn-evpn
family l2vpn-evpn advertise-pip <value>
advertise-pip
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family l2vpn-evpn
family l2vpn-evpn advertise-svi-ip
advertise-svi-ip
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family l2vpn-evpn ad-
family l2vpn-evpn ad- vertise ipv4 unicast
vertise ipv4 unicast route-map <value>
route-map
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family l2vpn-evpn ad-
family l2vpn-evpn ad- vertise ipv6 unicast
vertise ipv6 unicast route-map <value>
route-map
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp address-
family l2vpn-evpn default-
originate ipv4
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp address-
family l2vpn-evpn default-
originate ipv6
continues on next page

21.1. Configuration Commands 1653

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp address-
family l2vpn-evpn
disable-ead-evi-rx
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp address-
family l2vpn-evpn
disable-ead-evi-tx
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp address-
family l2vpn-evpn ead-es-
frag evi-limit
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp address-
family l2vpn-evpn ead-es-
route-target export
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family l2vpn-evpn flood-
family l2vpn-evpn flood- ing disable
ing disable
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family l2vpn-evpn flood-
family l2vpn-evpn flood- ing head-end-replication
ing head-end-replication
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp address-
family l2vpn-evpn mac-
vrf soo
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family l2vpn-evpn rd
family l2vpn-evpn rd <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family l2vpn-evpn route-
family l2vpn-evpn route- target both <value>
target both
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family l2vpn-evpn route-
family l2vpn-evpn route- target export <value>
target export
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family l2vpn-evpn route-
family l2vpn-evpn route- target import <value>
target import
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family l2vpn-evpn rt-auto-
family l2vpn-evpn rt-auto- derive
derive
continues on next page

21.1. Configuration Commands 1654

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family l2vpn-evpn vni
family l2vpn-evpn vni <text> advertise-default-
<vni> advertise-default- gw
gw
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family l2vpn-evpn vni
family l2vpn-evpn vni <text> advertise-svi-ip
<vni> advertise-svi-ip
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family l2vpn-evpn vni
family l2vpn-evpn vni <text> rd <value>
<vni> rd
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family l2vpn-evpn vni
family l2vpn-evpn vni <text> route-target both
<vni> route-target both <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family l2vpn-evpn vni
family l2vpn-evpn vni <text> route-target export
<vni> route-target export <value>
× not yet documented protocols_bgp.xml.in: protocols bgp address-
protocols bgp address- family l2vpn-evpn vni
family l2vpn-evpn vni <text> route-target import
<vni> route-target import <value>
× set protocols bgp Nothing found in XML Nothing found in VyOS
address-family Definitions
<ipv4-unicast|ipv6-unicast>
maximum-paths
<ebgp|ibgp>
<number>
× set protocols bgp Nothing found in XML Nothing found in VyOS
address-family Definitions
<ipv4-unicast|ipv6-unicast>
network <prefix>
× set protocols bgp Nothing found in XML Nothing found in VyOS
address-family Definitions
<ipv4-unicast|ipv6-unicast>
redistribute <route
source>
× set protocols bgp Nothing found in XML Nothing found in VyOS
address-family Definitions
<ipv4-unicast|ipv6-unicast>
redistribute <route
source> metric
<number>
continues on next page

21.1. Configuration Commands 1655

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set protocols bgp Nothing found in XML Nothing found in VyOS
address-family Definitions
<ipv4-unicast|ipv6-unicast>
redistribute <route
source> route-map
<name>
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp bmp mirror-
buffer-limit
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp bmp target
<target> address
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp bmp target
<target> max-retry
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp bmp target
<target> min-retry
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp bmp target
<target> mirror
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp bmp tar-
get <target> monitor ipv4-
unicast post-policy
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp bmp tar-
get <target> monitor ipv4-
unicast pre-policy
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp bmp tar-
get <target> monitor ipv6-
unicast post-policy
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp bmp tar-
get <target> monitor ipv6-
unicast pre-policy
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp bmp target
<target> port
× not yet documented protocols_bgp.xml.in: protocols bgp interface
protocols bgp inter- <text> mpls forwarding
face <interface> mpls
forwarding
✓ set protocols protocols_bgp.xml.in: protocols bgp listen limit
bgp listen limit protocols bgp listen limit <value>
<number>
continues on next page

21.1. Configuration Commands 1656

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set protocols protocols_bgp.xml.in: protocols bgp listen
bgp listen range protocols bgp listen range range <text> peer-group
<prefix> peer-group <range> peer-group <value>
<name>
× set protocols Nothing found in XML Nothing found in VyOS
bgp neighbor Definitions
<address|interface>
address-family
<ipv4-unicast|ipv6-unicast>
allowas-in number
<number>
× set protocols Nothing found in XML Nothing found in VyOS
bgp neighbor Definitions
<address|interface>
address-family
<ipv4-unicast|ipv6-unicast>
as-override
× set protocols Nothing found in XML Nothing found in VyOS
bgp neighbor Definitions
<address|interface>
address-family
<ipv4-unicast|ipv6-unicast>
attribute-unchanged
<as-path|med|next-hop>
× set protocols Nothing found in XML Nothing found in VyOS
bgp neighbor Definitions
<address|interface>
address-family
<ipv4-unicast|ipv6-unicast>
capability orf
<receive|send>
× set protocols Nothing found in XML Nothing found in VyOS
bgp neighbor Definitions
<address|interface>
address-family
<ipv4-unicast|ipv6-unicast>
default-originate
[route-map <name>]
× set protocols Nothing found in XML Nothing found in VyOS
bgp neighbor Definitions
<address|interface>
address-family
<ipv4-unicast|ipv6-unicast>
distribute-list
<export|import>
<number>
continues on next page

21.1. Configuration Commands 1657

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set protocols Nothing found in XML Nothing found in VyOS
bgp neighbor Definitions
<address|interface>
address-family
<ipv4-unicast|ipv6-unicast>
filter-list
<export|import>
<name>
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-flowspec filter-list
family ipv4-flowspec export <value>
filter-list export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-flowspec filter-list
family ipv4-flowspec import <value>
filter-list import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-flowspec prefix-list
family ipv4-flowspec export <value>
prefix-list export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-flowspec prefix-list
family ipv4-flowspec import <value>
prefix-list import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-flowspec route-map
family ipv4-flowspec export <value>
route-map export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-flowspec route-map
family ipv4-flowspec import <value>
route-map import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-flowspec route-
family ipv4-flowspec reflector-client
route-reflector-client
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-flowspec route-
family ipv4-flowspec server-client
route-server-client
continues on next page

21.1. Configuration Commands 1658

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-flowspec soft-
family ipv4-flowspec reconfiguration inbound
soft-reconfiguration
inbound
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- addpath-tx-all
unicast addpath-tx-all
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- addpath-tx-per-as
unicast addpath-tx-per-as
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- allowas-in number
unicast allowas-in number <value>
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- as-override
unicast as-override
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- attribute-unchanged
unicast attribute- as-path
unchanged as-path
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- attribute-unchanged med
unicast attribute-
unchanged med
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- attribute-unchanged
unicast attribute- next-hop
unchanged next-hop
continues on next page

21.1. Configuration Commands 1659

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast ca-
family ipv4-labeled- pability orf prefix-list
unicast capability orf receive
prefix-list receive
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast ca-
family ipv4-labeled- pability orf prefix-list
unicast capability orf send
prefix-list send
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- conditionally-advertise
unicast conditionally- advertise-map <value>
advertise advertise-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- conditionally-advertise
unicast conditionally- exist-map <value>
advertise exist-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- conditionally-advertise
unicast conditionally- non-exist-map <value>
advertise non-exist-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- default-originate route-
unicast default-originate map <value>
route-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- disable-send-community
unicast disable-send- extended
community extended
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- disable-send-community
unicast disable-send- standard
community standard
continues on next page

21.1. Configuration Commands 1660

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- distribute-list export
unicast distribute-list <value>
export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- distribute-list import
unicast distribute-list <value>
import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- filter-list export <value>
unicast filter-list export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- filter-list import <value>
unicast filter-list import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- maximum-prefix <value>
unicast maximum-prefix
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- maximum-prefix-out
unicast maximum-prefix- <value>
out
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- nexthop-self force
unicast nexthop-self
force
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- prefix-list export <value>
unicast prefix-list export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- prefix-list import <value>
unicast prefix-list import
continues on next page

21.1. Configuration Commands 1661

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented Nothing found in XML protocols bgp neighbor
Definitions <text> address-family
ipv4-labeled-unicast
remove-private-as
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp neighbor
<neighbor> address-
family ipv4-labeled-
unicast remove-private-as
all
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- route-map export <value>
unicast route-map export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- route-map import <value>
unicast route-map import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- route-reflector-client
unicast route-reflector-
client
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- route-server-client
unicast route-server-client
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neigh- <text> address-family
bor <neighbor> ipv4-labeled-unicast soft-
address-family ipv4- reconfiguration inbound
labeled-unicast soft-
reconfiguration inbound
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- unsuppress-map <value>
unicast unsuppress-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-labeled-unicast
family ipv4-labeled- weight <value>
unicast weight
continues on next page

21.1. Configuration Commands 1662

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast addpath-
family ipv4-multicast tx-all
addpath-tx-all
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast addpath-
family ipv4-multicast tx-per-as
addpath-tx-per-as
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast allowas-in
family ipv4-multicast number <value>
allowas-in number
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast as-override
family ipv4-multicast
as-override
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast attribute-
family ipv4-multicast unchanged as-path
attribute-unchanged
as-path
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast attribute-
family ipv4-multicast unchanged med
attribute-unchanged med
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast attribute-
family ipv4-multicast unchanged next-hop
attribute-unchanged
next-hop
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast capability
family ipv4-multicast orf prefix-list receive
capability orf prefix-list
receive
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast capability
family ipv4-multicast orf prefix-list send
capability orf prefix-list
send
continues on next page

21.1. Configuration Commands 1663

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neigh-
protocols bgp neighbor bor <text> address-
<neighbor> address- family ipv4-multicast
family ipv4-multicast conditionally-advertise
conditionally-advertise advertise-map <value>
advertise-map
× not yet documented protocols_bgp.xml.in: protocols bgp neigh-
protocols bgp neighbor bor <text> address-
<neighbor> address- family ipv4-multicast
family ipv4-multicast conditionally-advertise
conditionally-advertise exist-map <value>
exist-map
× not yet documented protocols_bgp.xml.in: protocols bgp neigh-
protocols bgp neighbor bor <text> address-
<neighbor> address- family ipv4-multicast
family ipv4-multicast conditionally-advertise
conditionally-advertise non-exist-map <value>
non-exist-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast default-
family ipv4-multicast originate route-map
default-originate route- <value>
map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast disable-
family ipv4-multicast send-community extended
disable-send-community
extended
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast disable-
family ipv4-multicast send-community standard
disable-send-community
standard
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast distribute-
family ipv4-multicast list export <value>
distribute-list export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast distribute-
family ipv4-multicast list import <value>
distribute-list import
continues on next page

21.1. Configuration Commands 1664

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast filter-list
family ipv4-multicast export <value>
filter-list export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast filter-list
family ipv4-multicast import <value>
filter-list import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast maximum-
family ipv4-multicast prefix <value>
maximum-prefix
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast maximum-
family ipv4-multicast prefix-out <value>
maximum-prefix-out
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast nexthop-
family ipv4-multicast self force
nexthop-self force
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast prefix-list
family ipv4-multicast export <value>
prefix-list export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast prefix-list
family ipv4-multicast import <value>
prefix-list import
× not yet documented Nothing found in XML protocols bgp neighbor
Definitions <text> address-family
ipv4-multicast remove-
private-as
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp neighbor
<neighbor> address-
family ipv4-multicast
remove-private-as all
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast route-map
family ipv4-multicast export <value>
route-map export
continues on next page

21.1. Configuration Commands 1665

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast route-map
family ipv4-multicast import <value>
route-map import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast route-
family ipv4-multicast reflector-client
route-reflector-client
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast route-
family ipv4-multicast server-client
route-server-client
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast soft-
family ipv4-multicast reconfiguration inbound
soft-reconfiguration
inbound
× not yet documented protocols_bgp.xml.in: protocols bgp neigh-
protocols bgp neighbor bor <text> address-
<neighbor> address- family ipv4-multicast
family ipv4-multicast unsuppress-map <value>
unsuppress-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-multicast weight
family ipv4-multicast <value>
weight
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast addpath-tx-
family ipv4-unicast all
addpath-tx-all
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast addpath-tx-
family ipv4-unicast per-as
addpath-tx-per-as
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast allowas-in
family ipv4-unicast number <value>
allowas-in number
continues on next page

21.1. Configuration Commands 1666

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast as-override
family ipv4-unicast
as-override
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast attribute-
family ipv4-unicast unchanged as-path
attribute-unchanged
as-path
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast attribute-
family ipv4-unicast unchanged med
attribute-unchanged med
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast attribute-
family ipv4-unicast unchanged next-hop
attribute-unchanged
next-hop
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast capability orf
family ipv4-unicast prefix-list receive
capability orf prefix-list
receive
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast capability orf
family ipv4-unicast prefix-list send
capability orf prefix-list
send
× not yet documented protocols_bgp.xml.in: protocols bgp neigh-
protocols bgp neighbor bor <text> address-
<neighbor> address- family ipv4-unicast
family ipv4-unicast conditionally-advertise
conditionally-advertise advertise-map <value>
advertise-map
× not yet documented protocols_bgp.xml.in: protocols bgp neigh-
protocols bgp neighbor bor <text> address-
<neighbor> address- family ipv4-unicast
family ipv4-unicast conditionally-advertise
conditionally-advertise exist-map <value>
exist-map
continues on next page

21.1. Configuration Commands 1667

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neigh-
protocols bgp neighbor bor <text> address-
<neighbor> address- family ipv4-unicast
family ipv4-unicast conditionally-advertise
conditionally-advertise non-exist-map <value>
non-exist-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast default-
family ipv4-unicast originate route-map
default-originate route- <value>
map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast disable-send-
family ipv4-unicast community extended
disable-send-community
extended
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast disable-send-
family ipv4-unicast community standard
disable-send-community
standard
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast distribute-list
family ipv4-unicast export <value>
distribute-list export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast distribute-list
family ipv4-unicast import <value>
distribute-list import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast filter-list
family ipv4-unicast export <value>
filter-list export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast filter-list
family ipv4-unicast import <value>
filter-list import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast maximum-
family ipv4-unicast prefix <value>
maximum-prefix
continues on next page

21.1. Configuration Commands 1668

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast maximum-
family ipv4-unicast prefix-out <value>
maximum-prefix-out
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast nexthop-self
family ipv4-unicast force
nexthop-self force
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast prefix-list
family ipv4-unicast export <value>
prefix-list export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast prefix-list
family ipv4-unicast import <value>
prefix-list import
× not yet documented Nothing found in XML protocols bgp neighbor
Definitions <text> address-family
ipv4-unicast remove-
private-as
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp neighbor
<neighbor> address-
family ipv4-unicast
remove-private-as all
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast route-map
family ipv4-unicast export <value>
route-map export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast route-map
family ipv4-unicast import <value>
route-map import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast route-
family ipv4-unicast reflector-client
route-reflector-client
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast route-server-
family ipv4-unicast client
route-server-client
continues on next page

21.1. Configuration Commands 1669

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neigh-
protocols bgp neighbor bor <text> address-
<neighbor> address- family ipv4-unicast
family ipv4-unicast soft-reconfiguration
soft-reconfiguration inbound
inbound
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast unsuppress-
family ipv4-unicast map <value>
unsuppress-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-unicast weight
family ipv4-unicast <value>
weight
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn addpath-tx-all
family ipv4-vpn addpath-
tx-all
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn addpath-tx-per-
family ipv4-vpn addpath- as
tx-per-as
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn allowas-in
family ipv4-vpn allowas- number <value>
in number
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn as-override
family ipv4-vpn as-
override
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn attribute-
family ipv4-vpn attribute- unchanged as-path
unchanged as-path
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn attribute-
family ipv4-vpn attribute- unchanged med
unchanged med
continues on next page

21.1. Configuration Commands 1670

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn attribute-
family ipv4-vpn attribute- unchanged next-hop
unchanged next-hop
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn conditionally-
family ipv4-vpn advertise advertise-map
conditionally-advertise <value>
advertise-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn conditionally-
family ipv4-vpn advertise exist-map
conditionally-advertise <value>
exist-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn conditionally-
family ipv4-vpn advertise non-exist-map
conditionally-advertise <value>
non-exist-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn disable-send-
family ipv4-vpn disable- community extended
send-community extended
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn disable-send-
family ipv4-vpn disable- community standard
send-community standard
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn distribute-list
family ipv4-vpn export <value>
distribute-list export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn distribute-list
family ipv4-vpn import <value>
distribute-list import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn filter-list export
family ipv4-vpn filter-list <value>
export
continues on next page

21.1. Configuration Commands 1671

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn filter-list import
family ipv4-vpn filter-list <value>
import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn maximum-prefix
family ipv4-vpn <value>
maximum-prefix
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn maximum-
family ipv4-vpn prefix-out <value>
maximum-prefix-out
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn nexthop-self
family ipv4-vpn nexthop- force
self force
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn prefix-list export
family ipv4-vpn prefix-list <value>
export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn prefix-list
family ipv4-vpn prefix-list import <value>
import
× not yet documented Nothing found in XML protocols bgp neighbor
Definitions <text> address-family
ipv4-vpn remove-private-
as
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp neighbor
<neighbor> address-
family ipv4-vpn remove-
private-as all
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn route-map
family ipv4-vpn route- export <value>
map export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn route-map
family ipv4-vpn route- import <value>
map import
continues on next page

21.1. Configuration Commands 1672

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn route-reflector-
family ipv4-vpn route- client
reflector-client
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn route-server-
family ipv4-vpn route- client
server-client
× not yet documented protocols_bgp.xml.in: protocols bgp neigh-
protocols bgp neighbor bor <text> address-
<neighbor> address- family ipv4-vpn soft-
family ipv4-vpn soft- reconfiguration inbound
reconfiguration inbound
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn unsuppress-map
family ipv4-vpn <value>
unsuppress-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv4-vpn weight <value>
family ipv4-vpn weight
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-flowspec filter-list
family ipv6-flowspec export <value>
filter-list export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-flowspec filter-list
family ipv6-flowspec import <value>
filter-list import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-flowspec prefix-list
family ipv6-flowspec export <value>
prefix-list export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-flowspec prefix-list
family ipv6-flowspec import <value>
prefix-list import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-flowspec route-map
family ipv6-flowspec export <value>
route-map export
continues on next page

21.1. Configuration Commands 1673

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-flowspec route-map
family ipv6-flowspec import <value>
route-map import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-flowspec route-
family ipv6-flowspec reflector-client
route-reflector-client
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-flowspec route-
family ipv6-flowspec server-client
route-server-client
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-flowspec soft-
family ipv6-flowspec reconfiguration inbound
soft-reconfiguration
inbound
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- addpath-tx-all
unicast addpath-tx-all
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- addpath-tx-per-as
unicast addpath-tx-per-as
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- allowas-in number
unicast allowas-in number <value>
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- as-override
unicast as-override
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- attribute-unchanged
unicast attribute- as-path
unchanged as-path
continues on next page

21.1. Configuration Commands 1674

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- attribute-unchanged med
unicast attribute-
unchanged med
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- attribute-unchanged
unicast attribute- next-hop
unchanged next-hop
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast ca-
family ipv6-labeled- pability orf prefix-list
unicast capability orf receive
prefix-list receive
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast ca-
family ipv6-labeled- pability orf prefix-list
unicast capability orf send
prefix-list send
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- conditionally-advertise
unicast conditionally- advertise-map <value>
advertise advertise-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- conditionally-advertise
unicast conditionally- exist-map <value>
advertise exist-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- conditionally-advertise
unicast conditionally- non-exist-map <value>
advertise non-exist-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- default-originate route-
unicast default-originate map <value>
route-map
continues on next page

21.1. Configuration Commands 1675

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- disable-send-community
unicast disable-send- extended
community extended
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- disable-send-community
unicast disable-send- standard
community standard
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- distribute-list export
unicast distribute-list <value>
export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- distribute-list import
unicast distribute-list <value>
import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- filter-list export <value>
unicast filter-list export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- filter-list import <value>
unicast filter-list import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- maximum-prefix <value>
unicast maximum-prefix
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- maximum-prefix-out
unicast maximum-prefix- <value>
out
continues on next page

21.1. Configuration Commands 1676

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- nexthop-local unchanged
unicast nexthop-local
unchanged
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- nexthop-self force
unicast nexthop-self
force
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- prefix-list export <value>
unicast prefix-list export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- prefix-list import <value>
unicast prefix-list import
× not yet documented Nothing found in XML protocols bgp neighbor
Definitions <text> address-family
ipv6-labeled-unicast
remove-private-as
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp neighbor
<neighbor> address-
family ipv6-labeled-
unicast remove-private-as
all
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- route-map export <value>
unicast route-map export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- route-map import <value>
unicast route-map import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- route-reflector-client
unicast route-reflector-
client
continues on next page

21.1. Configuration Commands 1677

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- route-server-client
unicast route-server-client
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neigh- <text> address-family
bor <neighbor> ipv6-labeled-unicast soft-
address-family ipv6- reconfiguration inbound
labeled-unicast soft-
reconfiguration inbound
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- unsuppress-map <value>
unicast unsuppress-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-labeled-unicast
family ipv6-labeled- weight <value>
unicast weight
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast addpath-
family ipv6-multicast tx-all
addpath-tx-all
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast addpath-
family ipv6-multicast tx-per-as
addpath-tx-per-as
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast allowas-in
family ipv6-multicast number <value>
allowas-in number
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast as-override
family ipv6-multicast
as-override
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast attribute-
family ipv6-multicast unchanged as-path
attribute-unchanged
as-path
continues on next page

21.1. Configuration Commands 1678

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast attribute-
family ipv6-multicast unchanged med
attribute-unchanged med
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast attribute-
family ipv6-multicast unchanged next-hop
attribute-unchanged
next-hop
× not yet documented protocols_bgp.xml.in: protocols bgp neigh-
protocols bgp neighbor bor <text> address-
<neighbor> address- family ipv6-multicast
family ipv6-multicast conditionally-advertise
conditionally-advertise advertise-map <value>
advertise-map
× not yet documented protocols_bgp.xml.in: protocols bgp neigh-
protocols bgp neighbor bor <text> address-
<neighbor> address- family ipv6-multicast
family ipv6-multicast conditionally-advertise
conditionally-advertise exist-map <value>
exist-map
× not yet documented protocols_bgp.xml.in: protocols bgp neigh-
protocols bgp neighbor bor <text> address-
<neighbor> address- family ipv6-multicast
family ipv6-multicast conditionally-advertise
conditionally-advertise non-exist-map <value>
non-exist-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast default-
family ipv6-multicast originate route-map
default-originate route- <value>
map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast disable-
family ipv6-multicast send-community extended
disable-send-community
extended
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast disable-
family ipv6-multicast send-community standard
disable-send-community
standard
continues on next page

21.1. Configuration Commands 1679

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast distribute-
family ipv6-multicast list export <value>
distribute-list export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast distribute-
family ipv6-multicast list import <value>
distribute-list import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast filter-list
family ipv6-multicast export <value>
filter-list export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast filter-list
family ipv6-multicast import <value>
filter-list import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast maximum-
family ipv6-multicast prefix <value>
maximum-prefix
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast maximum-
family ipv6-multicast prefix-out <value>
maximum-prefix-out
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast nexthop-
family ipv6-multicast local unchanged
nexthop-local unchanged
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast nexthop-
family ipv6-multicast self force
nexthop-self force
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast prefix-list
family ipv6-multicast export <value>
prefix-list export
continues on next page

21.1. Configuration Commands 1680

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast prefix-list
family ipv6-multicast import <value>
prefix-list import
× not yet documented Nothing found in XML protocols bgp neighbor
Definitions <text> address-family
ipv6-multicast remove-
private-as
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp neighbor
<neighbor> address-
family ipv6-multicast
remove-private-as all
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast route-map
family ipv6-multicast export <value>
route-map export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast route-map
family ipv6-multicast import <value>
route-map import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast route-
family ipv6-multicast reflector-client
route-reflector-client
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast route-
family ipv6-multicast server-client
route-server-client
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast soft-
family ipv6-multicast reconfiguration inbound
soft-reconfiguration
inbound
× not yet documented protocols_bgp.xml.in: protocols bgp neigh-
protocols bgp neighbor bor <text> address-
<neighbor> address- family ipv6-multicast
family ipv6-multicast unsuppress-map <value>
unsuppress-map
continues on next page

21.1. Configuration Commands 1681

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-multicast weight
family ipv6-multicast <value>
weight
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast addpath-tx-
family ipv6-unicast all
addpath-tx-all
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast addpath-tx-
family ipv6-unicast per-as
addpath-tx-per-as
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast allowas-in
family ipv6-unicast number <value>
allowas-in number
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast as-override
family ipv6-unicast
as-override
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast attribute-
family ipv6-unicast unchanged as-path
attribute-unchanged
as-path
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast attribute-
family ipv6-unicast unchanged med
attribute-unchanged med
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast attribute-
family ipv6-unicast unchanged next-hop
attribute-unchanged
next-hop
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast capability orf
family ipv6-unicast prefix-list receive
capability orf prefix-list
receive
continues on next page

21.1. Configuration Commands 1682

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast capability orf
family ipv6-unicast prefix-list send
capability orf prefix-list
send
× not yet documented protocols_bgp.xml.in: protocols bgp neigh-
protocols bgp neighbor bor <text> address-
<neighbor> address- family ipv6-unicast
family ipv6-unicast conditionally-advertise
conditionally-advertise advertise-map <value>
advertise-map
× not yet documented protocols_bgp.xml.in: protocols bgp neigh-
protocols bgp neighbor bor <text> address-
<neighbor> address- family ipv6-unicast
family ipv6-unicast conditionally-advertise
conditionally-advertise exist-map <value>
exist-map
× not yet documented protocols_bgp.xml.in: protocols bgp neigh-
protocols bgp neighbor bor <text> address-
<neighbor> address- family ipv6-unicast
family ipv6-unicast conditionally-advertise
conditionally-advertise non-exist-map <value>
non-exist-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast default-
family ipv6-unicast originate route-map
default-originate route- <value>
map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast disable-send-
family ipv6-unicast community extended
disable-send-community
extended
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast disable-send-
family ipv6-unicast community standard
disable-send-community
standard
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast distribute-list
family ipv6-unicast export <value>
distribute-list export
continues on next page

21.1. Configuration Commands 1683

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast distribute-list
family ipv6-unicast import <value>
distribute-list import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast filter-list
family ipv6-unicast export <value>
filter-list export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast filter-list
family ipv6-unicast import <value>
filter-list import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast maximum-
family ipv6-unicast prefix <value>
maximum-prefix
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast maximum-
family ipv6-unicast prefix-out <value>
maximum-prefix-out
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast nexthop-
family ipv6-unicast local unchanged
nexthop-local unchanged
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast nexthop-self
family ipv6-unicast force
nexthop-self force
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast prefix-list
family ipv6-unicast export <value>
prefix-list export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast prefix-list
family ipv6-unicast import <value>
prefix-list import
× not yet documented Nothing found in XML protocols bgp neighbor
Definitions <text> address-family
ipv6-unicast remove-
private-as
continues on next page

21.1. Configuration Commands 1684

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp neighbor
<neighbor> address-
family ipv6-unicast
remove-private-as all
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast route-map
family ipv6-unicast export <value>
route-map export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast route-map
family ipv6-unicast import <value>
route-map import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast route-
family ipv6-unicast reflector-client
route-reflector-client
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast route-server-
family ipv6-unicast client
route-server-client
× not yet documented protocols_bgp.xml.in: protocols bgp neigh-
protocols bgp neighbor bor <text> address-
<neighbor> address- family ipv6-unicast
family ipv6-unicast soft-reconfiguration
soft-reconfiguration inbound
inbound
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast unsuppress-
family ipv6-unicast map <value>
unsuppress-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-unicast weight
family ipv6-unicast <value>
weight
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn addpath-tx-all
family ipv6-vpn addpath-
tx-all
continues on next page

21.1. Configuration Commands 1685

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn addpath-tx-per-
family ipv6-vpn addpath- as
tx-per-as
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn allowas-in
family ipv6-vpn allowas- number <value>
in number
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn as-override
family ipv6-vpn as-
override
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn attribute-
family ipv6-vpn attribute- unchanged as-path
unchanged as-path
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn attribute-
family ipv6-vpn attribute- unchanged med
unchanged med
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn attribute-
family ipv6-vpn attribute- unchanged next-hop
unchanged next-hop
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn conditionally-
family ipv6-vpn advertise advertise-map
conditionally-advertise <value>
advertise-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn conditionally-
family ipv6-vpn advertise exist-map
conditionally-advertise <value>
exist-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn conditionally-
family ipv6-vpn advertise non-exist-map
conditionally-advertise <value>
non-exist-map
continues on next page

21.1. Configuration Commands 1686

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn disable-send-
family ipv6-vpn disable- community extended
send-community extended
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn disable-send-
family ipv6-vpn disable- community standard
send-community standard
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn distribute-list
family ipv6-vpn export <value>
distribute-list export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn distribute-list
family ipv6-vpn import <value>
distribute-list import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn filter-list export
family ipv6-vpn filter-list <value>
export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn filter-list import
family ipv6-vpn filter-list <value>
import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn maximum-prefix
family ipv6-vpn <value>
maximum-prefix
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn maximum-
family ipv6-vpn prefix-out <value>
maximum-prefix-out
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn nexthop-local
family ipv6-vpn nexthop- unchanged
local unchanged
continues on next page

21.1. Configuration Commands 1687

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn nexthop-self
family ipv6-vpn nexthop- force
self force
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn prefix-list export
family ipv6-vpn prefix-list <value>
export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn prefix-list
family ipv6-vpn prefix-list import <value>
import
× not yet documented Nothing found in XML protocols bgp neighbor
Definitions <text> address-family
ipv6-vpn remove-private-
as
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp neighbor
<neighbor> address-
family ipv6-vpn remove-
private-as all
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn route-map
family ipv6-vpn route- export <value>
map export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn route-map
family ipv6-vpn route- import <value>
map import
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn route-reflector-
family ipv6-vpn route- client
reflector-client
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn route-server-
family ipv6-vpn route- client
server-client
× not yet documented protocols_bgp.xml.in: protocols bgp neigh-
protocols bgp neighbor bor <text> address-
<neighbor> address- family ipv6-vpn soft-
family ipv6-vpn soft- reconfiguration inbound
reconfiguration inbound
continues on next page

21.1. Configuration Commands 1688

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn unsuppress-map
family ipv6-vpn <value>
unsuppress-map
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- ipv6-vpn weight <value>
family ipv6-vpn weight
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- l2vpn-evpn allowas-in
family l2vpn-evpn number <value>
allowas-in number
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- l2vpn-evpn attribute-
family l2vpn-evpn unchanged as-path
attribute-unchanged
as-path
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- l2vpn-evpn attribute-
family l2vpn-evpn unchanged med
attribute-unchanged
med
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- l2vpn-evpn attribute-
family l2vpn-evpn unchanged next-hop
attribute-unchanged
next-hop
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- l2vpn-evpn nexthop-self
family l2vpn-evpn force
nexthop-self force
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- l2vpn-evpn route-map
family l2vpn-evpn route- export <value>
map export
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- l2vpn-evpn route-map
family l2vpn-evpn route- import <value>
map import
continues on next page

21.1. Configuration Commands 1689

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- l2vpn-evpn route-
family l2vpn-evpn route- reflector-client
reflector-client
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> address-family
<neighbor> address- l2vpn-evpn route-server-
family l2vpn-evpn route- client
server-client
× not yet documented protocols_bgp.xml.in: protocols bgp neigh-
protocols bgp neighbor bor <text> address-
<neighbor> address- family l2vpn-evpn soft-
family l2vpn-evpn soft- reconfiguration inbound
reconfiguration inbound
× set protocols Nothing found in XML Nothing found in VyOS
bgp neighbor Definitions
<address|interface>
address-family
<ipv4-unicast|ipv6-unicast>
maximum-prefix
<number>
× set protocols Nothing found in XML Nothing found in VyOS
bgp neighbor Definitions
<address|interface>
address-family
<ipv4-unicast|ipv6-unicast>
nexthop-self
× set protocols Nothing found in XML Nothing found in VyOS
bgp neighbor Definitions
<address|interface>
address-family
<ipv4-unicast|ipv6-unicast>
prefix-list
<export|import>
<name>
× set protocols Nothing found in XML Nothing found in VyOS
bgp neighbor Definitions
<address|interface>
address-family
<ipv4-unicast|ipv6-unicast>
remove-private-as
continues on next page

21.1. Configuration Commands 1690

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set protocols Nothing found in XML Nothing found in VyOS
bgp neighbor Definitions
<address|interface>
address-family
<ipv4-unicast|ipv6-unicast>
route-map
<export|import>
<name>
× set protocols bgp Nothing found in XML Nothing found in VyOS
neighbor <address> Definitions
address-family
<ipv4-unicast|ipv6-unicast>
route-reflector-client
× set protocols Nothing found in XML Nothing found in VyOS
bgp neighbor Definitions
<address|interface>
address-family
<ipv4-unicast|ipv6-unicast>
soft-reconfiguration
inbound
× set protocols Nothing found in XML Nothing found in VyOS
bgp neighbor Definitions
<address|interface>
address-family
<ipv4-unicast|ipv6-unicast>
unsuppress-map
<name>
× set protocols Nothing found in XML Nothing found in VyOS
bgp neighbor Definitions
<address|interface>
address-family
<ipv4-unicast|ipv6-unicast>
weight <number>
✓ set protocols protocols_bgp.xml.in: protocols bgp neighbor
bgp neighbor protocols bgp neigh- <text> advertisement-
<address|interface> bor <neighbor> interval <value>
advertisement-interval advertisement-interval
<seconds>
× set protocols bgp Nothing found in XML Nothing found in VyOS
neighbor <neighbor> Definitions
bfd
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> bfd check-control-
<neighbor> bfd check- plane-failure
control-plane-failure
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> bfd profile <value>
<neighbor> bfd profile
continues on next page

21.1. Configuration Commands 1691

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set protocols protocols_bgp.xml.in: protocols bgp neighbor
bgp neighbor protocols bgp neighbor <text> capability dynamic
<address|interface> <neighbor> capability
capability dynamic dynamic
✓ set protocols protocols_bgp.xml.in: protocols bgp neigh-
bgp neighbor protocols bgp neighbor bor <text> capability
<address|interface> <neighbor> capability extended-nexthop
capability extended-nexthop
extended-nexthop
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp neighbor
<neighbor> capability
software-version
✓ set protocols protocols_bgp.xml.in: protocols bgp neigh-
bgp neighbor protocols bgp neighbor bor <text> description
<address|interface> <neighbor> description <value>
description <text>
✓ set protocols protocols_bgp.xml.in: protocols bgp neighbor
bgp neighbor protocols bgp neighbor <text> disable-capability-
<address|interface> <neighbor> disable- negotiation
disable-capability-negotiation
capability-negotiation
✓ set protocols protocols_bgp.xml.in: protocols bgp neighbor
bgp neighbor protocols bgp neighbor <text> disable-connected-
<address|interface> <neighbor> disable- check
disable-connected-checkconnected-check
× set protocols Nothing found in XML Nothing found in VyOS
bgp neighbor Definitions
<address|interface>
disable-send-community
<extended|standard>
✓ set protocols protocols_bgp.xml.in: protocols bgp neighbor
bgp neighbor protocols bgp neigh- <text> ebgp-multihop
<address|interface> bor <neighbor> ebgp- <value>
ebgp-multihop multihop
<number>
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> enforce-first-as
<neighbor> enforce-first-
as
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> graceful-restart
<neighbor> graceful- <value>
restart
× not yet documented protocols_bgp.xml.in: protocols bgp neigh-
protocols bgp neighbor bor <text> interface
<neighbor> interface peer-group <value>
peer-group
continues on next page

21.1. Configuration Commands 1692

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> interface remote-as
<neighbor> interface <value>
remote-as
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> interface source-
<neighbor> interface interface <value>
source-interface
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> interface v6only
<neighbor> interface peer-group <value>
v6only peer-group
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> interface v6only
<neighbor> interface remote-as <value>
v6only remote-as
× set protocols Nothing found in XML Nothing found in VyOS
bgp neighbor Definitions
<address|interface>
local-as <asn>
[no-prepend]
[replace-as]
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> local-as <text>
<neighbor> local-as no-prepend replace-as
<local-as> no-prepend
replace-as
× set protocols Nothing found in XML Nothing found in VyOS
bgp neighbor Definitions
<address|interface>
local-role <role>
[strict]
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> local-role <text>
<neighbor> local-role strict
<local-role> strict
✓ set protocols protocols_bgp.xml.in: protocols bgp neighbor
bgp neighbor protocols bgp neighbor <text> override-capability
<address|interface> <neighbor> override-
override-capability capability
✓ set protocols protocols_bgp.xml.in: protocols bgp neighbor
bgp neighbor protocols bgp neighbor <text> passive
<address|interface> <neighbor> passive
passive
✓ set protocols protocols_bgp.xml.in: protocols bgp neighbor
bgp neighbor protocols bgp neighbor <text> password <value>
<address|interface> <neighbor> password
password <text>
continues on next page

21.1. Configuration Commands 1693

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> path-attribute
<neighbor> path-attribute discard <value>
discard
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp neighbor
<neighbor> path-attribute
treat-as-withdraw
✓ set protocols protocols_bgp.xml.in: protocols bgp neigh-
bgp neighbor protocols bgp neighbor bor <text> peer-group
<address|interface> <neighbor> peer-group <value>
peer-group <name>
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neighbor <text> port <value>
<neighbor> port
✓ set protocols protocols_bgp.xml.in: protocols bgp neighbor
bgp neighbor protocols bgp neighbor <text> remote-as <value>
<address|interface> <neighbor> remote-as
remote-as <nasn>
× set protocols Nothing found in XML Nothing found in VyOS
bgp neighbor Definitions
<address|interface>
remote-as external
× set protocols Nothing found in XML Nothing found in VyOS
bgp neighbor Definitions
<address|interface>
remote-as internal
✓ set protocols protocols_bgp.xml.in: protocols bgp neighbor
bgp neighbor protocols bgp neighbor <text> shutdown
<address|interface> <neighbor> shutdown
shutdown
✓ set protocols protocols_bgp.xml.in: protocols bgp neighbor
bgp neighbor protocols bgp neighbor <text> solo
<address|interface> <neighbor> solo
solo
✓ set protocols protocols_bgp.xml.in: protocols bgp neighbor
bgp neighbor protocols bgp neigh- <text> strict-capability-
<address|interface> bor <neighbor> strict- match
strict-capability-matchcapability-match
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neigh- <text> timers connect
bor <neighbor> timers <value>
connect
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neigh- <text> timers holdtime
bor <neighbor> timers <value>
holdtime
continues on next page

21.1. Configuration Commands 1694

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp neighbor
protocols bgp neigh- <text> timers keepalive
bor <neighbor> timers <value>
keepalive
✓ set protocols protocols_bgp.xml.in: protocols bgp neighbor
bgp neighbor protocols bgp neighbor <text> ttl-security hops
<address|interface> <neighbor> ttl-security <value>
ttl-security hops hops
<number>
✓ set protocols protocols_bgp.xml.in: protocols bgp neighbor
bgp neighbor protocols bgp neighbor <text> update-source
<address|interface> <neighbor> update-source <value>
update-source
<address|interface>
× set protocols protocols_bgp.xml.in: Nothing found in VyOS
bgp parameters protocols bgp parameters
allow-martian-nexthop allow-martian-nexthop
✓ set protocols protocols_bgp.xml.in: protocols bgp parameters
bgp parameters protocols bgp parameters always-compare-med
always-compare-med always-compare-med
✓ set protocols bgp protocols_bgp.xml.in: protocols bgp parameters
parameters bestpath protocols bgp parameters bestpath as-path confed
as-path confed bestpath as-path confed
✓ set protocols bgp protocols_bgp.xml.in: protocols bgp parameters
parameters bestpath protocols bgp parameters bestpath as-path ignore
as-path ignore bestpath as-path ignore
✓ set protocols protocols_bgp.xml.in: protocols bgp param-
bgp parameters protocols bgp param- eters bestpath as-path
bestpath as-path eters bestpath as-path multipath-relax
multipath-relax multipath-relax
× not yet documented protocols_bgp.xml.in: protocols bgp parame-
protocols bgp parameters ters bestpath bandwidth
bestpath bandwidth <value>
✓ set protocols bgp protocols_bgp.xml.in: protocols bgp parameters
parameters bestpath protocols bgp parameters bestpath compare-routerid
compare-routerid bestpath compare-routerid
× not yet documented protocols_bgp.xml.in: protocols bgp parameters
protocols bgp parameters bestpath med <value>
bestpath med
× set protocols bgp Nothing found in XML Nothing found in VyOS
parameters bestpath Definitions
med confed
× set protocols Nothing found in XML Nothing found in VyOS
bgp parameters Definitions
bestpath med
missing-as-worst
continues on next page

21.1. Configuration Commands 1695

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp parame-
protocols bgp parame- ters bestpath peer-type
ters bestpath peer-type multipath-relax
multipath-relax
✓ set protocols protocols_bgp.xml.in: protocols bgp parameters
bgp parameters protocols bgp parameters cluster-id <value>
cluster-id <id> cluster-id
× not yet documented protocols_bgp.xml.in: protocols bgp parameters
protocols bgp parameters conditional-advertisement
conditional-advertisement timer <value>
timer
✓ set protocols protocols_bgp.xml.in: protocols bgp parameters
bgp parameters protocols bgp parameters confederation identifier
confederation confederation identifier <value>
identifier <asn>
✓ set protocols protocols_bgp.xml.in: protocols bgp parame-
bgp parameters protocols bgp parameters ters confederation peers
confederation peers confederation peers <value>
<nsubasn>
✓ set protocols bgp protocols_bgp.xml.in: protocols bgp parame-
parameters dampening protocols bgp parameters ters dampening half-life
half-life <minutes> dampening half-life <value>
✓ set protocols bgp protocols_bgp.xml.in: protocols bgp parameters
parameters dampening protocols bgp parameters dampening max-suppress-
max-suppress-time dampening max-suppress- time <value>
<seconds> time
✓ set protocols bgp protocols_bgp.xml.in: protocols bgp parameters
parameters dampening protocols bgp parameters dampening re-use <value>
re-use <seconds> dampening re-use
✓ set protocols bgp protocols_bgp.xml.in: protocols bgp parameters
parameters dampening protocols bgp parameters dampening start-suppress-
start-suppress-time dampening start-suppress- time <value>
<seconds> time
✓ set protocols protocols_bgp.xml.in: protocols bgp parameters
bgp parameters protocols bgp parameters default local-pref <value>
default local-pref default local-pref
<local-pref value>
✓ set protocols protocols_bgp.xml.in: protocols bgp parameters
bgp parameters protocols bgp parameters deterministic-med
deterministic-med deterministic-med
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp parameters
disable-ebgp-connected-
route-check
× set protocols Nothing found in XML Nothing found in VyOS
bgp parameters Definitions
distance global
<external|internal|local>
<distance>
continues on next page

21.1. Configuration Commands 1696

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp parameters
protocols bgp parameters distance global external
distance global external <value>
× not yet documented protocols_bgp.xml.in: protocols bgp parameters
protocols bgp parameters distance global internal
distance global internal <value>
× not yet documented protocols_bgp.xml.in: protocols bgp parameters
protocols bgp parameters distance global local
distance global local <value>
✓ set protocols bgp protocols_bgp.xml.in: protocols bgp parameters
parameters distance protocols bgp parameters distance prefix <text> dis-
prefix <subnet> distance prefix <prefix> tance <value>
distance <distance> distance
✓ set protocols protocols_bgp.xml.in: protocols bgp parameters
bgp parameters protocols bgp parameters ebgp-requires-policy
ebgp-requires-policy ebgp-requires-policy
× not yet documented protocols_bgp.xml.in: protocols bgp parameters
protocols bgp parameters fast-convergence
fast-convergence
× not yet documented protocols_bgp.xml.in: protocols bgp parameters
protocols bgp parameters graceful-restart stalepath-
graceful-restart stalepath- time <value>
time
× not yet documented protocols_bgp.xml.in: protocols bgp parameters
protocols bgp parameters graceful-shutdown
graceful-shutdown
× set protocols protocols_bgp.xml.in: Nothing found in VyOS
bgp parameters protocols bgp parameters
labeled-unicast labeled-unicast
<explicit-null |
ipv4-explicit-null |
ipv6-explicit-null>
✓ set protocols protocols_bgp.xml.in: protocols bgp parameters
bgp parameters protocols bgp parameters log-neighbor-changes
log-neighbor-changes log-neighbor-changes
× not yet documented protocols_bgp.xml.in: protocols bgp parame-
protocols bgp parameters ters minimum-holdtime
minimum-holdtime <value>
✓ set protocols protocols_bgp.xml.in: protocols bgp parameters
bgp parameters protocols bgp parameters network-import-check
network-import-check network-import-check
✓ set protocols protocols_bgp.xml.in: protocols bgp parameters
bgp parameters protocols bgp parameters no-client-to-client-
no-client-to-client-reflection
no-client-to-client- reflection
reflection
✓ set protocols protocols_bgp.xml.in: protocols bgp parameters
bgp parameters protocols bgp parameters no-fast-external-failover
no-fast-external-failover
no-fast-external-failover
continues on next page

21.1. Configuration Commands 1697

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set protocols protocols_bgp.xml.in: Nothing found in VyOS
bgp parameters protocols bgp parameters
no-hard-administrative-reset
no-hard-administrative-
reset
× not yet documented protocols_bgp.xml.in: protocols bgp parameters
protocols bgp parameters no-suppress-duplicates
no-suppress-duplicates
× not yet documented protocols_bgp.xml.in: protocols bgp parameters
protocols bgp parameters reject-as-sets
reject-as-sets
× not yet documented protocols_bgp.xml.in: protocols bgp parameters
protocols bgp parameters route-reflector-allow-
route-reflector-allow- outbound-policy
outbound-policy
✓ set protocols bgp protocols_bgp.xml.in: protocols bgp parameters
parameters router-id protocols bgp parameters router-id <value>
<id> router-id
× not yet documented protocols_bgp.xml.in: protocols bgp parameters
protocols bgp parameters shutdown
shutdown
× not yet documented protocols_bgp.xml.in: protocols bgp parameters
protocols bgp parameters suppress-fib-pending
suppress-fib-pending
× not yet documented protocols_bgp.xml.in: protocols bgp parameters
protocols bgp parameters tcp-keepalive idle <value>
tcp-keepalive idle
× not yet documented protocols_bgp.xml.in: protocols bgp parameters
protocols bgp parameters tcp-keepalive interval
tcp-keepalive interval <value>
× not yet documented protocols_bgp.xml.in: protocols bgp parameters
protocols bgp parameters tcp-keepalive probes
tcp-keepalive probes <value>
× set protocols bgp Nothing found in XML Nothing found in VyOS
peer-group <name> Definitions
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv4-labeled-
unicast addpath-tx-all
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv4-labeled-
unicast addpath-tx-per-as
continues on next page

21.1. Configuration Commands 1698

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv4-
labeled-unicast allowas-in
number
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv4-labeled-
unicast as-override
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv4-
labeled-unicast attribute-
unchanged as-path
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv4-
labeled-unicast attribute-
unchanged med
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv4-
labeled-unicast attribute-
unchanged next-hop
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv4-
labeled-unicast capability
orf prefix-list receive
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv4-
labeled-unicast capability
orf prefix-list send
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv4-labeled-
unicast conditionally-
advertise advertise-map
continues on next page

21.1. Configuration Commands 1699

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv4-labeled-
unicast conditionally-
advertise exist-map
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv4-labeled-
unicast conditionally-
advertise non-exist-map
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv4-labeled-
unicast default-originate
route-map
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv4-
labeled-unicast disable-
send-community extended
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv4-
labeled-unicast disable-
send-community standard
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv4-labeled-
unicast distribute-list
export
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv4-labeled-
unicast distribute-list
import
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv4-
labeled-unicast filter-list
export
continues on next page

21.1. Configuration Commands 1700

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv4-
labeled-unicast filter-list
import
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv4-labeled-
unicast maximum-prefix
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv4-labeled-
unicast maximum-prefix-
out
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv4-labeled-
unicast nexthop-self
force
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv4-
labeled-unicast prefix-list
export
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv4-
labeled-unicast prefix-list
import
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv4-labeled-
unicast remove-private-as
all
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv4-
labeled-unicast route-map
export
continues on next page

21.1. Configuration Commands 1701

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv4-
labeled-unicast route-map
import
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv4-
labeled-unicast route-
reflector-client
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv4-labeled-
unicast route-server-client
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv4-
labeled-unicast soft-
reconfiguration inbound
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv4-labeled-
unicast unsuppress-map
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv4-
labeled-unicast weight
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast addpath-tx-
family ipv4-unicast all
addpath-tx-all
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast addpath-tx-
family ipv4-unicast per-as
addpath-tx-per-as
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast allowas-in
family ipv4-unicast number <value>
allowas-in number
continues on next page

21.1. Configuration Commands 1702

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast as-override
family ipv4-unicast
as-override
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast attribute-
family ipv4-unicast unchanged as-path
attribute-unchanged
as-path
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast attribute-
family ipv4-unicast unchanged med
attribute-unchanged med
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast attribute-
family ipv4-unicast unchanged next-hop
attribute-unchanged
next-hop
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast capability orf
family ipv4-unicast prefix-list receive
capability orf prefix-list
receive
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast capability orf
family ipv4-unicast prefix-list send
capability orf prefix-list
send
× not yet documented protocols_bgp.xml.in: protocols bgp peer-
protocols bgp peer-group group <text> address-
<peer-group> address- family ipv4-unicast
family ipv4-unicast conditionally-advertise
conditionally-advertise advertise-map <value>
advertise-map
× not yet documented protocols_bgp.xml.in: protocols bgp peer-
protocols bgp peer-group group <text> address-
<peer-group> address- family ipv4-unicast
family ipv4-unicast conditionally-advertise
conditionally-advertise exist-map <value>
exist-map
continues on next page

21.1. Configuration Commands 1703

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp peer-
protocols bgp peer-group group <text> address-
<peer-group> address- family ipv4-unicast
family ipv4-unicast conditionally-advertise
conditionally-advertise non-exist-map <value>
non-exist-map
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-unicast default-
address-family ipv4- originate route-map
unicast default-originate <value>
route-map
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast disable-send-
family ipv4-unicast community extended
disable-send-community
extended
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast disable-send-
family ipv4-unicast community standard
disable-send-community
standard
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast distribute-list
family ipv4-unicast export <value>
distribute-list export
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast distribute-list
family ipv4-unicast import <value>
distribute-list import
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast filter-list
family ipv4-unicast export <value>
filter-list export
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast filter-list
family ipv4-unicast import <value>
filter-list import
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast maximum-
family ipv4-unicast prefix <value>
maximum-prefix
continues on next page

21.1. Configuration Commands 1704

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast maximum-
family ipv4-unicast prefix-out <value>
maximum-prefix-out
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast nexthop-self
family ipv4-unicast force
nexthop-self force
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast prefix-list
family ipv4-unicast export <value>
prefix-list export
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast prefix-list
family ipv4-unicast import <value>
prefix-list import
× not yet documented Nothing found in XML protocols bgp peer-group
Definitions <text> address-family
ipv4-unicast remove-
private-as
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv4-unicast
remove-private-as all
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast route-map
family ipv4-unicast export <value>
route-map export
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast route-map
family ipv4-unicast import <value>
route-map import
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast route-
family ipv4-unicast reflector-client
route-reflector-client
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast route-server-
family ipv4-unicast client
route-server-client
continues on next page

21.1. Configuration Commands 1705

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp peer-
protocols bgp peer-group group <text> address-
<peer-group> address- family ipv4-unicast
family ipv4-unicast soft-reconfiguration
soft-reconfiguration inbound
inbound
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast unsuppress-
family ipv4-unicast map <value>
unsuppress-map
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-unicast weight
family ipv4-unicast <value>
weight
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn addpath-tx-all
address-family ipv4-vpn
addpath-tx-all
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn addpath-tx-per-
address-family ipv4-vpn as
addpath-tx-per-as
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn allowas-in
address-family ipv4-vpn number <value>
allowas-in number
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn as-override
address-family ipv4-vpn
as-override
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn attribute-
address-family ipv4- unchanged as-path
vpn attribute-unchanged
as-path
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn attribute-
address-family ipv4-vpn unchanged med
attribute-unchanged med
continues on next page

21.1. Configuration Commands 1706

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn attribute-
address-family ipv4- unchanged next-hop
vpn attribute-unchanged
next-hop
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn conditionally-
address-family ipv4-vpn advertise advertise-map
conditionally-advertise <value>
advertise-map
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn conditionally-
address-family ipv4-vpn advertise exist-map
conditionally-advertise <value>
exist-map
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn conditionally-
address-family ipv4-vpn advertise non-exist-map
conditionally-advertise <value>
non-exist-map
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn disable-send-
address-family ipv4-vpn community extended
disable-send-community
extended
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn disable-send-
address-family ipv4-vpn community standard
disable-send-community
standard
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn distribute-list
address-family ipv4-vpn export <value>
distribute-list export
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn distribute-list
address-family ipv4-vpn import <value>
distribute-list import
continues on next page

21.1. Configuration Commands 1707

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-vpn filter-list export
family ipv4-vpn filter-list <value>
export
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-vpn filter-list import
family ipv4-vpn filter-list <value>
import
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn maximum-prefix
address-family ipv4-vpn <value>
maximum-prefix
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn maximum-
address-family ipv4-vpn prefix-out <value>
maximum-prefix-out
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn nexthop-self
address-family ipv4-vpn force
nexthop-self force
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-vpn prefix-list export
family ipv4-vpn prefix-list <value>
export
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-vpn prefix-list
family ipv4-vpn prefix-list import <value>
import
× not yet documented Nothing found in XML protocols bgp peer-group
Definitions <text> address-family
ipv4-vpn remove-private-
as
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv4-vpn
remove-private-as all
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn route-map
address-family ipv4-vpn export <value>
route-map export
continues on next page

21.1. Configuration Commands 1708

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn route-map
address-family ipv4-vpn import <value>
route-map import
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn route-reflector-
address-family ipv4-vpn client
route-reflector-client
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn route-server-
address-family ipv4-vpn client
route-server-client
× not yet documented protocols_bgp.xml.in: protocols bgp peer-
protocols bgp peer- group <text> address-
group <peer-group> family ipv4-vpn soft-
address-family ipv4- reconfiguration inbound
vpn soft-reconfiguration
inbound
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv4-vpn unsuppress-map
address-family ipv4-vpn <value>
unsuppress-map
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv4-vpn weight <value>
family ipv4-vpn weight
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv6-labeled-
unicast addpath-tx-all
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv6-labeled-
unicast addpath-tx-per-as
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv6-
labeled-unicast allowas-in
number
continues on next page

21.1. Configuration Commands 1709

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv6-labeled-
unicast as-override
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv6-
labeled-unicast attribute-
unchanged as-path
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv6-
labeled-unicast attribute-
unchanged med
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv6-
labeled-unicast attribute-
unchanged next-hop
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv6-
labeled-unicast capability
orf prefix-list receive
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv6-
labeled-unicast capability
orf prefix-list send
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv6-labeled-
unicast conditionally-
advertise advertise-map
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv6-labeled-
unicast conditionally-
advertise exist-map
continues on next page

21.1. Configuration Commands 1710

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv6-labeled-
unicast conditionally-
advertise non-exist-map
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv6-labeled-
unicast default-originate
route-map
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv6-
labeled-unicast disable-
send-community extended
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv6-
labeled-unicast disable-
send-community standard
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv6-labeled-
unicast distribute-list
export
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv6-labeled-
unicast distribute-list
import
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv6-
labeled-unicast filter-list
export
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv6-
labeled-unicast filter-list
import
continues on next page

21.1. Configuration Commands 1711

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv6-labeled-
unicast maximum-prefix
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv6-labeled-
unicast maximum-prefix-
out
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv6-labeled-
unicast nexthop-local
unchanged
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv6-labeled-
unicast nexthop-self
force
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv6-
labeled-unicast prefix-list
export
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv6-
labeled-unicast prefix-list
import
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv6-labeled-
unicast remove-private-as
all
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv6-
labeled-unicast route-map
export
continues on next page

21.1. Configuration Commands 1712

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv6-
labeled-unicast route-map
import
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv6-
labeled-unicast route-
reflector-client
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv6-labeled-
unicast route-server-client
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv6-
labeled-unicast soft-
reconfiguration inbound
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv6-labeled-
unicast unsuppress-map
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv6-
labeled-unicast weight
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast addpath-tx-
family ipv6-unicast all
addpath-tx-all
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast addpath-tx-
family ipv6-unicast per-as
addpath-tx-per-as
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast allowas-in
family ipv6-unicast number <value>
allowas-in number
continues on next page

21.1. Configuration Commands 1713

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast as-override
family ipv6-unicast
as-override
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast attribute-
family ipv6-unicast unchanged as-path
attribute-unchanged
as-path
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast attribute-
family ipv6-unicast unchanged med
attribute-unchanged med
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast attribute-
family ipv6-unicast unchanged next-hop
attribute-unchanged
next-hop
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast capability orf
family ipv6-unicast prefix-list receive
capability orf prefix-list
receive
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast capability orf
family ipv6-unicast prefix-list send
capability orf prefix-list
send
× not yet documented protocols_bgp.xml.in: protocols bgp peer-
protocols bgp peer-group group <text> address-
<peer-group> address- family ipv6-unicast
family ipv6-unicast conditionally-advertise
conditionally-advertise advertise-map <value>
advertise-map
× not yet documented protocols_bgp.xml.in: protocols bgp peer-
protocols bgp peer-group group <text> address-
<peer-group> address- family ipv6-unicast
family ipv6-unicast conditionally-advertise
conditionally-advertise exist-map <value>
exist-map
continues on next page

21.1. Configuration Commands 1714

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp peer-
protocols bgp peer-group group <text> address-
<peer-group> address- family ipv6-unicast
family ipv6-unicast conditionally-advertise
conditionally-advertise non-exist-map <value>
non-exist-map
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-unicast default-
address-family ipv6- originate route-map
unicast default-originate <value>
route-map
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast disable-send-
family ipv6-unicast community extended
disable-send-community
extended
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast disable-send-
family ipv6-unicast community standard
disable-send-community
standard
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast distribute-list
family ipv6-unicast export <value>
distribute-list export
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast distribute-list
family ipv6-unicast import <value>
distribute-list import
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast filter-list
family ipv6-unicast export <value>
filter-list export
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast filter-list
family ipv6-unicast import <value>
filter-list import
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast maximum-
family ipv6-unicast prefix <value>
maximum-prefix
continues on next page

21.1. Configuration Commands 1715

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast maximum-
family ipv6-unicast prefix-out <value>
maximum-prefix-out
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast nexthop-
family ipv6-unicast local unchanged
nexthop-local unchanged
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast nexthop-self
family ipv6-unicast force
nexthop-self force
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast prefix-list
family ipv6-unicast export <value>
prefix-list export
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast prefix-list
family ipv6-unicast import <value>
prefix-list import
× not yet documented Nothing found in XML protocols bgp peer-group
Definitions <text> address-family
ipv6-unicast remove-
private-as
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> address-
family ipv6-unicast
remove-private-as all
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast route-map
family ipv6-unicast export <value>
route-map export
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast route-map
family ipv6-unicast import <value>
route-map import
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast route-
family ipv6-unicast reflector-client
route-reflector-client
continues on next page

21.1. Configuration Commands 1716

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast route-server-
family ipv6-unicast client
route-server-client
× not yet documented protocols_bgp.xml.in: protocols bgp peer-
protocols bgp peer-group group <text> address-
<peer-group> address- family ipv6-unicast
family ipv6-unicast soft-reconfiguration
soft-reconfiguration inbound
inbound
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast unsuppress-
family ipv6-unicast map <value>
unsuppress-map
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-unicast weight
family ipv6-unicast <value>
weight
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn addpath-tx-all
address-family ipv6-vpn
addpath-tx-all
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn addpath-tx-per-
address-family ipv6-vpn as
addpath-tx-per-as
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn allowas-in
address-family ipv6-vpn number <value>
allowas-in number
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn as-override
address-family ipv6-vpn
as-override
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn attribute-
address-family ipv6- unchanged as-path
vpn attribute-unchanged
as-path
continues on next page

21.1. Configuration Commands 1717

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn attribute-
address-family ipv6-vpn unchanged med
attribute-unchanged med
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn attribute-
address-family ipv6- unchanged next-hop
vpn attribute-unchanged
next-hop
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn conditionally-
address-family ipv6-vpn advertise advertise-map
conditionally-advertise <value>
advertise-map
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn conditionally-
address-family ipv6-vpn advertise exist-map
conditionally-advertise <value>
exist-map
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn conditionally-
address-family ipv6-vpn advertise non-exist-map
conditionally-advertise <value>
non-exist-map
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn disable-send-
address-family ipv6-vpn community extended
disable-send-community
extended
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn disable-send-
address-family ipv6-vpn community standard
disable-send-community
standard
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn distribute-list
address-family ipv6-vpn export <value>
distribute-list export
continues on next page

21.1. Configuration Commands 1718

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn distribute-list
address-family ipv6-vpn import <value>
distribute-list import
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-vpn filter-list export
family ipv6-vpn filter-list <value>
export
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-vpn filter-list import
family ipv6-vpn filter-list <value>
import
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn maximum-prefix
address-family ipv6-vpn <value>
maximum-prefix
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn maximum-
address-family ipv6-vpn prefix-out <value>
maximum-prefix-out
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn nexthop-local
address-family ipv6-vpn unchanged
nexthop-local unchanged
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn nexthop-self
address-family ipv6-vpn force
nexthop-self force
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-vpn prefix-list export
family ipv6-vpn prefix-list <value>
export
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-vpn prefix-list
family ipv6-vpn prefix-list import <value>
import
× not yet documented Nothing found in XML protocols bgp peer-group
Definitions <text> address-family
ipv6-vpn remove-private-
as
continues on next page

21.1. Configuration Commands 1719

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
address-family ipv6-vpn
remove-private-as all
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn route-map
address-family ipv6-vpn export <value>
route-map export
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn route-map
address-family ipv6-vpn import <value>
route-map import
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn route-reflector-
address-family ipv6-vpn client
route-reflector-client
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn route-server-
address-family ipv6-vpn client
route-server-client
× not yet documented protocols_bgp.xml.in: protocols bgp peer-
protocols bgp peer- group <text> address-
group <peer-group> family ipv6-vpn soft-
address-family ipv6- reconfiguration inbound
vpn soft-reconfiguration
inbound
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> ipv6-vpn unsuppress-map
address-family ipv6-vpn <value>
unsuppress-map
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> address-family
<peer-group> address- ipv6-vpn weight <value>
family ipv6-vpn weight
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> l2vpn-evpn allowas-in
address-family l2vpn- number <value>
evpn allowas-in number
continues on next page

21.1. Configuration Commands 1720

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> l2vpn-evpn attribute-
address-family l2vpn- unchanged as-path
evpn attribute-unchanged
as-path
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> l2vpn-evpn attribute-
address-family l2vpn- unchanged med
evpn attribute-unchanged
med
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> l2vpn-evpn attribute-
address-family l2vpn- unchanged next-hop
evpn attribute-unchanged
next-hop
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> l2vpn-evpn nexthop-self
address-family l2vpn- force
evpn nexthop-self force
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> l2vpn-evpn route-map
address-family l2vpn- export <value>
evpn route-map export
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> l2vpn-evpn route-map
address-family l2vpn- import <value>
evpn route-map import
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> l2vpn-evpn route-
address-family l2vpn- reflector-client
evpn route-reflector-client
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> address-family
group <peer-group> l2vpn-evpn route-server-
address-family l2vpn- client
evpn route-server-client
× not yet documented protocols_bgp.xml.in: protocols bgp peer-
protocols bgp peer- group <text> address-
group <peer-group> family l2vpn-evpn soft-
address-family l2vpn- reconfiguration inbound
evpn soft-reconfiguration
inbound
continues on next page

21.1. Configuration Commands 1721

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set protocols Nothing found in XML Nothing found in VyOS
bgp peer-group Definitions
<neighbor> bfd
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> bfd check-control-
<peer-group> bfd check- plane-failure
control-plane-failure
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> bfd profile <value>
<peer-group> bfd profile
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> capability dynamic
<peer-group> capability
dynamic
× not yet documented protocols_bgp.xml.in: protocols bgp peer-
protocols bgp peer-group group <text> capability
<peer-group> capability extended-nexthop
extended-nexthop
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-group
<peer-group> capability
software-version
× not yet documented protocols_bgp.xml.in: protocols bgp peer-
protocols bgp peer-group group <text> description
<peer-group> description <value>
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> disable-capability-
<peer-group> disable- negotiation
capability-negotiation
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> disable-connected-
<peer-group> disable- check
connected-check
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> ebgp-multihop
<peer-group> ebgp- <value>
multihop
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> graceful-restart
<peer-group> graceful- <value>
restart
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> local-as <text> no-
<peer-group> local-as prepend replace-as
<local-as> no-prepend
replace-as
continues on next page

21.1. Configuration Commands 1722

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> local-role <text>
<peer-group> local-role strict
<local-role> strict
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> override-capability
<peer-group> override-
capability
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> passive
<peer-group> passive
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> password <value>
<peer-group> password
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer- <text> path-attribute dis-
group <peer-group> card <value>
path-attribute discard
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp peer-
group <peer-group>
path-attribute treat-as-
withdraw
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> port <value>
<peer-group> port
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> remote-as <value>
<peer-group> remote-as
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> shutdown
<peer-group> shutdown
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> ttl-security hops
<peer-group> ttl-security <value>
hops
× not yet documented protocols_bgp.xml.in: protocols bgp peer-group
protocols bgp peer-group <text> update-source
<peer-group> update- <value>
source
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp sid vpn per-
vrf export
× not yet documented protocols_bgp.xml.in: Nothing found in VyOS
protocols bgp srv6 locator
✓ set protocols bgp protocols_bgp.xml.in: protocols bgp system-as
system-as <asn> protocols bgp system-as <value>
continues on next page

21.1. Configuration Commands 1723

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set protocols bgp protocols_bgp.xml.in: protocols bgp timers hold-
timers holdtime protocols bgp timers hold- time <value>
<seconds> time
✓ set protocols bgp protocols_bgp.xml.in: protocols bgp timers
timers keepalive protocols bgp timers keepalive <value>
<seconds> keepalive
× not yet documented protocols_eigrp.xml.in: Nothing found in VyOS
protocols eigrp local-as
× not yet documented protocols_eigrp.xml.in: Nothing found in VyOS
protocols eigrp maximum-
paths
× not yet documented protocols_eigrp.xml.in: Nothing found in VyOS
protocols eigrp metric
weights
× not yet documented protocols_eigrp.xml.in: Nothing found in VyOS
protocols eigrp network
× not yet documented protocols_eigrp.xml.in: Nothing found in VyOS
protocols eigrp passive-
interface
× not yet documented protocols_eigrp.xml.in: Nothing found in VyOS
protocols eigrp redis-
tribute
× not yet documented protocols_eigrp.xml.in: Nothing found in VyOS
protocols eigrp router-id
× not yet documented protocols_eigrp.xml.in: Nothing found in VyOS
protocols eigrp variance
✓ set protocols protocols_failover.xml.in: protocols failover route
failover route protocols failover route <text> next-hop <text>
<subnet> next-hop <route> next-hop <next- check policy <value>
<address> check hop> check policy
policy <policy>
× not yet documented protocols_failover.xml.in: protocols failover route
protocols failover route <text> next-hop <text>
<route> next-hop <next- check port <value>
hop> check port
✓ set protocols protocols_failover.xml.in: protocols failover route
failover route protocols failover route <text> next-hop <text>
<subnet> next-hop <route> next-hop <next- check target <value>
<address> hop> check target
check target
<target-address>
✓ set protocols protocols_failover.xml.in: protocols failover route
failover route protocols failover route <text> next-hop <text>
<subnet> next-hop <route> next-hop <next- check timeout <value>
<address> check hop> check timeout
timeout <timeout>
continues on next page

21.1. Configuration Commands 1724

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set protocols protocols_failover.xml.in: protocols failover route
failover route protocols failover route <text> next-hop <text>
<subnet> next-hop <route> next-hop <next- check type <value>
<address> check type hop> check type
<protocol>
✓ set protocols protocols_failover.xml.in: protocols failover route
failover route protocols failover route <text> next-hop <text>
<subnet> next-hop <route> next-hop <next- interface <value>
<address> interface hop> interface
<interface>
✓ set protocols protocols_failover.xml.in: protocols failover route
failover route protocols failover route <text> next-hop <text>
<subnet> next-hop <route> next-hop <next- metric <value>
<address> metric hop> metric
<metric>
× not yet documented protocols_failover.xml.in: Nothing found in VyOS
protocols failover route
<route> next-hop <next-
hop> onlink
✓ set protocols protocols_igmp- protocols igmp-proxy dis-
igmp-proxy disable proxy.xml.in: able
protocols igmp-proxy dis-
able
✓ set protocols protocols_igmp- protocols igmp-proxy
igmp-proxy proxy.xml.in: disable-quickleave
disable-quickleave protocols igmp-proxy
disable-quickleave
✓ set protocols protocols_igmp- protocols igmp-proxy in-
igmp-proxy interface proxy.xml.in: terface <text> alt-subnet
<interface> protocols igmp-proxy <value>
alt-subnet interface <interface>
<network> alt-subnet
✓ set protocols protocols_igmp- protocols igmp-proxy
igmp-proxy interface proxy.xml.in: interface <text> role
<interface> protocols igmp-proxy in- <value>
role <upstream | terface <interface> role
downstream>
× not yet documented protocols_igmp- protocols igmp-proxy in-
proxy.xml.in: terface <text> threshold
protocols igmp-proxy in- <value>
terface <interface> thresh-
old
× not yet documented protocols_igmp- protocols igmp-proxy
proxy.xml.in: interface <text> whitelist
protocols igmp-proxy <value>
interface <interface>
whitelist
continues on next page

21.1. Configuration Commands 1725

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented Nothing found in XML protocols igmp interface
Definitions <text> join <text> source
<value>
× not yet documented Nothing found in XML protocols igmp interface
Definitions <text> query-interval
<value>
× not yet documented Nothing found in XML protocols igmp interface
Definitions <text> query-max-
response-time <value>
× not yet documented Nothing found in XML protocols igmp interface
Definitions <text> version <value>
× not yet documented protocols_isis.xml.in: Nothing found in VyOS
protocols isis advertise-
high-metrics
× not yet documented protocols_isis.xml.in: Nothing found in VyOS
protocols isis advertise-
passive-only
× not yet documented protocols_isis.xml.in: protocols isis area-
protocols isis area- password md5 <value>
password md5
× not yet documented protocols_isis.xml.in: protocols isis area-
protocols isis area- password plaintext-
password plaintext- password <value>
password
× not yet documented protocols_isis.xml.in: protocols isis default-
protocols isis default- information originate ipv4
information originate ipv4 level-1 always
level-1 always
× not yet documented protocols_isis.xml.in: protocols isis default-
protocols isis default- information originate ipv4
information originate ipv4 level-1 metric <value>
level-1 metric
× not yet documented protocols_isis.xml.in: protocols isis default-
protocols isis default- information originate ipv4
information originate ipv4 level-1 route-map <value>
level-1 route-map
× not yet documented protocols_isis.xml.in: protocols isis default-
protocols isis default- information originate ipv4
information originate ipv4 level-2 always
level-2 always
× not yet documented protocols_isis.xml.in: protocols isis default-
protocols isis default- information originate ipv4
information originate ipv4 level-2 metric <value>
level-2 metric
× not yet documented protocols_isis.xml.in: protocols isis default-
protocols isis default- information originate ipv4
information originate ipv4 level-2 route-map <value>
level-2 route-map
continues on next page

21.1. Configuration Commands 1726

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_isis.xml.in: protocols isis default-
protocols isis default- information originate ipv6
information originate ipv6 level-1 always
level-1 always
× not yet documented protocols_isis.xml.in: protocols isis default-
protocols isis default- information originate ipv6
information originate ipv6 level-1 metric <value>
level-1 metric
× not yet documented protocols_isis.xml.in: protocols isis default-
protocols isis default- information originate ipv6
information originate ipv6 level-1 route-map <value>
level-1 route-map
× not yet documented protocols_isis.xml.in: protocols isis default-
protocols isis default- information originate ipv6
information originate ipv6 level-2 always
level-2 always
× not yet documented protocols_isis.xml.in: protocols isis default-
protocols isis default- information originate ipv6
information originate ipv6 level-2 metric <value>
level-2 metric
× not yet documented protocols_isis.xml.in: protocols isis default-
protocols isis default- information originate ipv6
information originate ipv6 level-2 route-map <value>
level-2 route-map
× not yet documented protocols_isis.xml.in: protocols isis domain-
protocols isis domain- password md5 <value>
password md5
× not yet documented protocols_isis.xml.in: protocols isis domain-
protocols isis domain- password plaintext-
password plaintext- password <value>
password
✓ set protocols isis protocols_isis.xml.in: protocols isis dynamic-
dynamic-hostname protocols isis dynamic- hostname
hostname
× set protocols Nothing found in XML Nothing found in VyOS
isis fast-reroute Definitions
lfa local
load-sharing disable
<level-1|level-2>
× not yet documented protocols_isis.xml.in: Nothing found in VyOS
protocols isis fast-reroute
lfa local load-sharing dis-
able level-1
× not yet documented protocols_isis.xml.in: Nothing found in VyOS
protocols isis fast-reroute
lfa local load-sharing dis-
able level-2
continues on next page

21.1. Configuration Commands 1727

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set protocols isis Nothing found in XML Nothing found in VyOS
fast-reroute lfa Definitions
local priority-limit
<medium|high|critical>
<level-1|level-2>
× not yet documented protocols_isis.xml.in: Nothing found in VyOS
protocols isis fast-reroute
lfa local priority-limit crit-
ical level-1
× not yet documented protocols_isis.xml.in: Nothing found in VyOS
protocols isis fast-reroute
lfa local priority-limit crit-
ical level-2
× not yet documented protocols_isis.xml.in: Nothing found in VyOS
protocols isis fast-reroute
lfa local priority-limit high
level-1
× not yet documented protocols_isis.xml.in: Nothing found in VyOS
protocols isis fast-reroute
lfa local priority-limit high
level-2
× not yet documented protocols_isis.xml.in: Nothing found in VyOS
protocols isis fast-reroute
lfa local priority-limit
medium level-1
× not yet documented protocols_isis.xml.in: Nothing found in VyOS
protocols isis fast-reroute
lfa local priority-limit
medium level-2
× not yet documented protocols_isis.xml.in: Nothing found in VyOS
protocols isis fast-reroute
lfa local tiebreaker down-
stream index <index>
level-1
× not yet documented protocols_isis.xml.in: Nothing found in VyOS
protocols isis fast-reroute
lfa local tiebreaker down-
stream index <index>
level-2
× set protocols isis Nothing found in XML Nothing found in VyOS
fast-reroute lfa Definitions
local tiebreaker
<downstream|lowest-backup-metric|node-protecting>
index <number>
<level-1|level-2>
continues on next page

21.1. Configuration Commands 1728

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_isis.xml.in: Nothing found in VyOS
protocols isis fast-reroute
lfa local tiebreaker lowest-
backup-metric index <in-
dex> level-1
× not yet documented protocols_isis.xml.in: Nothing found in VyOS
protocols isis fast-reroute
lfa local tiebreaker lowest-
backup-metric index <in-
dex> level-2
× not yet documented protocols_isis.xml.in: Nothing found in VyOS
protocols isis fast-reroute
lfa local tiebreaker node-
protecting index <index>
level-1
× not yet documented protocols_isis.xml.in: Nothing found in VyOS
protocols isis fast-reroute
lfa local tiebreaker node-
protecting index <index>
level-2
× set protocols Nothing found in XML Nothing found in VyOS
isis fast-reroute Definitions
lfa remote
prefix-list <name>
<level-1|level-2>
× not yet documented protocols_isis.xml.in: Nothing found in VyOS
protocols isis fast-reroute
lfa remote prefix-list
<prefix-list> level-1
× not yet documented protocols_isis.xml.in: Nothing found in VyOS
protocols isis fast-reroute
lfa remote prefix-list
<prefix-list> level-2
× set protocols Nothing found in XML Nothing found in VyOS
isis interface Definitions
<interface>
× set protocols isis Nothing found in XML Nothing found in VyOS
<name> interface Definitions
<interface> bfd
× not yet documented protocols_isis.xml.in: protocols isis interface
protocols isis interface <text> bfd profile <value>
<interface> bfd profile
✓ set protocols protocols_isis.xml.in: protocols isis inter-
isis interface protocols isis interface face <text> circuit-type
<interface> <interface> circuit-type <value>
circuit-type
<level-1|level-1-2|level-2-only>
continues on next page

21.1. Configuration Commands 1729

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set protocols protocols_isis.xml.in: protocols isis interface
isis interface protocols isis interface <text> hello-interval
<interface> <interface> hello-interval <value>
hello-interval
<seconds>
✓ set protocols protocols_isis.xml.in: protocols isis interface
isis interface protocols isis inter- <text> hello-multiplier
<interface> face <interface> hello- <value>
hello-multiplier multiplier
<seconds>
✓ set protocols protocols_isis.xml.in: protocols isis interface
isis interface protocols isis interface <text> hello-padding
<interface> <interface> hello-padding
hello-padding
✓ set protocols protocols_isis.xml.in: protocols isis interface
isis interface protocols isis interface <text> ldp-sync disable
<interface> ldp-sync <interface> ldp-sync
disable disable
✓ set protocols protocols_isis.xml.in: protocols isis interface
isis interface protocols isis interface <text> ldp-sync holddown
<interface> ldp-sync <interface> ldp-sync <value>
holddown <seconds> holddown
✓ set protocols protocols_isis.xml.in: protocols isis interface
isis interface protocols isis interface <text> metric <value>
<interface> metric <interface> metric
<metric>
✓ set protocols protocols_isis.xml.in: protocols isis interface
isis interface protocols isis interface <text> network point-to-
<interface> network <interface> network point
point-to-point point-to-point
✓ set protocols protocols_isis.xml.in: protocols isis interface
isis interface protocols isis interface <text> no-three-way-
<interface> <interface> no-three-way- handshake
no-three-way-handshake handshake
✓ set protocols protocols_isis.xml.in: protocols isis interface
isis interface protocols isis interface <text> passive
<interface> passive <interface> passive
× not yet documented protocols_isis.xml.in: protocols isis interface
protocols isis interface <text> password md5
<interface> password md5 <value>
✓ set protocols protocols_isis.xml.in: protocols isis interface
isis interface protocols isis interface <text> password plaintext-
<interface> password <interface> password password <value>
plaintext-password plaintext-password
<text>
✓ set protocols protocols_isis.xml.in: protocols isis interface
isis interface protocols isis interface <text> priority <value>
<interface> priority <interface> priority
<number>
continues on next page

21.1. Configuration Commands 1730

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set protocols protocols_isis.xml.in: protocols isis interface
isis interface protocols isis interface <text> psnp-interval
<interface> <interface> psnp-interval <value>
psnp-interval
<number>
× set protocols isis Nothing found in XML Nothing found in VyOS
ldp-sync Definitions
✓ set protocols isis protocols_isis.xml.in: protocols isis ldp-sync
ldp-sync holddown protocols isis ldp-sync holddown <value>
<seconds> holddown
✓ set protocols protocols_isis.xml.in: protocols isis level
isis level protocols isis level <value>
<level-1|level-1-2|level-2>
× not yet documented protocols_isis.xml.in: protocols isis log-
protocols isis log- adjacency-changes
adjacency-changes
✓ set protocols isis protocols_isis.xml.in: protocols isis lsp-gen-
lsp-gen-interval protocols isis lsp-gen- interval <value>
<seconds> interval
✓ set protocols isis protocols_isis.xml.in: protocols isis lsp-mtu
lsp-mtu <size> protocols isis lsp-mtu <value>
✓ set protocols isis protocols_isis.xml.in: protocols isis lsp-refresh-
lsp-refresh-interval protocols isis lsp-refresh- interval <value>
<seconds> interval
✓ set protocols isis protocols_isis.xml.in: protocols isis max-lsp-
max-lsp-lifetime protocols isis max-lsp- lifetime <value>
<seconds> lifetime
✓ set protocols protocols_isis.xml.in: protocols isis metric-style
isis metric-style protocols isis metric-style <value>
<narrow|transition|wide>
× set protocols Nothing found in XML Nothing found in VyOS
isis name Definitions
default-information
originate
<ipv4|ipv6> level-1
× set protocols Nothing found in XML Nothing found in VyOS
isis name Definitions
default-information
originate
<ipv4|ipv6> level-2
✓ set protocols protocols_isis.xml.in: protocols isis net <value>
isis net protocols isis net
<network-entity-title>
✓ set protocols isis protocols_isis.xml.in: protocols isis purge-
purge-originator protocols isis purge- originator
originator
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 babel level-1 metric
ipv4 babel level-1 metric <value>
continues on next page

21.1. Configuration Commands 1731

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 babel level-1 route-
ipv4 babel level-1 route- map <value>
map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 babel level-2 metric
ipv4 babel level-2 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 babel level-2 route-
ipv4 babel level-2 route- map <value>
map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 bgp level-1 metric
ipv4 bgp level-1 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 bgp level-1 route-
ipv4 bgp level-1 route- map <value>
map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 bgp level-2 metric
ipv4 bgp level-2 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 bgp level-2 route-
ipv4 bgp level-2 route- map <value>
map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 connected level-1
ipv4 connected level-1 metric <value>
metric
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 connected level-1
ipv4 connected level-1 route-map <value>
route-map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 connected level-2
ipv4 connected level-2 metric <value>
metric
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 connected level-2
ipv4 connected level-2 route-map <value>
route-map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 kernel level-1 metric
ipv4 kernel level-1 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 kernel level-1 route-
ipv4 kernel level-1 route- map <value>
map
continues on next page

21.1. Configuration Commands 1732

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 kernel level-2 metric
ipv4 kernel level-2 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 kernel level-2 route-
ipv4 kernel level-2 route- map <value>
map
× set protocols isis Nothing found in XML Nothing found in VyOS
redistribute ipv4 Definitions
<route source>
level-1
× set protocols isis Nothing found in XML Nothing found in VyOS
redistribute ipv4 Definitions
<route source>
level-2
× set protocols isis Nothing found in XML Nothing found in VyOS
redistribute ipv4 Definitions
<route source>
<level-1|level-2>
metric <number>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 ospf level-1 metric
ipv4 ospf level-1 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 ospf level-1 route-
ipv4 ospf level-1 route- map <value>
map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 ospf level-2 metric
ipv4 ospf level-2 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 ospf level-2 route-
ipv4 ospf level-2 route- map <value>
map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 rip level-1 metric
ipv4 rip level-1 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 rip level-1 route-map
ipv4 rip level-1 route-map <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 rip level-2 metric
ipv4 rip level-2 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 rip level-2 route-map
ipv4 rip level-2 route-map <value>
continues on next page

21.1. Configuration Commands 1733

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set protocols isis Nothing found in XML Nothing found in VyOS
redistribute ipv4 Definitions
<route source>
<level-1|level-2>
route-map <name>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 static level-1 metric
ipv4 static level-1 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 static level-1 route-
ipv4 static level-1 route- map <value>
map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 static level-2 metric
ipv4 static level-2 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv4 static level-2 route-
ipv4 static level-2 route- map <value>
map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 babel level-1 metric
ipv6 babel level-1 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 babel level-1 route-
ipv6 babel level-1 route- map <value>
map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 babel level-2 metric
ipv6 babel level-2 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 babel level-2 route-
ipv6 babel level-2 route- map <value>
map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 bgp level-1 metric
ipv6 bgp level-1 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 bgp level-1 route-
ipv6 bgp level-1 route- map <value>
map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 bgp level-2 metric
ipv6 bgp level-2 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 bgp level-2 route-
ipv6 bgp level-2 route- map <value>
map
continues on next page

21.1. Configuration Commands 1734

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 connected level-1
ipv6 connected level-1 metric <value>
metric
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 connected level-1
ipv6 connected level-1 route-map <value>
route-map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 connected level-2
ipv6 connected level-2 metric <value>
metric
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 connected level-2
ipv6 connected level-2 route-map <value>
route-map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 kernel level-1 metric
ipv6 kernel level-1 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 kernel level-1 route-
ipv6 kernel level-1 route- map <value>
map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 kernel level-2 metric
ipv6 kernel level-2 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 kernel level-2 route-
ipv6 kernel level-2 route- map <value>
map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 ospf6 level-1 metric
ipv6 ospf6 level-1 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 ospf6 level-1 route-
ipv6 ospf6 level-1 route- map <value>
map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 ospf6 level-2 metric
ipv6 ospf6 level-2 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 ospf6 level-2 route-
ipv6 ospf6 level-2 route- map <value>
map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 ripng level-1 metric
ipv6 ripng level-1 metric <value>
continues on next page

21.1. Configuration Commands 1735

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 ripng level-1 route-
ipv6 ripng level-1 route- map <value>
map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 ripng level-2 metric
ipv6 ripng level-2 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 ripng level-2 route-
ipv6 ripng level-2 route- map <value>
map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 static level-1 metric
ipv6 static level-1 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 static level-1 route-
ipv6 static level-1 route- map <value>
map
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 static level-2 metric
ipv6 static level-2 metric <value>
× not yet documented protocols_isis.xml.in: protocols isis redistribute
protocols isis redistribute ipv6 static level-2 route-
ipv6 static level-2 route- map <value>
map
✓ set protocols isis protocols_isis.xml.in: protocols isis segment-
segment-routing protocols isis segment- routing global-block
global-block routing global-block high-label-value <value>
high-label-value high-label-value
<label-value>
✓ set protocols isis protocols_isis.xml.in: protocols isis segment-
segment-routing protocols isis segment- routing global-block
global-block routing global-block low-label-value <value>
low-label-value low-label-value
<label-value>
× set protocols isis Nothing found in XML Nothing found in VyOS
segment-routing Definitions
local-block
<low-label-value
<label-value>
✓ set protocols isis protocols_isis.xml.in: protocols isis segment-
segment-routing protocols isis segment- routing local-block
local-block routing local-block high-label-value <value>
high-label-value high-label-value
<label-value>
× not yet documented protocols_isis.xml.in: protocols isis segment-
protocols isis segment- routing local-block
routing local-block low-label-value <value>
low-label-value
continues on next page

21.1. Configuration Commands 1736

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set protocols isis protocols_isis.xml.in: protocols isis segment-
segment-routing protocols isis segment- routing maximum-label-
maximum-label-depth routing maximum-label- depth <value>
<1-16> depth
× not yet documented protocols_isis.xml.in: protocols isis segment-
protocols isis segment- routing prefix <text>
routing prefix <prefix> absolute explicit-null
absolute explicit-null
× not yet documented protocols_isis.xml.in: protocols isis segment-
protocols isis segment- routing prefix <text>
routing prefix <prefix> absolute no-php-flag
absolute no-php-flag
× not yet documented protocols_isis.xml.in: protocols isis segment-
protocols isis segment- routing prefix <text>
routing prefix <prefix> absolute value <value>
absolute value
× set protocols isis Nothing found in XML Nothing found in VyOS
segment-routing Definitions
prefix <address>
index <no-php-flag
| explicit-null|
n-flag-clear>
× not yet documented protocols_isis.xml.in: protocols isis segment-
protocols isis segment- routing prefix <text>
routing prefix <prefix> index explicit-null
index explicit-null
× not yet documented protocols_isis.xml.in: protocols isis segment-
protocols isis segment- routing prefix <text>
routing prefix <prefix> index no-php-flag
index no-php-flag
✓ set protocols isis protocols_isis.xml.in: protocols isis segment-
segment-routing protocols isis segment- routing prefix <text>
prefix <address> routing prefix <prefix> index value <value>
index value index value
<0-65535>
✓ set protocols isis protocols_isis.xml.in: protocols isis set-attached-
set-attached-bit protocols isis set-attached- bit
bit
✓ set protocols isis protocols_isis.xml.in: protocols isis set-
set-overload-bit protocols isis set- overload-bit
overload-bit
✓ set protocols isis protocols_isis.xml.in: protocols isis spf-delay-
spf-delay-ietf protocols isis spf-delay- ietf holddown <value>
holddown ietf holddown
<milliseconds>
✓ set protocols isis protocols_isis.xml.in: protocols isis spf-delay-
spf-delay-ietf protocols isis spf-delay- ietf init-delay <value>
init-delay ietf init-delay
<milliseconds>
continues on next page

21.1. Configuration Commands 1737

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set protocols isis protocols_isis.xml.in: protocols isis spf-delay-
spf-delay-ietf protocols isis spf-delay- ietf long-delay <value>
long-delay ietf long-delay
<milliseconds>
✓ set protocols isis protocols_isis.xml.in: protocols isis spf-delay-
spf-delay-ietf protocols isis spf-delay- ietf short-delay <value>
short-delay ietf short-delay
<milliseconds>
✓ set protocols isis protocols_isis.xml.in: protocols isis spf-delay-
spf-delay-ietf protocols isis spf-delay- ietf time-to-learn <value>
time-to-learn ietf time-to-learn
<milliseconds>
✓ set protocols protocols_isis.xml.in: protocols isis spf-interval
isis spf-interval protocols isis spf-interval <value>
<seconds>
× not yet documented protocols_isis.xml.in: protocols isis traffic-
protocols isis traffic- engineering address
engineering address <value>
× not yet documented protocols_isis.xml.in: protocols isis traffic-
protocols isis traffic- engineering enable
engineering enable
✓ set protocols protocols_mpls.xml.in: protocols mpls interface
mpls interface protocols mpls interface <value>
<interface>
✓ set protocols mpls protocols_mpls.xml.in: protocols mpls ldp al-
ldp allocation ipv4 protocols mpls ldp alloca- location ipv4 access-list
access-list <access tion ipv4 access-list <value>
list number>
✓ set protocols mpls protocols_mpls.xml.in: protocols mpls ldp allo-
ldp allocation ipv6 protocols mpls ldp alloca- cation ipv6 access-list6
access-list6 <access tion ipv6 access-list6 <value>
list number>
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp discov-
mpls ldp discovery protocols mpls ldp discov- ery hello-ipv4-holdtime
hello-ipv4-holdtime ery hello-ipv4-holdtime <value>
<seconds>
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp dis-
mpls ldp discovery protocols mpls ldp discov- covery hello-ipv4-interval
hello-ipv4-interval ery hello-ipv4-interval <value>
<seconds>
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp discov-
mpls ldp discovery protocols mpls ldp discov- ery hello-ipv6-holdtime
hello-ipv6-holdtime ery hello-ipv6-holdtime <value>
<seconds>
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp dis-
mpls ldp discovery protocols mpls ldp discov- covery hello-ipv6-interval
hello-ipv6-interval ery hello-ipv6-interval <value>
<seconds>
continues on next page

21.1. Configuration Commands 1738

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp discov-
mpls ldp discovery protocols mpls ldp discov- ery session-ipv4-holdtime
session-ipv4-holdtime ery session-ipv4-holdtime <value>
<seconds>
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp discov-
mpls ldp discovery protocols mpls ldp discov- ery session-ipv6-holdtime
session-ipv6-holdtime ery session-ipv6-holdtime <value>
<seconds>
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp discov-
mpls ldp discovery protocols mpls ldp discov- ery transport-ipv4-address
transport-ipv4-address ery transport-ipv4-address <value>
<address>
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp discov-
mpls ldp discovery protocols mpls ldp discov- ery transport-ipv6-address
transport-ipv6-address ery transport-ipv6-address <value>
<address>
✓ set protocols mpls protocols_mpls.xml.in: protocols mpls ldp export
ldp export ipv4 protocols mpls ldp export ipv4 explicit-null
explicit-null ipv4 explicit-null
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp ex-
mpls ldp export protocols mpls ldp ex- port ipv4 export-filter
ipv4 export-filter port ipv4 export-filter filter-access-list <value>
filter-access-list filter-access-list
<access list
number>
× not yet documented protocols_mpls.xml.in: protocols mpls ldp ex-
protocols mpls ldp ex- port ipv4 export-filter
port ipv4 export-filter neighbor-access-list
neighbor-access-list <value>
✓ set protocols mpls protocols_mpls.xml.in: protocols mpls ldp export
ldp export ipv6 protocols mpls ldp export ipv6 explicit-null
explicit-null ipv6 explicit-null
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp ex-
mpls ldp export protocols mpls ldp ex- port ipv6 export-filter
ipv6 export-filter port ipv6 export-filter filter-access-list6 <value>
filter-access-list6 filter-access-list6
<access list
number>
× not yet documented protocols_mpls.xml.in: protocols mpls ldp ex-
protocols mpls ldp ex- port ipv6 export-filter
port ipv6 export-filter neighbor-access-list6
neighbor-access-list6 <value>
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp im-
mpls ldp import protocols mpls ldp im- port ipv4 import-filter
ipv4 import-filter port ipv4 import-filter filter-access-list <value>
filter-access-list filter-access-list
<access list
number>
continues on next page

21.1. Configuration Commands 1739

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_mpls.xml.in: protocols mpls ldp im-
protocols mpls ldp im- port ipv4 import-filter
port ipv4 import-filter neighbor-access-list
neighbor-access-list <value>
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp im-
mpls ldp import protocols mpls ldp im- port ipv6 import-filter
ipv6 import-filter port ipv6 import-filter filter-access-list6 <value>
filter-access-list6 filter-access-list6
<access list
number>
× not yet documented protocols_mpls.xml.in: protocols mpls ldp im-
protocols mpls ldp im- port ipv6 import-filter
port ipv6 import-filter neighbor-access-list6
neighbor-access-list6 <value>
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp inter-
mpls ldp interface protocols mpls ldp inter- face <value>
<interface> face
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp neigh-
mpls ldp neighbor protocols mpls ldp neigh- bor <text> password
<address> password bor <neighbor> password <value>
<password>
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp
mpls ldp neighbor protocols mpls ldp neigh- neighbor <text> session-
<address> bor <neighbor> session- holdtime <value>
session-holdtime holdtime
<seconds>
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp neigh-
mpls ldp neighbor protocols mpls ldp bor <text> ttl-security
<address> neighbor <neighbor> <value>
ttl-security ttl-security
<disable | hop
count>
✓ set protocols mpls protocols_mpls.xml.in: protocols mpls ldp param-
ldp parameters protocols mpls ldp param- eters cisco-interop-tlv
cisco-interop-tlv eters cisco-interop-tlv
✓ set protocols mpls protocols_mpls.xml.in: protocols mpls ldp param-
ldp parameters protocols mpls ldp param- eters ordered-control
ordered-control eters ordered-control
✓ set protocols mpls protocols_mpls.xml.in: protocols mpls ldp param-
ldp parameters protocols mpls ldp param- eters transport-prefer-ipv4
transport-prefer-ipv4 eters transport-prefer-ipv4
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp router-
mpls ldp router-id protocols mpls ldp router- id <value>
<address> id
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp
mpls ldp protocols mpls ldp targeted-neighbor ipv4
targeted-neighbor targeted-neighbor ipv4 address <value>
ipv4 address address
<address>
continues on next page

21.1. Configuration Commands 1740

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp
mpls ldp protocols mpls ldp targeted-neighbor ipv4
targeted-neighbor targeted-neighbor ipv4 enable
ipv4 enable enable
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp
mpls ldp protocols mpls ldp targeted-neighbor ipv4
targeted-neighbor targeted-neighbor ipv4 hello-holdtime <value>
ipv4 hello-holdtime hello-holdtime
<seconds>
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp
mpls ldp protocols mpls ldp targeted-neighbor ipv4
targeted-neighbor targeted-neighbor ipv4 hello-interval <value>
ipv4 hello-interval hello-interval
<seconds>
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp
mpls ldp protocols mpls ldp targeted-neighbor ipv6
targeted-neighbor targeted-neighbor ipv6 address <value>
ipv6 address address
<address>
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp
mpls ldp protocols mpls ldp targeted-neighbor ipv6
targeted-neighbor targeted-neighbor ipv6 enable
ipv6 enable enable
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp
mpls ldp protocols mpls ldp targeted-neighbor ipv6
targeted-neighbor targeted-neighbor ipv6 hello-holdtime <value>
ipv6 hello-holdtime hello-holdtime
<seconds>
✓ set protocols protocols_mpls.xml.in: protocols mpls ldp
mpls ldp protocols mpls ldp targeted-neighbor ipv6
targeted-neighbor targeted-neighbor ipv6 hello-interval <value>
ipv6 hello-interval hello-interval
<seconds>
× not yet documented protocols_mpls.xml.in: protocols mpls parameters
protocols mpls parameters maximum-ttl <value>
maximum-ttl
× not yet documented protocols_mpls.xml.in: protocols mpls parameters
protocols mpls parameters no-propagate-ttl
no-propagate-ttl
✓ set protocols nhrp protocols_nhrp.xml.in: protocols nhrp tun-
tunnel <tunnel> protocols nhrp tun- nel <text> cisco-
cisco-authentication nel <tunnel> cisco- authentication <value>
<secret> authentication
✓ set protocols nhrp protocols_nhrp.xml.in: protocols nhrp tunnel
tunnel <tunnel> protocols nhrp tunnel <text> dynamic-map
dynamic-map <tunnel> dynamic-map <text> nbma-domain-
<address> <dynamic-map> nbma- name <value>
nbma-domain-name domain-name
<fqdn>
continues on next page

21.1. Configuration Commands 1741

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set protocols nhrp protocols_nhrp.xml.in: protocols nhrp tunnel
tunnel <tunnel> protocols nhrp tunnel <text> holding-time
holding-time <tunnel> holding-time <value>
<timeout>
✓ set protocols nhrp protocols_nhrp.xml.in: protocols nhrp tunnel
tunnel <tunnel> map protocols nhrp tunnel <text> map <text> cisco
cisco <tunnel> map <map>
cisco
✓ set protocols nhrp protocols_nhrp.xml.in: protocols nhrp tunnel
tunnel <tunnel> protocols nhrp tunnel <text> map <text> nbma-
map nbma-address <tunnel> map <map> address <value>
<address> nbma-address
✓ set protocols nhrp protocols_nhrp.xml.in: protocols nhrp tunnel
tunnel <tunnel> map protocols nhrp tunnel <text> map <text> register
register <tunnel> map <map>
register
✓ set protocols nhrp protocols_nhrp.xml.in: protocols nhrp tunnel
tunnel <tunnel> protocols nhrp tunnel <text> multicast <value>
multicast <dynamic | <tunnel> multicast
nhs>
✓ set protocols nhrp protocols_nhrp.xml.in: protocols nhrp tunnel
tunnel <tunnel> protocols nhrp tunnel <text> non-caching
non-caching <tunnel> non-caching
✓ set protocols nhrp protocols_nhrp.xml.in: protocols nhrp tunnel
tunnel <tunnel> protocols nhrp tunnel <text> redirect
redirect <tunnel> redirect
✓ set protocols nhrp protocols_nhrp.xml.in: protocols nhrp tunnel
tunnel <tunnel> protocols nhrp tunnel <text> shortcut
shortcut <tunnel> shortcut
✓ set protocols nhrp protocols_nhrp.xml.in: protocols nhrp tun-
tunnel <tunnel> protocols nhrp tunnel nel <text> shortcut-
shortcut-destination <tunnel> shortcut- destination
destination
× set protocols nhrp Nothing found in XML Nothing found in VyOS
tunnel <tunnel> Definitions
shortcut-target
<address>
✓ set protocols nhrp protocols_nhrp.xml.in: protocols nhrp tunnel
tunnel <tunnel> protocols nhrp tunnel <text> shortcut-target
shortcut-target <tunnel> shortcut-target <text> holding-time
<address> <shortcut-target> holding- <value>
holding-time time
<timeout>
× not yet documented protocols_ospf.xml.in: protocols ospf access-list
protocols ospf access-list <text> export <value>
<access-list> export
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf aggregation
aggregation timer protocols ospf aggregation timer <value>
<seconds> timer
continues on next page

21.1. Configuration Commands 1742

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_ospf.xml.in: protocols ospf area <text>
protocols ospf area <area> area-type normal
area-type normal
× set protocols Nothing found in XML Nothing found in VyOS
ospf area <number> Definitions
area-type nssa
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf area <text>
area <number> protocols ospf area <area> area-type nssa default-cost
area-type nssa area-type nssa default-cost <value>
default-cost
<number>
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf area
area <number> protocols ospf area <text> area-type nssa
area-type nssa <area> area-type nssa no-summary
no-summary no-summary
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf area <text>
area <number> protocols ospf area <area> area-type nssa translate
area-type nssa area-type nssa translate <value>
translate
<always|candidate|never>
× set protocols Nothing found in XML Nothing found in VyOS
ospf area <number> Definitions
area-type stub
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf area <text>
area <number> protocols ospf area <area> area-type stub default-cost
area-type stub area-type stub default-cost <value>
default-cost
<number>
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf area
area <number> protocols ospf area <text> area-type stub
area-type stub <area> area-type stub no-summary
no-summary no-summary
× not yet documented protocols_ospf.xml.in: protocols ospf area <text>
protocols ospf area <area> authentication <value>
authentication
× set protocols Nothing found in XML Nothing found in VyOS
ospf area <number> Definitions
authentication md5
× set protocols ospf Nothing found in XML Nothing found in VyOS
area <number> Definitions
authentication
plaintext-password
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf area <text>
area <number> protocols ospf area <area> export-list <value>
export-list export-list
<acl_number>
continues on next page

21.1. Configuration Commands 1743

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf area <text>
area <number> protocols ospf area <area> import-list <value>
import-list import-list
<acl_number>
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf area <text>
area <number> protocols ospf area <area> network <value>
network <A.B.C.D/ network
M>
× set protocols ospf Nothing found in XML Nothing found in VyOS
area <number> range Definitions
<A.B.C.D/M> [cost
<number>]
× not yet documented protocols_ospf.xml.in: protocols ospf area <text>
protocols ospf area <area> range <text> cost <value>
range <range> cost
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf area <text>
area <number> protocols ospf area range <text> not-advertise
range <A.B.C.D/M> <area> range <range>
not-advertise not-advertise
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf area <text>
area <number> protocols ospf area <area> range <text> substitute
range <A.B.C.D/M> range <range> substitute <value>
substitute <E.F.G.H/
M>
✓ set protocols protocols_ospf.xml.in: protocols ospf area <text>
ospf area protocols ospf area <area> shortcut <value>
<number> shortcut shortcut
<default|disable|enable>
× set protocols ospf Nothing found in XML Nothing found in VyOS
area <number> Definitions
virtual-link <A.
B.C.D>
× not yet documented protocols_ospf.xml.in: protocols ospf area <text>
protocols ospf area <area> virtual-link <text> authen-
virtual-link <virtual-link> tication md5 key-id <text>
authentication md5 key-id md5-key <value>
<key-id> md5-key
× not yet documented protocols_ospf.xml.in: protocols ospf area
protocols ospf area <area> <text> virtual-link <text>
virtual-link <virtual-link> authentication plaintext-
authentication plaintext- password <value>
password
× not yet documented protocols_ospf.xml.in: protocols ospf area <text>
protocols ospf area <area> virtual-link <text> dead-
virtual-link <virtual-link> interval <value>
dead-interval
continues on next page

21.1. Configuration Commands 1744

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_ospf.xml.in: protocols ospf area <text>
protocols ospf area <area> virtual-link <text> hello-
virtual-link <virtual-link> interval <value>
hello-interval
× not yet documented protocols_ospf.xml.in: protocols ospf area
protocols ospf area <area> <text> virtual-link
virtual-link <virtual-link> <text> retransmit-interval
retransmit-interval <value>
× not yet documented protocols_ospf.xml.in: protocols ospf area
protocols ospf area <area> <text> virtual-link <text>
virtual-link <virtual-link> transmit-delay <value>
transmit-delay
✓ set protocols protocols_ospf.xml.in: protocols ospf auto-cost
ospf auto-cost protocols ospf auto-cost reference-bandwidth
reference-bandwidth reference-bandwidth <value>
<number>
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf capability
capability opaque protocols ospf capability opaque
opaque
× set protocols ospf Nothing found in XML Nothing found in VyOS
default-information Definitions
originate [always]
[metric <number>]
[metric-type <1|2>]
[route-map <name>]
× not yet documented protocols_ospf.xml.in: protocols ospf default-
protocols ospf default- information originate
information originate always
always
× not yet documented protocols_ospf.xml.in: protocols ospf default-
protocols ospf default- information originate
information originate metric <value>
metric
× not yet documented protocols_ospf.xml.in: protocols ospf default-
protocols ospf default- information originate
information originate metric-type <value>
metric-type
× not yet documented protocols_ospf.xml.in: protocols ospf default-
protocols ospf default- information originate
information originate route-map <value>
route-map
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf default-
default-metric protocols ospf default- metric <value>
<number> metric
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf distance
distance global protocols ospf distance global <value>
<distance> global
continues on next page

21.1. Configuration Commands 1745

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set protocols Nothing found in XML Nothing found in VyOS
ospf distance ospf Definitions
<external|inter-area|intra-area>
<distance>
× not yet documented protocols_ospf.xml.in: protocols ospf distance
protocols ospf distance ospf external <value>
ospf external
× not yet documented protocols_ospf.xml.in: protocols ospf distance
protocols ospf distance ospf inter-area <value>
ospf inter-area
× not yet documented protocols_ospf.xml.in: protocols ospf distance
protocols ospf distance ospf intra-area <value>
ospf intra-area
× set protocols ospf Nothing found in XML Nothing found in VyOS
graceful-restart Definitions
[grace-period
(1-1800)]
× not yet documented protocols_ospf.xml.in: protocols ospf graceful-
protocols ospf graceful- restart grace-period
restart grace-period <value>
× set protocols ospf Nothing found in XML Nothing found in VyOS
graceful-restart Definitions
helper enable
[router-id A.B.C.
D]
× not yet documented protocols_ospf.xml.in: protocols ospf graceful-
protocols ospf graceful- restart helper enable
restart helper enable router-id <value>
router-id
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf graceful-
graceful-restart protocols ospf graceful- restart helper no-strict-lsa-
helper restart helper no-strict-lsa- checking
no-strict-lsa-checking checking
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf graceful-
graceful-restart protocols ospf graceful- restart helper planned-
helper planned-only restart helper planned- only
only
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf graceful-
graceful-restart protocols ospf graceful- restart helper supported-
helper restart helper supported- grace-time <value>
supported-grace-time grace-time
✓ set protocols protocols_ospf.xml.in: protocols ospf interface
ospf interface protocols ospf interface <text> area <value>
<interface> area <interface> area
<x.x.x.x | x>
continues on next page

21.1. Configuration Commands 1746

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set protocols protocols_ospf.xml.in: protocols ospf interface
ospf interface protocols ospf interface <text> authentication md5
<interface> <interface> authentication key-id <text> md5-key
authentication md5 md5 key-id <key-id> <value>
key-id <id> md5-key md5-key
<text>
✓ set protocols protocols_ospf.xml.in: protocols ospf inter-
ospf interface protocols ospf interface face <text> authentica-
<interface> <interface> authentication tion plaintext-password
authentication plaintext-password <value>
plaintext-password
<text>
✓ set protocols protocols_ospf.xml.in: protocols ospf interface
ospf interface protocols ospf interface <text> bandwidth <value>
<interface> <interface> bandwidth
bandwidth <number>
× set protocols Nothing found in XML Nothing found in VyOS
ospf interface Definitions
<interface> bfd
× not yet documented protocols_ospf.xml.in: protocols ospf interface
protocols ospf interface <text> bfd profile <value>
<interface> bfd profile
✓ set protocols protocols_ospf.xml.in: protocols ospf interface
ospf interface protocols ospf interface <text> cost <value>
<interface> cost <interface> cost
<number>
✓ set protocols protocols_ospf.xml.in: protocols ospf interface
ospf interface protocols ospf interface <text> dead-interval
<interface> <interface> dead-interval <value>
dead-interval
<number>
✓ set protocols protocols_ospf.xml.in: protocols ospf interface
ospf interface protocols ospf interface <text> hello-interval
<interface> <interface> hello-interval <value>
hello-interval
<number>
✓ set protocols protocols_ospf.xml.in: protocols ospf interface
ospf interface protocols ospf inter- <text> hello-multiplier
<interface> face <interface> hello- <value>
hello-multiplier multiplier
<number>
✓ set protocols protocols_ospf.xml.in: protocols ospf interface
ospf interface protocols ospf interface <text> ldp-sync disable
<interface> ldp-sync <interface> ldp-sync
disable disable
✓ set protocols protocols_ospf.xml.in: protocols ospf interface
ospf interface protocols ospf interface <text> ldp-sync holddown
<interface> ldp-sync <interface> ldp-sync <value>
holddown <seconds> holddown
continues on next page

21.1. Configuration Commands 1747

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set protocols protocols_ospf.xml.in: protocols ospf interface
ospf interface protocols ospf interface <text> mtu-ignore
<interface> <interface> mtu-ignore
mtu-ignore
✓ set protocols protocols_ospf.xml.in: protocols ospf interface
ospf interface protocols ospf interface <text> network <value>
<interface> network <interface> network
<type>
× set protocols Nothing found in XML Nothing found in VyOS
ospf interface Definitions
<interface> passive
[disable]
× not yet documented protocols_ospf.xml.in: protocols ospf interface
protocols ospf inter- <text> passive disable
face <interface> passive
disable
✓ set protocols protocols_ospf.xml.in: protocols ospf interface
ospf interface protocols ospf interface <text> priority <value>
<interface> priority <interface> priority
<number>
✓ set protocols protocols_ospf.xml.in: protocols ospf interface
ospf interface protocols ospf interface <text> retransmit-interval
<interface> <interface> retransmit- <value>
retransmit-interval interval
<number>
✓ set protocols protocols_ospf.xml.in: protocols ospf interface
ospf interface protocols ospf interface <text> transmit-delay
<interface> <interface> transmit-delay <value>
transmit-delay
<number>
× set protocols ospf Nothing found in XML Nothing found in VyOS
ldp-sync Definitions
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf ldp-sync
ldp-sync holddown protocols ospf ldp-sync holddown <value>
<seconds> holddown
× set protocols ospf Nothing found in XML Nothing found in VyOS
log-adjacency-changes Definitions
[detail]
× not yet documented protocols_ospf.xml.in: protocols ospf log-
protocols ospf log- adjacency-changes detail
adjacency-changes detail
× set protocols Nothing found in XML Nothing found in VyOS
ospf max-metric Definitions
router-lsa
<administrative|on-shutdown
<seconds>|on-startup
<seconds>>
continues on next page

21.1. Configuration Commands 1748

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_ospf.xml.in: protocols ospf max-metric
protocols ospf max-metric router-lsa administrative
router-lsa administrative
× not yet documented protocols_ospf.xml.in: protocols ospf max-metric
protocols ospf max-metric router-lsa on-shutdown
router-lsa on-shutdown <value>
× not yet documented protocols_ospf.xml.in: protocols ospf max-metric
protocols ospf max-metric router-lsa on-startup
router-lsa on-startup <value>
✓ set protocols protocols_ospf.xml.in: protocols ospf maximum-
ospf maximum-paths protocols ospf maximum- paths <value>
<1-64> paths
× not yet documented protocols_ospf.xml.in: protocols ospf mpls-te en-
protocols ospf mpls-te en- able
able
× not yet documented protocols_ospf.xml.in: protocols ospf mpls-te
protocols ospf mpls-te router-address <value>
router-address
× set protocols ospf Nothing found in XML Nothing found in VyOS
neighbor <A.B.C.D> Definitions
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf neigh-
neighbor <A.B.C. protocols ospf neighbor bor <text> poll-interval
D> poll-interval <neighbor> poll-interval <value>
<seconds>
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf neighbor
neighbor <A.B.C.D> protocols ospf neighbor <text> priority <value>
priority <number> <neighbor> priority
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf parameters
parameters abr-type protocols ospf parameters abr-type <value>
<cisco|ibm|shortcut|standard>
abr-type
✓ set protocols protocols_ospf.xml.in: protocols ospf parameters
ospf parameters protocols ospf parameters opaque-lsa
opaque-lsa opaque-lsa
✓ set protocols protocols_ospf.xml.in: protocols ospf parameters
ospf parameters protocols ospf parameters rfc1583-compatibility
rfc1583-compatibility rfc1583-compatibility
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf parameters
parameters router-id protocols ospf parameters router-id <value>
<rid> router-id
× not yet documented protocols_ospf.xml.in: protocols ospf passive-
protocols ospf passive- interface <value>
interface
× set protocols ospf Nothing found in XML Nothing found in VyOS
passive-interface Definitions
default
× set protocols ospf Nothing found in XML Nothing found in VyOS
redistribute <route Definitions
source>
continues on next page

21.1. Configuration Commands 1749

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute babel metric <value>
babel metric
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute babel metric-type <value>
babel metric-type
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute babel route-map <value>
babel route-map
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute bgp metric <value>
bgp metric
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute bgp metric-type <value>
bgp metric-type
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute bgp route-map <value>
bgp route-map
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute connected metric <value>
connected metric
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute connected metric-type
connected metric-type <value>
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute connected route-map
connected route-map <value>
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute isis metric <value>
isis metric
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute isis metric-type <value>
isis metric-type
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute isis route-map <value>
isis route-map
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute kernel metric <value>
kernel metric
× not yet documented protocols_ospf.xml.in: protocols ospf redis-
protocols ospf redistribute tribute kernel metric-type
kernel metric-type <value>
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute kernel route-map <value>
kernel route-map
× set protocols ospf Nothing found in XML Nothing found in VyOS
redistribute <route Definitions
source> metric
<number>
continues on next page

21.1. Configuration Commands 1750

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set protocols ospf Nothing found in XML Nothing found in VyOS
redistribute <route Definitions
source> metric-type
<1|2>
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute rip metric <value>
rip metric
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute rip metric-type <value>
rip metric-type
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute rip route-map <value>
rip route-map
× set protocols ospf Nothing found in XML Nothing found in VyOS
redistribute <route Definitions
source> route-map
<name>
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute static metric <value>
static metric
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute static metric-type <value>
static metric-type
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute static route-map <value>
static route-map
× not yet documented protocols_ospf.xml.in: protocols ospf redis-
protocols ospf redistribute tribute table <text> metric
table <table> metric <value>
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute table <text> metric-type
table <table> metric-type <value>
× not yet documented protocols_ospf.xml.in: protocols ospf redistribute
protocols ospf redistribute table <text> route-map
table <table> route-map <value>
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf refresh
refresh timers protocols ospf refresh timers <value>
<seconds> timers
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf segment-
segment-routing protocols ospf segment- routing global-block high-
global-block routing global-block high- label-value <value>
high-label-value label-value
<label-value>
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf segment-
segment-routing protocols ospf segment- routing global-block low-
global-block routing global-block low- label-value <value>
low-label-value label-value
<label-value>
continues on next page

21.1. Configuration Commands 1751

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set protocols ospf Nothing found in XML Nothing found in VyOS
segment-routing Definitions
local-block
<low-label-value
<label-value>
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf segment-
segment-routing protocols ospf segment- routing local-block high-
local-block routing local-block high- label-value <value>
high-label-value label-value
<label-value>
× not yet documented protocols_ospf.xml.in: protocols ospf segment-
protocols ospf segment- routing local-block low-
routing local-block low- label-value <value>
label-value
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf segment-
segment-routing protocols ospf segment- routing maximum-label-
maximum-label-depth routing maximum-label- depth <value>
<1-16> depth
× set protocols ospf Nothing found in XML Nothing found in VyOS
segment-routing Definitions
prefix <address>
index <no-php-flag
| explicit-null|
n-flag-clear>
× not yet documented protocols_ospf.xml.in: protocols ospf segment-
protocols ospf segment- routing prefix <text> index
routing prefix <prefix> in- explicit-null
dex explicit-null
× not yet documented protocols_ospf.xml.in: protocols ospf segment-
protocols ospf segment- routing prefix <text> index
routing prefix <prefix> in- no-php-flag
dex no-php-flag
✓ set protocols ospf protocols_ospf.xml.in: protocols ospf segment-
segment-routing protocols ospf segment- routing prefix <text> index
prefix <address> routing prefix <prefix> in- value <value>
index value dex value
<0-65535>
× not yet documented protocols_ospf.xml.in: protocols ospf summary-
protocols ospf summary- address <text> no-
address <summary- advertise
address> no-advertise
× not yet documented protocols_ospf.xml.in: protocols ospf summary-
protocols ospf summary- address <text> tag
address <summary- <value>
address> tag
× set protocols ospf Nothing found in XML Nothing found in VyOS
summary-address Definitions
x.x.x.x/y [tag
(1-4294967295)]
continues on next page

21.1. Configuration Commands 1752

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set protocols ospf Nothing found in XML Nothing found in VyOS
summary-address x.x. Definitions
x.x/y no-advertise
× set protocols ospf Nothing found in XML Nothing found in VyOS
timers throttle spf Definitions
<delay|initial-holdtime|max-holdtime>
<seconds>
× not yet documented protocols_ospf.xml.in: protocols ospf timers
protocols ospf timers throttle spf delay <value>
throttle spf delay
× not yet documented protocols_ospf.xml.in: protocols ospf timers
protocols ospf timers throttle spf initial-
throttle spf initial- holdtime <value>
holdtime
× not yet documented protocols_ospf.xml.in: protocols ospf timers
protocols ospf timers throttle spf max-holdtime
throttle spf max-holdtime <value>
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 area
protocols ospfv3 area <text> area-type nssa
<area> area-type nssa default-information-
default-information- originate
originate
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 area
protocols ospfv3 area <text> area-type nssa
<area> area-type nssa no-summary
no-summary
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 area
protocols ospfv3 area <text> area-type stub
<area> area-type stub no-summary
no-summary
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 area
protocols ospfv3 area <text> export-list <value>
<area> export-list
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 area
protocols ospfv3 area <text> import-list <value>
<area> import-list
× set protocols ospfv3 Nothing found in XML Nothing found in VyOS
area <number> range Definitions
<prefix>
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 area
protocols ospfv3 area <text> range <text>
<area> range <range> advertise
advertise
✓ set protocols ospfv3 protocols_ospfv3.xml.in: protocols ospfv3 area
area <number> protocols ospfv3 area <text> range <text>
range <prefix> <area> range <range> not-advertise
not-advertise not-advertise
continues on next page

21.1. Configuration Commands 1753

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 auto-
protocols ospfv3 auto-cost cost reference-bandwidth
reference-bandwidth <value>
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 default-
protocols ospfv3 default- information originate al-
information originate al- ways
ways
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 default-
protocols ospfv3 default- information originate met-
information originate met- ric <value>
ric
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 default-
protocols ospfv3 default- information originate
information originate metric-type <value>
metric-type
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 default-
protocols ospfv3 default- information originate
information originate route-map <value>
route-map
✓ set protocols ospfv3 protocols_ospfv3.xml.in: protocols ospfv3 distance
distance global protocols ospfv3 distance global <value>
<distance> global
× set protocols ospfv3 Nothing found in XML Nothing found in VyOS
distance ospfv3 Definitions
<external|inter-area|intra-area>
<distance>
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 distance
protocols ospfv3 distance ospfv3 external <value>
ospfv3 external
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 distance
protocols ospfv3 distance ospfv3 inter-area <value>
ospfv3 inter-area
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 distance
protocols ospfv3 distance ospfv3 intra-area <value>
ospfv3 intra-area
× set protocols ospfv3 Nothing found in XML Nothing found in VyOS
graceful-restart Definitions
[grace-period
(1-1800)]
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 graceful-
protocols ospfv3 graceful- restart grace-period
restart grace-period <value>
× set protocols ospfv3 Nothing found in XML Nothing found in VyOS
graceful-restart Definitions
helper enable
[router-id A.B.C.
D]
continues on next page

21.1. Configuration Commands 1754

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 graceful-
protocols ospfv3 graceful- restart helper enable
restart helper enable router-id <value>
router-id
✓ set protocols ospfv3 protocols_ospfv3.xml.in: protocols ospfv3 graceful-
graceful-restart protocols ospfv3 graceful- restart helper lsa-check-
helper restart helper lsa-check- disable
lsa-check-disable disable
✓ set protocols ospfv3 protocols_ospfv3.xml.in: protocols ospfv3 graceful-
graceful-restart protocols ospfv3 graceful- restart helper planned-
helper planned-only restart helper planned- only
only
✓ set protocols ospfv3 protocols_ospfv3.xml.in: protocols ospfv3 graceful-
graceful-restart protocols ospfv3 graceful- restart helper supported-
helper restart helper supported- grace-time <value>
supported-grace-time grace-time
✓ set protocols protocols_ospfv3.xml.in: protocols ospfv3 interface
ospfv3 interface protocols ospfv3 interface <text> area <value>
<interface> area <interface> area
<number>
× set protocols Nothing found in XML Nothing found in VyOS
ospfv3 interface Definitions
<interface> bfd
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 interface
protocols ospfv3 interface <text> bfd profile <value>
<interface> bfd profile
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 interface
protocols ospfv3 interface <text> cost <value>
<interface> cost
✓ set protocols protocols_ospfv3.xml.in: protocols ospfv3 inter-
ospfv3 interface protocols ospfv3 interface face <text> dead-interval
<interface> <interface> dead-interval <value>
dead-interval
<number>
✓ set protocols protocols_ospfv3.xml.in: protocols ospfv3 interface
ospfv3 interface protocols ospfv3 interface <text> hello-interval
<interface> <interface> hello-interval <value>
hello-interval
<number>
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 interface
protocols ospfv3 interface <text> ifmtu <value>
<interface> ifmtu
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 inter-
protocols ospfv3 interface face <text> instance-id
<interface> instance-id <value>
× set protocols Nothing found in XML Nothing found in VyOS
ospfv3 interface Definitions
<interface> ipv6
cost <number>
continues on next page

21.1. Configuration Commands 1755

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set protocols protocols_ospfv3.xml.in: protocols ospfv3 interface
ospfv3 interface protocols ospfv3 interface <text> mtu-ignore
<interface> <interface> mtu-ignore
mtu-ignore
✓ set protocols protocols_ospfv3.xml.in: protocols ospfv3 interface
ospfv3 interface protocols ospfv3 interface <text> network <value>
<interface> network <interface> network
<type>
✓ set protocols protocols_ospfv3.xml.in: protocols ospfv3 interface
ospfv3 interface protocols ospfv3 interface <text> passive
<interface> passive <interface> passive
✓ set protocols protocols_ospfv3.xml.in: protocols ospfv3 interface
ospfv3 interface protocols ospfv3 interface <text> priority <value>
<interface> priority <interface> priority
<number>
✓ set protocols protocols_ospfv3.xml.in: protocols ospfv3 interface
ospfv3 interface protocols ospfv3 interface <text> retransmit-interval
<interface> <interface> retransmit- <value>
retransmit-interval interval
<number>
✓ set protocols protocols_ospfv3.xml.in: protocols ospfv3 interface
ospfv3 interface protocols ospfv3 interface <text> transmit-delay
<interface> <interface> transmit-delay <value>
transmit-delay
<number>
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 log-
protocols ospfv3 log- adjacency-changes detail
adjacency-changes detail
✓ set protocols ospfv3 protocols_ospfv3.xml.in: protocols ospfv3 parame-
parameters router-id protocols ospfv3 parame- ters router-id <value>
<rid> ters router-id
× set protocols ospfv3 Nothing found in XML Nothing found in VyOS
redistribute <route Definitions
source>
× not yet documented protocols_ospfv3.xml.in: Nothing found in VyOS
protocols ospfv3 redis-
tribute babel metric
× not yet documented protocols_ospfv3.xml.in: Nothing found in VyOS
protocols ospfv3 redis-
tribute babel metric-type
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 redis-
protocols ospfv3 redis- tribute babel route-map
tribute babel route-map <value>
× not yet documented protocols_ospfv3.xml.in: Nothing found in VyOS
protocols ospfv3 redis-
tribute bgp metric
× not yet documented protocols_ospfv3.xml.in: Nothing found in VyOS
protocols ospfv3 redis-
tribute bgp metric-type
continues on next page

21.1. Configuration Commands 1756

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 redis-
protocols ospfv3 redis- tribute bgp route-map
tribute bgp route-map <value>
× not yet documented protocols_ospfv3.xml.in: Nothing found in VyOS
protocols ospfv3 redis-
tribute connected metric
× not yet documented protocols_ospfv3.xml.in: Nothing found in VyOS
protocols ospfv3 re-
distribute connected
metric-type
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 re-
protocols ospfv3 re- distribute connected
distribute connected route-map <value>
route-map
× not yet documented protocols_ospfv3.xml.in: Nothing found in VyOS
protocols ospfv3 redis-
tribute isis metric
× not yet documented protocols_ospfv3.xml.in: Nothing found in VyOS
protocols ospfv3 redis-
tribute isis metric-type
× not yet documented protocols_ospfv3.xml.in: Nothing found in VyOS
protocols ospfv3 redis-
tribute isis route-map
× not yet documented protocols_ospfv3.xml.in: Nothing found in VyOS
protocols ospfv3 redis-
tribute kernel metric
× not yet documented protocols_ospfv3.xml.in: Nothing found in VyOS
protocols ospfv3 redis-
tribute kernel metric-type
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 redis-
protocols ospfv3 redis- tribute kernel route-map
tribute kernel route-map <value>
× not yet documented protocols_ospfv3.xml.in: Nothing found in VyOS
protocols ospfv3 redis-
tribute ripng metric
× not yet documented protocols_ospfv3.xml.in: Nothing found in VyOS
protocols ospfv3 redis-
tribute ripng metric-type
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 redis-
protocols ospfv3 redis- tribute ripng route-map
tribute ripng route-map <value>
× not yet documented protocols_ospfv3.xml.in: Nothing found in VyOS
protocols ospfv3 redis-
tribute static metric
× not yet documented protocols_ospfv3.xml.in: Nothing found in VyOS
protocols ospfv3 redis-
tribute static metric-type
continues on next page

21.1. Configuration Commands 1757

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_ospfv3.xml.in: protocols ospfv3 redis-
protocols ospfv3 redis- tribute static route-map
tribute static route-map <value>
× set protocols Nothing found in XML Nothing found in VyOS
pim6 interface Definitions
<interface-name>
× not yet documented protocols_pim6.xml.in: Nothing found in VyOS
protocols pim6 interface
<interface> dr-priority
× not yet documented protocols_pim6.xml.in: Nothing found in VyOS
protocols pim6 interface
<interface> hello
× set protocols protocols_pim6.xml.in: Nothing found in VyOS
pim6 interface protocols pim6 interface
<interface-name> <interface> mld disable
mld disable
× set protocols protocols_pim6.xml.in: Nothing found in VyOS
pim6 interface protocols pim6 interface
<interface-name> mld <interface> mld interval
interval <seconds>
× set protocols Nothing found in XML Nothing found in VyOS
pim6 interface Definitions
<interface-name>
mld join
<multicast-address>
× set protocols protocols_pim6.xml.in: Nothing found in VyOS
pim6 interface protocols pim6 interface
<interface-name> <interface> mld join
mld join <join> source
<multicast-address>
source
<source-address>
× set protocols protocols_pim6.xml.in: Nothing found in VyOS
pim6 interface protocols pim6 inter-
<interface-name> mld face <interface> mld
last-member-query-countlast-member-query-count
<count>
× set protocols protocols_pim6.xml.in: Nothing found in VyOS
pim6 interface protocols pim6 interface
<interface-name> mld <interface> mld last-
last-member-query-interval
member-query-interval
<milliseconds>
× set protocols protocols_pim6.xml.in: Nothing found in VyOS
pim6 interface protocols pim6 inter-
<interface-name> mld face <interface> mld
max-response-time max-response-time
<milliseconds>
continues on next page

21.1. Configuration Commands 1758

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set protocols protocols_pim6.xml.in: Nothing found in VyOS
pim6 interface protocols pim6 interface
<interface-name> <interface> mld version
mld version
<version-number>
× not yet documented protocols_pim6.xml.in: Nothing found in VyOS
protocols pim6 interface
<interface> no-bsm
× not yet documented protocols_pim6.xml.in: Nothing found in VyOS
protocols pim6 interface
<interface> no-unicast-
bsm
× not yet documented protocols_pim6.xml.in: Nothing found in VyOS
protocols pim6 interface
<interface> passive
× not yet documented protocols_pim6.xml.in: Nothing found in VyOS
protocols pim6 join-
prune-interval
× not yet documented protocols_pim6.xml.in: Nothing found in VyOS
protocols pim6 keep-
alive-timer
× not yet documented protocols_pim6.xml.in: Nothing found in VyOS
protocols pim6 packets
× not yet documented protocols_pim6.xml.in: Nothing found in VyOS
protocols pim6 register-
suppress-time
× not yet documented protocols_pim6.xml.in: Nothing found in VyOS
protocols pim6 rp address
<address> group
× not yet documented protocols_pim6.xml.in: Nothing found in VyOS
protocols pim6 rp address
<address> prefix-list6
× not yet documented protocols_pim6.xml.in: Nothing found in VyOS
protocols pim6 rp keep-
alive-timer
× set protocols pim Nothing found in XML Nothing found in VyOS
ecmp Definitions
× set protocols pim protocols_pim.xml.in: Nothing found in VyOS
ecmp rebalance protocols pim ecmp rebal-
ance
× set protocols protocols_pim.xml.in: Nothing found in VyOS
pim igmp protocols pim igmp
watermark-warning watermark-warning
<n>
× set protocols Nothing found in XML Nothing found in VyOS
pim interface Definitions
<interface> bfd
[profile <name>]
continues on next page

21.1. Configuration Commands 1759

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_pim.xml.in: Nothing found in VyOS
protocols pim interface
<interface> bfd profile
✓ set protocols protocols_pim.xml.in: protocols pim interface
pim interface protocols pim interface <text> dr-priority <value>
<interface> <interface> dr-priority
dr-priority <n>
✓ set protocols protocols_pim.xml.in: protocols pim interface
pim interface protocols pim interface <text> hello <value>
<interface> hello <interface> hello
<n>
× not yet documented protocols_pim.xml.in: Nothing found in VyOS
protocols pim interface
<interface> igmp disable
× set protocols protocols_pim.xml.in: Nothing found in VyOS
pim interface protocols pim interface
<interface> <interface> igmp join
igmp join <join> source-address
<multicast-address>
source-address
<IP-address>
× set protocols protocols_pim.xml.in: Nothing found in VyOS
pim interface protocols pim inter-
<interface> igmp face <interface> igmp
query-interval query-interval
<seconds>
× set protocols protocols_pim.xml.in: Nothing found in VyOS
pim interface protocols pim inter-
<interface> igmp face <interface> igmp
query-max-response-timequery-max-response-time
<n>
× set protocols protocols_pim.xml.in: Nothing found in VyOS
pim interface protocols pim interface
<interface> <interface> igmp version
igmp version
<version-number>
× set protocols protocols_pim.xml.in: Nothing found in VyOS
pim interface protocols pim interface
<interface> no-bsm <interface> no-bsm
× set protocols protocols_pim.xml.in: Nothing found in VyOS
pim interface protocols pim interface
<interface> <interface> no-unicast-
no-unicast-bsm bsm
× set protocols protocols_pim.xml.in: Nothing found in VyOS
pim interface protocols pim interface
<interface> passive <interface> passive
continues on next page

21.1. Configuration Commands 1760

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set protocols protocols_pim.xml.in: Nothing found in VyOS
pim interface protocols pim interface
<interface> <interface> source-
source-address address
<ip-address>
× set protocols pim protocols_pim.xml.in: Nothing found in VyOS
join-prune-interval protocols pim join-prune-
<n> interval
× set protocols pim protocols_pim.xml.in: Nothing found in VyOS
keep-alive-timer protocols pim keep-alive-
<n> timer
× set protocols pim protocols_pim.xml.in: Nothing found in VyOS
no-v6-secondary protocols pim no-v6-
secondary
× set protocols pim protocols_pim.xml.in: Nothing found in VyOS
packets <n> protocols pim packets
× set protocols pim Nothing found in XML Nothing found in VyOS
register-accept-list Definitions
<prefix-list>
× not yet documented protocols_pim.xml.in: Nothing found in VyOS
protocols pim register-
accept-list prefix-list
× set protocols pim protocols_pim.xml.in: Nothing found in VyOS
register-suppress-time protocols pim register-
<n> suppress-time
× not yet documented protocols_pim.xml.in: protocols pim rp address
protocols pim rp address <text> group <value>
<address> group
× set protocols pim Nothing found in XML Nothing found in VyOS
rp <address> group Definitions
<group>
✓ set protocols pim protocols_pim.xml.in: protocols pim rp keep-
rp keep-alive-timer protocols pim rp keep- alive-timer <value>
<n> alive-timer
× set protocols pim Nothing found in XML Nothing found in VyOS
spt-switchover Definitions
infinity-and-beyond
[prefix-list <list>]
× not yet documented protocols_pim.xml.in: Nothing found in VyOS
protocols pim spt-
switchover infinity-
and-beyond prefix-list
× set protocols pim protocols_pim.xml.in: Nothing found in VyOS
ssm prefix-list protocols pim ssm prefix-
<list> list
✓ set protocols rip protocols_rip.xml.in: protocols rip default-
default-distance protocols rip default- distance <value>
<distance> distance
continues on next page

21.1. Configuration Commands 1761

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set protocols rip protocols_rip.xml.in: protocols rip default-
default-information protocols rip default- information originate
originate information originate
✓ set protocols rip protocols_rip.xml.in: protocols rip default-
default-metric protocols rip default- metric <value>
<metric> metric
× set protocols rip Nothing found in XML Nothing found in VyOS
distribute-list Definitions
access-list <in|out>
<number>
× not yet documented protocols_rip.xml.in: protocols rip distribute-list
protocols rip distribute-list access-list in <value>
access-list in
× not yet documented protocols_rip.xml.in: protocols rip distribute-list
protocols rip distribute-list access-list out <value>
access-list out
× set protocols rip Nothing found in XML Nothing found in VyOS
distribute-list Definitions
interface
<interface>
access-list <in|out>
<number>
× not yet documented protocols_rip.xml.in: protocols rip distribute-list
protocols rip distribute- interface <text> access-list
list interface <interface> in <value>
access-list in
× not yet documented protocols_rip.xml.in: protocols rip distribute-list
protocols rip distribute- interface <text> access-list
list interface <interface> out <value>
access-list out
× set protocols rip Nothing found in XML Nothing found in VyOS
distribute-list Definitions
interface
<interface>
prefix-list <in|out>
<name>
× not yet documented protocols_rip.xml.in: protocols rip distribute-list
protocols rip distribute- interface <text> prefix-list
list interface <interface> in <value>
prefix-list in
× not yet documented protocols_rip.xml.in: protocols rip distribute-list
protocols rip distribute- interface <text> prefix-list
list interface <interface> out <value>
prefix-list out
× set protocols rip Nothing found in XML Nothing found in VyOS
distribute-list Definitions
prefix-list <in|out>
<name>
continues on next page

21.1. Configuration Commands 1762

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_rip.xml.in: protocols rip distribute-list
protocols rip distribute-list prefix-list in <value>
prefix-list in
× not yet documented protocols_rip.xml.in: protocols rip distribute-list
protocols rip distribute-list prefix-list out <value>
prefix-list out
× set protocols Nothing found in XML Nothing found in VyOS
rip interface Definitions
<interface>
× not yet documented protocols_rip.xml.in: protocols rip interface
protocols rip interface <text> authentication md5
<interface> authentication <text> password <value>
md5 <md5> password
× not yet documented protocols_rip.xml.in: protocols rip interface
protocols rip interface <text> authentication
<interface> authentication plaintext-password
plaintext-password <value>
× not yet documented protocols_rip.xml.in: protocols rip interface
protocols rip interface <in- <text> receive version
terface> receive version <value>
× not yet documented protocols_rip.xml.in: protocols rip interface
protocols rip interface <in- <text> send version
terface> send version <value>
× not yet documented protocols_rip.xml.in: protocols rip interface
protocols rip interface <in- <text> split-horizon
terface> split-horizon dis- disable
able
× not yet documented protocols_rip.xml.in: protocols rip interface
protocols rip interface <text> split-horizon
<interface> split-horizon poison-reverse
poison-reverse
✓ set protocols rip protocols_rip.xml.in: protocols rip neighbor
neighbor <A.B.C.D> protocols rip neighbor <value>
✓ set protocols rip protocols_rip.xml.in: protocols rip network
network <A.B.C.D/M> protocols rip network <value>
✓ set protocols rip protocols_rip.xml.in: protocols rip network-
network-distance <A. protocols rip network- distance <text> access-list
B.C.D/M> access-list distance <network- <value>
<name> distance> access-list
✓ set protocols rip protocols_rip.xml.in: protocols rip network-
network-distance protocols rip network- distance <text> distance
<A.B.C.D/M> distance distance <network- <value>
<distance> distance> distance
× not yet documented protocols_ripng.xml.in: protocols ripng aggregate-
protocols ripng aggregate- address <value>
address
× not yet documented protocols_ripng.xml.in: protocols ripng default-
protocols ripng default- information originate
information originate
continues on next page

21.1. Configuration Commands 1763

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_ripng.xml.in: protocols ripng default-
protocols ripng default- metric <value>
metric
× not yet documented protocols_ripng.xml.in: protocols ripng distribute-
protocols ripng distribute- list access-list in <value>
list access-list in
× not yet documented protocols_ripng.xml.in: protocols ripng distribute-
protocols ripng distribute- list access-list out <value>
list access-list out
× not yet documented protocols_ripng.xml.in: protocols ripng distribute-
protocols ripng distribute- list interface <text>
list interface <interface> access-list in <value>
access-list in
× not yet documented protocols_ripng.xml.in: protocols ripng distribute-
protocols ripng distribute- list interface <text>
list interface <interface> access-list out <value>
access-list out
× not yet documented protocols_ripng.xml.in: protocols ripng distribute-
protocols ripng distribute- list interface <text> prefix-
list interface <interface> list in <value>
prefix-list in
× not yet documented protocols_ripng.xml.in: protocols ripng distribute-
protocols ripng distribute- list interface <text> prefix-
list interface <interface> list out <value>
prefix-list out
× not yet documented protocols_ripng.xml.in: protocols ripng distribute-
protocols ripng distribute- list prefix-list in <value>
list prefix-list in
× not yet documented protocols_ripng.xml.in: protocols ripng distribute-
protocols ripng distribute- list prefix-list out <value>
list prefix-list out
× not yet documented protocols_ripng.xml.in: protocols ripng interface
protocols ripng interface <text> split-horizon dis-
<interface> split-horizon able
disable
× not yet documented protocols_ripng.xml.in: protocols ripng inter-
protocols ripng interface face <text> split-horizon
<interface> split-horizon poison-reverse
poison-reverse
× not yet documented protocols_ripng.xml.in: protocols ripng network
protocols ripng network <value>
× not yet documented protocols_ripng.xml.in: protocols ripng passive-
protocols ripng passive- interface <value>
interface
× not yet documented protocols_ripng.xml.in: protocols ripng redis-
protocols ripng redis- tribute babel metric
tribute babel metric <value>
continues on next page

21.1. Configuration Commands 1764

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_ripng.xml.in: protocols ripng redis-
protocols ripng redis- tribute babel route-map
tribute babel route-map <value>
× not yet documented protocols_ripng.xml.in: protocols ripng re-
protocols ripng redis- distribute bgp metric
tribute bgp metric <value>
× not yet documented protocols_ripng.xml.in: protocols ripng redis-
protocols ripng redis- tribute bgp route-map
tribute bgp route-map <value>
× not yet documented protocols_ripng.xml.in: protocols ripng redis-
protocols ripng redis- tribute connected metric
tribute connected metric <value>
× not yet documented protocols_ripng.xml.in: protocols ripng re-
protocols ripng re- distribute connected
distribute connected route-map <value>
route-map
× not yet documented protocols_ripng.xml.in: protocols ripng redis-
protocols ripng redis- tribute kernel metric
tribute kernel metric <value>
× not yet documented protocols_ripng.xml.in: protocols ripng redis-
protocols ripng redis- tribute kernel route-map
tribute kernel route-map <value>
× not yet documented protocols_ripng.xml.in: protocols ripng redis-
protocols ripng redis- tribute ospfv3 metric
tribute ospfv3 metric <value>
× not yet documented protocols_ripng.xml.in: protocols ripng redis-
protocols ripng redis- tribute ospfv3 route-map
tribute ospfv3 route-map <value>
× not yet documented protocols_ripng.xml.in: protocols ripng redis-
protocols ripng redis- tribute static metric
tribute static metric <value>
× not yet documented protocols_ripng.xml.in: protocols ripng redis-
protocols ripng redis- tribute static route-map
tribute static route-map <value>
× not yet documented protocols_ripng.xml.in: protocols ripng route
protocols ripng route <value>
× not yet documented protocols_ripng.xml.in: protocols ripng route-map
protocols ripng route-map <value>
× not yet documented protocols_ripng.xml.in: protocols ripng timers
protocols ripng timers garbage-collection
garbage-collection <value>
× not yet documented protocols_ripng.xml.in: protocols ripng timers
protocols ripng timers timeout <value>
timeout
× not yet documented protocols_ripng.xml.in: protocols ripng timers up-
protocols ripng timers up- date <value>
date
continues on next page

21.1. Configuration Commands 1765

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_rip.xml.in: protocols rip passive-
protocols rip passive- interface <value>
interface
× set protocols rip Nothing found in XML Nothing found in VyOS
passive-interface Definitions
interface
<interface>
× set protocols rip Nothing found in XML Nothing found in VyOS
passive-interface Definitions
interface default
× set protocols rip Nothing found in XML Nothing found in VyOS
redistribute <route Definitions
source>
× not yet documented protocols_rip.xml.in: protocols rip redistribute
protocols rip redistribute babel metric <value>
babel metric
× not yet documented protocols_rip.xml.in: protocols rip redistribute
protocols rip redistribute babel route-map <value>
babel route-map
× not yet documented protocols_rip.xml.in: protocols rip redistribute
protocols rip redistribute bgp metric <value>
bgp metric
× not yet documented protocols_rip.xml.in: protocols rip redistribute
protocols rip redistribute bgp route-map <value>
bgp route-map
× not yet documented protocols_rip.xml.in: protocols rip redistribute
protocols rip redistribute connected metric <value>
connected metric
× not yet documented protocols_rip.xml.in: protocols rip redistribute
protocols rip redistribute connected route-map
connected route-map <value>
× not yet documented protocols_rip.xml.in: protocols rip redistribute
protocols rip redistribute isis metric <value>
isis metric
× not yet documented protocols_rip.xml.in: protocols rip redistribute
protocols rip redistribute isis route-map <value>
isis route-map
× not yet documented protocols_rip.xml.in: protocols rip redistribute
protocols rip redistribute kernel metric <value>
kernel metric
× not yet documented protocols_rip.xml.in: protocols rip redistribute
protocols rip redistribute kernel route-map <value>
kernel route-map
× set protocols rip Nothing found in XML Nothing found in VyOS
redistribute <route Definitions
source> metric
<metric>
continues on next page

21.1. Configuration Commands 1766

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_rip.xml.in: protocols rip redistribute
protocols rip redistribute ospf metric <value>
ospf metric
× not yet documented protocols_rip.xml.in: protocols rip redistribute
protocols rip redistribute ospf route-map <value>
ospf route-map
× set protocols rip Nothing found in XML Nothing found in VyOS
redistribute <route Definitions
source> route-map
<name>
× not yet documented protocols_rip.xml.in: protocols rip redistribute
protocols rip redistribute static metric <value>
static metric
× not yet documented protocols_rip.xml.in: protocols rip redistribute
protocols rip redistribute static route-map <value>
static route-map
✓ set protocols rip protocols_rip.xml.in: protocols rip route
route <A.B.C.D/M> protocols rip route <value>
× not yet documented protocols_rip.xml.in: protocols rip route-map
protocols rip route-map <value>
✓ set protocols protocols_rip.xml.in: protocols rip timers
rip timers protocols rip timers garbage-collection
garbage-collection garbage-collection <value>
<seconds>
✓ set protocols rip protocols_rip.xml.in: protocols rip timers time-
timers timeout protocols rip timers time- out <value>
<seconds> out
✓ set protocols protocols_rip.xml.in: protocols rip timers update
rip timers update protocols rip timers update <value>
<seconds>
× not yet documented protocols_rip.xml.in: protocols rip version
protocols rip version <value>
✓ set protocols rpki protocols_rpki.xml.in: protocols rpki cache
cache <address> port protocols rpki cache <text> port <value>
<port> <cache> port
✓ set protocols rpki protocols_rpki.xml.in: protocols rpki cache
cache <address> protocols rpki cache <text> preference <value>
preference <cache> preference
<preference>
× not yet documented protocols_rpki.xml.in: Nothing found in VyOS
protocols rpki cache
<cache> ssh key
× not yet documented Nothing found in XML protocols rpki cache
Definitions <text> ssh known-hosts-
file <value>
× set protocols rpki Nothing found in XML protocols rpki cache
cache <address> ssh Definitions <text> ssh private-key-file
private-key-file <value>
<filepath>
continues on next page

21.1. Configuration Commands 1767

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set protocols rpki Nothing found in XML protocols rpki cache
cache <address> Definitions <text> ssh public-key-file
ssh public-key-file <value>
<filepath>
✓ set protocols rpki protocols_rpki.xml.in: protocols rpki cache
cache <address> ssh protocols rpki cache <text> ssh username
username <user> <cache> ssh username <value>
× set protocols rpki protocols_rpki.xml.in: Nothing found in VyOS
expire-interval protocols rpki expire-
<600-172800> interval
✓ set protocols rpki protocols_rpki.xml.in: protocols rpki polling-
polling-period protocols rpki polling- period <value>
<1-86400> period
× set protocols rpki protocols_rpki.xml.in: Nothing found in VyOS
retry-interval protocols rpki retry-
<1-7200> interval
× not yet documented protocols_segment- Nothing found in VyOS
routing.xml.in:
protocols segment-routing
interface <interface> srv6
hmac
× not yet documented protocols_segment- Nothing found in VyOS
routing.xml.in:
protocols segment-routing
srv6 locator <locator>
behavior-usid
× not yet documented protocols_segment- Nothing found in VyOS
routing.xml.in:
protocols segment-routing
srv6 locator <locator>
block-len
× not yet documented protocols_segment- Nothing found in VyOS
routing.xml.in:
protocols segment-routing
srv6 locator <locator>
func-bits
× not yet documented protocols_segment- Nothing found in VyOS
routing.xml.in:
protocols segment-routing
srv6 locator <locator>
node-len
× not yet documented protocols_segment- Nothing found in VyOS
routing.xml.in:
protocols segment-routing
srv6 locator <locator> pre-
fix
continues on next page

21.1. Configuration Commands 1768

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented proto- protocols static arp inter-
cols_static_arp.xml.in: face <text> address <text>
protocols static arp inter- description <value>
face <interface> address
<address> description
✓ set protocols proto- protocols static arp inter-
static arp interface cols_static_arp.xml.in: face <text> address <text>
<interface> address protocols static arp inter- mac <value>
<host> mac <mac> face <interface> address
<address> mac
× not yet documented proto- protocols static multicast
cols_static_multicast.xml.in: interface-route <text>
protocols static multicast next-hop-interface <text>
interface-route <interface- distance <value>
route> next-hop-interface
<next-hop-interface> dis-
tance
× not yet documented proto- protocols static multicast
cols_static_multicast.xml.in: route <text> next-hop
protocols static multicast <text> distance <value>
route <route> next-hop
<next-hop> distance
× not yet documented protocols_static_neighbor- Nothing found in VyOS
proxy.xml.in:
protocols static neighbor-
proxy arp <arp> interface
× not yet documented protocols_static_neighbor- Nothing found in VyOS
proxy.xml.in:
protocols static neighbor-
proxy nd <nd> interface
× not yet documented protocols_static.xml.in: protocols static route-map
protocols static route-map <value>
× set protocols static Nothing found in XML Nothing found in VyOS
route 0.0.0.0/0 Definitions
next-hop <address>
× set protocols static Nothing found in XML Nothing found in VyOS
route6 <subnet> Definitions
blackhole
✓ set protocols static protocols_static.xml.in: protocols static route6
route6 <subnet> protocols static route6 <text> blackhole distance
blackhole distance <route6> blackhole <value>
<distance> distance
× not yet documented protocols_static.xml.in: protocols static route6
protocols static route6 <text> blackhole tag
<route6> blackhole tag <value>
× not yet documented protocols_static.xml.in: protocols static route6
protocols static route6 <text> description
<route6> description <value>
continues on next page

21.1. Configuration Commands 1769

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set protocols Nothing found in XML Nothing found in VyOS
static route6 Definitions
<subnet> interface
<interface>
✓ set protocols protocols_static.xml.in: protocols static route6
static route6 protocols static route6 <text> interface <text>
<subnet> interface <route6> interface <inter- disable
<interface> disable face> disable
✓ set protocols protocols_static.xml.in: protocols static route6
static route6 protocols static route6 <text> interface <text>
<subnet> interface <route6> interface <inter- distance <value>
<interface> distance face> distance
<distance>
× set protocols protocols_static.xml.in: Nothing found in VyOS
static route6 protocols static route6
<subnet> interface <route6> interface <inter-
<interface> segments face> segments
<segments>
× not yet documented protocols_static.xml.in: protocols static route6
protocols static route6 <text> interface <text> vrf
<route6> interface <inter- <value>
face> vrf
× set protocols static Nothing found in XML Nothing found in VyOS
route6 <subnet> Definitions
next-hop <address>
✓ set protocols static protocols_static.xml.in: protocols static route6
route6 <subnet> protocols static route6 <text> next-hop <text>
next-hop <address> <route6> next-hop <next- bfd multi-hop source
bfd multi-hop source hop> bfd multi-hop source <text> profile <value>
<address> profile <source> profile
<profile>
✓ set protocols protocols_static.xml.in: protocols static route6
static route6 protocols static route6 <text> next-hop <text>
<subnet> next-hop <route6> next-hop <next- bfd profile <value>
<address> bfd hop> bfd profile
profile <profile>
✓ set protocols static protocols_static.xml.in: protocols static route6
route6 <subnet> protocols static route6 <text> next-hop <text>
next-hop <address> <route6> next-hop <next- disable
disable hop> disable
✓ set protocols static protocols_static.xml.in: protocols static route6
route6 <subnet> protocols static route6 <text> next-hop <text>
next-hop <address> <route6> next-hop <next- distance <value>
distance <distance> hop> distance
× not yet documented protocols_static.xml.in: protocols static route6
protocols static route6 <text> next-hop <text>
<route6> next-hop <next- interface <value>
hop> interface
continues on next page

21.1. Configuration Commands 1770

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set protocols static protocols_static.xml.in: Nothing found in VyOS
route6 <subnet> protocols static route6
next-hop <address> <route6> next-hop <next-
segments <segments> hop> segments
× not yet documented protocols_static.xml.in: protocols static route6
protocols static route6 <text> next-hop <text> vrf
<route6> next-hop <next- <value>
hop> vrf
× not yet documented protocols_static.xml.in: protocols static route6
protocols static route6 <text> reject distance
<route6> reject distance <value>
× not yet documented protocols_static.xml.in: protocols static route6
protocols static route6 <text> reject tag <value>
<route6> reject tag
× set protocols static Nothing found in XML Nothing found in VyOS
route <subnet> Definitions
blackhole
✓ set protocols static protocols_static.xml.in: protocols static route
route <subnet> protocols static route <text> blackhole distance
blackhole distance <route> blackhole dis- <value>
<distance> tance
× not yet documented protocols_static.xml.in: protocols static route
protocols static route <text> blackhole tag
<route> blackhole tag <value>
× not yet documented protocols_static.xml.in: protocols static route
protocols static route <text> description
<route> description <value>
× not yet documented protocols_static.xml.in: protocols static route
protocols static route <text> dhcp-interface
<route> dhcp-interface <value>
× set protocols Nothing found in XML Nothing found in VyOS
static route Definitions
<subnet> interface
<interface>
✓ set protocols protocols_static.xml.in: protocols static route
static route protocols static route <text> interface <text>
<subnet> interface <route> interface <inter- disable
<interface> disable face> disable
✓ set protocols protocols_static.xml.in: protocols static route
static route protocols static route <text> interface <text>
<subnet> interface <route> interface <inter- distance <value>
<interface> distance face> distance
<distance>
× not yet documented protocols_static.xml.in: protocols static route
protocols static route <text> interface <text> vrf
<route> interface <inter- <value>
face> vrf
continues on next page

21.1. Configuration Commands 1771

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set protocols static Nothing found in XML Nothing found in VyOS
route <subnet> Definitions
next-hop <address>
✓ set protocols static protocols_static.xml.in: protocols static route
route <subnet> protocols static route <text> next-hop <text>
next-hop <address> <route> next-hop <next- bfd multi-hop source
bfd multi-hop source hop> bfd multi-hop source <text> profile <value>
<address> profile <source> profile
<profile>
✓ set protocols protocols_static.xml.in: protocols static route
static route protocols static route <text> next-hop <text>
<subnet> next-hop <route> next-hop <next- bfd profile <value>
<address> bfd hop> bfd profile
profile <profile>
✓ set protocols static protocols_static.xml.in: protocols static route
route <subnet> protocols static route <text> next-hop <text>
next-hop <address> <route> next-hop <next- disable
disable hop> disable
✓ set protocols static protocols_static.xml.in: protocols static route
route <subnet> protocols static route <text> next-hop <text>
next-hop <address> <route> next-hop <next- distance <value>
distance <distance> hop> distance
× not yet documented protocols_static.xml.in: protocols static route
protocols static route <text> next-hop <text>
<route> next-hop <next- interface <value>
hop> interface
× not yet documented protocols_static.xml.in: protocols static route
protocols static route <text> next-hop <text> vrf
<route> next-hop <next- <value>
hop> vrf
× not yet documented protocols_static.xml.in: protocols static route
protocols static route <text> reject distance
<route> reject distance <value>
× not yet documented protocols_static.xml.in: protocols static route
protocols static route <text> reject tag <value>
<route> reject tag
× not yet documented protocols_static.xml.in: protocols static ta-
protocols static table <ta- ble <text> description
ble> description <value>
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <text> route6 <text>
<table> route6 <route6> blackhole distance
blackhole distance <value>
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <text> route6 <text>
<table> route6 <route6> blackhole tag <value>
blackhole tag
continues on next page

21.1. Configuration Commands 1772

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <ta- <text> route6 <text>
ble> route6 <route6> de- description <value>
scription
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <ta- <text> route6 <text>
ble> route6 <route6> in- interface <text> disable
terface <interface> disable
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <text> route6 <text>
<table> route6 <route6> interface <text> distance
interface <interface> <value>
distance
× not yet documented protocols_static.xml.in: Nothing found in VyOS
protocols static table <ta-
ble> route6 <route6> in-
terface <interface> seg-
ments
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <ta- <text> route6 <text>
ble> route6 <route6> in- interface <text> vrf
terface <interface> vrf <value>
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <text> route6 <text> next-
<table> route6 <route6> hop <text> bfd multi-hop
next-hop <next-hop> source <text> profile
bfd multi-hop source <value>
<source> profile
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <text> route6 <text> next-
<table> route6 <route6> hop <text> bfd profile
next-hop <next-hop> bfd <value>
profile
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <text> route6 <text>
<table> route6 <route6> next-hop <text> disable
next-hop <next-hop>
disable
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <text> route6 <text>
<table> route6 <route6> next-hop <text> distance
next-hop <next-hop> <value>
distance
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <text> route6 <text>
<table> route6 <route6> next-hop <text> interface
next-hop <next-hop> <value>
interface
continues on next page

21.1. Configuration Commands 1773

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_static.xml.in: Nothing found in VyOS
protocols static table
<table> route6 <route6>
next-hop <next-hop>
segments
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <text> route6 <text>
<table> route6 <route6> next-hop <text> vrf
next-hop <next-hop> vrf <value>
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <ta- <text> route6 <text>
ble> route6 <route6> re- reject distance <value>
ject distance
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <ta- <text> route6 <text>
ble> route6 <route6> re- reject tag <value>
ject tag
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <ta- <text> route <text> black-
ble> route <route> black- hole distance <value>
hole distance
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <ta- <text> route <text>
ble> route <route> black- blackhole tag <value>
hole tag
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <ta- <text> route <text>
ble> route <route> de- description <value>
scription
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <ta- <text> route <text>
ble> route <route> dhcp- dhcp-interface <value>
interface
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <ta- <text> route <text>
ble> route <route> inter- interface <text> disable
face <interface> disable
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <ta- <text> route <text> in-
ble> route <route> inter- terface <text> distance
face <interface> distance <value>
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <ta- <text> route <text> inter-
ble> route <route> inter- face <text> vrf <value>
face <interface> vrf
continues on next page

21.1. Configuration Commands 1774

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <ta- <text> route <text> next-
ble> route <route> next- hop <text> bfd multi-hop
hop <next-hop> bfd multi- source <text> profile
hop source <source> pro- <value>
file
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <ta- <text> route <text> next-
ble> route <route> next- hop <text> bfd profile
hop <next-hop> bfd pro- <value>
file
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <ta- <text> route <text>
ble> route <route> next- next-hop <text> disable
hop <next-hop> disable
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <ta- <text> route <text>
ble> route <route> next- next-hop <text> distance
hop <next-hop> distance <value>
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <ta- <text> route <text> next-
ble> route <route> next- hop <text> interface
hop <next-hop> interface <value>
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <ta- <text> route <text> next-
ble> route <route> next- hop <text> vrf <value>
hop <next-hop> vrf
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <ta- <text> route <text> reject
ble> route <route> reject distance <value>
distance
× not yet documented protocols_static.xml.in: protocols static table
protocols static table <ta- <text> route <text> reject
ble> route <route> reject tag <value>
tag
× not yet documented qos.xml.in: qos interface <text> egress
qos interface <interface> <value>
egress
× not yet documented qos.xml.in: qos interface <text>
qos interface <interface> ingress <value>
ingress
✓ set qos policy cake qos.xml.in: qos policy cake <text>
<text> bandwidth qos policy cake <cake> bandwidth <value>
<value> bandwidth
✓ set qos policy cake qos.xml.in: qos policy cake <text> de-
<text> description qos policy cake <cake> scription <value>
description
continues on next page

21.1. Configuration Commands 1775

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set qos policy qos.xml.in: qos policy cake <text>
cake <text> qos policy cake <cake> flow-isolation blind
flow-isolation flow-isolation blind
blind
✓ set qos policy qos.xml.in: qos policy cake <text>
cake <text> qos policy cake <cake> flow-isolation dst-host
flow-isolation flow-isolation dst-host
dst-host
✓ set qos policy qos.xml.in: qos policy cake <text>
cake <text> qos policy cake <cake> flow-isolation dual-dst-
flow-isolation flow-isolation dual-dst- host
dual-dst-host host
✓ set qos policy qos.xml.in: qos policy cake <text>
cake <text> qos policy cake <cake> flow-isolation dual-src-
flow-isolation flow-isolation dual-src- host
dual-src-host host
✓ set qos policy qos.xml.in: qos policy cake <text>
cake <text> qos policy cake <cake> flow-isolation flow
flow-isolation flow flow-isolation flow
✓ set qos policy qos.xml.in: qos policy cake <text>
cake <text> qos policy cake <cake> flow-isolation host
flow-isolation host flow-isolation host
✓ set qos policy qos.xml.in: qos policy cake <text>
cake <text> qos policy cake <cake> flow-isolation nat
flow-isolation nat flow-isolation nat
✓ set qos policy qos.xml.in: qos policy cake <text>
cake <text> qos policy cake <cake> flow-isolation src-host
flow-isolation flow-isolation src-host
src-host
× set qos policy qos.xml.in: Nothing found in VyOS
cake <text> qos policy cake <cake>
flow-isolation flow-isolation triple-
triple-isolate isolate
✓ set qos policy cake qos.xml.in: qos policy cake <text> rtt
<text> rtt qos policy cake <cake> rtt <value>
× not yet documented qos.xml.in: qos policy drop-tail <text>
qos policy drop-tail description <value>
<drop-tail> description
✓ set qos policy qos.xml.in: qos policy drop-tail <text>
drop-tail qos policy drop-tail queue-limit <value>
<policy-name> <drop-tail> queue-limit
queue-limit
<number-of-packets>
× set qos policy Nothing found in XML Nothing found in VyOS
fair-queue Definitions
<policy-name>
× not yet documented qos.xml.in: qos policy fair-queue
qos policy fair-queue <text> description
<fair-queue> description <value>
continues on next page

21.1. Configuration Commands 1776

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set qos policy qos.xml.in: qos policy fair-queue
fair-queue qos policy fair-queue <text> hash-interval
<policy-name> <fair-queue> hash- <value>
hash-interval interval
<seconds>
✓ set qos policy qos.xml.in: qos policy fair-queue
fair-queue qos policy fair-queue <text> queue-limit
<policy-name> <fair-queue> queue-limit <value>
queue-limit <limit>
✓ set qos policy qos.xml.in: qos policy fq-codel <text>
fq-codel <policy qos policy fq-codel <fq- codel-quantum <value>
name> codel-quantum codel> codel-quantum
<bytes>
× not yet documented qos.xml.in: qos policy fq-codel <text>
qos policy fq-codel <fq- description <value>
codel> description
✓ set qos policy qos.xml.in: qos policy fq-codel <text>
fq-codel <policy qos policy fq-codel <fq- flows <value>
name> flows codel> flows
<number-of-flows>
✓ set qos policy qos.xml.in: qos policy fq-codel <text>
fq-codel <policy qos policy fq-codel <fq- interval <value>
name> interval codel> interval
<milliseconds>
✓ set qos policy qos.xml.in: qos policy fq-codel <text>
fq-codel qos policy fq-codel <fq- queue-limit <value>
<policy-name> codel> queue-limit
queue-limit
<number-of-packets>
✓ set qos policy qos.xml.in: qos policy fq-codel <text>
fq-codel qos policy fq-codel <fq- target <value>
<policy-name> target codel> target
<milliseconds>
✓ set qos policy qos.xml.in: qos policy limiter <text>
limiter qos policy limiter <lim- class <text> bandwidth
<policy-name> class iter> class <class> band- <value>
<class-ID> bandwidth width
<rate>
✓ set qos policy qos.xml.in: qos policy limiter <text>
limiter qos policy limiter <lim- class <text> burst <value>
<policy-name> class iter> class <class> burst
<class-ID> burst
<burst-size>
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> description
iter> class <class> de- <value>
scription
continues on next page

21.1. Configuration Commands 1777

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> exceed
iter> class <class> exceed <value>
✓ set qos policy qos.xml.in: qos policy limiter <text>
limiter qos policy limiter <lim- class <text> match <text>
<policy-name> iter> class <class> match description <value>
class <class ID> <match> description
match <match-name>
description
<description>
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match ether destination <value>
<match> ether destination
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match ether protocol <value>
<match> ether protocol
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match ether source <value>
<match> ether source
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match interface <value>
<match> interface
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match ip destination address
<match> ip destination ad- <value>
dress
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match
iter> class <class> match <text> ip destination port
<match> ip destination <value>
port
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match ip dscp <value>
<match> ip dscp
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match ip max-length <value>
<match> ip max-length
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match ip protocol <value>
<match> ip protocol
continues on next page

21.1. Configuration Commands 1778

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match ip source address <value>
<match> ip source address
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match ip source port <value>
<match> ip source port
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match ip tcp ack
<match> ip tcp ack
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match ip tcp syn
<match> ip tcp syn
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match ipv6 destination address
<match> ipv6 destination <value>
address
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match ipv6 destination port
<match> ipv6 destination <value>
port
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match ipv6 dscp <value>
<match> ipv6 dscp
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match ipv6 max-length <value>
<match> ipv6 max-length
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match ipv6 protocol <value>
<match> ipv6 protocol
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match ipv6 source address
<match> ipv6 source ad- <value>
dress
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match ipv6 source port <value>
<match> ipv6 source port
continues on next page

21.1. Configuration Commands 1779

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match ipv6 tcp ack
<match> ipv6 tcp ack
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match ipv6 tcp syn
<match> ipv6 tcp syn
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match mark <value>
<match> mark
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> match <text>
iter> class <class> match vif <value>
<match> vif
× not yet documented qos.xml.in: Nothing found in VyOS
qos policy limiter <lim-
iter> class <class> mtu
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- class <text> not-exceed
iter> class <class> not- <value>
exceed
✓ set qos policy qos.xml.in: qos policy limiter <text>
limiter qos policy limiter <lim- class <text> priority
<policy-name> class iter> class <class> priority <value>
<class ID> priority
<value>
✓ set qos policy qos.xml.in: qos policy limiter <text>
limiter qos policy limiter <lim- default bandwidth
<policy-name> iter> default bandwidth <value>
default bandwidth
<rate>
✓ set qos policy qos.xml.in: qos policy limiter <text>
limiter qos policy limiter <lim- default burst <value>
<policy-name> iter> default burst
default burst
<burst-size>
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- default exceed <value>
iter> default exceed
× not yet documented qos.xml.in: Nothing found in VyOS
qos policy limiter <lim-
iter> default mtu
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- default not-exceed
iter> default not-exceed <value>
continues on next page

21.1. Configuration Commands 1780

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented qos.xml.in: qos policy limiter <text>
qos policy limiter <lim- description <value>
iter> description
✓ set qos policy qos.xml.in: qos policy network-
network-emulator qos policy network- emulator <text> band-
<policy-name> emulator <network- width <value>
bandwidth <rate> emulator> bandwidth
× set qos policy Nothing found in XML Nothing found in VyOS
network-emulator Definitions
<policy-name> burst
<burst-size>
✓ set qos policy qos.xml.in: qos policy network-
network-emulator qos policy network- emulator <text> corrup-
<policy-name> emulator <network- tion <value>
corruption emulator> corruption
<percent>
✓ set qos policy qos.xml.in: qos policy network-
network-emulator qos policy network- emulator <text> delay
<policy-name> delay emulator <network- <value>
<delay> emulator> delay
× not yet documented qos.xml.in: qos policy network-
qos policy network- emulator <text> descrip-
emulator <network- tion <value>
emulator> description
× not yet documented qos.xml.in: qos policy network-
qos policy network- emulator <text> duplicate
emulator <network- <value>
emulator> duplicate
✓ set qos policy qos.xml.in: qos policy network-
network-emulator qos policy network- emulator <text> loss
<policy-name> loss emulator <network- <value>
<percent> emulator> loss
× not yet documented qos.xml.in: qos policy network-
qos policy network- emulator <text> queue-
emulator <network- limit <value>
emulator> queue-limit
× not yet documented qos.xml.in: qos policy network-
qos policy network- emulator <text> reorder-
emulator <network- ing <value>
emulator> reordering
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> codel-
<priority-queue> class quantum <value>
<class> codel-quantum
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> de-
<priority-queue> class scription <value>
<class> description
continues on next page

21.1. Configuration Commands 1781

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> flows
<priority-queue> class <value>
<class> flows
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> inter-
<priority-queue> class val <value>
<class> interval
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text>
<priority-queue> class match <text> description
<class> match <match> <value>
description
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ether destination
<class> match <match> <value>
ether destination
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ether protocol
<class> match <match> <value>
ether protocol
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ether source
<class> match <match> <value>
ether source
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> interface <value>
<class> match <match>
interface
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ip destination ad-
<class> match <match> ip dress <value>
destination address
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ip destination port
<class> match <match> ip <value>
destination port
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ip dscp <value>
<class> match <match> ip
dscp
continues on next page

21.1. Configuration Commands 1782

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ip max-length
<class> match <match> ip <value>
max-length
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ip protocol <value>
<class> match <match> ip
protocol
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ip source address
<class> match <match> ip <value>
source address
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ip source port
<class> match <match> ip <value>
source port
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ip tcp ack
<class> match <match> ip
tcp ack
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ip tcp syn
<class> match <match> ip
tcp syn
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ipv6 destination ad-
<class> match <match> dress <value>
ipv6 destination address
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ipv6 destination
<class> match <match> port <value>
ipv6 destination port
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ipv6 dscp <value>
<class> match <match>
ipv6 dscp
continues on next page

21.1. Configuration Commands 1783

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ipv6 max-length
<class> match <match> <value>
ipv6 max-length
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ipv6 protocol
<class> match <match> <value>
ipv6 protocol
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ipv6 source address
<class> match <match> <value>
ipv6 source address
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ipv6 source port
<class> match <match> <value>
ipv6 source port
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ipv6 tcp ack
<class> match <match>
ipv6 tcp ack
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> ipv6 tcp syn
<class> match <match>
ipv6 tcp syn
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> mark <value>
<class> match <match>
mark
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> match
<priority-queue> class <text> vif <value>
<class> match <match>
vif
✓ set qos policy qos.xml.in: qos policy priority-queue
priority-queue qos policy priority-queue <text> class <text> queue-
<policy-name> <priority-queue> class limit <value>
class <class-ID> <class> queue-limit
queue-limit <limit>
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> queue-
<priority-queue> class type <value>
<class> queue-type
continues on next page

21.1. Configuration Commands 1784

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> class <text> target
<priority-queue> class <value>
<class> target
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> default codel-
<priority-queue> default quantum <value>
codel-quantum
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> default flows
<priority-queue> default <value>
flows
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> default interval
<priority-queue> default <value>
interval
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> default queue-limit
<priority-queue> default <value>
queue-limit
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> default queue-type
<priority-queue> default <value>
queue-type
× not yet documented qos.xml.in: qos policy priority-queue
qos policy priority-queue <text> default target
<priority-queue> default <value>
target
× not yet documented qos.xml.in: qos policy priority-
qos policy priority-queue queue <text> description
<priority-queue> descrip- <value>
tion
✓ set qos policy qos.xml.in: qos policy random-detect
random-detect qos policy random- <text> bandwidth <value>
<policy-name> detect <random-detect>
bandwidth bandwidth
<bandwidth>
× not yet documented qos.xml.in: qos policy random-
qos policy random-detect detect <text> description
<random-detect> descrip- <value>
tion
✓ set qos policy qos.xml.in: qos policy random-detect
random-detect qos policy random-detect <text> precedence <text>
<policy-name> <random-detect> prece- average-packet <value>
precedence dence <precedence>
<IP-precedence-value> average-packet
average-packet
<bytes>
continues on next page

21.1. Configuration Commands 1785

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set qos policy qos.xml.in: qos policy random-detect
random-detect qos policy random-detect <text> precedence <text>
<policy-name> <random-detect> prece- mark-probability <value>
precedence dence <precedence>
<IP-precedence-value> mark-probability
mark-probability
<value>
✓ set qos policy qos.xml.in: qos policy random-detect
random-detect qos policy random-detect <text> precedence <text>
<policy-name> <random-detect> prece- maximum-threshold
precedence dence <precedence> <value>
<IP-precedence-value> maximum-threshold
maximum-threshold
<packets>
✓ set qos policy qos.xml.in: qos policy random-detect
random-detect qos policy random-detect <text> precedence <text>
<policy-name> <random-detect> prece- minimum-threshold
precedence dence <precedence> <value>
<IP-precedence-value> minimum-threshold
minimum-threshold
<packets>
✓ set qos policy qos.xml.in: qos policy random-detect
random-detect qos policy random-detect <text> precedence <text>
<policy-name> <random-detect> prece- queue-limit <value>
precedence dence <precedence>
<IP-precedence-value> queue-limit
queue-limit
<packets>
✓ set qos policy qos.xml.in: qos policy rate-control
rate-control qos policy rate-control <text> bandwidth <value>
<policy-name> <rate-control> bandwidth
bandwidth <rate>
✓ set qos policy qos.xml.in: qos policy rate-control
rate-control qos policy rate-control <text> burst <value>
<policy-name> burst <rate-control> burst
<burst-size>
× not yet documented qos.xml.in: qos policy rate-control
qos policy rate-control <text> description
<rate-control> description <value>
✓ set qos policy qos.xml.in: qos policy rate-control
rate-control qos policy rate-control <text> latency <value>
<policy-name> <rate-control> latency
latency
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text>
<round-robin> class codel-quantum <value>
<class> codel-quantum
continues on next page

21.1. Configuration Commands 1786

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text>
<round-robin> class description <value>
<class> description
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> flows
<round-robin> class <value>
<class> flows
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text>
<round-robin> class interval <value>
<class> interval
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text>
<round-robin> class match <text> description
<class> match <match> <value>
description
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ether destination
<class> match <match> <value>
ether destination
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ether protocol
<class> match <match> <value>
ether protocol
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ether source
<class> match <match> <value>
ether source
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> interface <value>
<class> match <match>
interface
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ip destination
<class> match <match> ip address <value>
destination address
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ip destination port
<class> match <match> ip <value>
destination port
continues on next page

21.1. Configuration Commands 1787

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ip dscp <value>
<class> match <match> ip
dscp
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ip max-length
<class> match <match> ip <value>
max-length
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ip protocol <value>
<class> match <match> ip
protocol
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ip source address
<class> match <match> ip <value>
source address
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ip source port
<class> match <match> ip <value>
source port
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ip tcp ack
<class> match <match> ip
tcp ack
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ip tcp syn
<class> match <match> ip
tcp syn
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ipv6 destination
<class> match <match> address <value>
ipv6 destination address
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ipv6 destination
<class> match <match> port <value>
ipv6 destination port
continues on next page

21.1. Configuration Commands 1788

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ipv6 dscp <value>
<class> match <match>
ipv6 dscp
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ipv6 max-length
<class> match <match> <value>
ipv6 max-length
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ipv6 protocol
<class> match <match> <value>
ipv6 protocol
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ipv6 source address
<class> match <match> <value>
ipv6 source address
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ipv6 source port
<class> match <match> <value>
ipv6 source port
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ipv6 tcp ack
<class> match <match>
ipv6 tcp ack
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> ipv6 tcp syn
<class> match <match>
ipv6 tcp syn
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> mark <value>
<class> match <match>
mark
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> match
<round-robin> class <text> vif <value>
<class> match <match>
vif
continues on next page

21.1. Configuration Commands 1789

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set qos policy qos.xml.in: qos policy round-robin
round-robin qos policy round-robin <text> class <text>
<policy name> class <round-robin> class quantum <value>
<class-ID> quantum <class> quantum
<packets>
✓ set qos policy qos.xml.in: qos policy round-robin
round-robin <policy qos policy round-robin <text> class <text>
name> class <class <round-robin> class queue-limit <value>
ID> queue-limit <class> queue-limit
<packets>
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text>
<round-robin> class queue-type <value>
<class> queue-type
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> class <text> target
<round-robin> class <value>
<class> target
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> default codel-
<round-robin> default quantum <value>
codel-quantum
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> default flows
<round-robin> default <value>
flows
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> default interval
<round-robin> default <value>
interval
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> default queue-limit
<round-robin> default <value>
queue-limit
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> default queue-type
<round-robin> default <value>
queue-type
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> default target
<round-robin> default <value>
target
× not yet documented qos.xml.in: qos policy round-robin
qos policy round-robin <text> description
<round-robin> description <value>
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> bandwidth <value>
<shaper-hfsc> bandwidth
continues on next page

21.1. Configuration Commands 1790

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text>
<shaper-hfsc> class description <value>
<class> description
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text>
<shaper-hfsc> class linkshare d <value>
<class> linkshare d
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text>
<shaper-hfsc> class linkshare m1 <value>
<class> linkshare m1
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text>
<shaper-hfsc> class linkshare m2 <value>
<class> linkshare m2
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text>
<shaper-hfsc> class match <text> description
<class> match <match> <value>
description
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ether destination
<class> match <match> <value>
ether destination
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ether protocol
<class> match <match> <value>
ether protocol
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ether source
<class> match <match> <value>
ether source
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> interface <value>
<class> match <match>
interface
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ip destination
<class> match <match> ip address <value>
destination address
continues on next page

21.1. Configuration Commands 1791

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ip destination port
<class> match <match> ip <value>
destination port
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ip dscp <value>
<class> match <match> ip
dscp
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ip max-length
<class> match <match> ip <value>
max-length
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ip protocol <value>
<class> match <match> ip
protocol
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ip source address
<class> match <match> ip <value>
source address
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ip source port
<class> match <match> ip <value>
source port
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ip tcp ack
<class> match <match> ip
tcp ack
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ip tcp syn
<class> match <match> ip
tcp syn
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ipv6 destination
<class> match <match> address <value>
ipv6 destination address
continues on next page

21.1. Configuration Commands 1792

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ipv6 destination
<class> match <match> port <value>
ipv6 destination port
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ipv6 dscp <value>
<class> match <match>
ipv6 dscp
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ipv6 max-length
<class> match <match> <value>
ipv6 max-length
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ipv6 protocol
<class> match <match> <value>
ipv6 protocol
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ipv6 source address
<class> match <match> <value>
ipv6 source address
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ipv6 source port
<class> match <match> <value>
ipv6 source port
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ipv6 tcp ack
<class> match <match>
ipv6 tcp ack
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> ipv6 tcp syn
<class> match <match>
ipv6 tcp syn
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> mark <value>
<class> match <match>
mark
continues on next page

21.1. Configuration Commands 1793

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text> match
<shaper-hfsc> class <text> vif <value>
<class> match <match>
vif
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text>
<shaper-hfsc> class realtime d <value>
<class> realtime d
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text>
<shaper-hfsc> class realtime m1 <value>
<class> realtime m1
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text>
<shaper-hfsc> class realtime m2 <value>
<class> realtime m2
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text>
<shaper-hfsc> class upperlimit d <value>
<class> upperlimit d
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text>
<shaper-hfsc> class upperlimit m1 <value>
<class> upperlimit m1
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> class <text>
<shaper-hfsc> class upperlimit m2 <value>
<class> upperlimit m2
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> default linkshare d
<shaper-hfsc> default <value>
linkshare d
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> default linkshare
<shaper-hfsc> default m1 <value>
linkshare m1
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> default linkshare
<shaper-hfsc> default m2 <value>
linkshare m2
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> default realtime d
<shaper-hfsc> default <value>
realtime d
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> default realtime m1
<shaper-hfsc> default <value>
realtime m1
continues on next page

21.1. Configuration Commands 1794

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> default realtime m2
<shaper-hfsc> default <value>
realtime m2
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> default upperlimit
<shaper-hfsc> default d <value>
upperlimit d
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> default upperlimit
<shaper-hfsc> default m1 <value>
upperlimit m1
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> default upperlimit
<shaper-hfsc> default m2 <value>
upperlimit m2
× not yet documented qos.xml.in: qos policy shaper-hfsc
qos policy shaper-hfsc <text> description
<shaper-hfsc> description <value>
✓ set qos policy qos.xml.in: qos policy shaper <text>
shaper <policy-name> qos policy shaper bandwidth <value>
bandwidth <rate> <shaper> bandwidth
× not yet documented qos.xml.in: Nothing found in VyOS
qos policy shaper
<shaper> class <class>
average-packet
✓ set qos policy qos.xml.in: qos policy shaper <text>
shaper <policy-name> qos policy shaper class <text> bandwidth
class <class-ID> <shaper> class <class> <value>
bandwidth <rate> bandwidth
✓ set qos policy qos.xml.in: qos policy shaper <text>
shaper <policy-name> qos policy shaper class <text> burst <value>
class <class-ID> <shaper> class <class>
burst <bytes> burst
✓ set qos policy qos.xml.in: qos policy shaper <text>
shaper <policy-name> qos policy shaper class <text> ceiling
class <class-ID> <shaper> class <class> <value>
ceiling <bandwidth> ceiling
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> codel-
<shaper> class <class> quantum <value>
codel-quantum
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> description
<shaper> class <class> <value>
description
continues on next page

21.1. Configuration Commands 1795

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> flows <value>
<shaper> class <class>
flows
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> interval
<shaper> class <class> <value>
interval
× not yet documented qos.xml.in: Nothing found in VyOS
qos policy shaper
<shaper> class <class>
mark-probability
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> description <value>
match <match> descrip-
tion
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> ether destination <value>
match <match> ether
destination
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> ether protocol <value>
match <match> ether
protocol
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> ether source <value>
match <match> ether
source
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> interface <value>
match <match> interface
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> ip destination address
match <match> ip desti- <value>
nation address
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match
<shaper> class <class> <text> ip destination port
match <match> ip desti- <value>
nation port
continues on next page

21.1. Configuration Commands 1796

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> ip dscp <value>
match <match> ip dscp
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> ip max-length <value>
match <match> ip max-
length
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> ip protocol <value>
match <match> ip proto-
col
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> ip source address <value>
match <match> ip source
address
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> ip source port <value>
match <match> ip source
port
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> ip tcp ack
match <match> ip tcp ack
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> ip tcp syn
match <match> ip tcp syn
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> ipv6 destination address
match <match> ipv6 <value>
destination address
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> ipv6 destination port
match <match> ipv6 <value>
destination port
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> ipv6 dscp <value>
match <match> ipv6 dscp
continues on next page

21.1. Configuration Commands 1797

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> ipv6 max-length <value>
match <match> ipv6
max-length
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> ipv6 protocol <value>
match <match> ipv6
protocol
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> ipv6 source address
match <match> ipv6 <value>
source address
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> ipv6 source port <value>
match <match> ipv6
source port
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> ipv6 tcp ack
match <match> ipv6 tcp
ack
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> ipv6 tcp syn
match <match> ipv6 tcp
syn
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> mark <value>
match <match> mark
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> match <text>
<shaper> class <class> vif <value>
match <match> vif
× not yet documented qos.xml.in: Nothing found in VyOS
qos policy shaper
<shaper> class <class>
maximum-threshold
× not yet documented qos.xml.in: Nothing found in VyOS
qos policy shaper
<shaper> class <class>
minimum-threshold
continues on next page

21.1. Configuration Commands 1798

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set qos policy qos.xml.in: qos policy shaper <text>
shaper <policy-name> qos policy shaper class <text> priority
class <class-ID> <shaper> class <class> <value>
priority <0-7> priority
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> queue-limit
<shaper> class <class> <value>
queue-limit
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> queue-type
<shaper> class <class> <value>
queue-type
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> set-dscp
<shaper> class <class> <value>
set-dscp
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper class <text> target
<shaper> class <class> <value>
target
× not yet documented qos.xml.in: Nothing found in VyOS
qos policy shaper
<shaper> default average-
packet
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper default bandwidth
<shaper> default band- <value>
width
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper default burst <value>
<shaper> default burst
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper default ceiling <value>
<shaper> default ceil-
ing
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper default codel-quantum
<shaper> default codel- <value>
quantum
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper default flows <value>
<shaper> default flows
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper default interval <value>
<shaper> default interval
× not yet documented qos.xml.in: Nothing found in VyOS
qos policy shaper
<shaper> default mark-
probability
continues on next page

21.1. Configuration Commands 1799

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented qos.xml.in: Nothing found in VyOS
qos policy shaper
<shaper> default
maximum-threshold
× not yet documented qos.xml.in: Nothing found in VyOS
qos policy shaper
<shaper> default
minimum-threshold
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper default priority <value>
<shaper> default pri-
ority
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper default queue-limit
<shaper> default queue- <value>
limit
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper default queue-type
<shaper> default queue- <value>
type
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper default set-dscp <value>
<shaper> default set-
dscp
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper default target <value>
<shaper> default tar-
get
× not yet documented qos.xml.in: qos policy shaper <text>
qos policy shaper description <value>
<shaper> description
× rename Nothing found in XML Nothing found in VyOS
Definitions
× rollback <N> Nothing found in XML Nothing found in VyOS
Definitions
× run Nothing found in XML Nothing found in VyOS
Definitions
× save Nothing found in XML Nothing found in VyOS
Definitions
✓ set service service_broadcast- service broadcast-relay
broadcast-relay relay.xml.in: disable
disable service broadcast-relay
disable
✓ set service service_broadcast- service broadcast-relay id
broadcast-relay relay.xml.in: <text> address <value>
id <n> address service broadcast-relay id
<ipv4-address> <id> address
continues on next page

21.1. Configuration Commands 1800

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set service service_broadcast- service broadcast-relay
broadcast-relay relay.xml.in: id <text> description
id <n> description service broadcast-relay id <value>
<description> <id> description
✓ set service service_broadcast- service broadcast-relay id
broadcast-relay relay.xml.in: <text> disable
id <n> disable service broadcast-relay id
<id> disable
✓ set service service_broadcast- service broadcast-relay id
broadcast-relay relay.xml.in: <text> interface <value>
id <n> interface service broadcast-relay id
<interface> <id> interface
✓ set service service_broadcast- service broadcast-relay id
broadcast-relay relay.xml.in: <text> port <value>
id <n> port <port> service broadcast-relay id
<id> port
✓ set service service_config- service config-sync mode
config-sync mode sync.xml.in: <value>
<load|set> service config-sync mode
× set service Nothing found in XML Nothing found in VyOS
config-sync Definitions
secondary
<address|key|timeout|port>
× not yet documented service_config- service config-sync sec-
sync.xml.in: ondary address <value>
service config-sync sec-
ondary address
× not yet documented service_config- service config-sync sec-
sync.xml.in: ondary key <value>
service config-sync sec-
ondary key
× not yet documented service_config- service config-sync sec-
sync.xml.in: ondary timeout <value>
service config-sync sec-
ondary timeout
× set service Nothing found in XML service config-sync sec-
config-sync section Definitions tion <value>
<section>
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion firewall
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion interfaces bonding
continues on next page

21.1. Configuration Commands 1801

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion interfaces bridge
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion interfaces dummy
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion interfaces ethernet
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion interfaces geneve
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion interfaces input
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion interfaces l2tpv3
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion interfaces loopback
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion interfaces macsec
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion interfaces openvpn
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion interfaces pppoe
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync
section interfaces pseudo-
ethernet
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion interfaces sstpc
continues on next page

21.1. Configuration Commands 1802

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion interfaces tunnel
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync
section interfaces virtual-
ethernet
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion interfaces vti
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion interfaces vxlan
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion interfaces wireguard
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion interfaces wireless
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion interfaces wwan
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion nat
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion nat66
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion pki
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion policy
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion protocols babel
continues on next page

21.1. Configuration Commands 1803

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion protocols bfd
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion protocols bgp
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion protocols failover
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion protocols igmp-proxy
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion protocols isis
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion protocols mpls
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion protocols nhrp
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion protocols ospf
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion protocols ospfv3
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion protocols pim
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion protocols pim6
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion protocols rip
continues on next page

21.1. Configuration Commands 1804

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion protocols ripng
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion protocols rpki
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion protocols segment-
routing
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion protocols static
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion qos interface
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion qos policy
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync
section service console-
server
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion service dhcp-relay
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion service dhcp-server
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion service dhcpv6-relay
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion service dhcpv6-server
continues on next page

21.1. Configuration Commands 1805

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion service dns
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion service lldp
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion service mdns
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion service monitoring
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion service ndp-proxy
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion service ntp
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion service snmp
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion service tftp-server
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion service webproxy
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion system conntrack
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync
section system flow-
accounting
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion system option
continues on next page

21.1. Configuration Commands 1806

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion system sflow
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync
section system static-host-
mapping
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion system sysctl
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion vpn
× not yet documented service_config- Nothing found in VyOS
sync.xml.in:
service config-sync sec-
tion vrf
✓ set service service_conntrack- service conntrack-sync
conntrack-sync sync.xml.in: accept-protocol <value>
accept-protocol service conntrack-sync
accept-protocol
✓ set service service_conntrack- service conntrack-sync
conntrack-sync sync.xml.in: disable-external-cache
disable-external-cache service conntrack-sync
disable-external-cache
× set service service_conntrack- Nothing found in VyOS
conntrack-sync sync.xml.in:
disable-syslog service conntrack-sync
disable-syslog
✓ set service service_conntrack- service conntrack-sync
conntrack-sync sync.xml.in: event-listen-queue-size
event-listen-queue-sizeservice conntrack-sync <value>
<size> event-listen-queue-size
✓ set service service_conntrack- service conntrack-sync
conntrack-sync sync.xml.in: expect-sync <value>
expect-sync service conntrack-sync
<all|ftp|h323|nfs|sip|sqlnet>
expect-sync
✓ set service service_conntrack- service conntrack-sync
conntrack-sync sync.xml.in: failover-mechanism vrrp
failover-mechanism service conntrack-sync sync-group <value>
vrrp sync-group failover-mechanism vrrp
<group> sync-group
continues on next page

21.1. Configuration Commands 1807

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set service service_conntrack- service conntrack-sync
conntrack-sync sync.xml.in: ignore-address <value>
ignore-address <x.x. service conntrack-sync
x.x> ignore-address
× set service Nothing found in XML Nothing found in VyOS
conntrack-sync Definitions
interface <name>
✓ set service service_conntrack- service conntrack-sync
conntrack-sync sync.xml.in: interface <text> peer
interface <name> service conntrack-sync in- <value>
peer <address> terface <interface> peer
✓ set service service_conntrack- service conntrack-sync
conntrack-sync sync.xml.in: interface <text> port
interface <name> service conntrack-sync in- <value>
port <port> terface <interface> port
✓ set service service_conntrack- service conntrack-sync
conntrack-sync sync.xml.in: listen-address <value>
listen-address service conntrack-sync
<ipv4address> listen-address
✓ set service service_conntrack- service conntrack-sync
conntrack-sync sync.xml.in: mcast-group <value>
mcast-group <x.x. service conntrack-sync
x.x> mcast-group
× set service service_conntrack- Nothing found in VyOS
conntrack-sync sync.xml.in:
startup-resync service conntrack-sync
startup-resync
✓ set service service_conntrack- service conntrack-sync
conntrack-sync sync.xml.in: sync-queue-size <value>
sync-queue-size service conntrack-sync
<size> sync-queue-size
✓ set service service_console- service console-server de-
console-server server.xml.in: vice <text> alias <value>
device <device> service console-server de-
alias <string> vice <device> alias
✓ set service service_console- service console-server
console-server server.xml.in: device <text> data-bits
device <device> service console-server de- <value>
data-bits [7 | 8] vice <device> data-bits
✓ set service service_console- service console-server
console-server server.xml.in: device <text> description
device <device> service console-server de- <value>
description vice <device> description
<string>
✓ set service service_console- service console-server de-
console-server server.xml.in: vice <text> parity <value>
device <device> service console-server de-
parity [even | odd | vice <device> parity
none]
continues on next page

21.1. Configuration Commands 1808

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set service service_console- service console-server de-
console-server server.xml.in: vice <text> speed <value>
device <device> service console-server de-
speed [ 300 | 1200 | vice <device> speed
2400 | 4800 | 9600
| 19200 | 38400 |
57600 | 115200 ]
✓ set service service_console- service console-server
console-server server.xml.in: device <text> ssh port
device <device> service console-server de- <value>
ssh port <port> vice <device> ssh port
✓ set service service_console- service console-server
console-server server.xml.in: device <text> stop-bits
device <device> service console-server de- <value>
stop-bits [1 | 2] vice <device> stop-bits
✓ set service service_dhcp- service dhcp-relay disable
dhcp-relay disable relay.xml.in:
service dhcp-relay disable
✓ set service service_dhcp- service dhcp-relay inter-
dhcp-relay interface relay.xml.in: face <value>
<interface> service dhcp-relay inter-
face
✓ set service service_dhcp- service dhcp-relay listen-
dhcp-relay relay.xml.in: interface <value>
listen-interface service dhcp-relay listen-
<interface> interface
✓ set service service_dhcp- service dhcp-relay
dhcp-relay relay.xml.in: relay-options hop-count
relay-options service dhcp-relay relay- <value>
hop-count <count> options hop-count
✓ set service service_dhcp- service dhcp-relay relay-
dhcp-relay relay.xml.in: options max-size <value>
relay-options service dhcp-relay relay-
max-size <size> options max-size
✓ set service service_dhcp- service dhcp-relay relay-
dhcp-relay relay.xml.in: options relay-agents-
relay-options service dhcp-relay relay- packets <value>
relay-agents-packets options relay-agents-
<append | discard | packets
forward | replace>
× set service Nothing found in XML Nothing found in VyOS
dhcp-relay Definitions
relay-options
relay-agents-packets
discard
✓ set service service_dhcp- service dhcp-relay server
dhcp-relay server relay.xml.in: <value>
<server> service dhcp-relay server
continues on next page

21.1. Configuration Commands 1809

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set service service_dhcp- service dhcp-relay
dhcp-relay relay.xml.in: upstream-interface
upstream-interface service dhcp-relay <value>
<interface> upstream-interface
× not yet documented service_dhcp- service dhcp-server dis-
server.xml.in: able
service dhcp-server dis-
able
× not yet documented service_dhcp- service dhcp-server
server.xml.in: dynamic-dns-update
service dhcp-server
dynamic-dns-update
× not yet documented Nothing found in XML service dhcp-server
Definitions failover name <value>
× not yet documented Nothing found in XML service dhcp-server
Definitions failover remote <value>
× not yet documented Nothing found in XML service dhcp-server
Definitions failover source-address
<value>
× not yet documented Nothing found in XML service dhcp-server
Definitions failover status <value>
× not yet documented service_dhcp- service dhcp-server
server.xml.in: global-parameters
service dhcp-server <value>
global-parameters
× set service service_dhcp- Nothing found in VyOS
dhcp-server server.xml.in:
high-availability service dhcp-server high-
mode [active-active availability mode
| active-passive]
× set service service_dhcp- Nothing found in VyOS
dhcp-server server.xml.in:
high-availability service dhcp-server high-
name <name> availability name
× set service service_dhcp- Nothing found in VyOS
dhcp-server server.xml.in:
high-availability service dhcp-server high-
remote <address> availability remote
× set service service_dhcp- Nothing found in VyOS
dhcp-server server.xml.in:
high-availability service dhcp-server
source-address high-availability source-
<address> address
× set service service_dhcp- Nothing found in VyOS
dhcp-server server.xml.in:
high-availability service dhcp-server high-
status <primary | availability status
secondary>
continues on next page

21.1. Configuration Commands 1810

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_dhcp- service dhcp-server host-
server.xml.in: decl-name
service dhcp-server host-
decl-name
✓ set service service_dhcp- service dhcp-server
dhcp-server server.xml.in: hostfile-update
hostfile-update service dhcp-server
hostfile-update
✓ set service service_dhcp- service dhcp-server listen-
dhcp-server server.xml.in: address <value>
listen-address service dhcp-server listen-
<address> address
✓ set service service_dhcp- service dhcp-server
dhcp-server server.xml.in: shared-network-name
shared-network-name service dhcp-server <text> authoritative
<name> authoritative shared-network-name
<shared-network-name>
authoritative
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> description
shared-network-name <value>
<shared-network-name>
description
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> disable
shared-network-name
<shared-network-name>
disable
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> domain-name
shared-network-name <value>
<shared-network-name>
domain-name
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> domain-search
shared-network-name <value>
<shared-network-name>
domain-search
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> name-server
shared-network-name <value>
<shared-network-name>
name-server
continues on next page

21.1. Configuration Commands 1811

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> ntp-server <value>
shared-network-name
<shared-network-name>
ntp-server
× set service Nothing found in XML Nothing found in VyOS
dhcp-server Definitions
shared-network-name
<name> option
domain-name
<domain-name>
× set service Nothing found in XML Nothing found in VyOS
dhcp-server Definitions
shared-network-name
<name> option
domain-search
<domain-name>
× set service Nothing found in XML Nothing found in VyOS
dhcp-server Definitions
shared-network-name
<name> option
name-server
<address>
× set service Nothing found in XML Nothing found in VyOS
dhcp-server Definitions
shared-network-name
<name> option
vendor-option
<option-name>
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> ping-check
shared-network-name
<shared-network-name>
ping-check
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> shared-network-
shared-network-name parameters <value>
<shared-network-
name> shared-network-
parameters
continues on next page

21.1. Configuration Commands 1812

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name bootfile-name <value>
<shared-network-name>
subnet <subnet> bootfile-
name
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name bootfile-server <value>
<shared-network-name>
subnet <subnet> bootfile-
server
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name bootfile-size <value>
<shared-network-name>
subnet <subnet> bootfile-
size
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name client-prefix-length
<shared-network-name> <value>
subnet <subnet> client-
prefix-length
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name default-router <value>
<shared-network-name>
subnet <subnet> default-
router
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name description <value>
<shared-network-name>
subnet <subnet> descrip-
tion
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name domain-name <value>
<shared-network-name>
subnet <subnet> domain-
name
continues on next page

21.1. Configuration Commands 1813

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name domain-search <value>
<shared-network-name>
subnet <subnet> domain-
search
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name enable-failover
<shared-network-name>
subnet <subnet> enable-
failover
✓ set service service_dhcp- service dhcp-server
dhcp-server server.xml.in: shared-network-name
shared-network-name service dhcp-server <text> subnet <text>
<name> subnet shared-network-name exclude <value>
<subnet> exclude <shared-network-name>
<address> subnet <subnet> exclude
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name ip-forwarding
<shared-network-name>
subnet <subnet> ip-
forwarding
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text> ipv6-
shared-network-name only-preferred <value>
<shared-network-name>
subnet <subnet> ipv6-
only-preferred
✓ set service service_dhcp- service dhcp-server
dhcp-server server.xml.in: shared-network-name
shared-network-name service dhcp-server <text> subnet <text> lease
<name> subnet shared-network-name <value>
<subnet> lease <shared-network-name>
<time> subnet <subnet> lease
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name name-server <value>
<shared-network-name>
subnet <subnet> name-
server
continues on next page

21.1. Configuration Commands 1814

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name ntp-server <value>
<shared-network-name>
subnet <subnet> ntp-
server
× set service Nothing found in XML Nothing found in VyOS
dhcp-server Definitions
shared-network-name
<name> subnet
<subnet> option
default-router
<address>
× set service Nothing found in XML Nothing found in VyOS
dhcp-server Definitions
shared-network-name
<name> subnet
<subnet> option
domain-name
<domain-name>
× set service Nothing found in XML Nothing found in VyOS
dhcp-server Definitions
shared-network-name
<name> subnet
<subnet> option
domain-search
<domain-name>
× set service Nothing found in XML Nothing found in VyOS
dhcp-server Definitions
shared-network-name
<name> subnet
<subnet> option
name-server
<address>
× set service Nothing found in XML Nothing found in VyOS
dhcp-server Definitions
shared-network-name
<name> subnet
<subnet> option
vendor-option
<option-name>
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name ping-check
<shared-network-name>
subnet <subnet> ping-
check
continues on next page

21.1. Configuration Commands 1815

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name pop-server <value>
<shared-network-name>
subnet <subnet> pop-
server
✓ set service service_dhcp- service dhcp-server
dhcp-server server.xml.in: shared-network-name
shared-network-name service dhcp-server <text> subnet <text>
<name> subnet shared-network-name range <text> start <value>
<subnet> range <n> <shared-network-name>
start <address> subnet <subnet> range
<range> start
✓ set service service_dhcp- service dhcp-server
dhcp-server server.xml.in: shared-network-name
shared-network-name service dhcp-server <text> subnet <text>
<name> subnet shared-network-name range <text> stop <value>
<subnet> range <n> <shared-network-name>
stop <address> subnet <subnet> range
<range> stop
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name server-identifier <value>
<shared-network-name>
subnet <subnet> server-
identifier
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name smtp-server <value>
<shared-network-name>
subnet <subnet> smtp-
server
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name static-mapping <text>
<shared-network- disable
name> subnet <subnet>
static-mapping <static-
mapping> disable
continues on next page

21.1. Configuration Commands 1816

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set service Nothing found in XML Nothing found in VyOS
dhcp-server Definitions
shared-network-name
<name> subnet
<subnet>
static-mapping
<description> duid
<identifier>
✓ set service service_dhcp- service dhcp-server
dhcp-server server.xml.in: shared-network-name
shared-network-name service dhcp-server <text> subnet <text>
<name> subnet shared-network-name static-mapping <text>
<subnet> <shared-network- ip-address <value>
static-mapping name> subnet <subnet>
<description> static-mapping <static-
ip-address mapping> ip-address
<address>
× set service Nothing found in XML Nothing found in VyOS
dhcp-server Definitions
shared-network-name
<name> subnet
<subnet>
static-mapping
<description> mac
<address>
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name static-mapping <text>
<shared-network- mac-address <value>
name> subnet <subnet>
static-mapping <static-
mapping> mac-address
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-
service dhcp-server name <text> subnet
shared-network-name <text> static-mapping
<shared-network- <text> static-mapping-
name> subnet <sub- parameters <value>
net> static-mapping
<static-mapping> static-
mapping-parameters
continues on next page

21.1. Configuration Commands 1817

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name static-route <text> next-
<shared-network-name> hop <value>
subnet <subnet> static-
route <static-route>
next-hop
× set service Nothing found in XML Nothing found in VyOS
dhcp-server Definitions
shared-network-name
<name> subnet
<subnet> subnet-id
<id>
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name subnet-parameters
<shared-network-name> <value>
subnet <subnet> subnet-
parameters
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name tftp-server-name <value>
<shared-network-name>
subnet <subnet> tftp-
server-name
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name time-offset <value>
<shared-network-name>
subnet <subnet> time-
offset
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name time-server <value>
<shared-network-name>
subnet <subnet> time-
server
continues on next page

21.1. Configuration Commands 1818

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name vendor-option ubiquiti
<shared-network-name> unifi-controller <value>
subnet <subnet> vendor-
option ubiquiti unifi-
controller
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name wins-server <value>
<shared-network-name>
subnet <subnet> wins-
server
× not yet documented service_dhcp- service dhcp-server
server.xml.in: shared-network-name
service dhcp-server <text> subnet <text>
shared-network-name wpad-url <value>
<shared-network-name>
subnet <subnet> wpad-url
✓ set service service_dhcpv6- service dhcpv6-relay dis-
dhcpv6-relay disable relay.xml.in: able
service dhcpv6-relay dis-
able
× set service Nothing found in XML Nothing found in VyOS
dhcpv6-relay Definitions
listen-interface
<interface>
× not yet documented service_dhcpv6- service dhcpv6-relay
relay.xml.in: listen-interface <text>
service dhcpv6-relay address <value>
listen-interface <listen-
interface> address
✓ set service service_dhcpv6- service dhcpv6-relay max-
dhcpv6-relay relay.xml.in: hop-count <value>
max-hop-count service dhcpv6-relay max-
<count> hop-count
✓ set service service_dhcpv6- service dhcpv6-relay
dhcpv6-relay relay.xml.in: upstream-interface <text>
upstream-interface service dhcpv6-relay address <value>
<interface> address upstream-interface
<server> <upstream-interface>
address
✓ set service service_dhcpv6- service dhcpv6-relay use-
dhcpv6-relay relay.xml.in: interface-id-option
use-interface-id-optionservice dhcpv6-relay use-
interface-id-option
continues on next page

21.1. Configuration Commands 1819

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_dhcpv6- service dhcpv6-server dis-
server.xml.in: able
service dhcpv6-server dis-
able
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: global-parameters name-
service dhcpv6-server server <value>
global-parameters name-
server
✓ set service service_dhcpv6- service dhcpv6-server
dhcpv6-server server.xml.in: preference <value>
preference service dhcpv6-server
<preference value> preference
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> common-options
shared-network-name domain-search <value>
<shared-network-name>
common-options domain-
search
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> common-options
shared-network-name info-refresh-time <value>
<shared-network-name>
common-options info-
refresh-time
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> common-options
shared-network-name name-server <value>
<shared-network-name>
common-options name-
server
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> description
shared-network-name <value>
<shared-network-name>
description
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> disable
shared-network-name
<shared-network-name>
disable
continues on next page

21.1. Configuration Commands 1820

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> subnet <text>
shared-network-name address-range prefix
<shared-network-name> <text> temporary
subnet <subnet> address-
range prefix <prefix>
temporary
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> subnet <text>
shared-network-name address-range start <text>
<shared-network-name> stop <value>
subnet <subnet> address-
range start <start> stop
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> subnet <text>
shared-network-name domain-search <value>
<shared-network-name>
subnet <subnet> domain-
search
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> subnet <text>
shared-network-name lease-time default <value>
<shared-network-name>
subnet <subnet> lease-
time default
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> subnet <text>
shared-network-name lease-time maximum
<shared-network-name> <value>
subnet <subnet> lease-
time maximum
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> subnet <text>
shared-network-name lease-time minimum
<shared-network-name> <value>
subnet <subnet> lease-
time minimum
continues on next page

21.1. Configuration Commands 1821

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set service Nothing found in XML Nothing found in VyOS
dhcpv6-server Definitions
shared-network-name
<name> subnet
<prefix> lease-time
{default | maximum |
minimum}
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> subnet <text>
shared-network-name name-server <value>
<shared-network-name>
subnet <subnet> name-
server
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> subnet <text>
shared-network-name nis-domain <value>
<shared-network-name>
subnet <subnet> nis-
domain
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> subnet <text>
shared-network-name nis-server <value>
<shared-network-name>
subnet <subnet> nis-
server
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> subnet <text>
shared-network-name nisplus-domain <value>
<shared-network-name>
subnet <subnet> nisplus-
domain
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> subnet <text>
shared-network-name nisplus-server <value>
<shared-network-name>
subnet <subnet> nisplus-
server
× set service Nothing found in XML Nothing found in VyOS
dhcpv6-server Definitions
shared-network-name
<name> subnet
<prefix> option
nis-domain
<domain-name>
continues on next page

21.1. Configuration Commands 1822

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set service Nothing found in XML Nothing found in VyOS
dhcpv6-server Definitions
shared-network-name
<name> subnet
<prefix> option
nis-server
<address>
× set service Nothing found in XML Nothing found in VyOS
dhcpv6-server Definitions
shared-network-name
<name> subnet
<prefix> option
nisplus-domain
<domain-name>
× set service Nothing found in XML Nothing found in VyOS
dhcpv6-server Definitions
shared-network-name
<name> subnet
<prefix> option
nisplus-server
<address>
× set service Nothing found in XML Nothing found in VyOS
dhcpv6-server Definitions
shared-network-name
<name> subnet
<prefix> option
sip-server <address
| fqdn>
× set service Nothing found in XML Nothing found in VyOS
dhcpv6-server Definitions
shared-network-name
<name> subnet
<prefix> option
sntp-server-address
<address>
✓ set service service_dhcpv6- service dhcpv6-server
dhcpv6-server server.xml.in: shared-network-name
shared-network-name service dhcpv6-server <text> subnet <text>
<name> subnet shared-network-name prefix-delegation start
<prefix> <shared-network-name> <text> prefix-length
prefix-delegation subnet <subnet> prefix- <value>
start <address> delegation start <start>
prefix-length prefix-length
<length>
continues on next page

21.1. Configuration Commands 1823

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set service service_dhcpv6- service dhcpv6-server
dhcpv6-server server.xml.in: shared-network-name
shared-network-name service dhcpv6-server <text> subnet <text>
<name> subnet shared-network-name prefix-delegation start
<prefix> <shared-network-name> <text> stop <value>
prefix-delegation subnet <subnet> prefix-
start <address> stop delegation start <start>
<address> stop
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> subnet <text>
shared-network-name sip-server <value>
<shared-network-name>
subnet <subnet> sip-
server
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> subnet <text>
shared-network-name sntp-server <value>
<shared-network-name>
subnet <subnet> sntp-
server
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> subnet <text>
shared-network-name static-mapping <text>
<shared-network- disable
name> subnet <subnet>
static-mapping <static-
mapping> disable
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> subnet <text>
shared-network-name static-mapping <text>
<shared-network- identifier <value>
name> subnet <subnet>
static-mapping <static-
mapping> identifier
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> subnet <text>
shared-network-name static-mapping <text>
<shared-network- ipv6-address <value>
name> subnet <subnet>
static-mapping <static-
mapping> ipv6-address
continues on next page

21.1. Configuration Commands 1824

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> subnet <text>
shared-network-name static-mapping <text>
<shared-network- ipv6-prefix <value>
name> subnet <subnet>
static-mapping <static-
mapping> ipv6-prefix
× set service Nothing found in XML Nothing found in VyOS
dhcpv6-server Definitions
shared-network-name
<name> subnet
<subnet> subnet-id
<id>
× not yet documented service_dhcpv6- service dhcpv6-server
server.xml.in: shared-network-name
service dhcpv6-server <text> subnet <text>
shared-network-name vendor-option cisco
<shared-network-name> tftp-server <value>
subnet <subnet> vendor-
option cisco tftp-server
× not yet documented Nothing found in XML service dns dynamic ad-
Definitions dress <text> rfc2136
<text> description
<value>
× not yet documented Nothing found in XML service dns dynamic
Definitions address <text> rfc2136
<text> host-name <value>
× not yet documented Nothing found in XML service dns dynamic
Definitions address <text> rfc2136
<text> key <value>
× not yet documented Nothing found in XML service dns dynamic
Definitions address <text> rfc2136
<text> server <value>
× not yet documented Nothing found in XML service dns dynamic
Definitions address <text> rfc2136
<text> ttl <value>
× not yet documented Nothing found in XML service dns dynamic
Definitions address <text> rfc2136
<text> zone <value>
× not yet documented Nothing found in XML service dns dynamic
Definitions address <text> ser-
vice <text> description
<value>
× not yet documented Nothing found in XML service dns dynamic
Definitions address <text> service
<text> host-name <value>
continues on next page

21.1. Configuration Commands 1825

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented Nothing found in XML service dns dynamic
Definitions address <text> service
<text> ip-version <value>
× not yet documented Nothing found in XML service dns dynamic
Definitions address <text> service
<text> password <value>
× not yet documented Nothing found in XML service dns dynamic
Definitions address <text> service
<text> protocol <value>
× not yet documented Nothing found in XML service dns dynamic
Definitions address <text> service
<text> server <value>
× not yet documented Nothing found in XML service dns dynamic
Definitions address <text> service
<text> username <value>
× not yet documented Nothing found in XML service dns dynamic
Definitions address <text> service
<text> zone <value>
× not yet documented Nothing found in XML service dns dynamic ad-
Definitions dress <text> web-options
skip <value>
× not yet documented Nothing found in XML service dns dynamic ad-
Definitions dress <text> web-options
url <value>
× set service dns ser- Nothing found in VyOS
dynamic interval vice_dns_dynamic.xml.in:
<60-3600> service dns dynamic inter-
val
× set service dns ser- Nothing found in VyOS
dynamic name vice_dns_dynamic.xml.in:
<service-name> service dns dynamic name
address interface <name> address interface
<interface>
× set service dns Nothing found in XML Nothing found in VyOS
dynamic name Definitions
<service-name>
address web <url>
× set service dns ser- Nothing found in VyOS
dynamic name vice_dns_dynamic.xml.in:
<service-name> service dns dynamic name
address web skip <name> address web skip
<pattern>
× not yet documented ser- Nothing found in VyOS
vice_dns_dynamic.xml.in:
service dns dynamic name
<name> address web url
continues on next page

21.1. Configuration Commands 1826

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set service dns ser- Nothing found in VyOS
dynamic name vice_dns_dynamic.xml.in:
<service-name> service dns dynamic name
description <text> <name> description
× not yet documented ser- Nothing found in VyOS
vice_dns_dynamic.xml.in:
service dns dynamic name
<name> expiry-time
× set service dns ser- Nothing found in VyOS
dynamic name vice_dns_dynamic.xml.in:
<service-name> service dns dynamic name
host-name <name> host-name
<hostname>
× not yet documented ser- Nothing found in VyOS
vice_dns_dynamic.xml.in:
service dns dynamic name
<name> ip-version
× set service dns Nothing found in XML Nothing found in VyOS
dynamic name Definitions
<service-name>
ip-version 'ipv6'
× set service dns ser- Nothing found in VyOS
dynamic name vice_dns_dynamic.xml.in:
<service-name> key service dns dynamic name
<filename> <name> key
× set service dns ser- Nothing found in VyOS
dynamic name vice_dns_dynamic.xml.in:
<service-name> service dns dynamic name
password <password> <name> password
× set service dns ser- Nothing found in VyOS
dynamic name vice_dns_dynamic.xml.in:
<service-name> service dns dynamic name
protocol <protocol> <name> protocol
× set service dns ser- Nothing found in VyOS
dynamic name vice_dns_dynamic.xml.in:
<service-name> service dns dynamic name
server <server> <name> server
× set service dns ser- Nothing found in VyOS
dynamic name vice_dns_dynamic.xml.in:
<service-name> ttl service dns dynamic name
<ttl> <name> ttl
× set service dns ser- Nothing found in VyOS
dynamic name vice_dns_dynamic.xml.in:
<service-name> service dns dynamic name
username <username> <name> username
× not yet documented ser- Nothing found in VyOS
vice_dns_dynamic.xml.in:
service dns dynamic name
<name> wait-time
continues on next page

21.1. Configuration Commands 1827

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set service dns ser- Nothing found in VyOS
dynamic name vice_dns_dynamic.xml.in:
<service-name> zone service dns dynamic name
<zone> <name> zone
× not yet documented Nothing found in XML service dns dynamic time-
Definitions out <value>
× not yet documented ser- Nothing found in VyOS
vice_dns_dynamic.xml.in:
service dns dynamic vrf
✓ set service ser- service dns forwarding
dns forwarding vice_dns_forwarding.xml.in: allow-from <value>
allow-from service dns forwarding
<network> allow-from
✓ set service ser- service dns forwarding
dns forwarding vice_dns_forwarding.xml.in: authoritative-domain
authoritative-domain service dns forwarding <text> disable
<domain-name> authoritative-domain
disable <authoritative-domain>
disable
✓ set service ser- service dns forwarding
dns forwarding vice_dns_forwarding.xml.in: authoritative-domain
authoritative-domain service dns forwarding <text> records aaaa <text>
<domain-name> authoritative-domain address <value>
records aaaa <authoritative-domain>
<name> address records aaaa <aaaa>
<h:h:h:h:h:h:h:h> address
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records aaaa <text>
authoritative-domain disable
<authoritative-domain>
records aaaa <aaaa>
disable
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records aaaa <text>
authoritative-domain ttl <value>
<authoritative-domain>
records aaaa <aaaa> ttl
✓ set service ser- service dns forwarding
dns forwarding vice_dns_forwarding.xml.in: authoritative-domain
authoritative-domain service dns forwarding <text> records a <text>
<domain-name> authoritative-domain address <value>
records a <name> <authoritative-domain>
address <x.x.x.x> records a <a> address
continues on next page

21.1. Configuration Commands 1828

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records a <text>
authoritative-domain disable
<authoritative-domain>
records a <a> disable
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records a <text> ttl
authoritative-domain <value>
<authoritative-domain>
records a <a> ttl
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records cname
authoritative-domain <text> disable
<authoritative-domain>
records cname <cname>
disable
✓ set service ser- service dns forwarding
dns forwarding vice_dns_forwarding.xml.in: authoritative-domain
authoritative-domain service dns forwarding <text> records cname
<domain-name> authoritative-domain <text> target <value>
records cname <authoritative-domain>
<name> target records cname <cname>
<target-domain-name> target
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records cname
authoritative-domain <text> ttl <value>
<authoritative-domain>
records cname <cname>
ttl
× set service Nothing found in XML Nothing found in VyOS
dns forwarding Definitions
authoritative-domain
<domain-name>
records <type>
<name> disable
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records mx <text>
authoritative-domain disable
<authoritative-domain>
records mx <mx> disable
continues on next page

21.1. Configuration Commands 1829

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records mx <text>
authoritative-domain server <text> priority
<authoritative-domain> <value>
records mx <mx> server
<server> priority
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records mx <text>
authoritative-domain ttl <value>
<authoritative-domain>
records mx <mx> ttl
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records naptr
authoritative-domain <text> disable
<authoritative-domain>
records naptr <naptr>
disable
× set service Nothing found in XML Nothing found in VyOS
dns forwarding Definitions
authoritative-domain
<domain-name>
records naptr <name>
rule <rule-number>
<option> <value>
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records naptr
authoritative-domain <text> rule <text> lookup-
<authoritative-domain> a
records naptr <naptr> rule
<rule> lookup-a
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records naptr
authoritative-domain <text> rule <text> lookup-
<authoritative-domain> srv
records naptr <naptr> rule
<rule> lookup-srv
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records naptr
authoritative-domain <text> rule <text> order
<authoritative-domain> <value>
records naptr <naptr> rule
<rule> order
continues on next page

21.1. Configuration Commands 1830

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records naptr
authoritative-domain <text> rule <text> prefer-
<authoritative-domain> ence <value>
records naptr <naptr> rule
<rule> preference
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records naptr
authoritative-domain <text> rule <text>
<authoritative-domain> protocol-specific
records naptr <naptr> rule
<rule> protocol-specific
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records naptr
authoritative-domain <text> rule <text> regexp
<authoritative-domain> <value>
records naptr <naptr> rule
<rule> regexp
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records naptr
authoritative-domain <text> rule <text> re-
<authoritative-domain> placement <value>
records naptr <naptr> rule
<rule> replacement
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records naptr
authoritative-domain <text> rule <text> resolve-
<authoritative-domain> uri
records naptr <naptr> rule
<rule> resolve-uri
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records naptr
authoritative-domain <text> rule <text> service
<authoritative-domain> <value>
records naptr <naptr> rule
<rule> service
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records naptr
authoritative-domain <text> ttl <value>
<authoritative-domain>
records naptr <naptr> ttl
continues on next page

21.1. Configuration Commands 1831

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records ns <text>
authoritative-domain disable
<authoritative-domain>
records ns <ns> disable
✓ set service ser- service dns forwarding
dns forwarding vice_dns_forwarding.xml.in: authoritative-domain
authoritative-domain service dns forwarding <text> records ns <text>
<domain-name> authoritative-domain target <value>
records ns <authoritative-domain>
<name> target records ns <ns> target
<target-name>
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records ns <text>
authoritative-domain ttl <value>
<authoritative-domain>
records ns <ns> ttl
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records ptr <text>
authoritative-domain disable
<authoritative-domain>
records ptr <ptr> disable
✓ set service ser- service dns forwarding
dns forwarding vice_dns_forwarding.xml.in: authoritative-domain
authoritative-domain service dns forwarding <text> records ptr <text>
<domain-name> authoritative-domain target <value>
records ptr <authoritative-domain>
<name> target records ptr <ptr> target
<target-name>
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records ptr <text>
authoritative-domain ttl <value>
<authoritative-domain>
records ptr <ptr> ttl
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records spf <text>
authoritative-domain disable
<authoritative-domain>
records spf <spf> disable
continues on next page

21.1. Configuration Commands 1832

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records spf <text>
authoritative-domain ttl <value>
<authoritative-domain>
records spf <spf> ttl
✓ set service ser- service dns forwarding
dns forwarding vice_dns_forwarding.xml.in: authoritative-domain
authoritative-domain service dns forwarding <text> records spf <text>
<domain-name> authoritative-domain value <value>
records spf <name> <authoritative-domain>
value <value> records spf <spf> value
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records srv <text>
authoritative-domain disable
<authoritative-domain>
records srv <srv> disable
× set service Nothing found in XML Nothing found in VyOS
dns forwarding Definitions
authoritative-domain
<domain-name>
records srv <name>
entry <entry-number>
[hostname | port |
priority | weight]
<value>
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records srv <text>
authoritative-domain entry <text> hostname
<authoritative-domain> <value>
records srv <srv> entry
<entry> hostname
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records srv <text>
authoritative-domain entry <text> port <value>
<authoritative-domain>
records srv <srv> entry
<entry> port
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records srv <text>
authoritative-domain entry <text> priority
<authoritative-domain> <value>
records srv <srv> entry
<entry> priority
continues on next page

21.1. Configuration Commands 1833

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records srv <text>
authoritative-domain entry <text> weight
<authoritative-domain> <value>
records srv <srv> entry
<entry> weight
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records srv <text>
authoritative-domain ttl <value>
<authoritative-domain>
records srv <srv> ttl
× set service Nothing found in XML Nothing found in VyOS
dns forwarding Definitions
authoritative-domain
<domain-name>
records <type>
<name> ttl
<seconds>
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records txt <text>
authoritative-domain disable
<authoritative-domain>
records txt <txt> disable
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: authoritative-domain
service dns forwarding <text> records txt <text>
authoritative-domain ttl <value>
<authoritative-domain>
records txt <txt> ttl
✓ set service ser- service dns forwarding
dns forwarding vice_dns_forwarding.xml.in: authoritative-domain
authoritative-domain service dns forwarding <text> records txt <text>
<domain-name> authoritative-domain value <value>
records txt <name> <authoritative-domain>
value <value> records txt <txt> value
✓ set service ser- service dns forwarding
dns forwarding vice_dns_forwarding.xml.in: cache-size <value>
cache-size service dns forwarding
<0-2147483647> cache-size
✓ set service dns ser- service dns forwarding
forwarding dhcp vice_dns_forwarding.xml.in: dhcp <value>
<interface> service dns forwarding
dhcp
continues on next page

21.1. Configuration Commands 1834

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: dns64-prefix <value>
service dns forwarding
dns64-prefix
✓ set service ser- service dns forwarding
dns forwarding vice_dns_forwarding.xml.in: dnssec <value>
dnssec <off | service dns forwarding
process-no-validate dnssec
| process | log-fail
| validate>
✓ set service dns ser- service dns forwarding do-
forwarding domain vice_dns_forwarding.xml.in: main <text> addnta
<domain-name> service dns forwarding do-
addnta main <domain> addnta
× set service dns Nothing found in XML Nothing found in VyOS
forwarding domain Definitions
<domain-name>
name-server
<address>
× not yet documented ser- service dns forwarding do-
vice_dns_forwarding.xml.in: main <text> name-server
service dns forwarding <text> port <value>
domain <domain> name-
server <name-server>
port
✓ set service dns ser- service dns forwarding
forwarding domain vice_dns_forwarding.xml.in: domain <text> recursion-
<domain-name> service dns forwarding do- desired
recursion-desired main <domain> recursion-
desired
× not yet documented ser- Nothing found in VyOS
vice_dns_forwarding.xml.in:
service dns forwarding
exclude-throttle-address
✓ set service ser- service dns forwarding
dns forwarding vice_dns_forwarding.xml.in: ignore-hosts-file
ignore-hosts-file service dns forwarding
ignore-hosts-file
✓ set service ser- service dns forwarding
dns forwarding vice_dns_forwarding.xml.in: listen-address <value>
listen-address service dns forwarding
<address> listen-address
✓ set service ser- service dns forwarding
dns forwarding vice_dns_forwarding.xml.in: name-server <text> port
name-server service dns forwarding <value>
<address> port name-server <name-
<port> server> port
continues on next page

21.1. Configuration Commands 1835

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set service ser- service dns forwarding
dns forwarding vice_dns_forwarding.xml.in: negative-ttl <value>
negative-ttl service dns forwarding
<0-7200> negative-ttl
✓ set service ser- service dns forwarding no-
dns forwarding vice_dns_forwarding.xml.in: serve-rfc1918
no-serve-rfc1918 service dns forwarding no-
serve-rfc1918
× not yet documented ser- Nothing found in VyOS
vice_dns_forwarding.xml.in:
service dns forwarding op-
tions ecs-add-for
× not yet documented ser- Nothing found in VyOS
vice_dns_forwarding.xml.in:
service dns forwarding op-
tions ecs-ipv4-bits
× not yet documented ser- Nothing found in VyOS
vice_dns_forwarding.xml.in:
service dns forwarding
options edns-subnet-
allow-list
× not yet documented ser- service dns forwarding
vice_dns_forwarding.xml.in: port <value>
service dns forwarding
port
× not yet documented ser- Nothing found in VyOS
vice_dns_forwarding.xml.in:
service dns forwarding
serve-stale-extension
✓ set service ser- service dns forwarding
dns forwarding vice_dns_forwarding.xml.in: source-address <value>
source-address service dns forwarding
<address> source-address
✓ set service dns ser- service dns forwarding
forwarding system vice_dns_forwarding.xml.in: system
service dns forwarding
system
✓ set service dns ser- service dns forwarding
forwarding timeout vice_dns_forwarding.xml.in: timeout <value>
<10-60000> service dns forwarding
timeout
× set service Nothing found in XML Nothing found in VyOS
event-handler event Definitions
<event-handler
name>
continues on next page

21.1. Configuration Commands 1836

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set service service_event- service event-handler
event-handler event handler.xml.in: event <text> filter pattern
<event-handler service event-handler <value>
name> filter pattern event <event> filter
<regex> pattern
✓ set service service_event- service event-handler
event-handler event handler.xml.in: event <text> filter syslog-
<event-handler service event-handler identifier <value>
name> filter event <event> filter
syslog-identifier syslog-identifier
<sylogid name>
✓ set service service_event- service event-handler
event-handler event handler.xml.in: event <text> script argu-
<event-handler name> service event-handler ments <value>
script arguments event <event> script
<arguments> arguments
✓ set service service_event- service event-handler
event-handler event handler.xml.in: event <text> script en-
<event-handler name> service event-handler vironment <text> value
script environment event <event> script envi- <value>
<env name> value ronment <environment>
<env value> value
✓ set service service_event- service event-handler
event-handler event handler.xml.in: event <text> script path
<event-handler name> service event-handler <value>
script path <path to event <event> script path
script>
× set service https service_https.xml.in: Nothing found in VyOS
allow-client address service https allow-client
<address> address
× not yet documented Nothing found in XML service https api-restrict
Definitions virtual-host <value>
✓ set service service_https.xml.in: service https api cors
https api cors service https api cors allow-origin <value>
allow-origin allow-origin
<origin>
✓ set service https service_https.xml.in: service https api debug
api debug service https api debug
✓ set service https service_https.xml.in: service https api graphql
api graphql service https api graphql authentication expiration
authentication authentication expiration <value>
expiration
✓ set service https service_https.xml.in: service https api graphql
api graphql service https api graphql authentication secret-
authentication authentication secret- length <value>
secret-length length
continues on next page

21.1. Configuration Commands 1837

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set service service_https.xml.in: service https api graphql
https api graphql service https api graphql authentication type
authentication type authentication type <value>
<key | token>
✓ set service service_https.xml.in: service https api graphql
https api graphql service https api graphql introspection
introspection introspection
✓ set service https service_https.xml.in: service https api keys id
api keys id <name> service https api keys id <text> key <value>
key <apikey> <id> key
× not yet documented Nothing found in XML service https api port
Definitions <value>
× not yet documented Nothing found in XML service https api socket
Definitions
✓ set service https service_https.xml.in: service https api strict
api strict service https api strict
✓ set service https service_https.xml.in: service https certificates
certificates service https certificates ca-certificate <value>
ca-certificate ca-certificate
<name>
× not yet documented Nothing found in XML service https certificates
Definitions certbot domain-name
<value>
× not yet documented Nothing found in XML service https certificates
Definitions certbot email <value>
✓ set service https service_https.xml.in: service https certificates
certificates service https certificates certificate <value>
certificate <name> certificate
× set service https service_https.xml.in: Nothing found in VyOS
certificates service https certificates
dh-params <name> dh-params
× set service https service_https.xml.in: Nothing found in VyOS
enable-http-redirect service https enable-http-
redirect
× set service https service_https.xml.in: Nothing found in VyOS
listen-address service https listen-
<address> address
× set service https service_https.xml.in: Nothing found in VyOS
port <number> service https port
× set service https service_https.xml.in: Nothing found in VyOS
request-body-size-limitservice https request-
<size> body-size-limit
× set service https service_https.xml.in: Nothing found in VyOS
tls-version <1.2 | service https tls-version
1.3>
× not yet documented Nothing found in XML service https virtual-
Definitions host <text> allow-client
address <value>
continues on next page

21.1. Configuration Commands 1838

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented Nothing found in XML service https virtual-host
Definitions <text> listen-address
<value>
× not yet documented Nothing found in XML service https virtual-host
Definitions <text> listen-port <value>
× not yet documented Nothing found in XML service https virtual-
Definitions host <text> server-name
<value>
✓ set service https service_https.xml.in: service https vrf <value>
vrf <name> service https vrf
✓ set service ids service_ids_ddos- service ids ddos-
ddos-protection protection.xml.in: protection alert-script
alert-script <text> service ids ddos- <value>
protection alert-script
✓ set service ids service_ids_ddos- service ids ddos-
ddos-protection protection.xml.in: protection ban-time
ban-time service ids ddos- <value>
<1-4294967294> protection ban-time
✓ set service ids service_ids_ddos- service ids ddos-
ddos-protection protection.xml.in: protection direction
direction [in | out] service ids ddos- <value>
protection direction
× set service ids Nothing found in XML Nothing found in VyOS
ddos-protection Definitions
exclude-network
<h:h:h:h:h:h:h:h/x>
× not yet documented service_ids_ddos- service ids ddos-
protection.xml.in: protection excluded-
service ids ddos- network <value>
protection excluded-
network
✓ set service ids service_ids_ddos- service ids ddos-
ddos-protection protection.xml.in: protection listen-interface
listen-interface service ids ddos- <value>
<text> protection listen-interface
✓ set service ids service_ids_ddos- service ids ddos-
ddos-protection mode protection.xml.in: protection mode <value>
[mirror | sflow] service ids ddos-
protection mode
✓ set service ids service_ids_ddos- service ids ddos-
ddos-protection protection.xml.in: protection network
network service ids ddos- <value>
<h:h:h:h:h:h:h:h/ protection network
x>
✓ set service ids service_ids_ddos- service ids ddos-
ddos-protection protection.xml.in: protection sflow listen-
sflow listen-address service ids ddos- address <value>
<x.x.x.x> protection sflow listen-
address
continues on next page

21.1. Configuration Commands 1839

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set service ids service_ids_ddos- service ids ddos-
ddos-protection protection.xml.in: protection sflow port
sflow port service ids ddos- <value>
<1-65535> protection sflow port
× set service ids Nothing found in XML Nothing found in VyOS
ddos-protection Definitions
threshold general
[fps | mbps | pps]
<0-4294967294>
× not yet documented service_ids_ddos- service ids ddos-
protection.xml.in: protection threshold
service ids ddos- general fps <value>
protection threshold
general fps
× not yet documented service_ids_ddos- service ids ddos-
protection.xml.in: protection threshold
service ids ddos- general mbps <value>
protection threshold
general mbps
× not yet documented service_ids_ddos- service ids ddos-
protection.xml.in: protection threshold
service ids ddos- general pps <value>
protection threshold
general pps
× set service ids Nothing found in XML Nothing found in VyOS
ddos-protection Definitions
threshold icmp
[fps | mbps | pps]
<0-4294967294>
× not yet documented service_ids_ddos- service ids ddos-
protection.xml.in: protection threshold
service ids ddos- icmp fps <value>
protection threshold
icmp fps
× not yet documented service_ids_ddos- service ids ddos-
protection.xml.in: protection threshold
service ids ddos- icmp mbps <value>
protection threshold
icmp mbps
× not yet documented service_ids_ddos- service ids ddos-
protection.xml.in: protection threshold
service ids ddos- icmp pps <value>
protection threshold
icmp pps
× set service ids Nothing found in XML Nothing found in VyOS
ddos-protection Definitions
threshold tcp
[fps | mbps | pps]
<0-4294967294>
continues on next page

21.1. Configuration Commands 1840

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_ids_ddos- service ids ddos-
protection.xml.in: protection threshold
service ids ddos- tcp fps <value>
protection threshold
tcp fps
× not yet documented service_ids_ddos- service ids ddos-
protection.xml.in: protection threshold
service ids ddos- tcp mbps <value>
protection threshold
tcp mbps
× not yet documented service_ids_ddos- service ids ddos-
protection.xml.in: protection threshold
service ids ddos- tcp pps <value>
protection threshold
tcp pps
× set service ids Nothing found in XML Nothing found in VyOS
ddos-protection Definitions
threshold udp
[fps | mbps | pps]
<0-4294967294>
× not yet documented service_ids_ddos- service ids ddos-
protection.xml.in: protection threshold
service ids ddos- udp fps <value>
protection threshold
udp fps
× not yet documented service_ids_ddos- service ids ddos-
protection.xml.in: protection threshold
service ids ddos- udp mbps <value>
protection threshold
udp mbps
× not yet documented service_ids_ddos- service ids ddos-
protection.xml.in: protection threshold
service ids ddos- udp pps <value>
protection threshold
udp pps
× set service Nothing found in XML Nothing found in VyOS
ipoe-server Definitions
authentication
interface
<interface> mac
<MAC>
✓ set service service_ipoe- service ipoe-server au-
ipoe-server server.xml.in: thentication interface
authentication service ipoe-server au- <text> mac <text> rate-
interface thentication interface limit download <value>
<interface> <interface> mac <mac>
mac <MAC> rate-limit download
rate-limit download
<bandwidth>
continues on next page

21.1. Configuration Commands 1841

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set service service_ipoe- service ipoe-server au-
ipoe-server server.xml.in: thentication interface
authentication service ipoe-server au- <text> mac <text> rate-
interface thentication interface limit upload <value>
<interface> mac <interface> mac <mac>
<MAC> rate-limit rate-limit upload
upload <bandwidth>
✓ set service service_ipoe- service ipoe-server au-
ipoe-server server.xml.in: thentication interface
authentication service ipoe-server au- <text> mac <text> vlan
interface thentication interface <value>
<interface> <interface> mac <mac>
mac <MAC> vlan vlan
<vlan-id>
✓ set service service_ipoe- service ipoe-server
ipoe-server server.xml.in: authentication mode
authentication mode service ipoe-server au- <value>
<local | radius> thentication mode
× not yet documented service_ipoe- service ipoe-server
server.xml.in: authentication radius
service ipoe-server accounting-interim-
authentication radius interval <value>
accounting-interim-
interval
× not yet documented service_ipoe- service ipoe-server
server.xml.in: authentication radius acct-
service ipoe-server interim-jitter <value>
authentication radius
acct-interim-jitter
✓ set service service_ipoe- service ipoe-server
ipoe-server server.xml.in: authentication radius
authentication service ipoe-server acct-timeout <value>
radius acct-timeout authentication radius
<timeout> acct-timeout
✓ set service service_ipoe- service ipoe-server
ipoe-server server.xml.in: authentication radius
authentication service ipoe-server dynamic-author key
radius authentication radius <value>
dynamic-author key dynamic-author key
<secret>
✓ set service service_ipoe- service ipoe-server
ipoe-server server.xml.in: authentication radius
authentication service ipoe-server dynamic-author port
radius authentication radius <value>
dynamic-author port dynamic-author port
<port>
continues on next page

21.1. Configuration Commands 1842

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set service service_ipoe- service ipoe-server
ipoe-server server.xml.in: authentication radius
authentication service ipoe-server dynamic-author server
radius authentication radius <value>
dynamic-author dynamic-author server
server <address>
✓ set service service_ipoe- service ipoe-server
ipoe-server server.xml.in: authentication radius
authentication service ipoe-server max-try <value>
radius max-try authentication radius
<number> max-try
✓ set service service_ipoe- service ipoe-server
ipoe-server server.xml.in: authentication radius
authentication service ipoe-server nas-identifier <value>
radius authentication radius
nas-identifier nas-identifier
<identifier>
✓ set service service_ipoe- service ipoe-server
ipoe-server server.xml.in: authentication radius
authentication service ipoe-server nas-ip-address <value>
radius authentication radius
nas-ip-address nas-ip-address
<address>
× not yet documented service_ipoe- service ipoe-server
server.xml.in: authentication radius
service ipoe-server preallocate-vif
authentication radius
preallocate-vif
✓ set service service_ipoe- service ipoe-server
ipoe-server server.xml.in: authentication radius rate-
authentication service ipoe-server limit attribute <value>
radius rate-limit authentication radius
attribute rate-limit attribute
<attribute>
✓ set service service_ipoe- service ipoe-server
ipoe-server server.xml.in: authentication radius
authentication service ipoe-server rate-limit enable
radius rate-limit authentication radius
enable rate-limit enable
× not yet documented service_ipoe- service ipoe-server
server.xml.in: authentication radius
service ipoe-server rate-limit multiplier
authentication radius <value>
rate-limit multiplier
✓ set service service_ipoe- service ipoe-server
ipoe-server server.xml.in: authentication radius
authentication service ipoe-server rate-limit vendor <value>
radius rate-limit authentication radius
vendor rate-limit vendor
continues on next page

21.1. Configuration Commands 1843

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_ipoe- service ipoe-server au-
server.xml.in: thentication radius server
service ipoe-server au- <text> acct-port <value>
thentication radius server
<server> acct-port
✓ set service service_ipoe- service ipoe-server au-
ipoe-server server.xml.in: thentication radius server
authentication service ipoe-server au- <text> disable
radius server thentication radius server
<server> disable <server> disable
× not yet documented service_ipoe- service ipoe-server au-
server.xml.in: thentication radius server
service ipoe-server <text> disable-accounting
authentication radius
server <server> disable-
accounting
✓ set service service_ipoe- service ipoe-server au-
ipoe-server server.xml.in: thentication radius server
authentication service ipoe-server au- <text> fail-time <value>
radius server thentication radius server
<server> fail-time <server> fail-time
<time>
✓ set service service_ipoe- service ipoe-server au-
ipoe-server server.xml.in: thentication radius server
authentication service ipoe-server au- <text> key <value>
radius server thentication radius server
<server> key <server> key
<secret>
✓ set service service_ipoe- service ipoe-server au-
ipoe-server server.xml.in: thentication radius server
authentication service ipoe-server au- <text> port <value>
radius server thentication radius server
<server> port <server> port
<port>
✓ set service service_ipoe- service ipoe-server
ipoe-server server.xml.in: authentication radius
authentication service ipoe-server source-address <value>
radius authentication radius
source-address source-address
<address>
✓ set service service_ipoe- service ipoe-server
ipoe-server server.xml.in: authentication radius
authentication service ipoe-server timeout <value>
radius timeout authentication radius
<timeout> timeout
× not yet documented Nothing found in XML service ipoe-server client-
Definitions ip-pool name <text>
gateway-address <value>
continues on next page

21.1. Configuration Commands 1844

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented Nothing found in XML service ipoe-server client-
Definitions ip-pool name <text> next-
pool <value>
× not yet documented Nothing found in XML service ipoe-server client-
Definitions ip-pool name <text> sub-
net <value>
× set service service_ipoe- Nothing found in VyOS
ipoe-server server.xml.in:
client-ip-pool service ipoe-server client-
<POOL-NAME> ip-pool <client-ip-pool>
next-pool next-pool
<NEXT-POOL-NAME>
× set service service_ipoe- Nothing found in VyOS
ipoe-server server.xml.in:
client-ip-pool service ipoe-server client-
<POOL-NAME> range ip-pool <client-ip-pool>
<x.x.x.x-x.x.x.x | range
x.x.x.x/x>
✓ set service service_ipoe- service ipoe-server client-
ipoe-server server.xml.in: ipv6-pool delegate <text>
client-ipv6-pool service ipoe-server client- delegation-prefix <value>
<IPv6-POOL-NAME> ipv6-pool <client-ipv6-
delegate <address> pool> delegate <delegate>
delegation-prefix delegation-prefix
<number-of-bits>
✓ set service service_ipoe- service ipoe-server client-
ipoe-server server.xml.in: ipv6-pool prefix <text>
client-ipv6-pool service ipoe-server client- mask <value>
<IPv6-POOL-NAME> ipv6-pool <client-ipv6-
prefix pool> prefix <prefix>
<address> mask mask
<number-of-bits>
× set service service_ipoe- Nothing found in VyOS
ipoe-server server.xml.in:
default-ipv6-pool service ipoe-server
<IPv6-POOL-NAME> default-ipv6-pool
× set service service_ipoe- Nothing found in VyOS
ipoe-server server.xml.in:
default-pool service ipoe-server
<POOL-NAME> default-pool
× set service service_ipoe- Nothing found in VyOS
ipoe-server server.xml.in:
description service ipoe-server de-
<description> scription
× set service service_ipoe- Nothing found in VyOS
ipoe-server server.xml.in:
extended-scripts service ipoe-server
on-change extended-scripts on-
<path_to_script> change
continues on next page

21.1. Configuration Commands 1845

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set service service_ipoe- Nothing found in VyOS
ipoe-server server.xml.in:
extended-scripts service ipoe-server
on-down extended-scripts on-down
<path_to_script>
× set service service_ipoe- Nothing found in VyOS
ipoe-server server.xml.in:
extended-scripts service ipoe-server
on-pre-up extended-scripts on-pre-
<path_to_script> up
× set service service_ipoe- Nothing found in VyOS
ipoe-server server.xml.in:
extended-scripts service ipoe-server
on-up extended-scripts on-up
<path_to_script>
× set service service_ipoe- Nothing found in VyOS
ipoe-server server.xml.in:
gateway-address service ipoe-server
<x.x.x.x/x> gateway-address
✓ set service service_ipoe- service ipoe-server inter-
ipoe-server server.xml.in: face <text> client-subnet
interface service ipoe-server <value>
<interface> interface <interface>
client-subnet <x. client-subnet
x.x.x/x>
✓ set service service_ipoe- service ipoe-server inter-
ipoe-server server.xml.in: face <text> external-dhcp
interface service ipoe-server inter- dhcp-relay <value>
<interface> face <interface> external-
external-dhcp dhcp dhcp-relay
dhcp-relay <x.x.
x.x>
✓ set service service_ipoe- service ipoe-server inter-
ipoe-server server.xml.in: face <text> external-dhcp
interface service ipoe-server inter- giaddr <value>
<interface> face <interface> external-
external-dhcp giaddr dhcp giaddr
<x.x.x.x>
✓ set service service_ipoe- service ipoe-server inter-
ipoe-server server.xml.in: face <text> mode <value>
interface service ipoe-server inter-
<interface> mode face <interface> mode
<l2 | l3>
✓ set service service_ipoe- service ipoe-server in-
ipoe-server server.xml.in: terface <text> network
interface service ipoe-server inter- <value>
<interface> network face <interface> network
<shared | vlan>
continues on next page

21.1. Configuration Commands 1846

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_ipoe- service ipoe-server inter-
server.xml.in: face <text> vlan <value>
service ipoe-server inter-
face <interface> vlan
× set service service_ipoe- Nothing found in VyOS
ipoe-server limits server.xml.in:
burst <value> service ipoe-server limits
burst
× set service service_ipoe- Nothing found in VyOS
ipoe-server limits server.xml.in:
connection-limit service ipoe-server limits
<value> connection-limit
× set service service_ipoe- Nothing found in VyOS
ipoe-server limits server.xml.in:
timeout <value> service ipoe-server limits
timeout
× set service service_ipoe- Nothing found in VyOS
ipoe-server server.xml.in:
max-concurrent-sessionsservice ipoe-server max-
concurrent-sessions
✓ set service service_ipoe- service ipoe-server name-
ipoe-server server.xml.in: server <value>
name-server service ipoe-server name-
<address> server
× set service service_ipoe- Nothing found in VyOS
ipoe-server server.xml.in:
shaper fwmark service ipoe-server shaper
<1-2147483647> fwmark
× set service service_ipoe- Nothing found in VyOS
ipoe-server snmp server.xml.in:
master-agent service ipoe-server snmp
master-agent
× set service lldp Nothing found in XML Nothing found in VyOS
Definitions
× set service Nothing found in XML Nothing found in VyOS
lldp interface Definitions
<interface>
✓ set service service_lldp.xml.in: service lldp interface
lldp interface service lldp interface <in- <text> disable
<interface> disable terface> disable
× not yet documented service_lldp.xml.in: service lldp inter-
service lldp interface face <text> location
<interface> location coordinate-based altitude
coordinate-based altitude <value>
× not yet documented service_lldp.xml.in: service lldp inter-
service lldp interface face <text> location
<interface> location coordinate-based datum
coordinate-based datum <value>
continues on next page

21.1. Configuration Commands 1847

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× not yet documented service_lldp.xml.in: service lldp inter-
service lldp interface face <text> location
<interface> location coordinate-based latitude
coordinate-based latitude <value>
× not yet documented service_lldp.xml.in: service lldp inter-
service lldp interface face <text> location
<interface> location coordinate-based longi-
coordinate-based longi- tude <value>
tude
× not yet documented service_lldp.xml.in: service lldp interface
service lldp interface <in- <text> location elin
terface> location elin <value>
× set service lldp Nothing found in XML Nothing found in VyOS
legacy-protocols Definitions
<cdp|edp|fdp|sonmp>
× not yet documented service_lldp.xml.in: service lldp legacy-
service lldp legacy- protocols cdp
protocols cdp
× not yet documented service_lldp.xml.in: service lldp legacy-
service lldp legacy- protocols edp
protocols edp
× not yet documented service_lldp.xml.in: service lldp legacy-
service lldp legacy- protocols fdp
protocols fdp
× not yet documented service_lldp.xml.in: service lldp legacy-
service lldp legacy- protocols sonmp
protocols sonmp
✓ set service lldp service_lldp.xml.in: service lldp management-
management-address service lldp management- address <value>
<address> address
× set service lldp service_lldp.xml.in: Nothing found in VyOS
snmp service lldp snmp
× not yet documented Nothing found in XML service lldp snmp enable
Definitions
✓ set service ser- service mdns repeater
mdns repeater vice_mdns_repeater.xml.in: allow-service <value>
allow-service service mdns repeater
<service> allow-service
✓ set service ser- service mdns repeater
mdns repeater vice_mdns_repeater.xml.in: browse-domain <value>
browse-domain service mdns repeater
<domain> browse-domain
✓ set service mdns ser- service mdns repeater dis-
repeater disable vice_mdns_repeater.xml.in: able
service mdns repeater dis-
able
continues on next page

21.1. Configuration Commands 1848

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set service mdns ser- service mdns repeater in-
repeater interface vice_mdns_repeater.xml.in: terface <value>
<interface> service mdns repeater in-
terface
× set service mdns ser- Nothing found in VyOS
repeater ip-version vice_mdns_repeater.xml.in:
<ipv4 | ipv6 | service mdns repeater ip-
both> version
× not yet documented ser- service mdns repeater
vice_mdns_repeater.xml.in: vrrp-disable
service mdns repeater
vrrp-disable
✓ set service ser- service monitoring tele-
monitoring telegraf vice_monitoring_telegraf.xml.in:
graf azure-data-explorer
azure-data-explorer service monitoring tele- authentication client-id
authentication graf azure-data-explorer <value>
client-id authentication client-id
<client-id>
✓ set service ser- service monitoring tele-
monitoring telegraf vice_monitoring_telegraf.xml.in:
graf azure-data-explorer
azure-data-explorer service monitoring tele- authentication client-
authentication graf azure-data-explorer secret <value>
client-secret authentication client-
<client-secret> secret
✓ set service ser- service monitoring tele-
monitoring telegraf vice_monitoring_telegraf.xml.in:
graf azure-data-explorer
azure-data-explorer service monitoring tele- authentication tenant-id
authentication graf azure-data-explorer <value>
tenant-id authentication tenant-id
<tenant-id>
✓ set service ser- service monitoring tele-
monitoring telegraf vice_monitoring_telegraf.xml.in:
graf azure-data-explorer
azure-data-explorer service monitoring tele- database <value>
database <name> graf azure-data-explorer
database
✓ set service ser- service monitoring tele-
monitoring telegraf vice_monitoring_telegraf.xml.in:
graf azure-data-explorer
azure-data-explorer service monitoring tele- group-metrics <value>
group-metrics graf azure-data-explorer
<single-table | group-metrics
table-per-metric>
✓ set service ser- service monitoring tele-
monitoring telegraf vice_monitoring_telegraf.xml.in:
graf azure-data-explorer
azure-data-explorer service monitoring tele- table <value>
table <name> graf azure-data-explorer
table
continues on next page

21.1. Configuration Commands 1849

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set service ser- service monitoring tele-
monitoring telegraf vice_monitoring_telegraf.xml.in:
graf azure-data-explorer
azure-data-explorer service monitoring tele- url <value>
url <url> graf azure-data-explorer
url
× set service Nothing found in XML Nothing found in VyOS
monitoring telegraf Definitions
bucket <bucket>
✓ set service ser- service monitoring tele-
monitoring vice_monitoring_telegraf.xml.in:
graf influxdb authentica-
telegraf influxdb service monitoring tele- tion organization <value>
authentication graf influxdb authentica-
organization tion organization
<organization>
✓ set service ser- service monitoring tele-
monitoring vice_monitoring_telegraf.xml.in:
graf influxdb authentica-
telegraf influxdb service monitoring tele- tion token <value>
authentication token graf influxdb authentica-
<token> tion token
× not yet documented ser- service monitoring tele-
vice_monitoring_telegraf.xml.in:
graf influxdb bucket
service monitoring tele- <value>
graf influxdb bucket
✓ set service ser- service monitoring tele-
monitoring telegraf vice_monitoring_telegraf.xml.in:
graf influxdb port <value>
influxdb port service monitoring tele-
<port> graf influxdb port
✓ set service ser- service monitoring tele-
monitoring telegraf vice_monitoring_telegraf.xml.in:
graf influxdb url <value>
influxdb url <url> service monitoring tele-
graf influxdb url
× set service Nothing found in XML Nothing found in VyOS
monitoring telegraf Definitions
loki authentication
password <password>
× set service Nothing found in XML Nothing found in VyOS
monitoring telegraf Definitions
loki authentication
username <username>
× set service Nothing found in XML Nothing found in VyOS
monitoring Definitions
telegraf loki
metric-name-label
<label>
× set service Nothing found in XML Nothing found in VyOS
monitoring telegraf Definitions
loki port <port>
continues on next page

21.1. Configuration Commands 1850

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
× set service Nothing found in XML Nothing found in VyOS
monitoring telegraf Definitions
loki url <url>
× set service Nothing found in XML Nothing found in VyOS
monitoring telegraf Definitions
prometheus-client
✓ set service ser- service monitoring tele-
monitoring telegraf vice_monitoring_telegraf.xml.in:
graf prometheus-client
prometheus-client service monitoring tele- allow-from <value>
allow-from <prefix> graf prometheus-client
allow-from
✓ set service ser- service monitoring tele-
monitoring telegraf vice_monitoring_telegraf.xml.in:
graf prometheus-client
prometheus-client service monitoring tele- authentication password
authentication graf prometheus-client au- <value>
password <password> thentication password
✓ set service ser- service monitoring tele-
monitoring telegraf vice_monitoring_telegraf.xml.in:
graf prometheus-client
prometheus-client service monitoring tele- authentication username
authentication graf prometheus-client au- <value>
username <username> thentication username
✓ set service ser- service monitoring tele-
monitoring telegraf vice_monitoring_telegraf.xml.in:
graf prometheus-client
prometheus-client service monitoring tele- listen-address <value>
listen-address graf prometheus-client
<address> listen-address
✓ set service ser- service monitoring tele-
monitoring telegraf vice_monitoring_telegraf.xml.in:
graf prometheus-client
prometheus-client service monitoring tele- metric-version <value>
metric-version <1 | graf prometheus-client
2> metric-version
✓ set service ser- service monitoring tele-
monitoring telegraf vice_monitoring_telegraf.xml.in:
graf prometheus-client
prometheus-client service monitoring tele- port <value>
port <port> graf prometheus-client
port
× not yet documented ser- service monitoring tele-
vice_monitoring_telegraf.xml.in:
graf source <value>
service monitoring tele-
graf source
✓ set service ser- service monitoring tele-
monitoring vice_monitoring_telegraf.xml.in:
graf splunk authentication
telegraf splunk service monitoring tele- insecure
authentication graf splunk authentication
insecure insecure
continues on next page

21.1. Configuration Commands 1851

 VyOS Documentation, Release 1.5.x (circinus)

Table 1 – continued from previous page

Status 2287/7750 Documentation XML in VyOS 1.4-rolling-
202308240020
✓ set service ser- service monitoring tele-
monitoring vice_monitoring_telegraf.xml.in:
graf splunk authentication
telegraf splunk service monitoring tele- token <value>
authentication token graf splunk authentication
<token> token
× set service Nothing found in XML Nothing found in VyOS
monitoring Definitions
telegraf splunk
authentication url
<url>
× no