Overview

Welcome to the 2012 (December 2020) version of DANOS.

The DANOS 2012 release is based upon Debian 10, with the 5.4 version of the Linux Kernel, the 1911 version of DPDK, and the 7.4 version of FRR.

show version

user@danos2012:~$ show version
Version:      2012
Description:  DANOS 2012 (DANOS:Shipping:2012:20210114)
Built on:     Thu Jan 14 12:43:42 UTC 2021

Important changes

User Isolation

By default from DANOS 2012, users of "operator" and "admin" levels are logged into a restricted, isolated environment. This environment ensures these users may only interact with the underlying system via the DANOS operational and configuration infrastructure, by using separate IPC, network, mount, PID, and UTS namespaces.

For example, the "ip" utility is not installed in the restricted environment. Even if it were, the separate namespaces would prevent access to, or manipulation of, state of the underlying host system.

Users of the "superuser" level are not placed in an isolated environment. These users should observe no behaviour changes compared to earlier DANOS releases.

We strongly recommend keeping user isolation enabled to improve system security. However, it may be disabled via the configuration:

system login user-isolation disable

BGP behaviour changes

RFC 8212

By default, DANOS 2012 will no longer advertise routes to, or import routes from, eBGP peers unless import and export policies are configured. This default behaviour change is inherited from FRR 7.4 and defined by RFC 8212.

The value "(Policy)" in the output of the BGP summary show command(s) indicates that route import and/or export has been blocked due to a missing policy. For example:

$ show protocols bgp all summary 

IPv4 Unicast Summary:
BGP router identifier 192.168.252.179, local AS number 65000 vrf-id 0
BGP table version 3
RIB entries 5, using 960 bytes of memory
Peers 1, using 21 KiB of memory

Neighbor        V         AS   MsgRcvd   MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd   PfxSnt
10.10.2.2       4      65001         8        10        0    0    0 00:04:17     (Policy) (Policy)

Total number of neighbors 1

Import/export policies can be applied on a neighbor or peer-group basis under the corresponding address-family configuration:

[routing routing-instance <name>] protocols bgp <asn> <peer-group-or-neighbor> address-family <af> distribute-list (import|export) <text>
[routing routing-instance <name>] protocols bgp <asn> <peer-group-or-neighbor> address-family <af> filter-list (import|export) <text>
[routing routing-instance <name>] protocols bgp <asn> <peer-group-or-neighbor> address-family <af> prefix-list (import|export) <text>

Alternatively, the RFC 8212 behaviour can be reverted (to that of previous DANOS/FRR releases) by setting "ebgp-requires-policy" to "disabled":

[routing routing-instance <instance-name>] protocols bgp <asn> parameters ebgp-requires-policy (enabled|disabled)

Network Advertisement

By default, DANOS 2012 will no longer advertise routes which are not present in the RIB. This default behaviour change is inherited from FRR 7.4.

This behaviour can be reverted by setting "import-check" to "disabled":

[routing routing-instance <instance-name>] protocols bgp <asn> parameters network import-check (enabled|disabled)

Reminder about the default username and password

The default LiveCD and ONIE image username and password change in the 2005 release from vyatta/vyatta to tmpuser/tmppswd.

As part of the installation process, the user has to enter a username and password manually. It is no longer possible to press "enter" and accept the default vyatta/vyatta option.

New Features

Enhancements to RSTP and spanning tree

The following configuration options have been added

interfaces bonding <tagnode> switch-group admin-edge
interfaces bonding <tagnode> switch-group auto-edge
interfaces bonding <tagnode> switch-group bpdu-filter
interfaces bonding <tagnode> switch-group bpdu-guard
interfaces bonding <tagnode> switch-group cost <value>
interfaces bonding <tagnode> switch-group cost auto
interfaces bonding <tagnode> switch-group network-port
interfaces bonding <tagnode> switch-group point-to-point auto
interfaces bonding <tagnode> switch-group point-to-point off
interfaces bonding <tagnode> switch-group point-to-point on
interfaces bonding <tagnode> switch-group priority <value>
interfaces bonding <tagnode> switch-group pvst-filter
interfaces bonding <tagnode> switch-group pvst-guard
interfaces bonding <tagnode> switch-group restrict-tcn
interfaces bonding <tagnode> switch-group root-block

which do the following:

admin-edge      Enable Spanning Tree admin edge mode
auto-edge       Enable Spanning Tree automatic admin edge detection
bpdu-filter     Enable the Spanning Tree BPDU filter capability
bpdu-guard      Enable Spanning Tree BPDU guard
cost            Spanning Tree port cost
network-port    Enable Spanning Tree uni-directional link detection
point-to-point  Set point-to-point operational status
priority        Spanning Tree port priority (0 is highest priority)
pvst-filter     Enable the Spanning Tree PVST filter capability
pvst-guard      Enable the Spanning Tree PVST guard capability
restrict-tcn    Restrict propagation of Spanning Tree topology change notifications
root-block      Restrict ports ability to take Spanning Tree root role

L3 ingress and egress stateless ACLs

L3 ingress and egress stateless ACLs operate at the start and end of the packet path. They are different from the current stateless firewall rules because:

  1. The firewall is always stateful, even when only stateless rules exist.

    1. The firewall always reassembles fragments, which entails maintaining state.

    2. The firewall always attempts to match a packet against state entries, before it consults the ruleset.

  2. Reassembly can be triggered by the presence of a firewall, NAT, or PBR.

  3. By default, the presence of NAT state impacts firewall behaviour (firewall always attempts state lookup). This behaviour can be modified with the stateful firewall override functionality defined below.

  4. The firewall can never block router originated packets (which is desired for these L3 ACLs).

The filter action is only to affect L3 packets which are L3 processed. i.e. an L3 packet which is L2 forwarded between links in a VLAN will not be affected by this feature.

The L3 ingress/egress counters can be cleared and accessed using the following command hierarchies. See below for the full set of options.

clear security ip-packet-filter statistics
show security ip-packet-filter statistics

So why use L3 ingress/egress ACLs?

security ip-packet-filter group <group-name> counters
security ip-packet-filter group <group-name> counters count packets
security ip-packet-filter group <group-name> counters sharing per-interface
security ip-packet-filter group <group-name> counters type
security ip-packet-filter group <group-name> counters type auto-per-action
security ip-packet-filter group <group-name> counters type auto-per-action action accept
security ip-packet-filter group <group-name> counters type auto-per-action action drop
security ip-packet-filter group <group-name> counters type auto-per-rule
security ip-packet-filter group <group-name> description <value>
security ip-packet-filter group <group-name> ip-version ipv4
security ip-packet-filter group <group-name> ip-version ipv6
security ip-packet-filter group <group-name> rule <number> action accept
security ip-packet-filter group <group-name> rule <number> action drop
security ip-packet-filter group <group-name> rule <number> description <value>
security ip-packet-filter group <group-name> rule <number> disable
security ip-packet-filter group <group-name> rule <number> match destination ipv4 host <value>
security ip-packet-filter group <group-name> rule <number> match destination ipv4 prefix <value>
security ip-packet-filter group <group-name> rule <number> match destination ipv6 host <value>
security ip-packet-filter group <group-name> rule <number> match destination ipv6 prefix <value>
security ip-packet-filter group <group-name> rule <number> match destination port number <value>
security ip-packet-filter group <group-name> rule <number> match dscp name [ af11 | af12 | af13 | af21 | af22 | af23 | af31 | af32 | af33 | af41 | af42 | af43 ]
security ip-packet-filter group <group-name> rule <number> match dscp name [ cs1 | cs2 | cs3 | cs4 | cs5 | cs6 | cs7 | default | ef | va ]
security ip-packet-filter group <group-name> rule <number> match dscp value <value>
security ip-packet-filter group <group-name> rule <number> match fragment any
security ip-packet-filter group <group-name> rule <number> match icmp name TOS-host-redirect
security ip-packet-filter group <group-name> rule <number> match icmp name TOS-host-unreachable
security ip-packet-filter group <group-name> rule <number> match icmp name TOS-network-redirect
security ip-packet-filter group <group-name> rule <number> match icmp name TOS-network-unreachable
security ip-packet-filter group <group-name> rule <number> match icmp name address-mask-reply
security ip-packet-filter group <group-name> rule <number> match icmp name address-mask-request
security ip-packet-filter group <group-name> rule <number> match icmp name communication-prohibited
security ip-packet-filter group <group-name> rule <number> match icmp name destination-unreachable
security ip-packet-filter group <group-name> rule <number> match icmp name echo-reply
security ip-packet-filter group <group-name> rule <number> match icmp name echo-request
security ip-packet-filter group <group-name> rule <number> match icmp name fragmentation-needed
security ip-packet-filter group <group-name> rule <number> match icmp name host-precedence-violation
security ip-packet-filter group <group-name> rule <number> match icmp name host-prohibited
security ip-packet-filter group <group-name> rule <number> match icmp name host-redirect
security ip-packet-filter group <group-name> rule <number> match icmp name host-unknown
security ip-packet-filter group <group-name> rule <number> match icmp name host-unreachable
security ip-packet-filter group <group-name> rule <number> match icmp name ip-header-bad
security ip-packet-filter group <group-name> rule <number> match icmp name network-prohibited
security ip-packet-filter group <group-name> rule <number> match icmp name network-redirect
security ip-packet-filter group <group-name> rule <number> match icmp name network-unknown
security ip-packet-filter group <group-name> rule <number> match icmp name network-unreachable
security ip-packet-filter group <group-name> rule <number> match icmp name parameter-problem
security ip-packet-filter group <group-name> rule <number> match icmp name port-unreachable
security ip-packet-filter group <group-name> rule <number> match icmp name precedence-cutoff
security ip-packet-filter group <group-name> rule <number> match icmp name protocol-unreachable
security ip-packet-filter group <group-name> rule <number> match icmp name redirect
security ip-packet-filter group <group-name> rule <number> match icmp name required-option-missing
security ip-packet-filter group <group-name> rule <number> match icmp name router-advertisement
security ip-packet-filter group <group-name> rule <number> match icmp name router-solicitation
security ip-packet-filter group <group-name> rule <number> match icmp name source-quench
security ip-packet-filter group <group-name> rule <number> match icmp name source-route-failed
security ip-packet-filter group <group-name> rule <number> match icmp name time-exceeded
security ip-packet-filter group <group-name> rule <number> match icmp name timestamp-reply
security ip-packet-filter group <group-name> rule <number> match icmp name timestamp-request
security ip-packet-filter group <group-name> rule <number> match icmp name ttl-zero-during-reassembly
security ip-packet-filter group <group-name> rule <number> match icmp name ttl-zero-during-transit
security ip-packet-filter group <group-name> rule <number> match icmp type <type-number>
security ip-packet-filter group <group-name> rule <number> match icmp type <type-number> code <value>
security ip-packet-filter group <group-name> rule <number> match icmpv6 class error
security ip-packet-filter group <group-name> rule <number> match icmpv6 class info
security ip-packet-filter group <group-name> rule <number> match icmpv6 name address-unreachable
security ip-packet-filter group <group-name> rule <number> match icmpv6 name bad-header
security ip-packet-filter group <group-name> rule <number> match icmpv6 name communication-prohibited
security ip-packet-filter group <group-name> rule <number> match icmpv6 name destination-unreachable
security ip-packet-filter group <group-name> rule <number> match icmpv6 name echo-reply
security ip-packet-filter group <group-name> rule <number> match icmpv6 name echo-request
security ip-packet-filter group <group-name> rule <number> match icmpv6 name mobile-prefix-advertisement
security ip-packet-filter group <group-name> rule <number> match icmpv6 name mobile-prefix-solicitation
security ip-packet-filter group <group-name> rule <number> match icmpv6 name multicast-listener-done
security ip-packet-filter group <group-name> rule <number> match icmpv6 name multicast-listener-query
security ip-packet-filter group <group-name> rule <number> match icmpv6 name multicast-listener-report
security ip-packet-filter group <group-name> rule <number> match icmpv6 name neighbor-advertisement
security ip-packet-filter group <group-name> rule <number> match icmpv6 name neighbor-solicitation
security ip-packet-filter group <group-name> rule <number> match icmpv6 name no-route
security ip-packet-filter group <group-name> rule <number> match icmpv6 name packet-too-big
security ip-packet-filter group <group-name> rule <number> match icmpv6 name parameter-problem
security ip-packet-filter group <group-name> rule <number> match icmpv6 name port-unreachable
security ip-packet-filter group <group-name> rule <number> match icmpv6 name redirect
security ip-packet-filter group <group-name> rule <number> match icmpv6 name router-advertisement
security ip-packet-filter group <group-name> rule <number> match icmpv6 name router-solicitation
security ip-packet-filter group <group-name> rule <number> match icmpv6 name time-exceeded
security ip-packet-filter group <group-name> rule <number> match icmpv6 name ttl-zero-during-reassembly
security ip-packet-filter group <group-name> rule <number> match icmpv6 name ttl-zero-during-transit
security ip-packet-filter group <group-name> rule <number> match icmpv6 name unknown-header-type
security ip-packet-filter group <group-name> rule <number> match icmpv6 name unknown-option
security ip-packet-filter group <group-name> rule <number> match icmpv6 type <type-number>
security ip-packet-filter group <group-name> rule <number> match icmpv6 type <type-number> code <value>
security ip-packet-filter group <group-name> rule <number> match protocol base name [ dccp | esp | gre | icmp | igmp | ipv6-frag | ipv6-icmp | sctp | tcp | udp | updlite ]
security ip-packet-filter group <group-name> rule <number> match protocol base number <value>
security ip-packet-filter group <group-name> rule <number> match protocol final name [ dccp | esp | gre | icmp | igmp | ipv6-frag | ipv6-icmp | sctp | tcp | udp | updlite ]
security ip-packet-filter group <group-name> rule <number> match protocol final number <value>
security ip-packet-filter group <group-name> rule <number> match source ipv4 host <value>
security ip-packet-filter group <group-name> rule <number> match source ipv4 prefix <value>
security ip-packet-filter group <group-name> rule <number> match source ipv6 host <value>
security ip-packet-filter group <group-name> rule <number> match source ipv6 prefix <value>
security ip-packet-filter group <group-name> rule <number> match source port number <value>
security ip-packet-filter group <group-name> rule <number> match ttl equals <value>
security ip-packet-filter interface <interface-name>
security ip-packet-filter interface <interface-name> in <value>
security ip-packet-filter interface <interface-name> out <value>

BGP enhancements

Some default BGP behaviours have changed in DANOS 2012 (inherited from FRR 7.4). These changes can be reversed by applying the configuration. Please see the "Important Changes" section at the top of the document for further details.

protocols bgp <tagnode> parameters ebgp-requires-policy disabled
protocols bgp <tagnode> parameters ebgp-requires-policy enabled
protocols bgp <tagnode> parameters network import-check disabled
protocols bgp <tagnode> parameters network import-check enabled
routing routing-instance <instance-name> protocols bgp <tagnode> parameters ebgp-requires-policy disabled
routing routing-instance <instance-name> protocols bgp <tagnode> parameters ebgp-requires-policy enabled
routing routing-instance <instance-name> protocols bgp <tagnode> parameters network import-check disabled
routing routing-instance <instance-name> protocols bgp <tagnode> parameters network import-check enabled

IS-IS enhancements

Additional IS-IS functionality has been exposed in the DANOS configuration. Thanks to Niral Networks for their contributions here.

IPv6 Support

interfaces dataplane <tagnode> ipv6 isis instance <value>
interfaces dataplane <tagnode> vif <tagnode> ipv6 isis instance <value>
interfaces loopback <tagnode> ipv6 isis instance <value>

Topologies

interfaces dataplane <tagnode> isis topology ipv4-mgmt
interfaces dataplane <tagnode> isis topology ipv4-multicast
interfaces dataplane <tagnode> isis topology ipv4-unicast
interfaces dataplane <tagnode> isis topology ipv6-dstsrc
interfaces dataplane <tagnode> isis topology ipv6-mgmt
interfaces dataplane <tagnode> isis topology ipv6-multicast
interfaces dataplane <tagnode> isis topology ipv6-unicast
interfaces loopback <tagnode> isis topology ipv4-mgmt
interfaces loopback <tagnode> isis topology ipv4-multicast
interfaces loopback <tagnode> isis topology ipv4-unicast
interfaces loopback <tagnode> isis topology ipv6-dstsrc
interfaces loopback <tagnode> isis topology ipv6-mgmt
interfaces loopback <tagnode> isis topology ipv6-multicast
interfaces loopback <tagnode> isis topology ipv6-unicast

protocols isis <area-tag> topology ipv4-mgmt
protocols isis <area-tag> topology ipv4-mgmt overload
protocols isis <area-tag> topology ipv4-multicast
protocols isis <area-tag> topology ipv4-multicast overload
protocols isis <area-tag> topology ipv4-unicast
protocols isis <area-tag> topology ipv4-unicast overload
protocols isis <area-tag> topology ipv6-dstsrc
protocols isis <area-tag> topology ipv6-dstsrc overload
protocols isis <area-tag> topology ipv6-mgmt
protocols isis <area-tag> topology ipv6-mgmt overload
protocols isis <area-tag> topology ipv6-multicast
protocols isis <area-tag> topology ipv6-multicast overload
protocols isis <area-tag> topology ipv6-unicast
protocols isis <area-tag> topology ipv6-unicast overload

Switch VIF Support

interfaces switch <name> vif <tagnode> ip isis instance <value>
interfaces switch <name> vif <tagnode> ipv6 isis instance <value>
interfaces switch <name> vif <tagnode> isis circuit-type level-1
interfaces switch <name> vif <tagnode> isis circuit-type level-1-2
interfaces switch <name> vif <tagnode> isis circuit-type level-2-only
interfaces switch <name> vif <tagnode> isis hello-interval level-1 <value>
interfaces switch <name> vif <tagnode> isis hello-interval level-2 <value>
interfaces switch <name> vif <tagnode> isis metric level-1 <value>
interfaces switch <name> vif <tagnode> isis metric level-2 <value>
interfaces switch <name> vif <tagnode> isis network point-to-point
interfaces switch <name> vif <tagnode> isis passive
interfaces switch <name> vif <tagnode> isis password
interfaces switch <name> vif <tagnode> isis password clear <value>
interfaces switch <name> vif <tagnode> isis password md5 <value>
interfaces switch <name> vif <tagnode> isis priority level-1 <value>
interfaces switch <name> vif <tagnode> isis priority level-2 <value>
interfaces switch <name> vif <tagnode> isis topology ipv4-mgmt
interfaces switch <name> vif <tagnode> isis topology ipv4-multicast
interfaces switch <name> vif <tagnode> isis topology ipv4-unicast
interfaces switch <name> vif <tagnode> isis topology ipv6-dstsrc
interfaces switch <name> vif <tagnode> isis topology ipv6-mgmt
interfaces switch <name> vif <tagnode> isis topology ipv6-multicast
interfaces switch <name> vif <tagnode> isis topology ipv6-unicast

Traffic Engineering

protocols isis <area-tag> mpls-te
protocols isis <area-tag> mpls-te router-address <value>

Stateful firewall override

This feature allows SNAT/DNAT rules to be configured to not automatically install a pinhole for return traffic matching the NAT sessions.  This means a user can have a firewall configuration that affects traffic matching a NAT session.

service nat destination explicit-firewall-pinhole
service nat destination rule <tagnode> firewall-pinhole
service nat source explicit-firewall-pinhole
service nat source rule <tagnode> firewall-pinhole

User isolation in a restricted environment

Please see the "Important Changes" section at the top of this document for an overview of the user isolation functionality.

User isolation may be disabled using the below command.

system login user-isolation disable

With user-isolation enabled the underlying system's directories aren't accessible to operator and admin-level users. This causes a problem for the admin-level users that may need to retain files across system reboots and upgrades.

The shared-storage configuration can define virtual storage mounted on directories accessible to the isolated operator and admin-level users. At the time of configuration, these directories must be empty. Users should log out from all of their login sessions for these configurations to take effect.

These shared directories are created as a virtual filesystem backed up by a file in the underlying file system. The filename is derived from the shared directory name.

system login user-isolation shared-storage <path>
system login user-isolation shared-storage <path> allow-exec
system login user-isolation shared-storage <path> size <value>

Allow isolated users read-only access to directories via the "copy file" and "show file" operational mode commands.

system login user-isolation read-only-directory <value>

Storage block device configuration

Scheduler

I/O schedulers attempt to improve throughput by reordering request access into a linear order based on the logical addresses of the data and trying to group these together. While this may increase overall throughput, it may lead to some I/O requests waiting for too long, causing latency issues. I/O schedulers attempt to balance the need for high throughput while sharing I/O requests amongst processes fairly.

Configuration is now provided to allow particular schedulers to be used for the block devices attached to the system.

system storage block-device <name> scheduler deadline
system storage block-device <name> scheduler none

To view scheduler information for the block devices attached to the system, use the following new operational mode command:

show system storage block-device

Periodic TRIM

fstrim is used on a mounted filesystem to discard (or "trim") blocks which are not in use by the filesystem. This is useful for solid-state drives (SSDs) and thinly-provisioned storage. By default, fstrim will discard all unused blocks in the filesystem.

The configuration is now provided to enable periodic trimming of the filesystem.

system storage block-device <name> discard-unused-blocks
system storage block-device <name> discard-unused-blocks repeat-interval daily
system storage block-device <name> discard-unused-blocks repeat-interval hourly
system storage block-device <name> discard-unused-blocks repeat-interval monthly
system storage block-device <name> discard-unused-blocks repeat-interval weekly
system storage block-device <name> discard-unused-blocks start-time <value>

A TRIM operation can also be run on-demand, using the following new operational mode command:

clear block-device <block-device-name | all> unused-blocks

TACACS+

Command Accounting Start Records

When enabled, a TACACS+ command accounting record is issued, with a start_time attribute, before a modelled NOS command being executed.

system tacplus-options accounting command-start-records

In addition, command accounting stop records now also include the corresponding start_time attribute. This happens regardless of whether "command-start-records" has been enabled.

Debug Logs

TACACS+ debugging logs are no longer emitted by default in DANOS 2012. Use the below configuration to re-enable the logs.

system tacplus-options log debug

Offline Timer

Use this command to define the minimum period during which the system will not perform any TACACS+ transactions following failure.

The offline period is triggered following a failure to connect to all TACACS+ servers. This can be due to either failed connection attempts, or because all configured servers have an active hold-down timer while attempting to connect to a server, or a combination.

When the running offline timer expires, the system will once again attempt to perform TACACS+ transactions. In most cases, the TACACS+ login provider will request a connection check immediately after the timer expires. If this succeeds the local fallback user login is once again locked (if TACACS+ login is enforced via the auth-chain configuration). Otherwise, a failure will cause the offline timer to be restarted, and the TACACS+ component will enter offline mode again.

system tacplus-options offline-timer <value>

The global offline timer, and all per-server hold down timers, maybe reset with the below operational mode command:

reset system tacplus suppression-timers

Disable Server

Use this command to prevent the use of a given TACACS+ server for any TACACS+ transaction.

A server which has been disabled will not appear in the output of the "show system tacplus status" operational mode command.

system login tacplus-server <tagnode> disable
routing routing-instance <instance-name> system login tacplus-server <tagnode> disable

Global Server Parameters

Use this command to define the TCP port used for communications with all configured TACACS+ servers.

The value configured here can be overridden on a per-server basis using the existing "system login tacplus-server <address> port <port>" configuration.

system tacplus-options server port <value>

Use this command to define the secret key used to obfuscate communications with all configured TACACS+ servers.

The value configured here can be overridden on a per-server basis using the existing "system login tacplus-server <address> secret <key>" configuration.

system tacplus-options server secret <value>

Use this command to define the timeout to be used for communications with all configured TACACS+ servers.

The value configured here can be overridden on a per-server basis using the existing "system login tacplus-server <address> timeout <timeout>" configuration.

Long timeouts should generally not be used, to avoid sluggish system response for users.

If long timeouts are used, it is strongly recommended to use hold-down timers and/or the offline-timer.

system tacplus-options server timeout <value>

Obsolete features

VRRP translation scripts

Support of custom VRRP transition scripts has been removed from this release.  Transition scripts are a security issue and have been replaced with notify and DBus signals. 

interfaces bonding <tagnode> vif <tagnode> vrrp vrrp-group <tagnode> run-transition-scripts
interfaces bonding <tagnode> vif <tagnode> vrrp vrrp-group <tagnode> run-transition-scripts backup <value>
interfaces bonding <tagnode> vif <tagnode> vrrp vrrp-group <tagnode> run-transition-scripts fault <value>
interfaces bonding <tagnode> vif <tagnode> vrrp vrrp-group <tagnode> run-transition-scripts master <value>
interfaces bonding <tagnode> vrrp vrrp-group <tagnode> run-transition-scripts
interfaces bonding <tagnode> vrrp vrrp-group <tagnode> run-transition-scripts backup <value>
interfaces bonding <tagnode> vrrp vrrp-group <tagnode> run-transition-scripts fault <value>
interfaces bonding <tagnode> vrrp vrrp-group <tagnode> run-transition-scripts master <value>
interfaces dataplane <tagnode> vif <tagnode> vrrp vrrp-group <tagnode> run-transition-scripts
interfaces dataplane <tagnode> vif <tagnode> vrrp vrrp-group <tagnode> run-transition-scripts backup <value>
interfaces dataplane <tagnode> vif <tagnode> vrrp vrrp-group <tagnode> run-transition-scripts fault <value>
interfaces dataplane <tagnode> vif <tagnode> vrrp vrrp-group <tagnode> run-transition-scripts master <value>
interfaces dataplane <tagnode> vrrp vrrp-group <tagnode> run-transition-scripts
interfaces dataplane <tagnode> vrrp vrrp-group <tagnode> run-transition-scripts backup <value>
interfaces dataplane <tagnode> vrrp vrrp-group <tagnode> run-transition-scripts fault <value>
interfaces dataplane <tagnode> vrrp vrrp-group <tagnode> run-transition-scripts master <value>
interfaces switch <name> vif <tagnode> vrrp vrrp-group <tagnode> run-transition-scripts
interfaces switch <name> vif <tagnode> vrrp vrrp-group <tagnode> run-transition-scripts backup <value>
interfaces switch <name> vif <tagnode> vrrp vrrp-group <tagnode> run-transition-scripts fault <value>
interfaces switch <name> vif <tagnode> vrrp vrrp-group <tagnode> run-transition-scripts master <value>

Operational command changes

Dataplane sessions

These commands complement the existing show session table commands, and in the future may replace them.

It is now possible to clear sessions based on the source address/port, destination address/port, translation address/port, direction, interface, protocol and feature (alg, application, dnat, firewall, nat46, nat64, other, snat).

The show commands allow sorting of the output using the "ascending" and "descending" options. Filtering of the output can be done by source address/port, destination address/port, translation address/port, direction, interface, protocol and feature (alg, application, dnat, firewall, nat46, nat64, other, snat).

Note that CGNAT does not use "dataplane" sessions. The separate clear cgnat session and show cgnat session commands should be used.

clear dataplane session
clear dataplane session destination address <value>
clear dataplane session destination port <value>
clear dataplane session direction in
clear dataplane session direction out
clear dataplane session feature [ alg | application | dnat | firewall | nat46 | nat64 | other | snat ]
clear dataplane session id <value>
clear dataplane session interface <value>
clear dataplane session ip
clear dataplane session ip6
clear dataplane session protocol <value>
clear dataplane session source address <value>
clear dataplane session source port <value>
clear dataplane session translation address <value>
clear dataplane session translation port <value>
show dataplane session
show dataplane session ascending destination-address
show dataplane session ascending id
show dataplane session ascending source-address
show dataplane session ascending timeout
show dataplane session ascending translation-address
show dataplane session brief
show dataplane session count <value>
show dataplane session descending destination-address
show dataplane session descending id
show dataplane session descending source-address
show dataplane session descending timeout
show dataplane session descending translation-address
show dataplane session destination address <value>
show dataplane session destination port <value>
show dataplane session detail
show dataplane session direction in
show dataplane session direction out
show dataplane session feature [ alg | application | dnat | firewall | nat46 | nat64 | other | snat ]
show dataplane session id <value>
show dataplane session interface <value>
show dataplane session ip
show dataplane session ip6
show dataplane session protocol <value>
show dataplane session source address <value>
show dataplane session source port <value>
show dataplane session starting-with address <value>
show dataplane session starting-with id <value>
show dataplane session starting-with timeout <value>
show dataplane session summary
show dataplane session translation address <value>
show dataplane session translation port <value>
show dataplane session unordered

L3 ingress and egress stateless ACLs

The following commands allow the viewing and clearing of the L3 ingress/egress stateless ACLs.

clear security ip-packet-filter statistics interface <if-name>
clear security ip-packet-filter statistics interface <if-name> direction [ in | out ]
clear security ip-packet-filter statistics interface <if-name> direction [ in | out ] group <group-name>
show security ip-packet-filter statistics action [ accept | drop | punt | reject ]
show security ip-packet-filter statistics direction [ in | out ]
show security ip-packet-filter statistics group <group-name>
show security ip-packet-filter statistics group <group-name> rule <rule-number>
show security ip-packet-filter statistics interface <if-name>

VRRP

The "group" keyword has been removed from the "show vrrp sync-group" command.

show vrrp sync-group group <value>
show vrrp sync-group <sync-group-name>

Resolved Security Vulnerabilities

The following security issues are resolved in this release: