{"type":"doc","content":[{"type":"paragraph"},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"978dd8c7-012a-48e4-b550-a7e7e790cc6d"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"5b12e5a6-79d2-46a7-b00e-b8e9f16e31e5"}},{"type":"heading","attrs":{"level":1},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"Welcome to the 2105 (May 2021) version of DANOS.","type":"text"}]},{"type":"paragraph","content":[{"text":"The DANOS 2105 release is based upon Debian 10, with the 5.4 version of the Linux Kernel, the 1911 version of DPDK, and the ","type":"text"},{"text":"7.5.1 version of FRR","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/FRRouting/frr/releases/tag/frr-7.5.1"}}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"show version","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[760.0]},"content":[{"type":"codeBlock","content":[{"text":"vyatta@vm-d2105-1:~$ show version\nVersion: 2105\nDescription: DANOS (Inverness) 2105 (DANOS:Shipping:2105:20210611)\nBuilt on: Fri Jun 11 11:58:32 UTC 2021","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Configuration and operational mode commands","type":"text"}]},{"type":"paragraph","content":[{"text":"The full list of configuration commands and operational mode (e.g. “show”) commands are attached to this page.","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Important changes","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reminder about the default username and password","type":"text"}]},{"type":"paragraph","content":[{"text":"The default LiveCD and ONIE image username and password change in the 2005 release from vyatta/vyatta to tmpuser/tmppswd.","type":"text"}]},{"type":"paragraph","content":[{"text":"As part of the installation process, the user has to enter a username and password manually. It is no longer possible to press \"enter\" and accept the default vyatta/vyatta option.","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"New Features","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Enhanced Syslog","type":"text"}]},{"type":"paragraph","content":[{"text":"The Enhanced Syslog feature allows syslog to be configured using a rule-based approach, similar to firewall rules. This provides more flexibility such that more complex expressions can be used to select which messages to discard and select, to which files/hosts those messages are forwarded, as well as rate-limiting based support.","type":"text"}]},{"type":"codeBlock","content":[{"text":"system syslog-enhanced\nsystem syslog-enhanced file \nsystem syslog-enhanced file archive files \nsystem syslog-enhanced file archive size \nsystem syslog-enhanced file filename \nsystem syslog-enhanced host \nsystem syslog-enhanced host hostname \nsystem syslog-enhanced host port \nsystem syslog-enhanced host protocol tcp\nsystem syslog-enhanced host protocol udp\nsystem syslog-enhanced host source-interface \nsystem syslog-enhanced host tls\nsystem syslog-enhanced host tls authentication mode x509/fingerprint\nsystem syslog-enhanced host tls authentication mode x509/name\nsystem syslog-enhanced host tls authentication peers \nsystem syslog-enhanced host tls authentication peers fingerprint \nsystem syslog-enhanced host tls cipher-suite \nsystem syslog-enhanced input journal rate-limit burst \nsystem syslog-enhanced input journal rate-limit interval \nsystem syslog-enhanced rule \nsystem syslog-enhanced rule description \nsystem syslog-enhanced rule disable\nsystem syslog-enhanced rule match facility all\nsystem syslog-enhanced rule match facility auth\nsystem syslog-enhanced rule match facility authpriv\nsystem syslog-enhanced rule match facility cron\nsystem syslog-enhanced rule match facility daemon\nsystem syslog-enhanced rule match facility dataplane\nsystem syslog-enhanced rule match facility kern\nsystem syslog-enhanced rule match facility local0\nsystem syslog-enhanced rule match facility local1\nsystem syslog-enhanced rule match facility local2\nsystem syslog-enhanced rule match facility local3\nsystem syslog-enhanced rule match facility local4\nsystem syslog-enhanced rule match facility local5\nsystem syslog-enhanced rule match facility local6\nsystem syslog-enhanced rule match facility local7\nsystem syslog-enhanced rule match facility lpr\nsystem syslog-enhanced rule match facility mail\nsystem syslog-enhanced rule match facility mark\nsystem syslog-enhanced rule match facility news\nsystem syslog-enhanced rule match facility protocols\nsystem syslog-enhanced rule match facility security\nsystem syslog-enhanced rule match facility sensors\nsystem syslog-enhanced rule match facility syslog\nsystem syslog-enhanced rule match facility user\nsystem syslog-enhanced rule match facility uucp\nsystem syslog-enhanced rule match msg posix-match \nsystem syslog-enhanced rule match msg posix-match unless \nsystem syslog-enhanced rule match severity at-least alert\nsystem syslog-enhanced rule match severity at-least crit\nsystem syslog-enhanced rule match severity at-least debug\nsystem syslog-enhanced rule match severity at-least emerg\nsystem syslog-enhanced rule match severity at-least err\nsystem syslog-enhanced rule match severity at-least info\nsystem syslog-enhanced rule match severity at-least notice\nsystem syslog-enhanced rule match severity at-least warning\nsystem syslog-enhanced rule match severity at-most alert\nsystem syslog-enhanced rule match severity at-most crit\nsystem syslog-enhanced rule match severity at-most debug\nsystem syslog-enhanced rule match severity at-most emerg\nsystem syslog-enhanced rule match severity at-most err\nsystem syslog-enhanced rule match severity at-most info\nsystem syslog-enhanced rule match severity at-most notice\nsystem syslog-enhanced rule match severity at-most warning\nsystem syslog-enhanced rule match severity equals alert\nsystem syslog-enhanced rule match severity equals crit\nsystem syslog-enhanced rule match severity equals debug\nsystem syslog-enhanced rule match severity equals emerg\nsystem syslog-enhanced rule match severity equals err\nsystem syslog-enhanced rule match severity equals info\nsystem syslog-enhanced rule match severity equals notice\nsystem syslog-enhanced rule match severity equals warning\nsystem syslog-enhanced rule match with-flag \nsystem syslog-enhanced rule match without-flag \nsystem syslog-enhanced rule otherwise clear-flag \nsystem syslog-enhanced rule otherwise console\nsystem syslog-enhanced rule otherwise discard\nsystem syslog-enhanced rule otherwise file \nsystem syslog-enhanced rule otherwise host \nsystem syslog-enhanced rule otherwise set-facility all\nsystem syslog-enhanced rule otherwise set-facility auth\nsystem syslog-enhanced rule otherwise set-facility authpriv\nsystem syslog-enhanced rule otherwise set-facility cron\nsystem syslog-enhanced rule otherwise set-facility daemon\nsystem syslog-enhanced rule otherwise set-facility dataplane\nsystem syslog-enhanced rule otherwise set-facility kern\nsystem syslog-enhanced rule otherwise set-facility local0\nsystem syslog-enhanced rule otherwise set-facility local1\nsystem syslog-enhanced rule otherwise set-facility local2\nsystem syslog-enhanced rule otherwise set-facility local3\nsystem syslog-enhanced rule otherwise set-facility local4\nsystem syslog-enhanced rule otherwise set-facility local5\nsystem syslog-enhanced rule otherwise set-facility local6\nsystem syslog-enhanced rule otherwise set-facility local7\nsystem syslog-enhanced rule otherwise set-facility lpr\nsystem syslog-enhanced rule otherwise set-facility mail\nsystem syslog-enhanced rule otherwise set-facility mark\nsystem syslog-enhanced rule otherwise set-facility news\nsystem syslog-enhanced rule otherwise set-facility protocols\nsystem syslog-enhanced rule otherwise set-facility security\nsystem syslog-enhanced rule otherwise set-facility sensors\nsystem syslog-enhanced rule otherwise set-facility syslog\nsystem syslog-enhanced rule otherwise set-facility user\nsystem syslog-enhanced rule otherwise set-facility uucp\nsystem syslog-enhanced rule otherwise set-flag \nsystem syslog-enhanced rule otherwise set-indicator \nsystem syslog-enhanced rule otherwise set-severity alert\nsystem syslog-enhanced rule otherwise set-severity crit\nsystem syslog-enhanced rule otherwise set-severity debug\nsystem syslog-enhanced rule otherwise set-severity emerg\nsystem syslog-enhanced rule otherwise set-severity err\nsystem syslog-enhanced rule otherwise set-severity info\nsystem syslog-enhanced rule otherwise set-severity notice\nsystem syslog-enhanced rule otherwise set-severity warning\nsystem syslog-enhanced rule otherwise user \nsystem syslog-enhanced rule rate-limit \nsystem syslog-enhanced rule rate-limit burst \nsystem syslog-enhanced rule rate-limit interval \nsystem syslog-enhanced rule rate-limit select-every-nth \nsystem syslog-enhanced rule then clear-flag \nsystem syslog-enhanced rule then console\nsystem syslog-enhanced rule then discard\nsystem syslog-enhanced rule then file \nsystem syslog-enhanced rule then host \nsystem syslog-enhanced rule then set-facility all\nsystem syslog-enhanced rule then set-facility auth\nsystem syslog-enhanced rule then set-facility authpriv\nsystem syslog-enhanced rule then set-facility cron\nsystem syslog-enhanced rule then set-facility daemon\nsystem syslog-enhanced rule then set-facility dataplane\nsystem syslog-enhanced rule then set-facility kern\nsystem syslog-enhanced rule then set-facility local0\nsystem syslog-enhanced rule then set-facility local1\nsystem syslog-enhanced rule then set-facility local2\nsystem syslog-enhanced rule then set-facility local3\nsystem syslog-enhanced rule then set-facility local4\nsystem syslog-enhanced rule then set-facility local5\nsystem syslog-enhanced rule then set-facility local6\nsystem syslog-enhanced rule then set-facility local7\nsystem syslog-enhanced rule then set-facility lpr\nsystem syslog-enhanced rule then set-facility mail\nsystem syslog-enhanced rule then set-facility mark\nsystem syslog-enhanced rule then set-facility news\nsystem syslog-enhanced rule then set-facility protocols\nsystem syslog-enhanced rule then set-facility security\nsystem syslog-enhanced rule then set-facility sensors\nsystem syslog-enhanced rule then set-facility syslog\nsystem syslog-enhanced rule then set-facility user\nsystem syslog-enhanced rule then set-facility uucp\nsystem syslog-enhanced rule then set-flag \nsystem syslog-enhanced rule then set-indicator \nsystem syslog-enhanced rule then set-severity alert\nsystem syslog-enhanced rule then set-severity crit\nsystem syslog-enhanced rule then set-severity debug\nsystem syslog-enhanced rule then set-severity emerg\nsystem syslog-enhanced rule then set-severity err\nsystem syslog-enhanced rule then set-severity info\nsystem syslog-enhanced rule then set-severity notice\nsystem syslog-enhanced rule then set-severity warning\nsystem syslog-enhanced rule then user \nsystem syslog-enhanced tls\nsystem syslog-enhanced tls certificate-authority \nsystem syslog-enhanced tls certificate-authority file \nsystem syslog-enhanced tls local-certificate certificate \nsystem syslog-enhanced tls local-certificate key \nsystem syslog-enhanced host routing-instance ","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"ARP Configuration support","type":"text"}]},{"type":"paragraph","content":[{"text":"This feature adds support to allow the ARP cache timeout (ARP timeout or ARP ageing timeout) and the ARP cache size to be configured.","type":"text"}]},{"type":"codeBlock","content":[{"text":"system ip arp stale-time \nsystem ip arp table-size 1024\nsystem ip arp table-size 2048\nsystem ip arp table-size 4096\nsystem ip arp table-size 8192\nsystem ip arp table-size 16384\nsystem ip arp table-size 32768\nsystem ip arp table-size 65536\nsystem ip arp table-size 131072\nsystem ipv6 neighbor table-size 131072","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"NETCONF support for adding copy-config to the candidate configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"This feature adds the ability for a pre-generated configuration to be pushed to the router and have it applied to the candidate datastore via the NETCONF RPC.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Prohibit password reuse","type":"text"}]},{"type":"paragraph","content":[{"text":"This feature adds the ability to prohibit the use of old passwords for the same system account. It only affects local system accounts and not those such as GRUB passwords or TACACS+ accounts. It also enforces password expiry based on a configurable time, thereby forcing users to update their passwords after a given time.","type":"text"}]},{"type":"paragraph","content":[{"text":"Password history and expiration operate on a system-wide level i.e. this policy cannot be enforced on a per user basis.","type":"text"}]},{"type":"codeBlock","content":[{"text":"system password requirements expiration maximum-days \nsystem password requirements history forbid-previous ","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"New DPI applications and protocols","type":"text"}]},{"type":"paragraph","content":[{"text":"Upgrade to use nDPI 3.4, which will introduce support for: anydesk, blookbert, capwap, discord, doh_dot, iec60870, microsoft365, nats, s7comm, soap, teams, websocket, zabbix.","type":"text"}]},{"type":"codeBlock","content":[{"text":"security application firewall name rule engine ndpi name anydesk\nsecurity application firewall name rule engine ndpi name bloomberg\nsecurity application firewall name rule engine ndpi name capwap\nsecurity application firewall name rule engine ndpi name discord\nsecurity application firewall name rule engine ndpi name doh_dot\nsecurity application firewall name rule engine ndpi name iec60870\nsecurity application firewall name rule engine ndpi name microsoft365\nsecurity application firewall name rule engine ndpi name nats\nsecurity application firewall name rule engine ndpi name s7comm\nsecurity application firewall name rule engine ndpi name soap\nsecurity application firewall name rule engine ndpi name teams\nsecurity application firewall name rule engine ndpi name websocket\nsecurity application firewall name rule engine ndpi name zabbix\nsecurity application firewall name rule engine ndpi protocol anydesk\nsecurity application firewall name rule engine ndpi protocol bloomberg\nsecurity application firewall name rule engine ndpi protocol capwap\nsecurity application firewall name rule engine ndpi protocol discord\nsecurity application firewall name rule engine ndpi protocol doh_dot\nsecurity application firewall name rule engine ndpi protocol iec60870\nsecurity application firewall name rule engine ndpi protocol microsoft365\nsecurity application firewall name rule engine ndpi protocol nats\nsecurity application firewall name rule engine ndpi protocol s7comm\nsecurity application firewall name rule engine ndpi protocol soap\nsecurity application firewall name rule engine ndpi protocol teams\nsecurity application firewall name rule engine ndpi protocol websocket\nsecurity application firewall name rule engine ndpi protocol zabbix\nsecurity application firewall name rule engine ndpi type connectivitycheck\nsecurity application firewall name rule engine ndpi type iot_scada","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"DHCP enhancements for switch interfaces","type":"text"}]},{"type":"codeBlock","content":[{"text":"interfaces switch vif dhcp-options no-rfc3442\ninterfaces switch vif dhcpv6-options parameters-only\ninterfaces switch vif dhcpv6-options prefix-delegation\ninterfaces switch vif dhcpv6-options temporary","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"ISIS enhancements","type":"text"}]},{"type":"paragraph","content":[{"text":"IS-IS routing protocol now supports topology and MPLS-TE configuration options, and IS-IS can be applied to a VIF interface.","type":"text"}]},{"type":"codeBlock","content":[{"text":"interfaces dataplane isis topology ipv4-mgmt\ninterfaces dataplane isis topology ipv4-multicast\ninterfaces dataplane isis topology ipv4-unicast\ninterfaces dataplane isis topology ipv6-dstsrc\ninterfaces dataplane isis topology ipv6-mgmt\ninterfaces dataplane isis topology ipv6-multicast\ninterfaces dataplane isis topology ipv6-unicast\ninterfaces loopback isis topology ipv4-mgmt\ninterfaces loopback isis topology ipv4-multicast\ninterfaces loopback isis topology ipv4-unicast\ninterfaces loopback isis topology ipv6-dstsrc\ninterfaces loopback isis topology ipv6-mgmt\ninterfaces loopback isis topology ipv6-multicast\ninterfaces loopback isis topology ipv6-unicast\ninterfaces switch vif ip isis instance \ninterfaces switch vif ipv6 isis instance \ninterfaces switch vif isis circuit-type level-1\ninterfaces switch vif isis circuit-type level-1-2\ninterfaces switch vif isis circuit-type level-2-only\ninterfaces switch vif isis hello-interval level-1 \ninterfaces switch vif isis hello-interval level-2 \ninterfaces switch vif isis metric level-1 \ninterfaces switch vif isis metric level-2 \ninterfaces switch vif isis network point-to-point\ninterfaces switch vif isis passive\ninterfaces switch vif isis password\ninterfaces switch vif isis password clear \ninterfaces switch vif isis password md5 \ninterfaces switch vif isis priority level-1 \ninterfaces switch vif isis priority level-2 \ninterfaces switch vif isis topology ipv4-mgmt\ninterfaces switch vif isis topology ipv4-multicast\ninterfaces switch vif isis topology ipv4-unicast\ninterfaces switch vif isis topology ipv6-dstsrc\ninterfaces switch vif isis topology ipv6-mgmt\ninterfaces switch vif isis topology ipv6-multicast\ninterfaces switch vif isis topology ipv6-unicast\nprotocols isis mpls-te\nprotocols isis mpls-te router-address \nprotocols isis topology ipv4-mgmt\nprotocols isis topology ipv4-mgmt overload\nprotocols isis topology ipv4-multicast\nprotocols isis topology ipv4-multicast overload\nprotocols isis topology ipv4-unicast\nprotocols isis topology ipv4-unicast overload\nprotocols isis topology ipv6-dstsrc\nprotocols isis topology ipv6-dstsrc overload\nprotocols isis topology ipv6-mgmt\nprotocols isis topology ipv6-mgmt overload\nprotocols isis topology ipv6-multicast\nprotocols isis topology ipv6-multicast overload\nprotocols isis topology ipv6-unicast\nprotocols isis topology ipv6-unicast overload","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Support for non-dataplane interfaces","type":"text"}]},{"type":"paragraph","content":[{"text":"Some interfaces do not (yet) have support in DPDK and will be owned by the kernel. They are likely to be used for the management of the system and not for the main packet forwarding functions. The ‘interfaces system’ configuration model provides a method of configuring such interfaces in a manner consistent with the rest of the system. All packet forwarding on such interfaces will occur in the kernel. The configuration available on these interfaces is a significantly smaller subset of the configuration available on interfaces owned by the dataplane.","type":"text"}]},{"type":"codeBlock","content":[{"text":"interfaces system \ninterfaces system address dhcp\ninterfaces system address dhcpv6\ninterfaces system description \ninterfaces system disable\ninterfaces system disable-link-detect\ninterfaces system ip enable-proxy-arp\ninterfaces system ip gratuitous-arp reply drop\ninterfaces system ip gratuitous-arp reply update\ninterfaces system ip gratuitous-arp request drop\ninterfaces system ip gratuitous-arp request update\ninterfaces system ip gratuitous-arp-count \ninterfaces system ip rpf-check disable\ninterfaces system ip rpf-check loose\ninterfaces system ip rpf-check strict\ninterfaces system ipv6 address\ninterfaces system ipv6 address autoconf\ninterfaces system ipv6 address eui64 \ninterfaces system ipv6 address link-local \ninterfaces system ipv6 disable\ninterfaces system ipv6 dup-addr-detect-transmits \ninterfaces system log_martians\ninterfaces system mac \ninterfaces system mtu \ninterfaces system vif \ninterfaces system vif address dhcp\ninterfaces system vif address dhcpv6\ninterfaces system vif description \ninterfaces system vif disable\ninterfaces system vif inner-vlan

Browser not supported