{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"978dd8c7-012a-48e4-b550-a7e7e790cc6d"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}}}},{"type":"heading","attrs":{"level":1},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"Welcome to the 2012 (December 2020) version of DANOS.","type":"text"}]},{"type":"paragraph","content":[{"text":"The DANOS 2012 release is based upon Debian 10, with the 5.4 version of the Linux Kernel, the 1911 version of DPDK, and the ","type":"text"},{"text":"7.4 version of FRR","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/FRRouting/frr/releases/tag/frr-7.4"}}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"show version","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"user@danos2012:~$ show version\nVersion: 2012\nDescription: DANOS 2012 (DANOS:Shipping:2012:20210114)\nBuilt on: Thu Jan 14 12:43:42 UTC 2021","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Important changes","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"User Isolation","type":"text"}]},{"type":"paragraph","content":[{"text":"By default from DANOS 2012, users of \"operator\" and \"admin\" levels are logged into a restricted, isolated environment. This environment ensures these users may only interact with the underlying system via the DANOS operational and configuration infrastructure, by using separate IPC, network, mount, PID, and UTS namespaces.","type":"text"}]},{"type":"paragraph","content":[{"text":"For example, the \"ip\" utility is not installed in the restricted environment. Even if it were, the separate namespaces would prevent access to, or manipulation of, state of the underlying host system.","type":"text"}]},{"type":"paragraph","content":[{"text":"Users of the \"superuser\" level are ","type":"text"},{"text":"not ","type":"text","marks":[{"type":"em"}]},{"text":"placed in an isolated environment. These users should observe no behaviour changes compared to earlier DANOS releases.","type":"text"}]},{"type":"paragraph","content":[{"text":"We strongly recommend keeping user isolation enabled to improve system security. However, it may be disabled via the configuration:","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"system login user-isolation disable","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"BGP behaviour changes","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"RFC 8212","type":"text"}]},{"type":"paragraph","content":[{"text":"By default, DANOS 2012 will no longer advertise routes to, or import routes from, eBGP peers unless import and export policies are configured. This default behaviour change is inherited from ","type":"text"},{"text":"FRR 7.4","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/FRRouting/frr/releases/tag/frr-7.4"}}]},{"text":" and defined by ","type":"text"},{"text":"RFC 8212","type":"text","marks":[{"type":"link","attrs":{"href":"https://tools.ietf.org/html/rfc8212"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"The value \"(Policy)\" in the output of the BGP summary show command(s) indicates that route import and/or export has been blocked due to a missing policy. For example:","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"$ show protocols bgp all summary \n\nIPv4 Unicast Summary:\nBGP router identifier 192.168.252.179, local AS number 65000 vrf-id 0\nBGP table version 3\nRIB entries 5, using 960 bytes of memory\nPeers 1, using 21 KiB of memory\n\nNeighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt\n10.10.2.2 4 65001 8 10 0 0 0 00:04:17 (Policy) (Policy)\n\nTotal number of neighbors 1","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Import/export policies can be applied on a neighbor or peer-group basis under the corresponding address-family configuration:","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"[routing routing-instance ] protocols bgp

address-family distribute-list (import|export) \n[routing routing-instance ] protocols bgp

address-family filter-list (import|export) \n[routing routing-instance ] protocols bgp

address-family prefix-list (import|export) ","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Alternatively, the RFC 8212 behaviour can be reverted (to that of previous DANOS/FRR releases) by setting \"ebgp-requires-policy\" to \"disabled\":","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"[routing routing-instance ] protocols bgp parameters ebgp-requires-policy (enabled|disabled)","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Network Advertisement","type":"text"}]},{"type":"paragraph","content":[{"text":"By default, DANOS 2012 will no longer advertise routes which are not present in the RIB. This default behaviour change is inherited from ","type":"text"},{"text":"FRR 7.4","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/FRRouting/frr/releases/tag/frr-7.4"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"This behaviour can be reverted by setting \"import-check\" to \"disabled\":","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"[routing routing-instance ] protocols bgp parameters network import-check (enabled|disabled)","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reminder about the default username and password","type":"text"}]},{"type":"paragraph","content":[{"text":"The default LiveCD and ONIE image username and password change in the 2005 release from vyatta/vyatta to tmpuser/tmppswd.","type":"text"}]},{"type":"paragraph","content":[{"text":"As part of the installation process, the user has to enter a username and password manually. It is no longer possible to press \"enter\" and accept the default vyatta/vyatta option.","type":"text"}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"New Features","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Enhancements to RSTP and spanning tree","type":"text"}]},{"type":"paragraph","content":[{"text":"The following configuration options have been added","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"interfaces bonding switch-group admin-edge\ninterfaces bonding switch-group auto-edge\ninterfaces bonding switch-group bpdu-filter\ninterfaces bonding switch-group bpdu-guard\ninterfaces bonding switch-group cost \ninterfaces bonding switch-group cost auto\ninterfaces bonding switch-group network-port\ninterfaces bonding switch-group point-to-point auto\ninterfaces bonding switch-group point-to-point off\ninterfaces bonding switch-group point-to-point on\ninterfaces bonding switch-group priority \ninterfaces bonding switch-group pvst-filter\ninterfaces bonding switch-group pvst-guard\ninterfaces bonding switch-group restrict-tcn\ninterfaces bonding switch-group root-block","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"which do the following:","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"admin-edge Enable Spanning Tree admin edge mode\nauto-edge Enable Spanning Tree automatic admin edge detection\nbpdu-filter Enable the Spanning Tree BPDU filter capability\nbpdu-guard Enable Spanning Tree BPDU guard\ncost Spanning Tree port cost\nnetwork-port Enable Spanning Tree uni-directional link detection\npoint-to-point Set point-to-point operational status\npriority Spanning Tree port priority (0 is highest priority)\npvst-filter Enable the Spanning Tree PVST filter capability\npvst-guard Enable the Spanning Tree PVST guard capability\nrestrict-tcn Restrict propagation of Spanning Tree topology change notifications\nroot-block Restrict ports ability to take Spanning Tree root role","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"L3 ingress and egress stateless ACLs","type":"text"}]},{"type":"paragraph","content":[{"text":"L3 ingress and egress stateless ACLs operate at the start and end of the packet path. They are different from the current stateless firewall rules because:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The firewall is always stateful, even when only stateless rules exist.","type":"text"},{"type":"hardBreak"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The firewall always reassembles fragments, which entails maintaining state.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The firewall always attempts to match a packet against state entries, before it consults the ruleset.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Reassembly can be triggered by the presence of a firewall, NAT, or PBR.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"By default, the presence of NAT state impacts firewall behaviour (firewall always attempts state lookup). This behaviour can be modified with the stateful firewall override functionality defined below.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The firewall can never block router originated packets (which is desired for these L3 ACLs).","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"The filter action is only to affect L3 packets which are L3 processed. i.e. an L3 packet which is L2 forwarded between links in a VLAN will not be affected by this feature.","type":"text"}]},{"type":"paragraph","content":[{"text":"The L3 ingress/egress counters can be cleared and accessed using the following command hierarchies. See below for the full set of options.","type":"text"}]},{"type":"codeBlock","content":[{"text":"clear security ip-packet-filter statistics\nshow security ip-packet-filter statistics","type":"text"}]},{"type":"paragraph","content":[{"text":"So why use L3 ingress/egress ACLs?","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Ingress ACLs are processed very early in the packet path, so the performance of drop actions will be superior compared to stateless firewall rules.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Egress ACLs can block router originated traffic.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Ingress and Egress ACLs can be expressed in named groups, making the construction and documentation of complex rules simpler.","type":"text"}]}]}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"security ip-packet-filter group counters\nsecurity ip-packet-filter group counters count packets\nsecurity ip-packet-filter group counters sharing per-interface\nsecurity ip-packet-filter group counters type\nsecurity ip-packet-filter group counters type auto-per-action\nsecurity ip-packet-filter group counters type auto-per-action action accept\nsecurity ip-packet-filter group counters type auto-per-action action drop\nsecurity ip-packet-filter group counters type auto-per-rule\nsecurity ip-packet-filter group description \nsecurity ip-packet-filter group ip-version ipv4\nsecurity ip-packet-filter group ip-version ipv6\nsecurity ip-packet-filter group rule action accept\nsecurity ip-packet-filter group rule action drop\nsecurity ip-packet-filter group rule description \nsecurity ip-packet-filter group rule disable\nsecurity ip-packet-filter group rule match destination ipv4 host \nsecurity ip-packet-filter group rule match destination ipv4 prefix \nsecurity ip-packet-filter group rule match destination ipv6 host \nsecurity ip-packet-filter group rule match destination ipv6 prefix \nsecurity ip-packet-filter group rule match destination port number \nsecurity ip-packet-filter group rule match dscp name [ af11 | af12 | af13 | af21 | af22 | af23 | af31 | af32 | af33 | af41 | af42 | af43 ]\nsecurity ip-packet-filter group rule match dscp name [ cs1 | cs2 | cs3 | cs4 | cs5 | cs6 | cs7 | default | ef | va ]\nsecurity ip-packet-filter group rule match dscp value \nsecurity ip-packet-filter group rule match fragment any\nsecurity ip-packet-filter group rule match icmp name TOS-host-redirect\nsecurity ip-packet-filter group rule match icmp name TOS-host-unreachable\nsecurity ip-packet-filter group rule match icmp name TOS-network-redirect\nsecurity ip-packet-filter group rule match icmp name TOS-network-unreachable\nsecurity ip-packet-filter group rule match icmp name address-mask-reply\nsecurity ip-packet-filter group rule match icmp name address-mask-request\nsecurity ip-packet-filter group rule match icmp name communication-prohibited\nsecurity ip-packet-filter group rule match icmp name destination-unreachable\nsecurity ip-packet-filter group rule match icmp name echo-reply\nsecurity ip-packet-filter group rule match icmp name echo-request\nsecurity ip-packet-filter group rule match icmp name fragmentation-needed\nsecurity ip-packet-filter group rule match icmp name host-precedence-violation\nsecurity ip-packet-filter group rule match icmp name host-prohibited\nsecurity ip-packet-filter group rule match icmp name host-redirect\nsecurity ip-packet-filter group rule match icmp name host-unknown\nsecurity ip-packet-filter group rule match icmp name host-unreachable\nsecurity ip-packet-filter group rule match icmp name ip-header-bad\nsecurity ip-packet-filter group rule match icmp name network-prohibited\nsecurity ip-packet-filter group rule match icmp name network-redirect\nsecurity ip-packet-filter group rule match icmp name network-unknown\nsecurity ip-packet-filter group rule match icmp name network-unreachable\nsecurity ip-packet-filter group rule match icmp name parameter-problem\nsecurity ip-packet-filter group rule match icmp name port-unreachable\nsecurity ip-packet-filter group rule match icmp name precedence-cutoff\nsecurity ip-packet-filter group rule match icmp name protocol-unreachable\nsecurity ip-packet-filter group rule match icmp name redirect\nsecurity ip-packet-filter group rule match icmp name required-option-missing\nsecurity ip-packet-filter group rule match icmp name router-advertisement\nsecurity ip-packet-filter group rule match icmp name router-solicitation\nsecurity ip-packet-filter group rule match icmp name source-quench\nsecurity ip-packet-filter group rule match icmp name source-route-failed\nsecurity ip-packet-filter group rule match icmp name time-exceeded\nsecurity ip-packet-filter group rule match icmp name timestamp-reply\nsecurity ip-packet-filter group rule match icmp name timestamp-request\nsecurity ip-packet-filter group rule match icmp name ttl-zero-during-reassembly\nsecurity ip-packet-filter group rule match icmp name ttl-zero-during-transit\nsecurity ip-packet-filter group rule match icmp type \nsecurity ip-packet-filter group rule match icmp type code \nsecurity ip-packet-filter group rule match icmpv6 class error\nsecurity ip-packet-filter group rule match icmpv6 class info\nsecurity ip-packet-filter group rule match icmpv6 name address-unreachable\nsecurity ip-packet-filter group rule match icmpv6 name bad-header\nsecurity ip-packet-filter group rule match icmpv6 name communication-prohibited\nsecurity ip-packet-filter group rule match icmpv6 name destination-unreachable\nsecurity ip-packet-filter group rule match icmpv6 name echo-reply\nsecurity ip-packet-filter group rule match icmpv6 name echo-request\nsecurity ip-packet-filter group rule match icmpv6 name mobile-prefix-advertisement\nsecurity ip-packet-filter group rule match icmpv6 name mobile-prefix-solicitation\nsecurity ip-packet-filter group rule match icmpv6 name multicast-listener-done\nsecurity ip-packet-filter group rule match icmpv6 name multicast-listener-query\nsecurity ip-packet-filter group rule match icmpv6 name multicast-listener-report\nsecurity ip-packet-filter group rule match icmpv6 name neighbor-advertisement\nsecurity ip-packet-filter group rule match icmpv6 name neighbor-solicitation\nsecurity ip-packet-filter group rule match icmpv6 name no-route\nsecurity ip-packet-filter group rule match icmpv6 name packet-too-big\nsecurity ip-packet-filter group rule match icmpv6 name parameter-problem\nsecurity ip-packet-filter group rule match icmpv6 name port-unreachable\nsecurity ip-packet-filter group rule match icmpv6 name redirect\nsecurity ip-packet-filter group rule match icmpv6 name router-advertisement\nsecurity ip-packet-filter group rule match icmpv6 name router-solicitation\nsecurity ip-packet-filter group rule match icmpv6 name time-exceeded\nsecurity ip-packet-filter group rule match icmpv6 name ttl-zero-during-reassembly\nsecurity ip-packet-filter group rule match icmpv6 name ttl-zero-during-transit\nsecurity ip-packet-filter group rule match icmpv6 name unknown-header-type\nsecurity ip-packet-filter group rule match icmpv6 name unknown-option\nsecurity ip-packet-filter group rule match icmpv6 type \nsecurity ip-packet-filter group rule match icmpv6 type code \nsecurity ip-packet-filter group rule match protocol base name [ dccp | esp | gre | icmp | igmp | ipv6-frag | ipv6-icmp | sctp | tcp | udp | updlite ]\nsecurity ip-packet-filter group rule match protocol base number \nsecurity ip-packet-filter group rule match protocol final name [ dccp | esp | gre | icmp | igmp | ipv6-frag | ipv6-icmp | sctp | tcp | udp | updlite ]\nsecurity ip-packet-filter group rule match protocol final number \nsecurity ip-packet-filter group rule match source ipv4 host \nsecurity ip-packet-filter group rule match source ipv4 prefix \nsecurity ip-packet-filter group rule match source ipv6 host \nsecurity ip-packet-filter group rule match source ipv6 prefix \nsecurity ip-packet-filter group rule match source port number \nsecurity ip-packet-filter group rule match ttl equals \nsecurity ip-packet-filter interface \nsecurity ip-packet-filter interface in \nsecurity ip-packet-filter interface out ","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"BGP enhancements","type":"text"}]},{"type":"paragraph","content":[{"text":"Some default BGP behaviours have changed in DANOS 2012 (inherited from FRR 7.4). These changes can be reversed by applying the configuration. Please see the \"Important Changes\" section at the top of the document for further details.","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"protocols bgp parameters ebgp-requires-policy disabled\nprotocols bgp parameters ebgp-requires-policy enabled\nprotocols bgp parameters network import-check disabled\nprotocols bgp parameters network import-check enabled\nrouting routing-instance protocols bgp parameters ebgp-requires-policy disabled\nrouting routing-instance protocols bgp parameters ebgp-requires-policy enabled\nrouting routing-instance protocols bgp parameters network import-check disabled\nrouting routing-instance protocols bgp parameters network import-check enabled","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"IS-IS enhancements","type":"text"}]},{"type":"paragraph","content":[{"text":"Additional IS-IS functionality has been exposed in the DANOS configuration. Thanks to ","type":"text"},{"text":"Niral Networks","type":"text","marks":[{"type":"link","attrs":{"href":"https://niralnetworks.com/"}}]},{"text":" for their contributions here.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"IPv6 Support","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"interfaces dataplane ipv6 isis instance \ninterfaces dataplane vif ipv6 isis instance \ninterfaces loopback ipv6 isis instance ","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Topologies","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"interfaces dataplane isis topology ipv4-mgmt\ninterfaces dataplane isis topology ipv4-multicast\ninterfaces dataplane isis topology ipv4-unicast\ninterfaces dataplane isis topology ipv6-dstsrc\ninterfaces dataplane isis topology ipv6-mgmt\ninterfaces dataplane isis topology ipv6-multicast\ninterfaces dataplane isis topology ipv6-unicast\ninterfaces loopback isis topology ipv4-mgmt\ninterfaces loopback isis topology ipv4-multicast\ninterfaces loopback isis topology ipv4-unicast\ninterfaces loopback isis topology ipv6-dstsrc\ninterfaces loopback isis topology ipv6-mgmt\ninterfaces loopback isis topology ipv6-multicast\ninterfaces loopback isis topology ipv6-unicast\n\nprotocols isis topology ipv4-mgmt\nprotocols isis topology ipv4-mgmt overload\nprotocols isis topology ipv4-multicast\nprotocols isis topology ipv4-multicast overload\nprotocols isis topology ipv4-unicast\nprotocols isis topology ipv4-unicast overload\nprotocols isis topology ipv6-dstsrc\nprotocols isis topology ipv6-dstsrc overload\nprotocols isis topology ipv6-mgmt\nprotocols isis topology ipv6-mgmt overload\nprotocols isis topology ipv6-multicast\nprotocols isis topology ipv6-multicast overload\nprotocols isis topology ipv6-unicast\nprotocols isis topology ipv6-unicast overload","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Switch VIF Support","type":"text"},{"type":"hardBreak"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"interfaces switch vif ip isis instance \ninterfaces switch vif ipv6 isis instance \ninterfaces switch vif isis circuit-type level-1\ninterfaces switch vif isis circuit-type level-1-2\ninterfaces switch vif isis circuit-type level-2-only\ninterfaces switch vif isis hello-interval level-1 \ninterfaces switch vif isis hello-interval level-2 \ninterfaces switch vif isis metric level-1 \ninterfaces switch vif isis metric level-2 \ninterfaces switch vif isis network point-to-point\ninterfaces switch vif isis passive\ninterfaces switch vif isis password\ninterfaces switch vif isis password clear \ninterfaces switch vif isis password md5 \ninterfaces switch vif isis priority level-1 \ninterfaces switch vif isis priority level-2 \ninterfaces switch vif isis topology ipv4-mgmt\ninterfaces switch vif isis topology ipv4-multicast\ninterfaces switch vif isis topology ipv4-unicast\ninterfaces switch vif isis topology ipv6-dstsrc\ninterfaces switch vif isis topology ipv6-mgmt\ninterfaces switch vif isis topology ipv6-multicast\ninterfaces switch vif isis topology ipv6-unicast","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Traffic Engineering","type":"text"},{"type":"hardBreak"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"protocols isis mpls-te\nprotocols isis mpls-te router-address ","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Stateful firewall override","type":"text"}]},{"type":"paragraph","content":[{"text":"This feature allows SNAT/DNAT rules to be configured to not automatically install a pinhole for return traffic matching the NAT sessions. This means a user can have a firewall configuration that affects traffic matching a NAT session.","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"service nat destination explicit-firewall-pinhole\nservice nat destination rule firewall-pinhole\nservice nat source explicit-firewall-pinhole\nservice nat source rule firewall-pinhole","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"User isolation in a restricted environment","type":"text"}]},{"type":"paragraph","content":[{"text":"Please see the \"Important Changes\" section at the top of this document for an overview of the user isolation functionality.","type":"text"}]},{"type":"paragraph","content":[{"text":"User isolation may be disabled using the below command.","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"system login user-isolation disable","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"With user-isolation enabled the underlying system's directories aren't accessible to operator and admin-level users. This causes a problem for the admin-level users that may need to retain files across system reboots and upgrades.","type":"text"}]},{"type":"paragraph","content":[{"text":"The shared-storage configuration can define virtual storage mounted on directories accessible to the isolated operator and admin-level users. At the time of configuration, these directories must be empty. Users should log out from all of their login sessions for these configurations to take effect.","type":"text"}]},{"type":"paragraph","content":[{"text":"These shared directories are created as a virtual filesystem backed up by a file in the underlying file system. The filename is derived from the shared directory name.","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"system login user-isolation shared-storage \nsystem login user-isolation shared-storage allow-exec\nsystem login user-isolation shared-storage size ","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Allow isolated users read-only access to directories via the \"copy file\" and \"show file\" operational mode commands.","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"system login user-isolation read-only-directory ","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Storage block device configuration","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Scheduler","type":"text"}]},{"type":"paragraph","content":[{"text":"I/O schedulers attempt to improve throughput by reordering request access into a linear order based on the logical addresses of the data and trying to group these together. While this may increase overall throughput, it may lead to some I/O requests waiting for too long, causing latency issues. I/O schedulers attempt to balance the need for high throughput while sharing I/O requests amongst processes fairly.","type":"text"}]},{"type":"paragraph","content":[{"text":"Configuration is now provided to allow particular schedulers to be used for the block devices attached to the system.","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"system storage block-device scheduler deadline\nsystem storage block-device scheduler none","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"To view scheduler information for the block devices attached to the system, use the following new operational mode command:","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"show system storage block-device","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Periodic TRIM","type":"text"}]},{"type":"paragraph","content":[{"text":"fstrim is used on a mounted filesystem to discard (or \"trim\") blocks which are not in use by the filesystem. This is useful for solid-state drives (SSDs) and thinly-provisioned storage. By default, fstrim will discard all unused blocks in the filesystem.","type":"text"}]},{"type":"paragraph","content":[{"text":"The configuration is now provided to enable periodic trimming of the filesystem.","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"system storage block-device discard-unused-blocks\nsystem storage block-device discard-unused-blocks repeat-interval daily\nsystem storage block-device discard-unused-blocks repeat-interval hourly\nsystem storage block-device discard-unused-blocks repeat-interval monthly\nsystem storage block-device discard-unused-blocks repeat-interval weekly\nsystem storage block-device discard-unused-blocks start-time ","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"A TRIM operation can also be run on-demand, using the following new operational mode command:","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"clear block-device unused-blocks","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"TACACS+","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Command Accounting Start Records","type":"text"}]},{"type":"paragraph","content":[{"text":"When enabled, a TACACS+ command accounting record is issued, with a start_time attribute, before a modelled NOS command being executed.","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"system tacplus-options accounting command-start-records","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"In addition, command accounting stop records now also include the corresponding start_time attribute. This happens regardless of whether \"command-start-records\" has been enabled.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Debug Logs","type":"text"}]},{"type":"paragraph","content":[{"text":"TACACS+ debugging logs are no longer emitted by default in DANOS 2012. Use the below configuration to re-enable the logs.","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"system tacplus-options log debug","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Offline Timer","type":"text"}]},{"type":"paragraph","content":[{"text":"Use this command to define the minimum period during which the system will not perform any TACACS+ transactions following failure.","type":"text"}]},{"type":"paragraph","content":[{"text":"The offline period is triggered following a failure to connect to all TACACS+ servers. This can be due to either failed connection attempts, or because all configured servers have an active hold-down timer while attempting to connect to a server, or a combination.","type":"text"}]},{"type":"paragraph","content":[{"text":"When the running offline timer expires, the system will once again attempt to perform TACACS+ transactions. In most cases, the TACACS+ login provider will request a connection check immediately after the timer expires. If this succeeds the local fallback user login is once again locked (if TACACS+ login is enforced via the auth-chain configuration). Otherwise, a failure will cause the offline timer to be restarted, and the TACACS+ component will enter offline mode again.","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"system tacplus-options offline-timer ","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"The global offline timer, and all per-server hold down timers, maybe reset with the below operational mode command:","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"reset system tacplus suppression-timers","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Disable Server","type":"text"}]},{"type":"paragraph","content":[{"text":"Use this command to prevent the use of a given TACACS+ server for any TACACS+ transaction.","type":"text"}]},{"type":"paragraph","content":[{"text":"A server which has been disabled will not appear in the output of the \"show system tacplus status\" operational mode command.","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"system login tacplus-server disable\nrouting routing-instance system login tacplus-server disable","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Global Server Parameters","type":"text"}]},{"type":"paragraph","content":[{"text":"Use this command to define the TCP port used for communications with all configured TACACS+ servers.","type":"text"}]},{"type":"paragraph","content":[{"text":"The value configured here can be overridden on a per-server basis using the existing \"","type":"text"},{"text":"system login tacplus-server

port ","type":"text","marks":[{"type":"code"}]},{"text":"\" configuration.","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"system tacplus-options server port ","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Use this command to define the secret key used to obfuscate communications with all configured TACACS+ servers.","type":"text"}]},{"type":"paragraph","content":[{"text":"The value configured here can be overridden on a per-server basis using the existing \"","type":"text"},{"text":"system login tacplus-server

secret ","type":"text","marks":[{"type":"code"}]},{"text":"\" configuration.","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"system tacplus-options server secret ","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Use this command to define the timeout to be used for communications with all configured TACACS+ servers.","type":"text"}]},{"type":"paragraph","content":[{"text":"The value configured here can be overridden on a per-server basis using the existing \"","type":"text"},{"text":"system login tacplus-server

timeout ","type":"text","marks":[{"type":"code"}]},{"text":"\" configuration.","type":"text"}]},{"type":"paragraph","content":[{"text":"Long timeouts should generally not be used, to avoid sluggish system response for users.","type":"text"}]},{"type":"paragraph","content":[{"text":"If long timeouts are used, it is strongly recommended to use hold-down timers and/or the offline-timer.","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"system tacplus-options server timeout ","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Obsolete features","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"VRRP translation scripts","type":"text"}]},{"type":"paragraph","content":[{"text":"Support of custom VRRP transition scripts has been removed from this release. Transition scripts are a security issue and have been replaced with notify and DBus signals. ","type":"text"}]},{"type":"table","attrs":{"layout":"default"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[680.0]},"content":[{"type":"codeBlock","content":[{"text":"interfaces bonding vif vrrp vrrp-group run-transition-scripts\ninterfaces bonding vif vrrp vrrp-group run-transition-scripts backup \ninterfaces bonding vif vrrp vrrp-group run-transition-scripts fault

Browser not supported