53. system commands

configure
— system
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— clear-message string
— description string
— normal-state keyword
— trigger-message string
— alarms
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— max-cleared number
— apply-groups reference
— apply-groups-exclude reference
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— device string
— apply-groups reference
— apply-groups-exclude reference
— description string
— module string
— apply-groups reference
— apply-groups-exclude reference
— pairing-button boolean
— passkey string
— power-mode keyword
— boot-bad-exec string
— boot-good-exec string
— apply-groups reference
— apply-groups-exclude reference
— bits
— input
— admin-state keyword
— interface-type keyword
— output
— admin-state keyword
— line-length keyword
— ql-minimum keyword
— source keyword
— squelch boolean
— ql-override keyword
— ssm-bit number
— ptp
— admin-state keyword
— ql-override keyword
— ql-minimum keyword
— ql-selection boolean
— fifth keyword
— first keyword
— fourth keyword
— second keyword
— third keyword
— ref1
— admin-state keyword
— ql-override keyword
— source-port string
— ref2
— admin-state keyword
— ql-override keyword
— source-port string
— revert boolean
— synce
— admin-state keyword
— ql-override keyword
— wait-to-restore number
— clli-code string
— contact string
— coordinates string
— apply-groups reference
— apply-groups-exclude reference
— optimized-mode boolean
— cron
— apply-groups reference
— apply-groups-exclude reference
— schedule string owner string
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— count number
— day-of-month number
— description string
— date-and-time string
— day keyword
— time string
— hour number
— interval number
— minute number
— month (keyword | number)
— name string
— owner string
— type keyword
— weekday (keyword | number)
— dhcp6
— adv-noaddrs-global keyword
— apply-groups reference
— apply-groups-exclude reference
— dns
— address-pref keyword
— apply-groups reference
— apply-groups-exclude reference
— dnssec
— ad-validation keyword
— efm-oam
— apply-groups reference
— apply-groups-exclude reference
— grace-tx boolean
— eth-cfm
— apply-groups reference
— apply-groups-exclude reference
— grace boolean
— apply-groups reference
— apply-groups-exclude reference
— end number
— start number
— apply-groups reference
— apply-groups-exclude reference
— end number
— start number
— apply-groups reference
— apply-groups-exclude reference
— mc-lag
— propagate-hold-time (number | keyword)
— standby-mep boolean
— local-name string
— type keyword
— slm
— apply-groups reference
— apply-groups-exclude reference
— inactivity-timer number
— grpc
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— gnmi
— admin-state keyword
— auto-config-save boolean
— gnoi
— admin-state keyword
— file
— admin-state keyword
— system
— admin-state keyword
— max-msg-size number
— md-cli
— admin-state keyword
— rib-api
— admin-state keyword
— purge-timeout number
— admin-state keyword
— idle-time number
— interval number
— retries number
— tls-server-profile reference
— apply-groups reference
— apply-groups-exclude reference
— destination-group string
— apply-groups reference
— apply-groups-exclude reference
— description string
— destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number
— apply-groups reference
— apply-groups-exclude reference
— local-source-address (ipv4-address-no-zone | ipv6-address-no-zone)
— router-instance string
— admin-state keyword
— idle-time number
— interval number
— retries number
— tls-client-profile reference
— tunnel string
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— description string
— destination-group reference
— handler string
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— port number
— custom-type string
— custom-string string
— icmp-vse boolean
— ip
— apply-groups reference
— apply-groups-exclude reference
— forward-6in4 boolean
— forward-ip-over-gre boolean
— ipv6-eh keyword
— mpls
— l2tp
— apply-groups reference
— apply-groups-exclude reference
— end number
— start number
— lacp
— apply-groups reference
— apply-groups-exclude reference
— system-priority number
— lldp
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— message-fast-tx number
— reinit-delay number
— tx-credit-max number
— tx-hold-multiplier number
— tx-interval number
— apply-groups reference
— apply-groups-exclude reference
— l2tp-load-balancing boolean
— l4-load-balancing boolean
— lsr-load-balancing keyword
— location string
— apply-groups reference
— apply-groups-exclude reference
— exponential-backoff boolean
— ftp
— idle-timeout (keyword | number)
— login-banner boolean
— global-script string
— file-name string
— user-directory string
— motd
— text string
— url string
— message string
— name boolean
— ssh
— graceful-shutdown boolean
— ttl-security number
— telnet
— graceful-shutdown boolean
— ttl-security number
— apply-groups reference
— apply-groups-exclude reference
— cli
— apply-groups reference
— apply-groups-exclude reference
— allow-immediate boolean
— apply-groups reference
— apply-groups-exclude reference
— local-checkpoints number
— location string
— remote-checkpoints number
— rescue
— location string
— cli-engine keyword
— md-cli
— apply-groups reference
— apply-groups-exclude reference
— auto-config-save boolean
— alias string
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— cli-command string
— description string
— mount-point (keyword | string)
— python-script reference
— enter boolean
— space boolean
— tab boolean
— console
— length number
— width number
— admin-state boolean
— cli keyword
— more boolean
— admin-state keyword
— delay number
— type keyword
— prompt
— context boolean
— newline boolean
— timestamp boolean
— python
— memory-reservation number
— timeout number
— time-display keyword
— time-format keyword
— commit-history number
— configuration-mode keyword
— apply-groups reference
— apply-groups-exclude reference
— netconf
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— auto-config-save boolean
— candidate boolean
— writable-running boolean
— port number
— apply-groups reference
— apply-groups-exclude reference
— asynchronous-execution (number | keyword)
— asynchronous-retention (number | keyword)
— synchronous-execution (number | keyword)
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— client-tls-profile reference
— connection-timeout number
— device-label string
— device-name string
— hello-interval number
— manager string
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— client-tls-profile reference
— connection-timeout number
— description string
— device-label string
— device-name string
— manager-address (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name)
— manager-port number
— router-instance string
— source-address (ipv4-address-no-zone | ipv6-address-no-zone)
— source-port (number | keyword)
— router-instance string
— source-address (ipv4-address-no-zone | ipv6-address-no-zone)
— source-port (number | keyword)
— schema-path string
— snmp
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— engine-id string
— general-port number
— packet-size number
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— apply-groups reference
— apply-groups-exclude reference
— base-r13-modules boolean
— nmda
— nmda-support boolean
— nokia-submodules boolean
— openconfig-modules boolean
— name string
— apply-groups reference
— apply-groups-exclude reference
— generate-traps boolean
— profile string
— apply-groups reference
— apply-groups-exclude reference
— neid string
— neip
— apply-groups reference
— apply-groups-exclude reference
— ipv4
— vendor-id-value number
— ipv6
— vendor-id-value number
— ipv4 string
— ipv6 string
— platform-type string
— system-mac string
— vendor-id string
— ancp
— apply-groups reference
— apply-groups-exclude reference
— description string
— location keyword
— apply-groups reference
— apply-groups-exclude reference
— description string
— location keyword
— apply-groups reference
— apply-groups-exclude reference
— apply-groups reference
— apply-groups-exclude reference
— description string
— location keyword
— apply-groups reference
— apply-groups-exclude reference
— description string
— location keyword
— options
— apply-groups reference
— apply-groups-exclude reference
— apply-groups reference
— apply-groups-exclude reference
— description string
— location keyword
— apply-groups reference
— apply-groups-exclude reference
— description string
— location keyword
— apply-groups reference
— apply-groups-exclude reference
— mode keyword
— power-safety-alert number
— power-safety-level number
— ptp
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— clock-type keyword
— domain number
— local-priority number
— network-type keyword
— port reference
— address string
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— local-priority number
— log-delay-interval number
— log-sync-interval number
— master-only boolean
— priority1 number
— priority2 number
— profile keyword
— ptsf
— admin-state keyword
— router string
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— peer (ipv4-address-no-zone | ipv6-address-no-zone)
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— local-priority number
— log-sync-interval number
— peer-limit number
— apply-groups reference
— apply-groups-exclude reference
— script string owner string
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— description string
— location string
— script-policy string owner string
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— expire-time (number | keyword)
— lifetime (number | keyword)
— lock-override boolean
— max-completed number
— python-lifetime number
— name reference
— results string
— script
— name string
— owner string
— aaa
— apply-groups reference
— apply-groups-exclude reference
— cli-session-group string
— apply-groups reference
— apply-groups-exclude reference
— description string
— ssh-max-sessions number
— health-check (number | keyword)
— apply-groups reference
— apply-groups-exclude reference
— profile string
— apply-groups reference
— apply-groups-exclude reference
— cli-session-group reference
— default-action keyword
— entry number
— action keyword
— apply-groups reference
— apply-groups-exclude reference
— description string
— match string
— grpc
— gnmi-capabilities keyword
— gnmi-get keyword
— gnmi-set keyword
— gnmi-subscribe keyword
— gnoi-file-get keyword
— gnoi-file-put keyword
— gnoi-file-remove keyword
— gnoi-file-stat keyword
— gnoi-system-ping keyword
— gnoi-system-reboot keyword
— gnoi-system-time keyword
— md-cli-session keyword
— rib-api-getversion keyword
— rib-api-modify keyword
— li boolean
— netconf
— action boolean
— cancel-commit boolean
— close-session boolean
— commit boolean
— copy-config boolean
— create-subscription boolean
— delete-config boolean
— discard-changes boolean
— edit-config boolean
— get boolean
— get-config boolean
— get-data boolean
— get-schema boolean
— kill-session boolean
— lock boolean
— validate boolean
— ssh-max-sessions number
— apply-groups reference
— apply-groups-exclude reference
— md-cli
— md-interfaces boolean
— telemetry-data boolean
— apply-groups reference
— apply-groups-exclude reference
— ldap
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— route-preference keyword
— server number
— address (ipv4-address-no-zone | ipv6-address-no-zone)
— apply-groups reference
— apply-groups-exclude reference
— port number
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— password string
— root-dn string
— search
— base-dn string
— server-name string
— tls-profile reference
— server-retry number
— server-timeout number
— radius
— access-algorithm keyword
— accounting boolean
— accounting-port number
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— authorization boolean
— port number
— route-preference keyword
— server number
— address (ipv4-address-no-zone | ipv6-address-no-zone)
— apply-groups reference
— apply-groups-exclude reference
— secret string
— tls-client-profile reference
— server-retry number
— server-timeout number
— tacplus
— record-type keyword
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— use-priv-lvl boolean
— apply-groups reference
— apply-groups-exclude reference
— priv-lvl number
— apply-groups reference
— apply-groups-exclude reference
— user-profile-name reference
— route-preference keyword
— server number
— address (ipv4-address-no-zone | ipv6-address-no-zone)
— apply-groups reference
— apply-groups-exclude reference
— port number
— secret string
— server-timeout number
— apply-groups reference
— apply-groups-exclude reference
— inband reference
— outband reference
— vprn reference
— user-template keyword
— access
— console boolean
— ftp boolean
— grpc boolean
— li boolean
— netconf boolean
— apply-groups reference
— apply-groups-exclude reference
— console
— login-exec string
— home-directory (sat-url | cflash-without-slot-url)
— profile string
— restricted-to-home boolean
— apply-groups reference
— apply-groups-exclude reference
— apply-groups reference
— apply-groups-exclude reference
— cron
— cli-user reference
— cli-user reference
— vsd
— cli-user reference
— apply-groups reference
— apply-groups-exclude reference
— default-action keyword
— admin-state keyword
— entry number
— action
— accept
— default
— drop
— queue reference
— apply-groups reference
— apply-groups-exclude reference
— description string
— log reference
— match
— dscp keyword
— dst-ip
— address (ipv4-address | ipv4-prefix-with-host-bits)
— ip-prefix-list reference
— mask string
— eq number
— mask number
— port-list reference
— range
— end number
— start number
— fragment keyword
— icmp
— code number
— type number
— mask number
— type number
— multiple-option boolean
— option-present boolean
— port
— eq number
— mask number
— port-list reference
— range
— end number
— start number
— protocol (number | keyword)
— router-instance string
— src-ip
— address (ipv4-address | ipv4-prefix-with-host-bits)
— ip-prefix-list reference
— mask string
— eq number
— mask number
— port-list reference
— range
— end number
— start number
— ack boolean
— syn boolean
— admin-state keyword
— entry number
— action
— accept
— default
— drop
— queue reference
— apply-groups reference
— apply-groups-exclude reference
— description string
— log reference
— match
— dscp keyword
— dst-ip
— address (ipv6-address | ipv6-prefix-with-host-bits)
— ipv6-prefix-list reference
— mask string
— eq number
— mask number
— port-list reference
— range
— end number
— start number
— hop-by-hop boolean
— flow-label number
— fragment keyword
— icmp
— code number
— type number
— next-header (number | keyword)
— port
— eq number
— mask number
— port-list reference
— range
— end number
— start number
— router-instance string
— src-ip
— address (ipv6-address | ipv6-prefix-with-host-bits)
— ipv6-prefix-list reference
— mask string
— eq number
— mask number
— port-list reference
— range
— end number
— start number
— ack boolean
— syn boolean
— admin-state keyword
— entry number
— action
— accept
— default
— drop
— queue reference
— apply-groups reference
— apply-groups-exclude reference
— description string
— log reference
— match
— eq number
— gt number
— lt number
— range
— end number
— start number
— dst-mac
— address string
— mask string
— etype string
— frame-type keyword
— dsap number
— mask number
— mask number
— ssap number
— service reference
— src-mac
— address string
— mask string
— apply-groups reference
— apply-groups-exclude reference
— queue number
— apply-groups reference
— apply-groups-exclude reference
— cbs number
— mbs number
— rate
— cir (number | keyword)
— pir (number | keyword)
— apply-groups reference
— apply-groups-exclude reference
— dhcp boolean
— gtp boolean
— icmp boolean
— igmp boolean
— link-specific-rate (number | keyword)
— policy number
— alarm boolean
— apply-groups reference
— apply-groups-exclude reference
— description string
— eth-cfm
— entry number
— apply-groups reference
— apply-groups-exclude reference
— level start number end number
— opcode start number end number
— pir (number | keyword)
— log-events boolean
— pir (number | keyword)
— overall-rate (number | keyword)
— per-source-rate (number | keyword)
— action-low-priority boolean
— pir (number | keyword)
— allow-sham-links boolean
— block-pim-tunneled boolean
— apply-groups reference
— apply-groups-exclude reference
— policy string
— apply-groups reference
— apply-groups-exclude reference
— description string
— apply-groups reference
— apply-groups-exclude reference
— description string
— exceed-action keyword
— log-events keyword
— rate
— kbps
— limit (keyword | number)
— mbs number
— packets
— initial-delay number
— limit (keyword | number)
— within number
— protocol keyword
— apply-groups reference
— apply-groups-exclude reference
— detection-time number
— action keyword
— hold-down (keyword | number)
— log-events keyword
— rate
— kbps
— limit (keyword | number)
— mbs number
— packets
— initial-delay number
— limit (keyword | number)
— within number
— dynamic
— mon-policer-name reference
— static
— policer-name reference
— static-policer string
— apply-groups reference
— apply-groups-exclude reference
— description string
— detection-time number
— action keyword
— hold-down (keyword | number)
— log-events keyword
— rate
— kbps
— limit (keyword | number)
— mbs number
— packets
— initial-delay number
— limit (keyword | number)
— within number
— type keyword
— dot1x
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— radius-policy string
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— retry number
— server number
— accounting-port number
— address string
— apply-groups reference
— apply-groups-exclude reference
— secret string
— type keyword
— source-address string
— timeout number
— ftp-server boolean
— apply-groups reference
— apply-groups-exclude reference
— read-algorithm keyword
— write-algorithm keyword
— grpc
— hash-algorithm keyword
— md-cli
— hash-algorithm keyword
— netconf
— hash-algorithm keyword
— keychain string
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— entry number
— admin-state keyword
— algorithm keyword
— apply-groups reference
— apply-groups-exclude reference
— authentication-key string
— begin-time string
— option keyword
— tolerance (number | keyword)
— description string
— receive
— entry number
— admin-state keyword
— algorithm keyword
— apply-groups reference
— apply-groups-exclude reference
— authentication-key string
— begin-time string
— end-time string
— tolerance (number | keyword)
— send
— entry number
— admin-state keyword
— algorithm keyword
— apply-groups reference
— apply-groups-exclude reference
— authentication-key string
— begin-time string
— receive keyword
— send keyword
— allow-ftp boolean
— allow-grpc boolean
— allow-netconf boolean
— allow-ssh boolean
— allow-telnet boolean
— allow-telnet6 boolean
— apply-groups reference
— apply-groups-exclude reference
— apply-groups reference
— apply-groups-exclude reference
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— default-action keyword
— entry number
— action keyword
— apply-groups reference
— apply-groups-exclude reference
— description string
— log-events boolean
— match
— mask number
— port number
— cpm
— lag string
— port-id string
— protocol (number | keyword)
— router-instance string
— src-ip
— address (ipv4-prefix | ipv4-address)
— ip-prefix-list reference
— mask string
— mask number
— port number
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— default-action keyword
— entry number
— action keyword
— apply-groups reference
— apply-groups-exclude reference
— description string
— log-events boolean
— match
— mask number
— port number
— flow-label number
— cpm
— lag string
— port-id string
— next-header (number | keyword)
— router-instance string
— src-ip
— address (ipv6-prefix | ipv6-address)
— ipv6-prefix-list reference
— mask string
— mask number
— port number
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— default-action keyword
— entry number
— action keyword
— apply-groups reference
— apply-groups-exclude reference
— description string
— log-events boolean
— match
— eq number
— gt number
— lt number
— range
— end number
— start number
— dot1p
— mask number
— priority number
— dst-mac
— address string
— mask string
— etype string
— frame-type keyword
— dsap number
— mask number
— mask number
— ssap number
— service string
— snap-oui keyword
— snap-pid number
— src-mac
— address string
— mask string
— per-peer-queuing boolean
— pki
— apply-groups reference
— apply-groups-exclude reference
— ca-profile string
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— url-entry number
— apply-groups reference
— apply-groups-exclude reference
— transmission-profile reference
— url http-url-path-loose
— pre-update-time number
— retry-interval number
— schedule-type keyword
— cert-file string
— cmpv2
— error-message boolean
— pkiconf-message boolean
— http
— response-timeout number
— version keyword
— key string
— apply-groups reference
— apply-groups-exclude reference
— password string
— url
— service-name string
— url-string http-optional-url-loose
— crl-file string
— description string
— ocsp
— responder-url http-optional-url-loose
— service-name string
— transmission-profile reference
— revocation-check keyword
— hours number
— repeat-hours number
— common-name-list string
— apply-groups reference
— apply-groups-exclude reference
— common-name number
— apply-groups reference
— apply-groups-exclude reference
— cn-type keyword
— cn-value string
— hours number
— repeat-hours number
— est-profile string
— apply-groups reference
— apply-groups-exclude reference
— client-tls-profile string
— password string
— username string
— server
— fqdn string
— ipv4 string
— ipv6 (ipv4-address-no-zone | ipv6-address-no-zone)
— port number
— imported-format keyword
— apply-groups reference
— apply-groups-exclude reference
— cron
— cli-user reference
— cli-user reference
— snmp
— access string context string security-model keyword security-level keyword
— apply-groups reference
— apply-groups-exclude reference
— notify string
— prefix-match keyword
— read string
— write string
— apply-groups reference
— apply-groups-exclude reference
— apply-groups reference
— apply-groups-exclude reference
— count number
— lockout number
— time number
— community string
— access-permissions keyword
— apply-groups reference
— apply-groups-exclude reference
— source-access-list reference
— version keyword
— source-access-list string
— apply-groups reference
— apply-groups-exclude reference
— source-host string
— address (ipv4-address-no-zone | ipv6-address-no-zone)
— apply-groups reference
— apply-groups-exclude reference
— usm-community string
— apply-groups reference
— apply-groups-exclude reference
— group string
— source-access-list reference
— view string subtree string
— apply-groups reference
— apply-groups-exclude reference
— mask string
— type keyword
— ipv4 keyword
— address string
— apply-groups reference
— apply-groups-exclude reference
— interface-name string
— ipv6 keyword
— address string
— apply-groups reference
— apply-groups-exclude reference
— ssh
— apply-groups reference
— apply-groups-exclude reference
— apply-groups reference
— apply-groups-exclude reference
— cipher number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— apply-groups reference
— apply-groups-exclude reference
— cipher number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— kex number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— mac number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— client
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— mbytes (number | keyword)
— minutes (number | keyword)
— server
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— mbytes (number | keyword)
— minutes (number | keyword)
— preserve-key boolean
— server-admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— cipher number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— apply-groups reference
— apply-groups-exclude reference
— cipher number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— kex number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— mac number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— version keyword
— admin-password string
— apply-groups reference
— apply-groups-exclude reference
— vsd-password string
— apply-groups reference
— apply-groups-exclude reference
— ts-location (ts-sat-url | cflash-url | string)
— telnet-server boolean
— telnet6-server boolean
— tls
— apply-groups reference
— apply-groups-exclude reference
— cert-profile string
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— entry number
— apply-groups reference
— apply-groups-exclude reference
— certificate-file string
— key-file string
— ca-profile reference
— client-cipher-list string
— apply-groups reference
— apply-groups-exclude reference
— tls12-cipher number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— client-tls-profile string
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— cert-profile reference
— cipher-list reference
— trust-anchor-profile reference
— server-cipher-list string
— apply-groups reference
— apply-groups-exclude reference
— tls12-cipher number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— server-tls-profile string
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— common-name-list reference
— trust-anchor-profile reference
— cert-profile reference
— cipher-list reference
— apply-groups reference
— apply-groups-exclude reference
— trust-anchor reference
— apply-groups reference
— apply-groups-exclude reference
— count number
— lockout number
— time number
— exit-on-reject boolean
— order keyword
— aging number
— apply-groups reference
— apply-groups-exclude reference
— allow-user-name boolean
— credits
— lowercase number
— numeric number
— special-character number
— uppercase number
— minimum-classes number
— minimum-length number
— lowercase number
— numeric number
— special-character number
— uppercase number
— hashing keyword
— history-size number
— minimum-age number
— minimum-change number
— user string
— access
— console boolean
— ftp boolean
— grpc boolean
— li boolean
— netconf boolean
— snmp boolean
— apply-groups reference
— apply-groups-exclude reference
— cli-engine keyword
— console
— login-exec (sat-url | cflash-url | ftp-tftp-url | filename)
— member reference
— home-directory (sat-url | cflash-without-slot-url)
— password string
— ecdsa
— ecdsa-key number
— apply-groups reference
— apply-groups-exclude reference
— description string
— key-value string
— rsa
— rsa-key number
— apply-groups reference
— apply-groups-exclude reference
— description string
— key-value string
— restricted-to-home boolean
— snmp
— apply-groups reference
— apply-groups-exclude reference
— authentication-key string
— privacy
— privacy-key string
— privacy-protocol keyword
— group string
— count number
— window number
— selective-fib boolean
— apply-groups reference
— apply-groups-exclude reference
— description string
— primary-location string
— secondary-location string
— tertiary-location string
— apply-groups reference
— apply-groups-exclude reference
— admin-state keyword
— sfm-loss-threshold number
— apply-groups reference
— apply-groups-exclude reference
— destination-group string
— apply-groups reference
— apply-groups-exclude reference
— description string
— destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number
— apply-groups reference
— apply-groups-exclude reference
— router-instance string
— admin-state keyword
— idle-time number
— interval number
— retries number
— tls-client-profile reference
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— max-msg-count number
— subscription string
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— description string
— destination-group reference
— encoding keyword
— local-source-address (ipv4-address-no-zone | ipv6-address-no-zone)
— mode keyword
— sample-interval number
— sensor-group reference
— sensor-group string
— apply-groups reference
— apply-groups-exclude reference
— description string
— path string
— apply-groups reference
— apply-groups-exclude reference
— falling-threshold number
— interval number
— rising-threshold number
— rmon-event-type keyword
— startup-alarm keyword
— apply-groups reference
— apply-groups-exclude reference
— falling-threshold number
— interval number
— rising-threshold number
— rmon-event-type keyword
— startup-alarm keyword
— apply-groups reference
— apply-groups-exclude reference
— falling-threshold number
— interval number
— rising-threshold number
— rmon-event-type keyword
— startup-alarm keyword
— apply-groups reference
— apply-groups-exclude reference
— falling-threshold number
— interval number
— rising-threshold number
— rmon-event-type keyword
— startup-alarm keyword
— rmon
— alarm number
— apply-groups reference
— apply-groups-exclude reference
— falling-event number
— falling-threshold number
— interval number
— owner string
— rising-event number
— rising-threshold number
— sample-type keyword
— startup-alarm keyword
— variable-oid string
— event number
— apply-groups reference
— apply-groups-exclude reference
— description string
— event-type keyword
— owner string
— time
— apply-groups reference
— apply-groups-exclude reference
— dst-zone string
— apply-groups reference
— apply-groups-exclude reference
— end
— day keyword
— hours-minutes string
— month keyword
— week keyword
— offset number
— start
— day keyword
— hours-minutes string
— month keyword
— week keyword
— ntp
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— authentication-key number
— apply-groups reference
— apply-groups-exclude reference
— key string
— type keyword
— broadcast reference interface-name string
— apply-groups reference
— apply-groups-exclude reference
— key-id reference
— ttl number
— version number
— broadcast-client string interface-name string
— apply-groups reference
— apply-groups-exclude reference
— authenticate boolean
— apply-groups reference
— apply-groups-exclude reference
— key-id reference
— version number
— apply-groups reference
— apply-groups-exclude reference
— authenticate boolean
— authenticate boolean
— peer (ipv4-address-no-zone | ipv6-address-no-zone) router-instance string
— apply-groups reference
— apply-groups-exclude reference
— key-id reference
— prefer boolean
— version number
— server (ipv4-address-no-zone | ipv6-address-no-zone | keyword) router-instance string
— apply-groups reference
— apply-groups-exclude reference
— key-id reference
— prefer boolean
— version number
— prefer-local-time boolean
— sntp
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— server (ipv4-address-no-zone | ipv6-address-no-zone)
— apply-groups reference
— apply-groups-exclude reference
— interval number
— prefer boolean
— version number
— sntp-state keyword
— zone
— name string
— offset string
— name keyword
— apply-groups reference
— apply-groups-exclude reference
— redirection number
— retry number
— router-instance string
— timeout number

53.1. system command descriptions

system

Synopsis

Enter the system context

Context

configure system

Tree

system

Description

Commands in this context enable debugging of general system level functions and router management protocols.

Introduced

16.0.R1

Platforms

All

alarm-contact-in-power boolean

Synopsis

Power the output pin on the CPM alarm interface port

Context

configure system alarm-contact-in-power boolean

Tree

alarm-contact-in-power

Default

false

Introduced

16.0.R1

Platforms

7750 SR-a

alarm-contact-input [input-pin-number] number

Synopsis

Enter the alarm-contact-input list instance

Context

configure system alarm-contact-input number

Tree

alarm-contact-input

Introduced

16.0.R1

Platforms

7750 SR-a

[input-pin-number] number

Synopsis

Alarm contact input pin

Context

configure system alarm-contact-input number

Range

1 to 4

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

7750 SR-a

admin-state keyword

Synopsis

Administrative state of the alarm contact input

Context

configure system alarm-contact-input number admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

7750 SR-a

clear-message string

Synopsis

Text message sent in the log event when an alarm clears

Context

configure system alarm-contact-input number clear-message string

Tree

clear-message

String Length

1 to 80

Default

Alarm Input Cleared

Introduced

16.0.R1

Platforms

7750 SR-a

description string

Synopsis

Text description

Context

configure system alarm-contact-input number description string

Tree

description

String Length

1 to 160

Introduced

16.0.R1

Platforms

7750 SR-a

normal-state keyword

Synopsis

Normal state associated with the alarm contact input

Context

configure system alarm-contact-input number normal-state keyword

Tree

normal-state

Default

open

Options

open, closed

Introduced

16.0.R1

Platforms

7750 SR-a

trigger-message string

Synopsis

Text message sent in the log event when input changes

Context

configure system alarm-contact-input number trigger-message string

Tree

trigger-message

String Length

1 to 80

Default

Alarm Input Triggered

Introduced

16.0.R1

Platforms

7750 SR-a

alarms

Synopsis

Enter the alarms context

Context

configure system alarms

Tree

alarms

Introduced

16.0.R4

Platforms

All

admin-state keyword

Synopsis

Administrative state of the system alarm

Context

configure system alarms admin-state keyword

Tree

admin-state

Default

enable

Options

enable, disable

Introduced

16.0.R4

Platforms

All

max-cleared number

Synopsis

Maximum number of cleared alarms

Context

configure system alarms max-cleared number

Tree

max-cleared

Range

0 to 500

Default

500

Introduced

16.0.R4

Platforms

All

allow-boot-license-violations boolean

Synopsis

Allow boot license violations in boot-up configuration

Context

configure system allow-boot-license-violations boolean

Tree

allow-boot-license-violations

Default

true

Introduced

16.0.R4

Platforms

All

bluetooth

Synopsis

Enter the bluetooth context

Context

configure system bluetooth

Tree

bluetooth

Introduced

16.0.R1

Platforms

7750 SR-1, 7750 SR-s

admin-state keyword

Synopsis

Specifies the desired administrative state of the bluetooth module.

Context

configure system bluetooth admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

20.2.R1

Platforms

7750 SR-1, 7750 SR-s

advertising-timeout number

Synopsis

Bluetooth advertising timeout

Context

configure system bluetooth advertising-timeout number

Tree

advertising-timeout

Range

30 to 3600

Units

seconds

Introduced

16.0.R1

Platforms

7750 SR-1, 7750 SR-s

device [mac-address] string

Synopsis

Enter the device list instance

Context

configure system bluetooth device string

Tree

device

Max. Elements

5

Introduced

16.0.R1

Platforms

7750 SR-1, 7750 SR-s

[mac-address] string

Synopsis

Bluetooth client device MAC address

Context

configure system bluetooth device string

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

7750 SR-1, 7750 SR-s

description string

Synopsis

Text description

Context

configure system bluetooth device string description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

7750 SR-1, 7750 SR-s

module [cpm-slot] string

Synopsis

Enter the module list instance

Context

configure system bluetooth module string

Tree

module

Introduced

16.0.R1

Platforms

7750 SR-1, 7750 SR-s

[cpm-slot] string

Synopsis

CPM slot on which the module resides

Context

configure system bluetooth module string

String Length

1

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

7750 SR-1, 7750 SR-s

provisioned-identifier string

Synopsis

Bluetooth module ID

Context

configure system bluetooth module string provisioned-identifier string

Tree

provisioned-identifier

String Length

1 to 32

Introduced

16.0.R1

Platforms

7750 SR-1, 7750 SR-s

pairing-button boolean

Synopsis

Enable the pairing button

Context

configure system bluetooth pairing-button boolean

Tree

pairing-button

Default

false

Introduced

16.0.R1

Platforms

7750 SR-1, 7750 SR-s

passkey string

Synopsis

Bluetooth passkey

Context

configure system bluetooth passkey string

Tree

passkey

String Length

6

Default

123456

Introduced

16.0.R1

Platforms

7750 SR-1, 7750 SR-s

power-mode keyword

Synopsis

Bluetooth module(s) power mode.

Context

configure system bluetooth power-mode keyword

Tree

power-mode

Default

automatic

Options

manual, automatic

Introduced

20.2.R1

Platforms

7750 SR-1, 7750 SR-s

boot-bad-exec string

Synopsis

CLI script file to execute following a failed boot-up

Context

configure system boot-bad-exec string

Tree

boot-bad-exec

String Length

1 to 180

Introduced

16.0.R1

Platforms

All

boot-good-exec string

Synopsis

CLI script file to execute following successful boot-up

Context

configure system boot-good-exec string

Tree

boot-good-exec

String Length

1 to 180

Introduced

16.0.R1

Platforms

All

central-frequency-clock

Synopsis

Enter the central-frequency-clock context

Context

configure system central-frequency-clock

Tree

central-frequency-clock

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

bits

Synopsis

Enter the bits context

Context

configure system central-frequency-clock bits

Tree

bits

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

input

Synopsis

Enter the input context

Context

configure system central-frequency-clock bits input

Tree

input

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

admin-state keyword

Synopsis

Administrative state of BITS input timing reference

Context

configure system central-frequency-clock bits input admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

interface-type keyword

Synopsis

Interface type of the BITS timing reference

Context

configure system central-frequency-clock bits interface-type keyword

Tree

interface-type

Default

ds1-esf

Options

ds1-esf, ds1-sf, e1-pcm30crc, e1-pcm31crc, g703-2048khz

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

output

Synopsis

Enter the output context

Context

configure system central-frequency-clock bits output

Tree

output

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

admin-state keyword

Synopsis

Administrative state of BITS output timing reference

Context

configure system central-frequency-clock bits output admin-state keyword

Tree

admin-state

Options

enable, disable

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

line-length keyword

Synopsis

Line length for the BITS output timing reference

Context

configure system central-frequency-clock bits output line-length keyword

Tree

line-length

Options

length-not-applicable, 110, 220, 330, 440, 550, 660

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ql-minimum keyword

Synopsis

Minimum signal quality level for BITSout port

Context

configure system central-frequency-clock bits output ql-minimum keyword

Tree

ql-minimum

Default

unused

Options

unused, prs, stu, st2, tnc, st3e, st3, prc, ssua, ssub, sec, eec1, eec2

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

source keyword

Synopsis

Source of the BITS output timing reference

Context

configure system central-frequency-clock bits output source keyword

Tree

source

Default

line-ref

Options

line-ref, internal-clock

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

squelch boolean

Synopsis

Squelch the signal of the BITS output timing reference

Context

configure system central-frequency-clock bits output squelch boolean

Tree

squelch

Default

false

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ql-override keyword

Synopsis

Override for the quality level of the timing reference

Context

configure system central-frequency-clock bits ql-override keyword

Tree

ql-override

Default

unused

Options

unused, prs, stu, st2, tnc, st3e, st3, prc, ssua, ssub, sec

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ssm-bit number

Synopsis

Sa bit to convey SSM information

Context

configure system central-frequency-clock bits ssm-bit number

Tree

ssm-bit

Range

4 to 8

Default

8

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ptp

Synopsis

Enter the ptp context

Context

configure system central-frequency-clock ptp

Tree

ptp

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

admin-state keyword

Synopsis

Administrative state of the PTP timing reference

Context

configure system central-frequency-clock ptp admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ql-override keyword

Synopsis

Quality level of a timing reference that overrides any value provided by the reference's SSM process

Context

configure system central-frequency-clock ptp ql-override keyword

Tree

ql-override

Default

unused

Options

unused, prs, stu, st2, tnc, st3e, st3, prc, ssua, ssub, sec

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ql-minimum keyword

Synopsis

Minimum signal quality level for system timing module

Context

configure system central-frequency-clock ql-minimum keyword

Tree

ql-minimum

Default

unused

Options

unused, prs, stu, st2, tnc, st3e, st3, prc, ssua, ssub, sec, eec1, eec2

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ql-selection boolean

Synopsis

Consider quality level in system and BITS output timing

Context

configure system central-frequency-clock ql-selection boolean

Tree

ql-selection

Default

false

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ref-order

Synopsis

Enter the ref-order context

Context

configure system central-frequency-clock ref-order

Tree

ref-order

Description

Commands in this context specify the priority order of the synchronous equipment timing subsystem.

If a reference source is disabled, this command defines the next reference source for the clock. If all reference sources are disabled, clocking is derived from a local oscillator.

If a timing reference is linked to a source port that is operationally down, the port is no longer a qualified, valid reference.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

fifth keyword

Synopsis

Fifth preferred timing reference source

Context

configure system central-frequency-clock ref-order fifth keyword

Tree

fifth

Options

ref1, ref2, bits, ptp, none, synce, gnss

Introduced

19.10.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

first keyword

Synopsis

First preferred timing reference source

Context

configure system central-frequency-clock ref-order first keyword

Tree

first

Options

ref1, ref2, bits, ptp, none, synce, gnss

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

fourth keyword

Synopsis

Fourth preferred timing reference source

Context

configure system central-frequency-clock ref-order fourth keyword

Tree

fourth

Options

ref1, ref2, bits, ptp, none, synce, gnss

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

second keyword

Synopsis

Second preferred timing reference source

Context

configure system central-frequency-clock ref-order second keyword

Tree

second

Options

ref1, ref2, bits, ptp, none, synce, gnss

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

third keyword

Synopsis

Third preferred timing reference source

Context

configure system central-frequency-clock ref-order third keyword

Tree

third

Options

ref1, ref2, bits, ptp, none, synce, gnss

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ref1

Synopsis

Enter the ref1 context

Context

configure system central-frequency-clock ref1

Tree

ref1

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

admin-state keyword

Synopsis

Administrative state of the first timing reference

Context

configure system central-frequency-clock ref1 admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ql-override keyword

Synopsis

Quality level override of a timing reference

Context

configure system central-frequency-clock ref1 ql-override keyword

Tree

ql-override

Default

unused

Options

unused, prs, stu, st2, tnc, st3e, st3, prc, ssua, ssub, sec, eec1, eec2

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

source-port string

Synopsis

Source port for the first timing reference

Context

configure system central-frequency-clock ref1 source-port string

Tree

source-port

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ref2

Synopsis

Enter the ref2 context

Context

configure system central-frequency-clock ref2

Tree

ref2

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

admin-state keyword

Synopsis

Administrative state of the second timing reference

Context

configure system central-frequency-clock ref2 admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ql-override keyword

Synopsis

Quality level override of a timing reference

Context

configure system central-frequency-clock ref2 ql-override keyword

Tree

ql-override

Default

unused

Options

unused, prs, stu, st2, tnc, st3e, st3, prc, ssua, ssub, sec, eec1, eec2

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

source-port string

Synopsis

Source port for the second timing reference

Context

configure system central-frequency-clock ref2 source-port string

Tree

source-port

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

revert boolean

Synopsis

Revert to higher-priority reference source

Context

configure system central-frequency-clock revert boolean

Tree

revert

Default

false

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

synce

Synopsis

Enter the synce context

Context

configure system central-frequency-clock synce

Tree

synce

Introduced

19.10.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

admin-state keyword

Synopsis

Administrative state of the SyncE timing reference

Context

configure system central-frequency-clock synce admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

19.10.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ql-override keyword

Synopsis

Override the quality level of a timing reference

Context

configure system central-frequency-clock synce ql-override keyword

Tree

ql-override

Default

unused

Options

unused, prs, stu, st2, tnc, st3e, st3, prc, ssua, ssub, sec, eec1, eec2

Introduced

19.10.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

wait-to-restore number

Synopsis

Time to re-validate a previously failed input reference

Context

configure system central-frequency-clock wait-to-restore number

Tree

wait-to-restore

Range

1 to 12

Units

minutes

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

clli-code string

Synopsis

CLLI code value for the system

Context

configure system clli-code string

Tree

clli-code

String Length

11

Introduced

16.0.R1

Platforms

All

congestion-management boolean

Synopsis

Enable Virtual Service Router congestion management

Context

configure system congestion-management boolean

Tree

congestion-management

Default

false

Introduced

16.0.R1

Platforms

VSR

contact string

Synopsis

Contact information for the managed node

Context

configure system contact string

Tree

contact

String Length

1 to 80

Introduced

16.0.R1

Platforms

All

coordinates string

Synopsis

GPS coordinates for the system location

Context

configure system coordinates string

Tree

coordinates

String Length

1 to 80

Introduced

16.0.R1

Platforms

All

cpm-http-redirect

Synopsis

Enter the cpm-http-redirect context

Context

configure system cpm-http-redirect

Tree

cpm-http-redirect

Introduced

16.0.R4

Platforms

All

optimized-mode boolean

Synopsis

Enable optimized mode for CPM HTTP redirect messages

Context

configure system cpm-http-redirect optimized-mode boolean

Tree

optimized-mode

Default

true

Introduced

16.0.R4

Platforms

All

cron

Synopsis

Enter the cron context

Context

configure system cron

Tree

cron

Introduced

16.0.R1

Platforms

All

schedule [schedule-name] string owner string

Synopsis

Enter the schedule list instance

Context

configure system cron schedule string owner string

Tree

schedule

Max. Elements

255

Introduced

16.0.R1

Platforms

All

[schedule-name] string

Synopsis

Schedule name

Context

configure system cron schedule string owner string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

owner string

Synopsis

Schedule owner

Context

configure system cron schedule string owner string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the CRON schedule

Context

configure system cron schedule string owner string admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

count number

Synopsis

Number of times to repeat a periodic schedule run

Context

configure system cron schedule string owner string count number

Tree

count

Range

1 to 65535

Introduced

16.0.R1

Platforms

All

day-of-month number

Synopsis

Days in a month when a schedule runs

Context

configure system cron schedule string owner string day-of-month number

Tree

day-of-month

Range

-31 to -1 | 1 to 31

Max. Elements

62

Introduced

16.0.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system cron schedule string owner string description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

All

end-time

Synopsis

Enter the end-time context

Context

configure system cron schedule string owner string end-time

Tree

end-time

Introduced

16.0.R1

Platforms

All

date-and-time string

Synopsis

Date and time to stop triggering the schedule

Context

configure system cron schedule string owner string end-time date-and-time string

Tree

date-and-time

Notes

The following elements are part of a choice: date-and-time or (day and time).

Introduced

16.0.R1

Platforms

All

day keyword

Synopsis

Day to stop triggering this schedule

Context

configure system cron schedule string owner string end-time day keyword

Tree

day

Options

sunday, monday, tuesday, wednesday, thursday, friday, saturday

Notes

The following elements are part of a choice: date-and-time or (day and time).

Introduced

16.0.R1

Platforms

All

time string

Synopsis

Time to stop triggering the schedule

Context

configure system cron schedule string owner string end-time time string

Tree

time

String Length

5

Notes

The following elements are part of a choice: date-and-time or (day and time).

Introduced

16.0.R1

Platforms

All

hour number

Synopsis

Hours within a day when the schedule runs

Context

configure system cron schedule string owner string hour number

Tree

hour

Range

0 to 23

Max. Elements

24

Introduced

16.0.R1

Platforms

All

interval number

Synopsis

Time between each periodic schedule run

Context

configure system cron schedule string owner string interval number

Tree

interval

Range

30 to 42949672

Units

seconds

Introduced

16.0.R1

Platforms

All

minute number

Synopsis

Minutes in an hour when the schedule runs

Context

configure system cron schedule string owner string minute number

Tree

minute

Range

0 to 59

Max. Elements

60

Introduced

16.0.R1

Platforms

All

month (keyword | number)

Synopsis

Months when the schedule runs

Context

configure system cron schedule string owner string month (keyword | number)

Tree

month

Range

1 to 12

Options

january, february, march, april, may, june, july, august, september, october, november, december

Max. Elements

12

Introduced

16.0.R1

Platforms

All

script-policy

Synopsis

Enter the script-policy context

Context

configure system cron schedule string owner string script-policy

Tree

script-policy

Introduced

16.0.R1

Platforms

All

name string

Synopsis

Script policy name

Context

configure system cron schedule string owner string script-policy name string

Tree

name

String Length

1 to 32

Introduced

16.0.R1

Platforms

All

owner string

Synopsis

Script policy owner

Context

configure system cron schedule string owner string script-policy owner string

Tree

owner

String Length

1 to 32

Introduced

16.0.R1

Platforms

All

type keyword

Synopsis

Schedule type

Context

configure system cron schedule string owner string type keyword

Tree

type

Default

periodic

Options

periodic, calendar, oneshot

Introduced

16.0.R1

Platforms

All

weekday (keyword | number)

Synopsis

Weekdays when the schedule runs

Context

configure system cron schedule string owner string weekday (keyword | number)

Tree

weekday

Range

1 to 7

Options

sunday, monday, tuesday, wednesday, thursday, friday, saturday

Max. Elements

7

Introduced

16.0.R1

Platforms

All

dhcp6

Synopsis

Enter the dhcp6 context

Context

configure system dhcp6

Tree

dhcp6

Introduced

16.0.R4

Platforms

All

adv-noaddrs-global keyword

Synopsis

Applications to send NoAddrsAvail in Advertise messages

Context

configure system dhcp6 adv-noaddrs-global keyword

Tree

adv-noaddrs-global

Options

esm-relay, server

Max. Elements

2

Introduced

16.0.R4

Platforms

All

dns

Synopsis

Enter the dns context

Context

configure system dns

Tree

dns

Introduced

16.0.R1

Platforms

All

address-pref keyword

Synopsis

Preference in DNS address resolving order

Context

configure system dns address-pref keyword

Tree

address-pref

Options

ipv4-only, ipv6-first

Introduced

16.0.R1

Platforms

All

dnssec

Synopsis

Enter the dnssec context

Context

configure system dns dnssec

Tree

dnssec

Introduced

16.0.R1

Platforms

All

ad-validation keyword

Synopsis

Validation of AD-bit presence in DNS server responses

Context

configure system dns dnssec ad-validation keyword

Tree

ad-validation

Options

fall-through, drop

Introduced

16.0.R1

Platforms

All

efm-oam

Synopsis

Enter the efm-oam context

Context

configure system efm-oam

Tree

efm-oam

Introduced

16.0.R1

Platforms

All

dying-gasp-tx-on-reset boolean

Synopsis

Generate Information OAM PDU on soft reset notification

Context

configure system efm-oam dying-gasp-tx-on-reset boolean

Tree

dying-gasp-tx-on-reset

Default

false

Introduced

16.0.R1

Platforms

All

grace-tx boolean

Synopsis

Send Grace TLVs for soft reset graceful recovery events

Context

configure system efm-oam grace-tx boolean

Tree

grace-tx

Description

When configured to true, the system sends the Nokia Vendor specific Grace TLV in the information PDU after an ISSU or a soft reset. The Grace TLV informs a remote peer to ignore the negotiated interval and multiplier and instead use the new timeout interval.

By default, the command is disabled at the system level and enabled at the port level. Both the system and port level must be enabled to support grace on a specific port. When configured to true, the EFM-OAM protocol does not enter a non-operational state when both nodes acknowledge the grace function. This feature minimizes service interruption by giving the restarting router time to become operationally and administratively up within the grace period.

The peer receiving the Grace TLV must be able to parse and process the vendor-specific messaging. Do not configure grace if the Nokia Vendor Specific Grace TLV is not supported on the remote peer.

When configured to false, the Nokia Vendor Specific Grace TLV is not sent.

Default

false

Introduced

16.0.R1

Platforms

All

eth-cfm

Synopsis

Enter the eth-cfm context

Context

configure system eth-cfm

Tree

eth-cfm

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

grace boolean

Synopsis

Allow system level capability of grace messaging

Context

configure system eth-cfm grace boolean

Tree

grace

Default

true

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

md-auto-id

Synopsis

Enter the md-auto-id context

Context

configure system eth-cfm md-auto-id

Tree

md-auto-id

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ma-index-range

Synopsis

Enable the ma-index-range context

Context

configure system eth-cfm md-auto-id ma-index-range

Tree

ma-index-range

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

end number

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Upper bound of the range

Context

configure system eth-cfm md-auto-id ma-index-range end number

Tree

end

Range

1 to 4294967295

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

start number

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Lower bound of the range

Context

configure system eth-cfm md-auto-id ma-index-range start number

Tree

start

Range

1 to 4294967295

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

md-index-range

Synopsis

Enable the md-index-range context

Context

configure system eth-cfm md-auto-id md-index-range

Tree

md-index-range

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

end number

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Upper bound of the range

Context

configure system eth-cfm md-auto-id md-index-range end number

Tree

end

Range

1 to 4294967295

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

start number

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Lower bound of the range

Context

configure system eth-cfm md-auto-id md-index-range start number

Tree

start

Range

1 to 4294967295

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

redundancy

Synopsis

Enter the redundancy context

Context

configure system eth-cfm redundancy

Tree

redundancy

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

mc-lag

Synopsis

Enter the mc-lag context

Context

configure system eth-cfm redundancy mc-lag

Tree

mc-lag

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

propagate-hold-time (number | keyword)

Synopsis

Delay timer value for the fault propagation

Context

configure system eth-cfm redundancy mc-lag propagate-hold-time (number | keyword)

Tree

propagate-hold-time

Range

1 to 60

Default

1

Units

seconds

Options

none

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

standby-mep boolean

Synopsis

Allow standby MC-LAG MEPs to act administratively down

Context

configure system eth-cfm redundancy mc-lag standby-mep boolean

Tree

standby-mep

Default

false

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

sender-id

Synopsis

Enter the sender-id context

Context

configure system eth-cfm sender-id

Tree

sender-id

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

local-name string

Synopsis

Local name used in CFM PDUs

Context

configure system eth-cfm sender-id local-name string

Tree

local-name

String Length

1 to 45

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

type keyword

Synopsis

ETH-CFM sender ID to be used in CFM PDUs

Context

configure system eth-cfm sender-id type keyword

Tree

type

Default

system

Options

system, local

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

slm

Synopsis

Enter the slm context

Context

configure system eth-cfm slm

Tree

slm

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

inactivity-timer number

Synopsis

SLR inactivity timer to maintain the stale test data

Context

configure system eth-cfm slm inactivity-timer number

Tree

inactivity-timer

Range

10 to 100

Default

100

Units

seconds

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

grpc

Synopsis

Enter the grpc context

Context

configure system grpc

Tree

grpc

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of gRPC server

Context

configure system grpc admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

allow-unsecure-connection

Synopsis

Allow connection without secured transport protocol

Context

configure system grpc allow-unsecure-connection

Tree

allow-unsecure-connection

Description

When configured, this command allows an unsecured connection to remote managers; TCP connections are not encrypted, including username and password information.

Notes

The following elements are part of a choice: allow-unsecure-connection or tls-server-profile.

Introduced

16.0.R1

Platforms

All

gnmi

Synopsis

Enter the gnmi context

Context

configure system grpc gnmi

Tree

gnmi

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of gNMI service

Context

configure system grpc gnmi admin-state keyword

Tree

admin-state

Default

enable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

auto-config-save boolean

Synopsis

Automatically save configuration as part of operation

Context

configure system grpc gnmi auto-config-save boolean

Tree

auto-config-save

Default

false

Introduced

16.0.R1

Platforms

All

gnoi

Synopsis

Enter the gnoi context

Context

configure system grpc gnoi

Tree

gnoi

Introduced

19.10.R1

Platforms

All

cert-mgmt

Synopsis

Enter the cert-mgmt context

Context

configure system grpc gnoi cert-mgmt

Tree

cert-mgmt

Introduced

19.10.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of gNOI CertificateManagement

Context

configure system grpc gnoi cert-mgmt admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

19.10.R1

Platforms

All

file

Synopsis

Enter the file context

Context

configure system grpc gnoi file

Tree

file

Introduced

21.2.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the gNOI File service

Context

configure system grpc gnoi file admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

21.2.R1

Platforms

All

system

Synopsis

Enter the system context

Context

configure system grpc gnoi system

Tree

system

Introduced

20.5.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the gNOI System service

Context

configure system grpc gnoi system admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

20.5.R1

Platforms

All

max-msg-size number

Synopsis

Maximum size of received message

Context

configure system grpc max-msg-size number

Tree

max-msg-size

Range

1 to 1024

Default

512

Units

megabytes

Introduced

16.0.R1

Platforms

All

md-cli

Synopsis

Enter the md-cli context

Context

configure system grpc md-cli

Tree

md-cli

Introduced

20.5.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the MD-CLI service

Context

configure system grpc md-cli admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

20.5.R1

Platforms

All

rib-api

Synopsis

Enter the rib-api context

Context

configure system grpc rib-api

Tree

rib-api

Introduced

16.0.R4

Platforms

All

admin-state keyword

Synopsis

Administrative state of RibAPI service

Context

configure system grpc rib-api admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R4

Platforms

All

purge-timeout number

Synopsis

Number of seconds until stale entries are purged

Context

configure system grpc rib-api purge-timeout number

Tree

purge-timeout

Range

1 to 100000

Units

seconds

Introduced

16.0.R4

Platforms

All

tcp-keepalive

Synopsis

Enter the tcp-keepalive context

Context

configure system grpc tcp-keepalive

Tree

tcp-keepalive

Introduced

16.0.R4

Platforms

All

admin-state keyword

Synopsis

Administrative state of the TCP keepalive algorithm

Context

configure system grpc tcp-keepalive admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R4

Platforms

All

idle-time number

Synopsis

Time until the first TCP keepalive probe is sent

Context

configure system grpc tcp-keepalive idle-time number

Tree

idle-time

Description

This command configures the amount of time the connection must be idle before TCP keepalives are sent.

Range

1 to 100000

Default

600

Units

seconds

Introduced

16.0.R4

Platforms

All

interval number

Synopsis

Time between TCP keep-alive probes

Context

configure system grpc tcp-keepalive interval number

Tree

interval

Range

1 to 100000

Default

15

Units

seconds

Introduced

16.0.R4

Platforms

All

retries number

Synopsis

Number of probe retries before closing the connection

Context

configure system grpc tcp-keepalive retries number

Tree

retries

Description

This command configures the number of missed TCP keepalive probes before closing the TCP connection and attempting to reach the other destinations within the same destination group.

Range

3 to 100

Default

4

Introduced

16.0.R4

Platforms

All

tls-server-profile reference

Synopsis

Preferred TLS server profile

Context

configure system grpc tls-server-profile reference

Tree

tls-server-profile

Reference

configure system security tls server-tls-profile string

Notes

The following elements are part of a choice: allow-unsecure-connection or tls-server-profile.

Introduced

16.0.R1

Platforms

All

grpc-tunnel

Synopsis

Enter the grpc-tunnel context

Context

configure system grpc-tunnel

Tree

grpc-tunnel

Introduced

22.2.R1

Platforms

All

destination-group [name] string

Synopsis

Enter the destination-group list instance

Context

configure system grpc-tunnel destination-group string

Tree

destination-group

Description

Commands in this context configure parameters for destination groups.

Max. Elements

4

Introduced

22.2.R1

Platforms

All

[name] string

Synopsis

Destination group name

Context

configure system grpc-tunnel destination-group string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

22.2.R1

Platforms

All

allow-unsecure-connection

Synopsis

Allow unsecured operation of gRPC connections

Context

configure system grpc-tunnel destination-group string allow-unsecure-connection

Tree

allow-unsecure-connection

Description

This command allows a gRPC tunnel to run without a secured transport protocol. Data is transferred in unencrypted form.

Notes

The following elements are part of a choice: allow-unsecure-connection or tls-client-profile.

Introduced

22.2.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system grpc-tunnel destination-group string description string

Tree

description

String Length

1 to 80

Introduced

22.2.R1

Platforms

All

destination [address] (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number

Synopsis

Enter the destination list instance

Context

configure system grpc-tunnel destination-group string destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number

Tree

destination

Max. Elements

4

Notes

This element is ordered by the user.

Introduced

22.2.R1

Platforms

All

[address] (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name)

Synopsis

Address of the destination within the destination group

Context

configure system grpc-tunnel destination-group string destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number

String Length

1 to 255

Notes

This element is part of a list key.

Introduced

22.2.R1

Platforms

All

port number

Synopsis

TCP port number for the destination

Context

configure system grpc-tunnel destination-group string destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number

Range

1 to 65535

Notes

This element is part of a list key.

Introduced

22.2.R1

Platforms

All

local-source-address (ipv4-address-no-zone | ipv6-address-no-zone)

Synopsis

Local IP address of packets sent from the source

Context

configure system grpc-tunnel destination-group string destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number local-source-address (ipv4-address-no-zone | ipv6-address-no-zone)

Tree

local-source-address

Introduced

22.2.R1

Platforms

All

originated-qos-marking keyword

Synopsis

QoS marking used for gRPC tunnel packets

Context

configure system grpc-tunnel destination-group string destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number originated-qos-marking keyword

Tree

originated-qos-marking

Options

be, cp1, cp2, cp3, cp4, cp5, cp6, cp7, cs1, cp9, af11, cp11, af12, cp13, af13, cp15, cs2, cp17, af21, cp19, af22, cp21, af23, cp23, cs3, cp25, af31, cp27, af32, cp29, af33, cp31, cs4, cp33, af41, cp35, af42, cp37, af43, cp39, cs5, cp41, cp42, cp43, cp44, cp45, ef, cp47, nc1, cp49, cp50, cp51, cp52, cp53, cp54, cp55, nc2, cp57, cp58, cp59, cp60, cp61, cp62, cp63

Introduced

22.2.R1

Platforms

All

router-instance string

Synopsis

Router instance for the destination group

Context

configure system grpc-tunnel destination-group string destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number router-instance string

Tree

router-instance

Introduced

22.2.R1

Platforms

All

tcp-keepalive

Synopsis

Enter the tcp-keepalive context

Context

configure system grpc-tunnel destination-group string tcp-keepalive

Tree

tcp-keepalive

Introduced

22.2.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the TCP keepalive algorithm

Context

configure system grpc-tunnel destination-group string tcp-keepalive admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

22.2.R1

Platforms

All

idle-time number

Synopsis

Time until the first TCP keepalive probe is sent

Context

configure system grpc-tunnel destination-group string tcp-keepalive idle-time number

Tree

idle-time

Description

This command configures the amount of time the connection must be idle before TCP keepalives are sent.

Range

1 to 100000

Default

600

Units

seconds

Introduced

22.2.R1

Platforms

All

interval number

Synopsis

Time between TCP keep-alive probes

Context

configure system grpc-tunnel destination-group string tcp-keepalive interval number

Tree

interval

Range

1 to 100000

Default

15

Units

seconds

Introduced

22.2.R1

Platforms

All

retries number

Synopsis

Number of probe retries before closing the connection

Context

configure system grpc-tunnel destination-group string tcp-keepalive retries number

Tree

retries

Description

This command configures the number of missed TCP keepalive probes before closing the TCP connection and attempting to reach the other destinations within the same destination group.

Range

3 to 100

Default

4

Introduced

22.2.R1

Platforms

All

tls-client-profile reference

Synopsis

TLS client profile assigned to the destination group

Context

configure system grpc-tunnel destination-group string tls-client-profile reference

Tree

tls-client-profile

Reference

configure system security tls client-tls-profile string

Notes

The following elements are part of a choice: allow-unsecure-connection or tls-client-profile.

Introduced

22.2.R1

Platforms

All

tunnel [name] string

Synopsis

Enter the tunnel list instance

Context

configure system grpc-tunnel tunnel string

Tree

tunnel

Description

Commands in this context configure gRPC-tunnel-related parameters.

Max. Elements

4

Introduced

22.2.R1

Platforms

All

[name] string

Synopsis

Tunnel name

Context

configure system grpc-tunnel tunnel string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

22.2.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the tunnel

Context

configure system grpc-tunnel tunnel string admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

22.2.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system grpc-tunnel tunnel string description string

Tree

description

String Length

1 to 80

Introduced

22.2.R1

Platforms

All

destination-group reference

Synopsis

Destination group used in the tunnel

Context

configure system grpc-tunnel tunnel string destination-group reference

Tree

destination-group

Reference

configure system grpc-tunnel destination-group string

Introduced

22.2.R1

Platforms

All

handler [name] string

Synopsis

Enter the handler list instance

Context

configure system grpc-tunnel tunnel string handler string

Tree

handler

Description

Commands in this context configure handler parameters for this instance. Multiple handlers can be created for any tunnel.

Max. Elements

8

Introduced

22.2.R1

Platforms

All

[name] string

Synopsis

Handler name

Context

configure system grpc-tunnel tunnel string handler string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

22.2.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the handler

Context

configure system grpc-tunnel tunnel string handler string admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

22.2.R1

Platforms

All

port number

Synopsis

TCP port number the handler listens to internally

Context

configure system grpc-tunnel tunnel string handler string port number

Tree

port

Range

1 to 65535

Introduced

22.2.R1

Platforms

All

target-type

Synopsis

Enter the target-type context

Context

configure system grpc-tunnel tunnel string handler string target-type

Tree

target-type

Introduced

22.2.R1

Platforms

All

custom-type string

Synopsis

Custom string for target type

Context

configure system grpc-tunnel tunnel string handler string target-type custom-type string

Tree

custom-type

Description

This command configures a custom string for the target type. This string can correspond to specific values used by the gRPC tunnel protocol, such as GNMI_GNOI or SSH. If a custom string is defined, the gRPC tunnel client must specify the string to request a session for that handler. The string must be unique within a tunnel.

String Length

1 to 64

Notes

The following elements are part of a choice: custom-type, grpc-server, or ssh-server.

Introduced

22.2.R1

Platforms

All

grpc-server

Synopsis

Target type set to GNMI_GNOI

Context

configure system grpc-tunnel tunnel string handler string target-type grpc-server

Tree

grpc-server

Description

When configured, this command assigns the gRPC server as a handler for all tunnels sessions. At the gRPC tunnel protocol level, this corresponds to a value of GNMI_GNOI.

Notes

The following elements are part of a choice: custom-type, grpc-server, or ssh-server.

Introduced

22.2.R1

Platforms

All

ssh-server

Synopsis

Target type is SSH

Context

configure system grpc-tunnel tunnel string handler string target-type ssh-server

Tree

ssh-server

Description

When configured, this command assigns the SSH server as a handler for all tunnels sessions. At the gRPC tunnel protocol level, this corresponds to a value of SSH.

Notes

The following elements are part of a choice: custom-type, grpc-server, or ssh-server.

Introduced

22.2.R1

Platforms

All

target-name

Synopsis

Enter the target-name context

Context

configure system grpc-tunnel tunnel string target-name

Tree

target-name

Introduced

22.2.R1

Platforms

All

custom-string string

Synopsis

Custom target name

Context

configure system grpc-tunnel tunnel string target-name custom-string string

Tree

custom-string

String Length

1 to 64

Notes

The following elements are part of a choice: custom-string, node-name, or user-agent.

Introduced

22.2.R1

Platforms

All

node-name

Synopsis

Set the node name as target name

Context

configure system grpc-tunnel tunnel string target-name node-name

Tree

node-name

Description

When configured, this command uses the node name as the target name. The node name is configured by the configure system name command.

Notes

The following elements are part of a choice: custom-string, node-name, or user-agent.

Introduced

22.2.R1

Platforms

All

user-agent

Synopsis

Set the user agent as the target name

Context

configure system grpc-tunnel tunnel string target-name user-agent

Tree

user-agent

Description

When configured, this command uses the user agent as the target name. The agent is a string consisting of node-name:vendor:model:software-version.

Notes

The following elements are part of a choice: custom-string, node-name, or user-agent.

Introduced

22.2.R1

Platforms

All

icmp-vse boolean

Synopsis

Enable vendor-specific extensions to ICMP

Context

configure system icmp-vse boolean

Tree

icmp-vse

Default

false

Introduced

16.0.R1

Platforms

All

ip

Synopsis

Enter the ip context

Context

configure system ip

Tree

ip

Introduced

16.0.R1

Platforms

All

allow-qinq-network-interface boolean

Synopsis

Allow QinQ encapsulation for network interfaces

Context

configure system ip allow-qinq-network-interface boolean

Tree

allow-qinq-network-interface

Default

false

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

enforce-unique-if-index boolean

Synopsis

Create IP interface indexes that are globally unique

Context

configure system ip enforce-unique-if-index boolean

Tree

enforce-unique-if-index

Default

false

Introduced

16.0.R1

Platforms

All

forward-6in4 boolean

Synopsis

Allow forwarding of IPv6 over IPv4 sent to the system IP address

Context

configure system ip forward-6in4 boolean

Tree

forward-6in4

Default

false

Introduced

19.10.R1

Platforms

All

forward-ip-over-gre boolean

Synopsis

Allow forwarding of IP over GRE sent to the system IP address

Context

configure system ip forward-ip-over-gre boolean

Tree

forward-ip-over-gre

Default

false

Introduced

19.10.R1

Platforms

All

ipv6-eh keyword

Synopsis

Limit the number of IPv6 extension headers processed ingress/egress.

Context

configure system ip ipv6-eh keyword

Tree

ipv6-eh

Default

max

Options

max, limited

Introduced

20.5.R1

Platforms

All

mpls

Synopsis

Enter the mpls context

Context

configure system ip mpls

Tree

mpls

Introduced

19.10.R3

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

label-stack-statistics-count number

Synopsis

Collect traffic statistics on labels of the MPLS stack

Context

configure system ip mpls label-stack-statistics-count number

Tree

label-stack-statistics-count

Range

1 to 2

Default

1

Introduced

19.10.R3

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

l2tp

Synopsis

Enter the l2tp context

Context

configure system l2tp

Tree

l2tp

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

non-multi-chassis-tunnel-id-range

Synopsis

Enter the non-multi-chassis-tunnel-id-range context

Context

configure system l2tp non-multi-chassis-tunnel-id-range

Tree

non-multi-chassis-tunnel-id-range

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

end number

Synopsis

Upper bound of the range

Context

configure system l2tp non-multi-chassis-tunnel-id-range end number

Tree

end

Range

0 to 16383

Default

16383

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

start number

Synopsis

Lower bound of the range

Context

configure system l2tp non-multi-chassis-tunnel-id-range start number

Tree

start

Range

0 to 16383

Default

1

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

lacp

Synopsis

Enter the lacp context

Context

configure system lacp

Tree

lacp

Introduced

16.0.R1

Platforms

All

system-priority number

Synopsis

LACP system priority on aggregated Ethernet interfaces

Context

configure system lacp system-priority number

Tree

system-priority

Range

1 to 65535

Default

32768

Introduced

16.0.R1

Platforms

All

lldp

Synopsis

Enter the lldp context

Context

configure system lldp

Tree

lldp

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of LLDP

Context

configure system lldp admin-state keyword

Tree

admin-state

Default

enable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

message-fast-tx number

Synopsis

Interval at which LLDP frames are transmitted

Context

configure system lldp message-fast-tx number

Tree

message-fast-tx

Description

This command configures the interval at which LLDP frames are transmitted on behalf of the LLDP during a fast transmission period.

Range

1 to 3600

Default

1

Units

seconds

Introduced

16.0.R1

Platforms

All

message-fast-tx-init number

Synopsis

PDUs to transmit during the fast transmission period

Context

configure system lldp message-fast-tx-init number

Tree

message-fast-tx-init

Range

1 to 8

Default

4

Introduced

16.0.R1

Platforms

All

notification-interval number

Synopsis

Minimum interval between change notifications

Context

configure system lldp notification-interval number

Tree

notification-interval

Range

5 to 3600

Default

5

Units

seconds

Introduced

16.0.R1

Platforms

All

reinit-delay number

Synopsis

Time required before re-initializing LLDP on a port

Context

configure system lldp reinit-delay number

Tree

reinit-delay

Range

1 to 10

Default

2

Units

seconds

Introduced

16.0.R1

Platforms

All

tx-credit-max number

Synopsis

Maximum consecutive LLDPDUs that can be transmitted

Context

configure system lldp tx-credit-max number

Tree

tx-credit-max

Range

1 to 100

Default

5

Introduced

16.0.R1

Platforms

All

tx-hold-multiplier number

Synopsis

Transmit interval multiplier

Context

configure system lldp tx-hold-multiplier number

Tree

tx-hold-multiplier

Range

2 to 10

Default

4

Introduced

16.0.R1

Platforms

All

tx-interval number

Synopsis

LLDP transmit interval

Context

configure system lldp tx-interval number

Tree

tx-interval

Range

5 to 32768

Default

30

Units

seconds

Introduced

16.0.R1

Platforms

All

load-balancing

Synopsis

Enter the load-balancing context

Context

configure system load-balancing

Tree

load-balancing

Introduced

16.0.R1

Platforms

All

l2tp-load-balancing boolean

Synopsis

Include L2TP header information for load balancing

Context

configure system load-balancing l2tp-load-balancing boolean

Tree

l2tp-load-balancing

Default

false

Introduced

16.0.R4

Platforms

All

l4-load-balancing boolean

Synopsis

Use load balancing based on Layer 4 fields

Context

configure system load-balancing l4-load-balancing boolean

Tree

l4-load-balancing

Introduced

16.0.R1

Platforms

All

lsr-load-balancing keyword

Synopsis

Hashing algorithm for system-wide LSR load balancing

Context

configure system load-balancing lsr-load-balancing keyword

Tree

lsr-load-balancing

Options

lbl-only, lbl-ip, ip-only, eth-encap-ip, lbl-ip-l4-teid, lbl-ip-or-teid

Introduced

16.0.R1

Platforms

All

mc-enh-load-balancing boolean

Synopsis

Enable enhanced egress multicast load balancing

Context

configure system load-balancing mc-enh-load-balancing boolean

Tree

mc-enh-load-balancing

Default

false

Introduced

16.0.R1

Platforms

All

service-id-lag-hashing boolean

Synopsis

Enable enhanced VLL LAG service ID hashing

Context

configure system load-balancing service-id-lag-hashing boolean

Tree

service-id-lag-hashing

Default

false

Introduced

16.0.R1

Platforms

All

system-ip-load-balancing boolean

Synopsis

Use system IP address for ECMP and LAG load balancing

Context

configure system load-balancing system-ip-load-balancing boolean

Tree

system-ip-load-balancing

Introduced

16.0.R1

Platforms

All

location string

Synopsis

Site location of the system

Context

configure system location string

Tree

location

String Length

1 to 80

Introduced

16.0.R1

Platforms

All

login-control

Synopsis

Enter the login-control context

Context

configure system login-control

Tree

login-control

Introduced

16.0.R1

Platforms

All

exponential-backoff boolean

Synopsis

Enable exponential-backoff of the login prompt

Context

configure system login-control exponential-backoff boolean

Tree

exponential-backoff

Default

false

Introduced

16.0.R1

Platforms

All

ftp

Synopsis

Enter the ftp context

Context

configure system login-control ftp

Tree

ftp

Introduced

16.0.R1

Platforms

All

inbound-max-sessions number

Synopsis

Maximum number of concurrent inbound FTP sessions

Context

configure system login-control ftp inbound-max-sessions number

Tree

inbound-max-sessions

Range

0 to 5

Default

3

Introduced

16.0.R1

Platforms

All

idle-timeout (keyword | number)

Synopsis

Idle timeout for FTP, console, or Telnet sessions

Context

configure system login-control idle-timeout (keyword | number)

Tree

idle-timeout

Range

1 to 1440

Default

30

Units

minutes

Options

none

Introduced

16.0.R1

Platforms

All

login-banner boolean

Synopsis

Display login banner

Context

configure system login-control login-banner boolean

Tree

login-banner

Default

false

Introduced

16.0.R1

Platforms

All

login-scripts

Synopsis

Enter the login-scripts context

Context

configure system login-control login-scripts

Tree

login-scripts

Introduced

16.0.R1

Platforms

All

global-script string

Synopsis

URL of the global CLI login script

Context

configure system login-control login-scripts global-script string

Tree

global-script

String Length

1 to 180

Introduced

16.0.R1

Platforms

All

per-user-script

Synopsis

Enter the per-user-script context

Context

configure system login-control login-scripts per-user-script

Tree

per-user-script

Introduced

16.0.R1

Platforms

All

file-name string

Synopsis

File name of the per-user login script

Context

configure system login-control login-scripts per-user-script file-name string

Tree

file-name

String Length

1 to 180

Introduced

16.0.R1

Platforms

All

user-directory string

Synopsis

Directory name of user-defined login script

Context

configure system login-control login-scripts per-user-script user-directory string

Tree

user-directory

String Length

1 to 180

Introduced

16.0.R1

Platforms

All

motd

Synopsis

Enter the motd context

Context

configure system login-control motd

Tree

motd

Introduced

16.0.R1

Platforms

All

text string

Synopsis

Message of the day displayed after console login

Context

configure system login-control motd text string

Tree

text

String Length

1 to 900

Notes

The following elements are part of a choice: text or url.

Introduced

16.0.R1

Platforms

All

url string

Synopsis

URL of the location of message of the day

Context

configure system login-control motd url string

Tree

url

String Length

1 to 180

Notes

The following elements are part of a choice: text or url.

Introduced

16.0.R1

Platforms

All

pre-login-message

Synopsis

Enter the pre-login-message context

Context

configure system login-control pre-login-message

Tree

pre-login-message

Introduced

16.0.R1

Platforms

All

message string

Synopsis

Message displayed prior to the login prompt

Context

configure system login-control pre-login-message message string

Tree

message

String Length

1 to 900

Introduced

16.0.R1

Platforms

All

name boolean

Synopsis

Display the system name before the pre-login message

Context

configure system login-control pre-login-message name boolean

Tree

name

Default

false

Introduced

16.0.R1

Platforms

All

ssh

Synopsis

Enter the ssh context

Context

configure system login-control ssh

Tree

ssh

Introduced

16.0.R1

Platforms

All

graceful-shutdown boolean

Synopsis

Allow graceful shutdown of SSH sessions

Context

configure system login-control ssh graceful-shutdown boolean

Tree

graceful-shutdown

Default

true

Introduced

16.0.R1

Platforms

All

inbound-max-sessions number

Synopsis

Maximum number of concurrent inbound sessions

Context

configure system login-control ssh inbound-max-sessions number

Tree

inbound-max-sessions

Range

0 to 50

Default

5

Introduced

16.0.R1

Platforms

All

outbound-max-sessions number

Synopsis

Maximum number of concurrent outbound sessions

Context

configure system login-control ssh outbound-max-sessions number

Tree

outbound-max-sessions

Range

0 to 15

Default

5

Introduced

16.0.R1

Platforms

All

ttl-security number

Synopsis

Minimum TTL value for incoming packets

Context

configure system login-control ssh ttl-security number

Tree

ttl-security

Range

1 to 255

Introduced

16.0.R1

Platforms

All

telnet

Synopsis

Enter the telnet context

Context

configure system login-control telnet

Tree

telnet

Introduced

16.0.R1

Platforms

All

graceful-shutdown boolean

Synopsis

Allow graceful shutdown of Telnet sessions

Context

configure system login-control telnet graceful-shutdown boolean

Tree

graceful-shutdown

Default

false

Introduced

16.0.R1

Platforms

All

inbound-max-sessions number

Synopsis

Maximum number of concurrent inbound sessions

Context

configure system login-control telnet inbound-max-sessions number

Tree

inbound-max-sessions

Range

0 to 50

Default

5

Introduced

16.0.R1

Platforms

All

outbound-max-sessions number

Synopsis

Maximum number of concurrent outbound sessions

Context

configure system login-control telnet outbound-max-sessions number

Tree

outbound-max-sessions

Range

0 to 15

Default

5

Introduced

16.0.R1

Platforms

All

ttl-security number

Synopsis

Minimum TTL value for incoming packets

Context

configure system login-control telnet ttl-security number

Tree

ttl-security

Range

1 to 255

Introduced

16.0.R1

Platforms

All

management-interface

Synopsis

Enter the management-interface context

Context

configure system management-interface

Tree

management-interface

Introduced

16.0.R1

Platforms

All

cli

Synopsis

Enter the cli context

Context

configure system management-interface cli

Tree

cli

Introduced

16.0.R1

Platforms

All

classic-cli

Synopsis

Enter the classic-cli context

Context

configure system management-interface cli classic-cli

Tree

classic-cli

Introduced

16.0.R1

Platforms

All

allow-immediate boolean

Synopsis

Allow writable access in classic CLI configure branch

Context

configure system management-interface cli classic-cli allow-immediate boolean

Tree

allow-immediate

Default

true

Introduced

16.0.R1

Platforms

All

rollback

Synopsis

Enter the rollback context

Context

configure system management-interface cli classic-cli rollback

Tree

rollback

Introduced

16.0.R1

Platforms

All

local-checkpoints number

Synopsis

Maximum number of rollback files on compact flash

Context

configure system management-interface cli classic-cli rollback local-checkpoints number

Tree

local-checkpoints

Range

1 to 50

Default

10

Introduced

16.0.R1

Platforms

All

location string

Synopsis

Location and filename of the rollback checkpoint files

Context

configure system management-interface cli classic-cli rollback location string

Tree

location

String Length

1 to 180

Introduced

16.0.R1

Platforms

All

remote-checkpoints number

Synopsis

Maximum rollback files saved at a remote location

Context

configure system management-interface cli classic-cli rollback remote-checkpoints number

Tree

remote-checkpoints

Range

1 to 200

Default

10

Introduced

16.0.R1

Platforms

All

rescue

Synopsis

Enter the rescue context

Context

configure system management-interface cli classic-cli rollback rescue

Tree

rescue

Introduced

16.0.R1

Platforms

All

location string

Synopsis

Location of the rollback rescue file

Context

configure system management-interface cli classic-cli rollback rescue location string

Tree

location

String Length

1 to 180

Introduced

16.0.R1

Platforms

All

cli-engine keyword

Synopsis

System-wide CLI engine access configuration

Context

configure system management-interface cli cli-engine keyword

Tree

cli-engine

Default

md-cli

Options

classic-cli, md-cli

Max. Elements

2

Notes

This element is ordered by the user.

Introduced

16.0.R1

Platforms

All

md-cli

Synopsis

Enter the md-cli context

Context

configure system management-interface cli md-cli

Tree

md-cli

Introduced

16.0.R1

Platforms

All

auto-config-save boolean

Synopsis

Automatically save configuration as part of operation

Context

configure system management-interface cli md-cli auto-config-save boolean

Tree

auto-config-save

Default

false

Introduced

16.0.R1

Platforms

All

environment

Synopsis

Enter the environment context

Context

configure system management-interface cli md-cli environment

Tree

environment

Introduced

16.0.R1

Platforms

All

command-alias

Synopsis

Enter the command-alias context

Context

configure system management-interface cli md-cli environment command-alias

Tree

command-alias

Introduced

21.7.R1

Platforms

All

alias [alias-name] string

Synopsis

Enter the alias list instance

Context

configure system management-interface cli md-cli environment command-alias alias string

Tree

alias

Description

Commands in this context create aliases to existing MD-CLI commands or to Python applications.

Aliases may be mounted for use globally or for selected context paths. Arguments and output modifiers may be provided to aliases at configuration or run time.

Introduced

21.7.R1

Platforms

All

[alias-name] string

Synopsis

Alias name

Context

configure system management-interface cli md-cli environment command-alias alias string

String Length

1 to 64

Notes

This element is part of a list key.

Introduced

21.7.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the alias

Context

configure system management-interface cli md-cli environment command-alias alias string admin-state keyword

Tree

admin-state

Description

This command controls the administrative state of the MD-CLI alias.

MD-CLI aliases that are administratively disabled cannot be executed, do not autocomplete in operational mode, and do not appear in ? help.

Default

disable

Options

enable, disable

Introduced

21.10.R1

Platforms

All

cli-command string

Synopsis

CLI command to run when executing the alias

Context

configure system management-interface cli md-cli environment command-alias alias string cli-command string

Tree

cli-command

String Length

1 to 255

Notes

The following elements are part of a mandatory choice: cli-command or python-script.

Introduced

21.7.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system management-interface cli md-cli environment command-alias alias string description string

Tree

description

String Length

1 to 110

Introduced

21.7.R1

Platforms

All

mount-point [path] (keyword | string)

Synopsis

Add a list entry for mount-point

Context

configure system management-interface cli md-cli environment command-alias alias string mount-point (keyword | string)

Tree

mount-point

Min. Elements

1

Introduced

21.7.R1

Platforms

All

[path] (keyword | string)

Synopsis

Mount point where alias is available

Context

configure system management-interface cli md-cli environment command-alias alias string mount-point (keyword | string)

String Length

1 to 255

Options

global

Notes

This element is part of a list key.

Introduced

21.7.R1

Platforms

All

python-script reference

Synopsis

Python script to run when executing the alias

Context

configure system management-interface cli md-cli environment command-alias alias string python-script reference

Tree

python-script

Reference

configure python python-script string

Notes

The following elements are part of a mandatory choice: cli-command or python-script.

Introduced

21.7.R1

Platforms

All

command-completion

Synopsis

Enter the command-completion context

Context

configure system management-interface cli md-cli environment command-completion

Tree

command-completion

Introduced

16.0.R1

Platforms

All

enter boolean

Synopsis

Complete the command when the Enter key is pressed

Context

configure system management-interface cli md-cli environment command-completion enter boolean

Tree

enter

Default

true

Introduced

16.0.R1

Platforms

All

space boolean

Synopsis

Complete the command when the Space key is pressed

Context

configure system management-interface cli md-cli environment command-completion space boolean

Tree

space

Default

true

Introduced

16.0.R1

Platforms

All

tab boolean

Synopsis

Complete the command when the Tab key is pressed

Context

configure system management-interface cli md-cli environment command-completion tab boolean

Tree

tab

Default

true

Introduced

16.0.R1

Platforms

All

console

Synopsis

Enter the console context

Context

configure system management-interface cli md-cli environment console

Tree

console

Introduced

16.0.R1

Platforms

All

length number

Synopsis

Number of lines displayed on the screen

Context

configure system management-interface cli md-cli environment console length number

Tree

length

Range

24 to 512

Default

24

Introduced

16.0.R1

Platforms

All

width number

Synopsis

Number of columns displayed on the screen

Context

configure system management-interface cli md-cli environment console width number

Tree

width

Range

80 to 512

Default

80

Introduced

16.0.R1

Platforms

All

info-output

Synopsis

Enter the info-output context

Context

configure system management-interface cli md-cli environment info-output

Tree

info-output

Introduced

22.2.R1

Platforms

All

always-display

Synopsis

Enter the always-display context

Context

configure system management-interface cli md-cli environment info-output always-display

Tree

always-display

Description

Commands in this context specify elements that are always displayed in the info output, regardless of whether the detail option is used.

Introduced

22.2.R1

Platforms

All

admin-state boolean

Synopsis

Display admin-state elements

Context

configure system management-interface cli md-cli environment info-output always-display admin-state boolean

Tree

admin-state

Description

When configured to true, the values of the admin-state elements in info output (without the detail option) are always displayed, even if they are the default values.

Default

false

Introduced

22.2.R1

Platforms

All

message-severity-level

Synopsis

Enter the message-severity-level context

Context

configure system management-interface cli md-cli environment message-severity-level

Tree

message-severity-level

Introduced

16.0.R1

Platforms

All

cli keyword

Synopsis

Message severity threshold for CLI messages

Context

configure system management-interface cli md-cli environment message-severity-level cli keyword

Tree

cli

Default

info

Options

warning, info

Introduced

16.0.R1

Platforms

All

more boolean

Synopsis

Prompt to continue or stop when output text fills page

Context

configure system management-interface cli md-cli environment more boolean

Tree

more

Default

true

Introduced

16.0.R1

Platforms

All

progress-indicator

Synopsis

Enter the progress-indicator context

Context

configure system management-interface cli md-cli environment progress-indicator

Tree

progress-indicator

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the progress indicator

Context

configure system management-interface cli md-cli environment progress-indicator admin-state keyword

Tree

admin-state

Default

enable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

delay number

Synopsis

Delay before progress indicator is displayed

Context

configure system management-interface cli md-cli environment progress-indicator delay number

Tree

delay

Range

0 to 10000

Default

1000

Units

milliseconds

Introduced

16.0.R1

Platforms

All

type keyword

Synopsis

Progress indicator output style

Context

configure system management-interface cli md-cli environment progress-indicator type keyword

Tree

type

Default

dots

Options

dots

Introduced

16.0.R1

Platforms

All

prompt

Synopsis

Enter the prompt context

Context

configure system management-interface cli md-cli environment prompt

Tree

prompt

Introduced

16.0.R1

Platforms

All

context boolean

Synopsis

Show the current command context in the prompt

Context

configure system management-interface cli md-cli environment prompt context boolean

Tree

context

Default

true

Introduced

16.0.R1

Platforms

All

newline boolean

Synopsis

Add a new line before every prompt line

Context

configure system management-interface cli md-cli environment prompt newline boolean

Tree

newline

Default

true

Introduced

16.0.R1

Platforms

All

timestamp boolean

Synopsis

Show the timestamp before the first prompt line

Context

configure system management-interface cli md-cli environment prompt timestamp boolean

Tree

timestamp

Default

false

Introduced

16.0.R1

Platforms

All

uncommitted-changes-indicator boolean

Synopsis

Show an asterisk (*) when uncommitted changes exist

Context

configure system management-interface cli md-cli environment prompt uncommitted-changes-indicator boolean

Tree

uncommitted-changes-indicator

Default

true

Introduced

16.0.R1

Platforms

All

python

Synopsis

Enter the python context

Context

configure system management-interface cli md-cli environment python

Tree

python

Introduced

21.10.R1

Platforms

All

memory-reservation number

Synopsis

Memory reserved per interpreter

Context

configure system management-interface cli md-cli environment python memory-reservation number

Tree

memory-reservation

Range

1 to 500

Units

megabytes

Introduced

21.10.R1

Platforms

All

minimum-available-memory number

Synopsis

Minimum memory requirement to spawn Python interpreter

Context

configure system management-interface cli md-cli environment python minimum-available-memory number

Tree

minimum-available-memory

Range

5 to 50

Units

percent

Introduced

21.10.R1

Platforms

All

timeout number

Synopsis

Maximum run time before a Python application is stopped

Context

configure system management-interface cli md-cli environment python timeout number

Tree

timeout

Range

30 to 86400

Default

3600

Units

seconds

Introduced

21.10.R1

Platforms

All

time-display keyword

Synopsis

Time zone to display time

Context

configure system management-interface cli md-cli environment time-display keyword

Tree

time-display

Description

This command configures the time zone for a timestamp displayed in outputs, such as event logs and traps for the current CLI session.

Log files on compact flash are maintained and displayed in UTC format.

Default

local

Options

local, utc

Introduced

16.0.R1

Platforms

All

time-format keyword

Synopsis

Time format to display date and time

Context

configure system management-interface cli md-cli environment time-format keyword

Tree

time-format

Description

This command specifies the format of the time display in configuration, state, and certain show command output in the current CLI session.

Default

rfc-3339

Options

iso-8601, rfc-1123, rfc-3339

Introduced

20.5.R1

Platforms

All

commit-history number

Synopsis

Number of commit history IDs to store

Context

configure system management-interface commit-history number

Tree

commit-history

Description

This command sets the number of IDs to store in the commit history.

Setting the value to 0 disables the commit history.

Range

0 to 200

Default

50

Introduced

21.10.R1

Platforms

All

configuration-mode keyword

Synopsis

Configuration mode for the system

Context

configure system management-interface configuration-mode keyword

Tree

configuration-mode

Default

classic

Options

classic, model-driven, mixed

Introduced

16.0.R1

Platforms

All

configuration-save

Synopsis

Enter the configuration-save context

Context

configure system management-interface configuration-save

Tree

configuration-save

Introduced

16.0.R1

Platforms

All

configuration-backups number

Synopsis

Maximum number of backup versions maintained

Context

configure system management-interface configuration-save configuration-backups number

Tree

configuration-backups

Range

1 to 200

Default

5

Introduced

16.0.R1

Platforms

All

netconf

Synopsis

Enter the netconf context

Context

configure system management-interface netconf

Tree

netconf

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of NETCONF

Context

configure system management-interface netconf admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

auto-config-save boolean

Synopsis

Automatically save configuration as part of operation

Context

configure system management-interface netconf auto-config-save boolean

Tree

auto-config-save

Default

false

Introduced

16.0.R1

Platforms

All

capabilities

Synopsis

Enter the capabilities context

Context

configure system management-interface netconf capabilities

Tree

capabilities

Introduced

16.0.R1

Platforms

All

candidate boolean

Synopsis

Allow the NETCONF server to access the candidate datastore

Context

configure system management-interface netconf capabilities candidate boolean

Tree

candidate

Default

true

Introduced

16.0.R1

Platforms

All

writable-running boolean

Synopsis

Allow NETCONF server to access the running datastore

Context

configure system management-interface netconf capabilities writable-running boolean

Tree

writable-running

Default

false

Introduced

16.0.R1

Platforms

All

port number

Synopsis

Choose port on which the NETCONF server will listen for new connections.

Context

configure system management-interface netconf port number

Tree

port

Range

22 | 830

Default

830

Introduced

19.10.R1

Platforms

All

operations

Synopsis

Enter the operations context

Context

configure system management-interface operations

Tree

operations

Description

Commands in this context configure parameters associated with operational commands in model-driven interfaces.

Introduced

21.5.R1

Platforms

All

global-timeouts

Synopsis

Enter the global-timeouts context

Context

configure system management-interface operations global-timeouts

Tree

global-timeouts

Description

Commands in this context configure system timeout parameters for operational commands.

Timeout parameters provide default system-level control for various types of operational commands in model-driven interfaces. The timeout values are used when specific execution and retention timeouts are not requested for a specific operation.

Introduced

21.5.R1

Platforms

All

asynchronous-execution (number | keyword)

Synopsis

Timeout for asynchronous operation execution

Context

configure system management-interface operations global-timeouts asynchronous-execution (number | keyword)

Tree

asynchronous-execution

Description

This command configures the period of time that operations launched as “asynchronous” are allowed to execute before being automatically stopped by the SR OS.

An asynchronous operation is not deleted from the system when it is stopped. See the asynchronous-retention command.

If a specific execution timeout is not included in the request for a particular asynchronous operation, this system-level timeout applies.

Note: This execution timeout is part of the general global operations infrastructure and is separate and independent from any operation-specific timeouts (for example, the ping operation also has its own timeout parameter).

Range

1 to 604800

Default

3600

Units

seconds

Options

never

Introduced

21.5.R1

Platforms

All

asynchronous-retention (number | keyword)

Synopsis

Timeout for asynchronous operation data retention

Context

configure system management-interface operations global-timeouts asynchronous-retention (number | keyword)

Tree

asynchronous-retention

Description

This command configures the period of time that data related to operations launched as “asynchronous” is retained in the system. After the retention timeout expires, all information related to the operation is deleted, including any status information and result data.

If a specific retention timeout is not included in the request for a particular asynchronous operation, this system-level timeout applies.

Range

1 to 604800

Default

86400

Units

seconds

Options

never

Introduced

21.5.R1

Platforms

All

synchronous-execution (number | keyword)

Synopsis

Timeout for synchronous operation execution

Context

configure system management-interface operations global-timeouts synchronous-execution (number | keyword)

Tree

synchronous-execution

Description

This command configures the period of time that operations launched as “'synchronous” (the default method for all operations) are allowed to execute before they are automatically stopped, and their associated data is deleted.

If a specific execution timeout is not included in the request for a particular synchronous operation, this system-level timeout applies.

Note: This execution timeout is part of the general global operations infrastructure and is separate and independent from any operation-specific timeouts (for example, the ping operation also has its own timeout parameter).

Caution: If this command is set with a specific time value, MD-CLI operations are subject to the timeout and are interrupted if they execute longer than the time value. This situation can arise because the timeout also applies to operations requested in the MD-CLI interface (for example, ping, file dir, and so on).

Range

1 to 604800

Default

never

Units

seconds

Options

never

Introduced

21.5.R1

Platforms

All

remote-management

Synopsis

Enter the remote-management context

Context

configure system management-interface remote-management

Tree

remote-management

Description

Commands in this context configure remote management to manage multiple SR OS nodes running different SR OS versions from the same MD-CLI shell.

Introduced

20.5.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of remote management registration

Context

configure system management-interface remote-management admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

20.5.R1

Platforms

All

allow-unsecure-connection

Synopsis

Allow connection without secured transport protocol

Context

configure system management-interface remote-management allow-unsecure-connection

Tree

allow-unsecure-connection

Description

When configured, this command allows an unsecured connection to remote managers; TCP connections are not encrypted, including username and password information.

Notes

The following elements are part of a choice: allow-unsecure-connection or client-tls-profile.

Introduced

20.5.R1

Platforms

All

client-tls-profile reference

Synopsis

TLS client profile name

Context

configure system management-interface remote-management client-tls-profile reference

Tree

client-tls-profile

Description

This command specifies the client TLS profile to all remote managers.

Reference

configure system security tls client-tls-profile string

Notes

The following elements are part of a choice: allow-unsecure-connection or client-tls-profile.

Introduced

20.5.R1

Platforms

All

connection-timeout number

Synopsis

Time without a response before manager declared down

Context

configure system management-interface remote-management connection-timeout number

Tree

connection-timeout

Range

1 to 3600

Default

60

Units

seconds

Introduced

20.5.R1

Platforms

All

device-label string

Synopsis

Device label supplied to the remote manager

Context

configure system management-interface remote-management device-label string

Tree

device-label

Description

This command specifies a metadata label that is supplied to the manager. This label is used to group devices or network nodes with a common purpose or goal.

String Length

1 to 64

Introduced

20.5.R1

Platforms

All

device-name string

Synopsis

Device name supplied to the remote manager

Context

configure system management-interface remote-management device-name string

Tree

device-name

Description

This command specifies a device name that is supplied to the manager. The name identifies a specific SR OS node in the network.

When unconfigured, the default system name is used.

String Length

1 to 64

Introduced

20.5.R1

Platforms

All

hello-interval number

Synopsis

Time between hello messages from SR OS node to manager

Context

configure system management-interface remote-management hello-interval number

Tree

hello-interval

Range

10 to 216000

Default

600

Units

seconds

Introduced

20.5.R1

Platforms

All

manager [manager-name] string

Synopsis

Enter the manager list instance

Context

configure system management-interface remote-management manager string

Tree

manager

Description

Commands in this context configure specific manager-related commands. Commands configured in this context take precedence over command values specified directly in the configure management-interface remote-management context.

If a command is not configured in this context, the command setting is inherited from the higher level context.

Max. Elements

2

Introduced

20.5.R1

Platforms

All

[manager-name] string

Synopsis

Remote management manager name

Context

configure system management-interface remote-management manager string

String Length

1 to 64

Notes

This element is part of a list key.

Introduced

20.5.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of remote management registration

Context

configure system management-interface remote-management manager string admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

20.5.R1

Platforms

All

allow-unsecure-connection

Synopsis

Allow connection without secured transport protocol

Context

configure system management-interface remote-management manager string allow-unsecure-connection

Tree

allow-unsecure-connection

Description

When configured, this command allows an unsecured connection to remote managers; TCP connections are not encrypted, including username and password information.

Notes

The following elements are part of a choice: allow-unsecure-connection or client-tls-profile.

Introduced

20.5.R1

Platforms

All

client-tls-profile reference

Synopsis

TLS client profile name

Context

configure system management-interface remote-management manager string client-tls-profile reference

Tree

client-tls-profile

Description

This command assigns a profile name to a remote manager.

Reference

configure system security tls client-tls-profile string

Notes

The following elements are part of a choice: allow-unsecure-connection or client-tls-profile.

Introduced

20.5.R1

Platforms

All

connection-timeout number

Synopsis

Max time without response before manager declared down

Context

configure system management-interface remote-management manager string connection-timeout number

Tree

connection-timeout

Range

1 to 3600

Units

seconds

Introduced

20.5.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system management-interface remote-management manager string description string

Tree

description

String Length

1 to 80

Introduced

20.5.R1

Platforms

All

device-label string

Synopsis

Device label supplied to the remote manager

Context

configure system management-interface remote-management manager string device-label string

Tree

device-label

Description

This command specifies a metadata label that is supplied to the manager. This label is used to group devices or network nodes with a common purpose or goal.

String Length

1 to 64

Introduced

20.5.R1

Platforms

All

device-name string

Synopsis

Device name supplied to the remote manager

Context

configure system management-interface remote-management manager string device-name string

Tree

device-name

Description

This command specifies a device name that is supplied to the manager. The name identifies a specific SR OS node in the network.

When unconfigured, the default system name is used.

String Length

1 to 64

Introduced

20.5.R1

Platforms

All

manager-address (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name)

Synopsis

Destination IP address of the manager

Context

configure system management-interface remote-management manager string manager-address (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name)

Tree

manager-address

String Length

1 to 255

Introduced

20.5.R1

Platforms

All

manager-port number

Synopsis

Destination TCP port for gRPC connections to manager

Context

configure system management-interface remote-management manager string manager-port number

Tree

manager-port

Range

1 to 65535

Default

57400

Introduced

20.5.R1

Platforms

All

router-instance string

Synopsis

Reference to a router or VPRN service name

Context

configure system management-interface remote-management manager string router-instance string

Tree

router-instance

Introduced

20.5.R1

Platforms

All

source-address (ipv4-address-no-zone | ipv6-address-no-zone)

Synopsis

Source IP address for connection to the manager

Context

configure system management-interface remote-management manager string source-address (ipv4-address-no-zone | ipv6-address-no-zone)

Tree

source-address

Introduced

20.5.R1

Platforms

All

source-port (number | keyword)

Synopsis

Source TCP destination port number

Context

configure system management-interface remote-management manager string source-port (number | keyword)

Tree

source-port

Range

1 to 65535

Options

grpc-default

Introduced

20.5.R1

Platforms

All

router-instance string

Synopsis

Router name or VPRN service name

Context

configure system management-interface remote-management router-instance string

Tree

router-instance

Default

management

Introduced

20.5.R1

Platforms

All

source-address (ipv4-address-no-zone | ipv6-address-no-zone)

Synopsis

Source IP address for connection to the manager

Context

configure system management-interface remote-management source-address (ipv4-address-no-zone | ipv6-address-no-zone)

Tree

source-address

Introduced

20.5.R1

Platforms

All

source-port (number | keyword)

Synopsis

Source TCP port number to connection to the manager

Context

configure system management-interface remote-management source-port (number | keyword)

Tree

source-port

Range

1 to 65535

Default

grpc-default

Options

grpc-default

Introduced

20.5.R1

Platforms

All

schema-path string

Synopsis

Schema path URL

Context

configure system management-interface schema-path string

Tree

schema-path

Description

This command specifies the schema path where the SR OS YANG modules can be manually copied by the user prior to using a <get-schema> request. It is recommended that the URL string not exceed 135 characters for the <get-schema> request to work properly with all schema files.

When unconfigured, the software upgrade process manages the YANG schema files to ensure the schema files are synchronized with the software image on both the primary and standby CPM.

String Length

1 to 180

Introduced

16.0.R4

Platforms

All

snmp

Synopsis

Enter the snmp context

Context

configure system management-interface snmp

Tree

snmp

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the SNMP daemon

Context

configure system management-interface snmp admin-state keyword

Tree

admin-state

Default

enable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

engine-id string

Synopsis

SNMP engine ID that identifies the SNMPv3 node

Context

configure system management-interface snmp engine-id string

Tree

engine-id

String Length

10 to 64

Introduced

16.0.R1

Platforms

All

general-port number

Synopsis

Port number to be used to send general SNMP messages.

Context

configure system management-interface snmp general-port number

Tree

general-port

Range

0 | 1 to 65535

Default

161

Introduced

16.0.R1

Platforms

All

packet-size number

Synopsis

Maximum SNMP packet size generated by the node

Context

configure system management-interface snmp packet-size number

Tree

packet-size

Range

484 to 9216

Default

1500

Introduced

16.0.R1

Platforms

All

streaming

Synopsis

Enter the streaming context

Context

configure system management-interface snmp streaming

Tree

streaming

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the streaming daemon

Context

configure system management-interface snmp streaming admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

yang-modules

Synopsis

Enter the yang-modules context

Context

configure system management-interface yang-modules

Tree

yang-modules

Description

Commands in this context determine the system support of the Nokia YANG models.

The settings affect the data sent in a NETCONF <hello>, data populated in the RFC 6022 /netconf-state/schemas list, data returned in a <get-schema> request, and data populated in the RFC 8525 /yang-library.

Introduced

16.0.R1

Platforms

All

base-r13-modules boolean

Synopsis

Support base release 13 YANG models

Context

configure system management-interface yang-modules base-r13-modules boolean

Tree

base-r13-modules

Default

false

Introduced

16.0.R1

Platforms

All

nmda

Synopsis

Enter the nmda context

Context

configure system management-interface yang-modules nmda

Tree

nmda

Description

Commands in this context configure the attributes for the Network Management Datastores Architecture (NMDA).

Introduced

21.7.R1

Platforms

All

nmda-support boolean

Synopsis

Advertise NMDA support over NETCONF

Context

configure system management-interface yang-modules nmda nmda-support boolean

Tree

nmda-support

Description

When configured to true, this command enables the advertisement of NMDA support over NETCONF through the use of YANG library 1.1.

When configured to false, this command disables NMDA advertisement over NETCONF and YANG library 1.0 is used.

Default

false

Introduced

21.7.R1

Platforms

All

nokia-combined-modules boolean

Synopsis

Support access to combined Nokia YANG models

Context

configure system management-interface yang-modules nokia-combined-modules boolean

Tree

nokia-combined-modules

Description

When configured to true, the system supports the combined Nokia YANG files for both configuration and state data in the NETCONF server.

When the system is operating in classic configuration mode, attempts to access (read or write) the configuration using the Nokia configuration modules or namespace via NETCONF result in errors, even if this command is set to true.

When configured to false, access to the combined Nokia YANG files is not supported.

This command and the nokia-submodules command cannot both be set to true at the same time.

Introduced

16.0.R4

Platforms

All

nokia-submodules boolean

Synopsis

Support submodule-based packaging of Nokia YANG models

Context

configure system management-interface yang-modules nokia-submodules boolean

Tree

nokia-submodules

Description

When configured to true, the system supports the alternative submodule-based packaging of the Nokia YANG files for both configuration and state data in the NETCONF server.

When the system is operating in classic configuration mode, attempts to access (read or write) the configuration using the Nokia configuration modules or namespace via NETCONF result in errors, even if this command is set to true.

When configured to false, access to the submodule-based packaging of the Nokia YANG files is not supported.

This command and the nokia-combined-modules command cannot both be set to true at the same time.

Introduced

21.2.R1

Platforms

All

openconfig-modules boolean

Synopsis

Support OpenConfig YANG models

Context

configure system management-interface yang-modules openconfig-modules boolean

Tree

openconfig-modules

Default

false

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

name string

Synopsis

Administrative name assigned to the system

Context

configure system name string

Tree

name

String Length

1 to 64

Introduced

16.0.R1

Platforms

All

network-element-discovery

Synopsis

Enter the network-element-discovery context

Context

configure system network-element-discovery

Tree

network-element-discovery

Introduced

19.5.R1

Platforms

All

generate-traps boolean

Synopsis

Generate NE discovery traps

Context

configure system network-element-discovery generate-traps boolean

Tree

generate-traps

Default

false

Introduced

19.5.R1

Platforms

All

profile [name] string

Synopsis

Enter the profile list instance

Context

configure system network-element-discovery profile string

Tree

profile

Max. Elements

1

Introduced

19.5.R1

Platforms

All

[name] string

Synopsis

Profile name

Context

configure system network-element-discovery profile string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

19.5.R1

Platforms

All

neid string

Synopsis

Network element ID of the advertised node

Context

configure system network-element-discovery profile string neid string

Tree

neid

String Length

7 to 8

Introduced

19.5.R1

Platforms

All

neip

Synopsis

Enter the neip context

Context

configure system network-element-discovery profile string neip

Tree

neip

Introduced

19.5.R1

Platforms

All

auto-generate

Synopsis

Enter the auto-generate context

Context

configure system network-element-discovery profile string neip auto-generate

Tree

auto-generate

Introduced

21.2.R1

Platforms

All

ipv4

Synopsis

Enable the ipv4 context

Context

configure system network-element-discovery profile string neip auto-generate ipv4

Tree

ipv4

Introduced

21.2.R1

Platforms

All

vendor-id-value number

Synopsis

Most significant byte if the NE IPv4 address

Context

configure system network-element-discovery profile string neip auto-generate ipv4 vendor-id-value number

Tree

vendor-id-value

Range

1 to 255

Default

140

Introduced

21.2.R1

Platforms

All

ipv6

Synopsis

Enable the ipv6 context

Context

configure system network-element-discovery profile string neip auto-generate ipv6

Tree

ipv6

Introduced

21.2.R1

Platforms

All

vendor-id-value number

Synopsis

Most significant byte of the NE IPv6 address

Context

configure system network-element-discovery profile string neip auto-generate ipv6 vendor-id-value number

Tree

vendor-id-value

Range

1 to 255

Default

140

Introduced

21.2.R1

Platforms

All

ipv4 string

Synopsis

NEIP IPv4 address

Context

configure system network-element-discovery profile string neip ipv4 string

Tree

ipv4

Introduced

19.5.R1

Platforms

All

ipv6 string

Synopsis

NEIP IPv6 address

Context

configure system network-element-discovery profile string neip ipv6 string

Tree

ipv6

Introduced

19.5.R1

Platforms

All

platform-type string

Synopsis

Platform name and chassis type to be advertised

Context

configure system network-element-discovery profile string platform-type string

Tree

platform-type

String Length

1 to 255

Introduced

19.5.R1

Platforms

All

system-mac string

Synopsis

MAC address of the advertised node

Context

configure system network-element-discovery profile string system-mac string

Tree

system-mac

Introduced

19.5.R1

Platforms

All

vendor-id string

Synopsis

Vendor ID to be advertised

Context

configure system network-element-discovery profile string vendor-id string

Tree

vendor-id

String Length

1 to 255

Default

Nokia

Introduced

19.5.R1

Platforms

All

ospf-dynamic-hostnames boolean

Synopsis

Process received OSPF dynamic hostname information

Context

configure system ospf-dynamic-hostnames boolean

Tree

ospf-dynamic-hostnames

Description

When configured to true, OSPF dynamic hostnames are enabled. The router receiving the new dynamic hostname within the OSPF Router Information (RI) LSA is instructed to process the received dynamic hostname information.

When configured to false, dynamic hostname information is not processed.

Default

false

Introduced

20.2.R1

Platforms

All

persistence

Synopsis

Enter the persistence context

Context

configure system persistence

Tree

persistence

Description

Commands in this context configure persistence on the system.

The persistence feature enables the system to retain state information learned through DHCP snooping across reboots. This information includes data such as the IP address and MAC binding information, lease-length information, and ingress SAP information (required for VPLS snooping to identify the ingress interface).

If persistence is enabled when there are no DHCP relay or snooping commands enabled, the system creates an empty file.

Introduced

16.0.R1

Platforms

All

ancp

Synopsis

Enter the ancp context

Context

configure system persistence ancp

Tree

ancp

Introduced

16.0.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system persistence ancp description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

All

location keyword

Synopsis

CPM flash card where the information is stored

Context

configure system persistence ancp location keyword

Tree

location

Options

cf1, cf2, cf3

Introduced

16.0.R1

Platforms

All

application-assurance

Synopsis

Enter the application-assurance context

Context

configure system persistence application-assurance

Tree

application-assurance

Description

Commands in this context configure AA persistence on the system.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

description string

Synopsis

Text description

Context

configure system persistence application-assurance description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

location keyword

Synopsis

CPM flash card where the information is stored

Context

configure system persistence application-assurance location keyword

Tree

location

Options

cf1, cf2, cf3

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

dhcp-server

Synopsis

Enter the dhcp-server context

Context

configure system persistence dhcp-server

Tree

dhcp-server

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

description string

Synopsis

Text description

Context

configure system persistence dhcp-server description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

location keyword

Synopsis

CPM flash card where the information is stored

Context

configure system persistence dhcp-server location keyword

Tree

location

Options

cf1, cf2, cf3

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

nat-port-forwarding

Synopsis

Enter the nat-port-forwarding context

Context

configure system persistence nat-port-forwarding

Tree

nat-port-forwarding

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

description string

Synopsis

Text description

Context

configure system persistence nat-port-forwarding description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

location keyword

Synopsis

CPM flash card where the information is stored

Context

configure system persistence nat-port-forwarding location keyword

Tree

location

Options

cf1, cf2, cf3

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-e, 7750 SR-s, VSR

options

Synopsis

Enter the options context

Context

configure system persistence options

Tree

options

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

dhcp-leasetime-threshold number

Synopsis

DHCP lease time limit to be eligible for persistence

Context

configure system persistence options dhcp-leasetime-threshold number

Tree

dhcp-leasetime-threshold

Range

1 to 631152000

Units

seconds

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

python-policy-cache

Synopsis

Enter the python-policy-cache context

Context

configure system persistence python-policy-cache

Tree

python-policy-cache

Introduced

16.0.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system persistence python-policy-cache description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

All

location keyword

Synopsis

CPM flash card where the information is stored

Context

configure system persistence python-policy-cache location keyword

Tree

location

Options

cf1, cf2, cf3

Introduced

16.0.R1

Platforms

All

subscriber-mgmt

Synopsis

Enter the subscriber-mgmt context

Context

configure system persistence subscriber-mgmt

Tree

subscriber-mgmt

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

description string

Synopsis

Text description

Context

configure system persistence subscriber-mgmt description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

location keyword

Synopsis

CPM flash card where the information is stored

Context

configure system persistence subscriber-mgmt location keyword

Tree

location

Options

cf1, cf2, cf3

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, VSR

power-management power-zone number

Synopsis

Enter the power-management list instance

Context

configure system power-management power-zone number

Tree

power-management

Introduced

16.0.R1

Platforms

7750 SR-s, 7950 XRS

power-zone number

Synopsis

Power zone

Context

configure system power-management power-zone number

Range

1 to 2

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

7750 SR-s, 7950 XRS

mode keyword

Synopsis

Power capacity mode algorithm

Context

configure system power-management power-zone number mode keyword

Tree

mode

Default

basic

Options

none, basic, advanced

Introduced

16.0.R1

Platforms

7750 SR-s, 7950 XRS

power-safety-alert number

Synopsis

Power capacity to trigger a safety alert event

Context

configure system power-management power-zone number power-safety-alert number

Tree

power-safety-alert

Range

0 to 120000

Default

0

Units

watts

Introduced

16.0.R1

Platforms

7750 SR-s, 7950 XRS

power-safety-level number

Synopsis

Minimum threshold to power off devices

Context

configure system power-management power-zone number power-safety-level number

Tree

power-safety-level

Range

0 to 100

Default

100

Units

percent

Introduced

16.0.R1

Platforms

7750 SR-s, 7950 XRS

ptp

Synopsis

Enter the ptp context

Context

configure system ptp

Tree

ptp

Description

Commands in this context configure Precision Time Control (PTP) parameters based on IEEE 1588-2008, Precision Time Protocol.

The context is only supported on control assemblies that support 1588.

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

admin-state keyword

Synopsis

Administrative state of PTP

Context

configure system ptp admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

announce-receipt-timeout number

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Expired intervals count before timeout event declared

Context

configure system ptp announce-receipt-timeout number

Tree

announce-receipt-timeout

Description

This command configures the number of Announce message intervals that must expire with no received Announce messages before declaring an ANNOUNCE_RECEIPT_TIMEOUT event.

Range

2 to 10

Default

3

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

clock-type keyword

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Clock type

Context

configure system ptp clock-type keyword

Tree

clock-type

Options

slave-only, master-only, boundary

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

domain number

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

PTP domain

Context

configure system ptp domain number

Tree

domain

Description

This command configures the PTP domain. The default and valid range of the domain depend on the configured PTP profile.

  1. IEEE 1588-2008 - domain range of 0 to 255 (default 0)
  2. G.8265.1 - domain range of 0 to 255 (default 4)
  3. G.8275.1 - domain range of 24 to 43 (default 24)
  4. G.8275.2 - domain range of 0 to 255 (default 44)
Range

0 to 255

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

local-priority number

Synopsis

PTP clock local priority

Context

configure system ptp local-priority number

Tree

local-priority

Description

This command configures the local priority used to choose between PTP masters in the best master clock algorithm (BMCA). This setting applies when the PTP profile is either configured for G.8275.1 or G.8275.2 and is ignored for any other profile.

For G.8275.1 or G.8275.2, this command configures the localPriority parameter associated with the local clock (ptp context). See G.8275.1 or G.8275.2 for detailed information.

Range

1 to 255

Default

128

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

log-announce-interval number

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Announce message interval in log form

Context

configure system ptp log-announce-interval number

Tree

log-announce-interval

Description

This command configures the Announce message interval used for both unicast and multicast messages.

For unicast messages, the Announce message interval is requested during unicast negotiation to any peer. This controls the Announce message rate sent from remote peers to the local node. It does not affect the announce message rate that may be sent from the local node to remote peers. Remote peers may request an Announce message rate within the acceptable grant range.

For multicast messages used on PTP Ethernet ports, this command specifies the message interval used for Announce messages transmitted by the local node.

This value also defines the interval between executions of the BMCA within the node.

To minimize BMCA driven reconfigurations, IEEE recommends that the announce interval should be consistent across the entire 1588 network.

Range

-3 to 4

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

network-type keyword

Synopsis

PTP network type

Context

configure system ptp network-type keyword

Tree

network-type

Description

This command configures the codeset (as defined in Table 1/G.8265.1) to be used for the encoding of QL values into PTP clockClass values when the profile is configured for G.8265.1.

This setting only applies to the range of values observed in the clockClass parameter transmitted out of the node in Announce messages. The router supports the reception of any valid value in Table 1/G.8265.1

Default

sdh

Options

sonet, sdh

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

port [port-id] reference

Synopsis

Enter the port list instance

Context

configure system ptp port reference

Tree

port

Description

Commands in this context configure PTP over Ethernet on the physical port. The PTP process transmits and receives PTP messages through the port using Ethernet encapsulation (as opposed to UDP/IPv4 encapsulation).

Frames are transmitted with no VLAN tags, even if the port is configured for dot1q or qinq modes for encap-type. The received frames from the external PTP clock must also be untagged.

Two reserved multicast addresses are allocated for PTP messages (see Annex F IEEE Std 1588-2008). Either address can be configured for the PTP messages sent through the port.

A PTP port cannot be created if the PTP profile is configured for G.8265.1.

If the port supports 1588 port-based timestamping, Synchronous Ethernet must be enabled on the MDA when PTP over Ethernet is enabled.

De-provisioning of the card or MDA containing the specified port is not permitted while the port is configured within PTP.

Changing the encapsulation or the port type of the Ethernet port is not permitted when PTP Ethernet Multicast operation is configured on the port.

To allocate an Ethernet satellite client port as a PTP port, the Ethernet satellite must first be enabled for the transparent clock function. For more information, see the configure satellite ethernet-satellite ptp-tc command.

The SyncE/1588 ports of the CPM and CCMs can be specified as PTP ports. These use the ‘A/3’ and ‘B/3’ designation and both must be specified as two PTP ports if both are used. The active CPM sends and receives messages on both ports if they are specified and enabled.

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

[port-id] reference

Synopsis

Ethernet PTP port ID

Context

configure system ptp port reference

Reference

configure port string

Notes

This element is part of a list key.

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

address string

Synopsis

Destination MAC address of the transmitted PTP messages

Context

configure system ptp port reference address string

Tree

address

Description

This command specifies the destination MAC address of the transmitted PTP messages. IEEE Std 1588-2008 Annex F defines two reserved addresses for 1588 messages, which include:

  1. 01-1B-19-00-00-00 — all except the peer delay mechanism messages
  2. 01-80-C2-00-00-0E — peer delay mechanism messages

Both addresses are supported for reception, independent of the address configured by this command.

Default

01:1B:19:00:00:00

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

admin-state keyword

Synopsis

Administrative state of the PTP port

Context

configure system ptp port reference admin-state keyword

Tree

admin-state

Default

enable

Options

enable, disable

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

local-priority number

Synopsis

PTP port local priority

Context

configure system ptp port reference local-priority number

Tree

local-priority

Description

This command configures the local priority used to choose between PTP masters in the best master clock algorithm (BMCA). This setting applies when the PTP profile is either configured for G.8275.1 or G.8275.2 and is ignored for any other profile.

For G.8275.1 or G.8275.2, this command configures the localPriority parameter associated with the Announce messages received from the external clocks (ptp port context). See G.8275.1 or G.8275.2 for detailed information.

Range

1 to 255

Default

128

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

log-delay-interval number

Synopsis

Minimum interval for Delay_Req messages in log form

Context

configure system ptp port reference log-delay-interval number

Tree

log-delay-interval

Description

This command configures the minimum interval used for multicast Delay_Req messages for the port. For ports in a slave state, the interval is used, unless the parent port indicates a longer interval. For a port in master state, the interval is advertised to external slave ports as the minimum acceptable interval for Delay_Req messages from the slave ports.

The router supports the 1588 standard requirement for a port in slave state to check the logMessageInterval field of received multicast Delay_Resp messages. If the value of the logMessageInterval field of the messages is greater than the value configured locally for the generation of Delay_Req messages, the slave must use the longer interval for the generation of Delay_Req messages.

The interval value is specified as the logarithm to the base 2.

Range

-6 to 0

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

log-sync-interval number

Synopsis

Interval for transmission of Sync messages in log form

Context

configure system ptp port reference log-sync-interval number

Tree

log-sync-interval

Description

This command configures the interval used for Sync messages transmitted by the local node when the port is in master state.

The interval value is specified as the logarithm to the base 2.

Range

-6 to 0

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

master-only boolean

Synopsis

Restrict the local port to master state

Context

configure system ptp port reference master-only boolean

Tree

master-only

Description

When configured to true, the local port is restricted to master state only, ensuring that the system does not obtain synchronization from attached external devices.

This command is supported only when the PTP profile is set for G.8275.1 or G.8275.2.

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

priority1 number

Synopsis

Priority1 of the local clock

Context

configure system ptp priority1 number

Tree

priority1

Description

This command configures the priority1 parameter of the local clock. The setting is used when the profile is configured for IEEE 1588-2008.

This value is used by the Best Master Clock Algorithm to determine which clock should provide timing for the network and is advertised in Announce messages.

Range

0 to 255

Default

128

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

priority2 number

Synopsis

Priority2 of the local clock

Context

configure system ptp priority2 number

Tree

priority2

Description

This command configures the priority2 parameter of the local clock. The setting is used when the profile is configured for IEEE 1588-2008, G.8275.1, or G.8275.2.

This value is used by the Best Master Clock algorithm to determine which clock should provide timing for the network and is advertised in Announce messages.

Range

0 to 255

Default

128

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

profile keyword

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

PTP profile

Context

configure system ptp profile keyword

Tree

profile

Description

This command configures the profile to be used for the internal PTP clock. It defines the Best Master Clock Algorithm (BMCA) behavior.

Profile changes may affect the settings of other configuration elements, such as the clock type and default settings for the delay interval, announce interval, and the Sync interval.

The following clock types are supported for the indicated profiles:

  1. G.8265.1: slave only, master only
  2. IEEE 1588 2008: slave only, master only, boundary
  3. G.8275.1: slave only, boundary, master only (master only, only if the platform includes an embedded GNSS receiver)
  4. G.8275.2: slave only, boundary, master only (master only, only if the platform includes an embedded GNSS receiver)
Options

g8265dot1-2010, ieee1588-2008, g8275dot1-2014, g8275dot2-2016

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ptsf

Synopsis

Enter the ptsf context

Context

configure system ptp ptsf

Tree

ptsf

Description

Commands in this context configure the attributes of Packet Timing Signal Fail (PTSF).

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

monitor-ptsf-unusable

Synopsis

Enter the monitor-ptsf-unusable context

Context

configure system ptp ptsf monitor-ptsf-unusable

Tree

monitor-ptsf-unusable

Description

Commands in this context configure monitoring of neighbor clocks for the PTSF-unusable state (condition) when the profile is set to g8275dot1-2014.

When administratively enabled, the local clock monitors the noise level of PTP event messages between external neighbor PTP ports and the local clock. If it detects a high variation in the network path between the external neighbor port and the local port, it considers the neighbor port unusable. Announce messages from the neighbor are discarded and excluded from the BMCA and the port cannot be selected as the parent clock. The unusable condition must be manually cleared.

When administratively disabled, the monitor PTSF function of the PTP clock clears PTSF-unusable states from all neighbor PTP ports. If no PTP messages are received from a neighbor for 15 minutes, the neighbor information is purged and the PTSF-unusable state is cleared.

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

admin-state keyword

Synopsis

Administrative state of PTSF unusable monitoring

Context

configure system ptp ptsf monitor-ptsf-unusable admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

router [router-instance] string

Synopsis

Enter the router list instance

Context

configure system ptp router string

Tree

router

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

[router-instance] string

Synopsis

Router name or VPRN service name

Context

configure system ptp router string

Notes

This element is part of a list key.

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

admin-state keyword

Synopsis

Administrative state of PTP on the router instance

Context

configure system ptp router string admin-state keyword

Tree

admin-state

Default

enable

Options

enable, disable

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

peer [ip-address] (ipv4-address-no-zone | ipv6-address-no-zone)

Synopsis

Enter the peer list instance

Context

configure system ptp router string peer (ipv4-address-no-zone | ipv6-address-no-zone)

Tree

peer

Description

Commands in this context configure a remote PTP peer.

In the current release, the system supports PTP using IPv4 only.

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

[ip-address] (ipv4-address-no-zone | ipv6-address-no-zone)

Synopsis

IP address of the remote PTP peer

Context

configure system ptp router string peer (ipv4-address-no-zone | ipv6-address-no-zone)

Description

This command specifies the IP address of the remote PTP peer.

In the current release, the system supports PTP using IPv4 only.

Notes

This element is part of a list key.

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

admin-state keyword

Synopsis

Administrative state of the PTP peer

Context

configure system ptp router string peer (ipv4-address-no-zone | ipv6-address-no-zone) admin-state keyword

Tree

admin-state

Default

enable

Options

enable, disable

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

local-priority number

Synopsis

PTP peer local priority

Context

configure system ptp router string peer (ipv4-address-no-zone | ipv6-address-no-zone) local-priority number

Tree

local-priority

Description

This command configures the local priority for the peer, which is used to choose between PTP masters in the best master clock algorithm (BMCA). This setting applies when the PTP profile is configured for G.8265.1, G.8275.1, or G.8275.2 and is ignored for any other profile.

For G.8265.1, this command configures the priority used to choose between master clocks with the same quality (see G.8265.1 for more details).

For G.8275.1 or G.8275.2, this command configures the localPriority parameter associated with the Announce messages received from the external clocks (ptp router peer context). See G.8275.1 or G.8275.2 for detailed information.

Range

1 to 255

Default

128

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

log-sync-interval number

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

PTP peer interval for Sync messages in log form

Context

configure system ptp router string peer (ipv4-address-no-zone | ipv6-address-no-zone) log-sync-interval number

Tree

log-sync-interval

Description

This command configures the message interval used for Sync and Delay_Resp messages that are requested during unicast negotiation to the peer. The setting controls messages sent from remote peers to the local node but the packet rate from the local node to remote peers is not affected. Remote peers may request a packet rate within the acceptable range.

The interval value is specified as the logarithm to the base 2.

Range

-6 to 0

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

peer-limit number

Synopsis

Number of discovered peers allowed for routing instance

Context

configure system ptp router string peer-limit number

Tree

peer-limit

Description

This command specifies the maximum number of discovered peers permitted within the routing instance. This ensures that a routing instance does not consume all the possible discovered peers and prevents the routing instance from blocking discovered peers in other routing instances.

The sum of all peer limit values for all routing instances cannot exceed the maximum number of discovered peers supported by the system.

Range

0 to 512

Introduced

21.7.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

tx-while-sync-uncertain boolean

Synopsis

Send Announce messages while clock is unsynchronized

Context

configure system ptp tx-while-sync-uncertain boolean

Tree

tx-while-sync-uncertain

Description

When configured to true, the local PTP clock transmits Announce messages to downstream clocks to indicate it has not yet stabilized on the recovered synchronization source (upstream clocks or GM clock). While the PTP clock is unsynchronized, the SyncUncertain state is true.

When configured to false, the local PTP clock does not send Announce messages to downstream clocks to indicate it is not synchronized to a valid timing source. If the SyncUncertain state of the clock is true while this command is configured to false, unicast negotiation grant requests are not granted and current grants are canceled. 

Default

true

Introduced

22.2.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

script-control

Synopsis

Enter the script-control context

Context

configure system script-control

Tree

script-control

Introduced

16.0.R1

Platforms

All

script [script-name] string owner string

Synopsis

Enter the script list instance

Context

configure system script-control script string owner string

Tree

script

Max. Elements

1500

Introduced

16.0.R1

Platforms

All

[script-name] string

Synopsis

Script name

Context

configure system script-control script string owner string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

owner string

Synopsis

Script owner

Context

configure system script-control script string owner string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the script

Context

configure system script-control script string owner string admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system script-control script string owner string description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

All

location string

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Script location

Context

configure system script-control script string owner string location string

Tree

location

String Length

1 to 255

Introduced

16.0.R1

Platforms

All

script-policy [policy-name] string owner string

Synopsis

Enter the script-policy list instance

Context

configure system script-control script-policy string owner string

Tree

script-policy

Max. Elements

1500

Introduced

16.0.R1

Platforms

All

[policy-name] string

Synopsis

Script policy name

Context

configure system script-control script-policy string owner string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

owner string

Synopsis

Script policy owner

Context

configure system script-control script-policy string owner string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the script policy

Context

configure system script-control script-policy string owner string admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

expire-time (number | keyword)

Synopsis

Maximum amount of time to keep a run history status

Context

configure system script-control script-policy string owner string expire-time (number | keyword)

Tree

expire-time

Range

0 to 21474836

Default

3600

Units

seconds

Options

forever

Introduced

16.0.R1

Platforms

All

lifetime (number | keyword)

Synopsis

Maximum amount of time the script may run

Context

configure system script-control script-policy string owner string lifetime (number | keyword)

Tree

lifetime

Range

0 to 21474836

Default

3600

Units

seconds

Options

forever

Notes

The following elements are part of a choice: (lifetime and script) or (python-lifetime and python-script).

Introduced

16.0.R1

Platforms

All

lock-override boolean

Synopsis

Allow EHS/CRON script to break database explicit lock

Context

configure system script-control script-policy string owner string lock-override boolean

Tree

lock-override

Default

false

Introduced

19.10.R1

Platforms

All

max-completed number

Synopsis

Maximum number of script history status entries kept

Context

configure system script-control script-policy string owner string max-completed number

Tree

max-completed

Range

1 to 1500

Default

1

Introduced

16.0.R1

Platforms

All

python-lifetime number

Synopsis

Maximum time the Python application can run

Context

configure system script-control script-policy string owner string python-lifetime number

Tree

python-lifetime

Range

30 to 86400

Units

seconds

Notes

The following elements are part of a choice: (lifetime and script) or (python-lifetime and python-script).

Introduced

21.10.R1

Platforms

All

python-script

Synopsis

Enter the python-script context

Context

configure system script-control script-policy string owner string python-script

Tree

python-script

Notes

The following elements are part of a choice: (lifetime and script) or (python-lifetime and python-script).

Introduced

21.10.R1

Platforms

All

name reference

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Python application name

Context

configure system script-control script-policy string owner string python-script name reference

Tree

name

Reference

configure python python-script string

Introduced

21.10.R1

Platforms

All

results string

Synopsis

Location to receive CLI output of a script run

Context

configure system script-control script-policy string owner string results string

Tree

results

String Length

1 to 255

Introduced

16.0.R1

Platforms

All

script

Synopsis

Enter the script context

Context

configure system script-control script-policy string owner string script

Tree

script

Notes

The following elements are part of a choice: (lifetime and script) or (python-lifetime and python-script).

Introduced

16.0.R1

Platforms

All

name string

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Script name

Context

configure system script-control script-policy string owner string script name string

Tree

name

String Length

1 to 32

Introduced

16.0.R1

Platforms

All

owner string

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Script owner

Context

configure system script-control script-policy string owner string script owner string

Tree

owner

String Length

1 to 32

Introduced

16.0.R1

Platforms

All

security

Synopsis

Enter the security context

Context

configure system security

Tree

security

Description

Commands in this context configure central security settings such as DDoS protection, users, authorization profiles, and certificates.

Access to these commands should be restricted to highly trusted users and device administrators.

Introduced

16.0.R1

Platforms

All

aaa

Synopsis

Enter the aaa context

Context

configure system security aaa

Tree

aaa

Introduced

16.0.R1

Platforms

All

cli-session-group [cli-session-group-name] string

Synopsis

Enter the cli-session-group list instance

Context

configure system security aaa cli-session-group string

Tree

cli-session-group

Max. Elements

16

Introduced

16.0.R1

Platforms

All

[cli-session-group-name] string

Synopsis

CLI session group name

Context

configure system security aaa cli-session-group string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R2

Platforms

All

combined-max-sessions number

Synopsis

Maximum number of concurrent SSH and Telnet sessions

Context

configure system security aaa cli-session-group string combined-max-sessions number

Tree

combined-max-sessions

Range

0 to 50

Introduced

16.0.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system security aaa cli-session-group string description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

All

ssh-max-sessions number

Synopsis

Maximum number of concurrent SSH sessions

Context

configure system security aaa cli-session-group string ssh-max-sessions number

Tree

ssh-max-sessions

Range

0 to 50

Introduced

16.0.R1

Platforms

All

telnet-max-sessions number

Synopsis

Maximum number of concurrent Telnet sessions

Context

configure system security aaa cli-session-group string telnet-max-sessions number

Tree

telnet-max-sessions

Range

0 to 50

Introduced

16.0.R1

Platforms

All

health-check (number | keyword)

Synopsis

Polling interval of RADIUS, TACACS+, and LDAP servers

Context

configure system security aaa health-check (number | keyword)

Tree

health-check

Range

6 to 1500

Default

30

Units

seconds

Options

none

Introduced

16.0.R1

Platforms

All

local-profiles

Synopsis

Enter the local-profiles context

Context

configure system security aaa local-profiles

Tree

local-profiles

Introduced

16.0.R1

Platforms

All

profile [user-profile-name] string

Synopsis

Enter the profile list instance

Context

configure system security aaa local-profiles profile string

Tree

profile

Max. Elements

128

Introduced

16.0.R1

Platforms

All

[user-profile-name] string

Synopsis

User profile name

Context

configure system security aaa local-profiles profile string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

cli-session-group reference

Synopsis

CLI session group to which the profile belongs

Context

configure system security aaa local-profiles profile string cli-session-group reference

Tree

cli-session-group

Reference

configure system security aaa cli-session-group string

Introduced

16.0.R1

Platforms

All

combined-max-sessions number

Synopsis

Maximum number of concurrent SSH and Telnet sessions

Context

configure system security aaa local-profiles profile string combined-max-sessions number

Tree

combined-max-sessions

Range

0 to 50

Introduced

16.0.R1

Platforms

All

default-action keyword

Synopsis

Action for non-matching entry

Context

configure system security aaa local-profiles profile string default-action keyword

Tree

default-action

Default

none

Options

deny-all, permit-all, none, read-only-all

Introduced

16.0.R1

Platforms

All

entry [entry-id] number

Synopsis

Enter the entry list instance

Context

configure system security aaa local-profiles profile string entry number

Tree

entry

Introduced

16.0.R1

Platforms

All

[entry-id] number

Synopsis

User profile entry ID

Context

configure system security aaa local-profiles profile string entry number

Range

1 to 9999

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

action keyword

Synopsis

Action when a user command matches the entry

Context

configure system security aaa local-profiles profile string entry number action keyword

Tree

action

Default

none

Options

deny, permit, none, read-only

Introduced

16.0.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system security aaa local-profiles profile string entry number description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

All

match string

Synopsis

Command to match the entry

Context

configure system security aaa local-profiles profile string entry number match string

Tree

match

String Length

1 to 255

Introduced

16.0.R1

Platforms

All

grpc

Synopsis

Enter the grpc context

Context

configure system security aaa local-profiles profile string grpc

Tree

grpc

Introduced

16.0.R1

Platforms

All

rpc-authorization

Synopsis

Enter the rpc-authorization context

Context

configure system security aaa local-profiles profile string grpc rpc-authorization

Tree

rpc-authorization

Description

Commands in this context control the authorization of each RPC in gRPC interfaces.  

Introduced

16.0.R1

Platforms

All

gnmi-capabilities keyword

Synopsis

gNMI Capabilities RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnmi-capabilities keyword

Tree

gnmi-capabilities

Default

permit

Options

permit, deny

Introduced

16.0.R1

Platforms

All

gnmi-get keyword

Synopsis

gNMI Get RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnmi-get keyword

Tree

gnmi-get

Default

permit

Options

permit, deny

Introduced

16.0.R1

Platforms

All

gnmi-set keyword

Synopsis

gNMI Set RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnmi-set keyword

Tree

gnmi-set

Default

permit

Options

permit, deny

Introduced

16.0.R1

Platforms

All

gnmi-subscribe keyword

Synopsis

gNMI Subscribe RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnmi-subscribe keyword

Tree

gnmi-subscribe

Default

permit

Options

permit, deny

Introduced

16.0.R1

Platforms

All

gnoi-cert-mgmt-cangenerate keyword

Synopsis

gNOI CanGenerateCSR RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnoi-cert-mgmt-cangenerate keyword

Tree

gnoi-cert-mgmt-cangenerate

Default

deny

Options

permit, deny

Introduced

19.10.R1

Platforms

All

gnoi-cert-mgmt-getcert keyword

Synopsis

gNOI GetCertificates RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnoi-cert-mgmt-getcert keyword

Tree

gnoi-cert-mgmt-getcert

Default

deny

Options

permit, deny

Introduced

19.10.R1

Platforms

All

gnoi-cert-mgmt-install keyword

Synopsis

gNOI Install RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnoi-cert-mgmt-install keyword

Tree

gnoi-cert-mgmt-install

Default

deny

Options

permit, deny

Introduced

19.10.R1

Platforms

All

gnoi-cert-mgmt-revoke keyword

Synopsis

gNOI RevokeCertificates RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnoi-cert-mgmt-revoke keyword

Tree

gnoi-cert-mgmt-revoke

Default

deny

Options

permit, deny

Introduced

20.2.R1

Platforms

All

gnoi-cert-mgmt-rotate keyword

Synopsis

gNOI Rotate RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnoi-cert-mgmt-rotate keyword

Tree

gnoi-cert-mgmt-rotate

Default

deny

Options

permit, deny

Introduced

19.10.R1

Platforms

All

gnoi-file-get keyword

Synopsis

gNOI File Get RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnoi-file-get keyword

Tree

gnoi-file-get

Default

permit

Options

permit, deny

Introduced

21.2.R1

Platforms

All

gnoi-file-put keyword

Synopsis

gNOI File Put RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnoi-file-put keyword

Tree

gnoi-file-put

Default

permit

Options

permit, deny

Introduced

21.2.R1

Platforms

All

gnoi-file-remove keyword

Synopsis

gNOI File Remove RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnoi-file-remove keyword

Tree

gnoi-file-remove

Default

permit

Options

permit, deny

Introduced

21.2.R1

Platforms

All

gnoi-file-stat keyword

Synopsis

gNOI File Stat RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnoi-file-stat keyword

Tree

gnoi-file-stat

Default

permit

Options

permit, deny

Introduced

21.2.R1

Platforms

All

gnoi-file-transfertoremote keyword

Synopsis

gNOI File TransferToRemote RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnoi-file-transfertoremote keyword

Tree

gnoi-file-transfertoremote

Default

permit

Options

permit, deny

Introduced

21.7.R1

Platforms

All

gnoi-system-cancelreboot keyword

Synopsis

gNOI System CancelReboot RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnoi-system-cancelreboot keyword

Tree

gnoi-system-cancelreboot

Default

deny

Options

permit, deny

Introduced

20.5.R1

Platforms

All

gnoi-system-ping keyword

Synopsis

gNOI System Ping RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnoi-system-ping keyword

Tree

gnoi-system-ping

Default

permit

Options

permit, deny

Introduced

21.7.R1

Platforms

All

gnoi-system-reboot keyword

Synopsis

gNOI System Reboot RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnoi-system-reboot keyword

Tree

gnoi-system-reboot

Default

deny

Options

permit, deny

Introduced

20.5.R1

Platforms

All

gnoi-system-rebootstatus keyword

Synopsis

gNOI System RebootStatus RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnoi-system-rebootstatus keyword

Tree

gnoi-system-rebootstatus

Default

deny

Options

permit, deny

Introduced

20.5.R1

Platforms

All

gnoi-system-setpackage keyword

Synopsis

gNOI System SetPackage RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnoi-system-setpackage keyword

Tree

gnoi-system-setpackage

Default

deny

Options

permit, deny

Introduced

20.5.R1

Platforms

All

gnoi-system-switchcontrolprocessor keyword

Synopsis

gNOI System SwitchControlProcessor RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnoi-system-switchcontrolprocessor keyword

Tree

gnoi-system-switchcontrolprocessor

Default

deny

Options

permit, deny

Introduced

20.5.R1

Platforms

All

gnoi-system-time keyword

Synopsis

gNOI System Time RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnoi-system-time keyword

Tree

gnoi-system-time

Default

permit

Options

permit, deny

Introduced

21.7.R1

Platforms

All

gnoi-system-traceroute keyword

Synopsis

gNOI System Traceroute RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization gnoi-system-traceroute keyword

Tree

gnoi-system-traceroute

Default

permit

Options

permit, deny

Introduced

21.7.R1

Platforms

All

md-cli-session keyword

Synopsis

gNOI MdCli Session RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization md-cli-session keyword

Tree

md-cli-session

Default

permit

Options

permit, deny

Introduced

20.5.R1

Platforms

All

rib-api-getversion keyword

Synopsis

RibApi GetVersion RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization rib-api-getversion keyword

Tree

rib-api-getversion

Default

permit

Options

permit, deny

Introduced

16.0.R4

Platforms

All

rib-api-modify keyword

Synopsis

RibApi Modify RPC authorization

Context

configure system security aaa local-profiles profile string grpc rpc-authorization rib-api-modify keyword

Tree

rib-api-modify

Default

permit

Options

permit, deny

Introduced

16.0.R4

Platforms

All

li boolean

Synopsis

Allow lawful intercept profile ID

Context

configure system security aaa local-profiles profile string li boolean

Tree

li

Default

false

Introduced

19.10.R1

Platforms

All

netconf

Synopsis

Enter the netconf context

Context

configure system security aaa local-profiles profile string netconf

Tree

netconf

Introduced

16.0.R1

Platforms

All

base-op-authorization

Synopsis

Enter the base-op-authorization context

Context

configure system security aaa local-profiles profile string netconf base-op-authorization

Tree

base-op-authorization

Description

Commands in this context configure the permission to use NETCONF operations at the base operation level for the specified profile.

The NETCONF operations are authorized by default in the built-in system-generated administrative profile.

Introduced

16.0.R1

Platforms

All

action boolean

Synopsis

Allow NETCONF action operation

Context

configure system security aaa local-profiles profile string netconf base-op-authorization action boolean

Tree

action

Default

false

Introduced

21.7.R1

Platforms

All

cancel-commit boolean

Synopsis

Allow NETCONF cancel-commit operation

Context

configure system security aaa local-profiles profile string netconf base-op-authorization cancel-commit boolean

Tree

cancel-commit

Default

false

Introduced

21.7.R1

Platforms

All

close-session boolean

Synopsis

Allow NETCONF close-session operation

Context

configure system security aaa local-profiles profile string netconf base-op-authorization close-session boolean

Tree

close-session

Default

false

Introduced

21.7.R1

Platforms

All

commit boolean

Synopsis

Allow NETCONF commit operation

Context

configure system security aaa local-profiles profile string netconf base-op-authorization commit boolean

Tree

commit

Default

false

Introduced

21.7.R1

Platforms

All

copy-config boolean

Synopsis

Allow NETCONF copy-config operation

Context

configure system security aaa local-profiles profile string netconf base-op-authorization copy-config boolean

Tree

copy-config

Default

false

Introduced

21.7.R1

Platforms

All

create-subscription boolean

Synopsis

Allow NETCONF create-subscription operation

Context

configure system security aaa local-profiles profile string netconf base-op-authorization create-subscription boolean

Tree

create-subscription

Description

When configured to true, this command enables the NETCONF create-subscription operation in the default profile.

The base-op-authorization create-subscription configuration is not pre-emptive, which means that it is checked only at the time of the initial subscription. Configuration changes to base-op-authorization do not cancel any in-progress subscriptions and operators who successfully subscribed continue to receive messages.

When configured to false, this command disables the NETCONF create-subscription operation in the default profile.

The operation is enabled by default in the built-in system-generated administrative profile.

Default

false

Introduced

21.7.R1

Platforms

All

delete-config boolean

Synopsis

Allow NETCONF delete-config operation

Context

configure system security aaa local-profiles profile string netconf base-op-authorization delete-config boolean

Tree

delete-config

Default

false

Introduced

21.7.R1

Platforms

All

discard-changes boolean

Synopsis

Allow NETCONF discard-changes operation

Context

configure system security aaa local-profiles profile string netconf base-op-authorization discard-changes boolean

Tree

discard-changes

Default

false

Introduced

21.7.R1

Platforms

All

edit-config boolean

Synopsis

Allow NETCONF edit-config operation

Context

configure system security aaa local-profiles profile string netconf base-op-authorization edit-config boolean

Tree

edit-config

Default

false

Introduced

21.7.R1

Platforms

All

get boolean

Synopsis

Allow NETCONF get operation

Context

configure system security aaa local-profiles profile string netconf base-op-authorization get boolean

Tree

get

Default

false

Introduced

21.7.R1

Platforms

All

get-config boolean

Synopsis

Allow NETCONF get-config operation

Context

configure system security aaa local-profiles profile string netconf base-op-authorization get-config boolean

Tree

get-config

Default

false

Introduced

21.7.R1

Platforms

All

get-data boolean

Synopsis

Allow NETCONF get-data operation

Context

configure system security aaa local-profiles profile string netconf base-op-authorization get-data boolean

Tree

get-data

Default

false

Introduced

21.7.R1

Platforms

All

get-schema boolean

Synopsis

Allow NETCONF get-schema operation

Context

configure system security aaa local-profiles profile string netconf base-op-authorization get-schema boolean

Tree

get-schema

Default

false

Introduced

21.7.R1

Platforms

All

kill-session boolean

Synopsis

Allow NETCONF kill-session operation

Context

configure system security aaa local-profiles profile string netconf base-op-authorization kill-session boolean

Tree

kill-session

Default

false

Introduced

16.0.R1

Platforms

All

lock boolean

Synopsis

Allow NETCONF lock and unlock operations

Context

configure system security aaa local-profiles profile string netconf base-op-authorization lock boolean

Tree

lock

Default

false

Introduced

16.0.R1

Platforms

All

validate boolean

Synopsis

Allow NETCONF validate operation

Context

configure system security aaa local-profiles profile string netconf base-op-authorization validate boolean

Tree

validate

Default

false

Introduced

21.7.R1

Platforms

All

ssh-max-sessions number

Synopsis

Maximum number of concurrent SSH sessions

Context

configure system security aaa local-profiles profile string ssh-max-sessions number

Tree

ssh-max-sessions

Range

0 to 50

Introduced

16.0.R1

Platforms

All

telnet-max-sessions number

Synopsis

Maximum number of concurrent Telnet sessions

Context

configure system security aaa local-profiles profile string telnet-max-sessions number

Tree

telnet-max-sessions

Range

0 to 50

Introduced

16.0.R1

Platforms

All

management-interface

Synopsis

Enter the management-interface context

Context

configure system security aaa management-interface

Tree

management-interface

Introduced

20.10.R1

Platforms

All

md-cli

Synopsis

Enter the md-cli context

Context

configure system security aaa management-interface md-cli

Tree

md-cli

Introduced

20.10.R1

Platforms

All

command-accounting-during-load boolean

Synopsis

Perform remote command accounting during a load or rollback operation

Context

configure system security aaa management-interface md-cli command-accounting-during-load boolean

Tree

command-accounting-during-load

Default

true

Introduced

20.10.R1

Platforms

All

output-authorization

Synopsis

Enter the output-authorization context

Context

configure system security aaa management-interface output-authorization

Tree

output-authorization

Description

Commands in this context configure output authorization for model-driven interfaces and telemetry.

When output authorization is performed, commands that display configuration or state output must authorize every element in the output. If a remote AAA server is configured, there may be delays in displaying output while the output is authorized. The remote AAA server may receive a large volume of authorization requests when substantial output displays are needed, such as for system configuration details.

Input to edit the configuration is always authorized, and is not affected by commands in this context.

Introduced

20.10.R1

Platforms

All

md-interfaces boolean

Synopsis

Authorize output in model-driven interfaces

Context

configure system security aaa management-interface output-authorization md-interfaces boolean

Tree

md-interfaces

Description

When configured to true, output is authorized for the following:

  1. MD-CLI info and compare commands 
  1. command completion of list key values
  1. NETCONF <get> and <get-config> RPCs, and gRPC/gNMI Get RPCs
Default

true

Introduced

20.10.R1

Platforms

All

telemetry-data boolean

Synopsis

Authorize telemetry data in gNMI Subscribe RPC response

Context

configure system security aaa management-interface output-authorization telemetry-data boolean

Tree

telemetry-data

Default

false

Introduced

20.10.R1

Platforms

All

remote-servers

Synopsis

Enter the remote-servers context

Context

configure system security aaa remote-servers

Tree

remote-servers

Introduced

16.0.R1

Platforms

All

ldap

Synopsis

Enter the ldap context

Context

configure system security aaa remote-servers ldap

Tree

ldap

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the LDAP operation protocol

Context

configure system security aaa remote-servers ldap admin-state keyword

Tree

admin-state

Default

enable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

public-key-authentication boolean

Synopsis

Allow SSH public key authentication from LDAP server

Context

configure system security aaa remote-servers ldap public-key-authentication boolean

Tree

public-key-authentication

Default

false

Introduced

16.0.R1

Platforms

All

route-preference keyword

Synopsis

Route preference to reach the AAA server

Context

configure system security aaa remote-servers ldap route-preference keyword

Tree

route-preference

Description

This command specifies the routing preference to reach the AAA server. If the configured option is to use both in-band and out-of-band routes, the out-of-band routes in the Base routing instance are used to reach the server before the in-band routes in the management routing instance.

Default

both

Options

both, inband, outband

Introduced

21.5.R1

Platforms

All

server [index] number

Synopsis

Enter the server list instance

Context

configure system security aaa remote-servers ldap server number

Tree

server

Max. Elements

5

Introduced

16.0.R1

Platforms

All

[index] number

Synopsis

LDAP server ID

Context

configure system security aaa remote-servers ldap server number

Range

1 to 5

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

address [ip-address] (ipv4-address-no-zone | ipv6-address-no-zone)

Synopsis

Enter the address list instance

Context

configure system security aaa remote-servers ldap server number address (ipv4-address-no-zone | ipv6-address-no-zone)

Tree

address

Max. Elements

1

Introduced

16.0.R1

Platforms

All

[ip-address] (ipv4-address-no-zone | ipv6-address-no-zone)

Synopsis

LDAP server address

Context

configure system security aaa remote-servers ldap server number address (ipv4-address-no-zone | ipv6-address-no-zone)

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

port number

Synopsis

Port number on which to contact the LDAP server

Context

configure system security aaa remote-servers ldap server number address (ipv4-address-no-zone | ipv6-address-no-zone) port number

Tree

port

Range

1 to 65535

Default

389

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the LDAP server

Context

configure system security aaa remote-servers ldap server number admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

bind-authentication

Synopsis

Enter the bind-authentication context

Context

configure system security aaa remote-servers ldap server number bind-authentication

Tree

bind-authentication

Introduced

16.0.R1

Platforms

All

password string

Synopsis

Password used for authentication with the LDAP server

Context

configure system security aaa remote-servers ldap server number bind-authentication password string

Tree

password

String Length

1 to 199

Introduced

16.0.R1

Platforms

All

root-dn string

Synopsis

Root domain used for authentication with LDAP server

Context

configure system security aaa remote-servers ldap server number bind-authentication root-dn string

Tree

root-dn

String Length

1 to 512

Introduced

16.0.R1

Platforms

All

search

Synopsis

Enter the search context

Context

configure system security aaa remote-servers ldap server number search

Tree

search

Introduced

16.0.R1

Platforms

All

base-dn string

Synopsis

LDAP server search base domain name

Context

configure system security aaa remote-servers ldap server number search base-dn string

Tree

base-dn

String Length

1 to 512

Introduced

16.0.R1

Platforms

All

server-name string

Synopsis

LDAP server name

Context

configure system security aaa remote-servers ldap server number server-name string

Tree

server-name

String Length

1 to 32

Introduced

16.0.R1

Platforms

All

tls-profile reference

Synopsis

TLS client profile used to encrypt the LDAP connection

Context

configure system security aaa remote-servers ldap server number tls-profile reference

Tree

tls-profile

Reference

configure system security tls client-tls-profile string

Introduced

16.0.R1

Platforms

All

server-retry number

Synopsis

Number of attempts to retry contacting the LDAP server

Context

configure system security aaa remote-servers ldap server-retry number

Tree

server-retry

Range

1 to 10

Default

3

Introduced

16.0.R1

Platforms

All

server-timeout number

Synopsis

Timeout for a response from the LDAP server

Context

configure system security aaa remote-servers ldap server-timeout number

Tree

server-timeout

Range

1 to 90

Default

3

Units

seconds

Introduced

16.0.R1

Platforms

All

use-default-template boolean

Synopsis

Apply the default template to LDAP

Context

configure system security aaa remote-servers ldap use-default-template boolean

Tree

use-default-template

Default

true

Introduced

16.0.R1

Platforms

All

radius

Synopsis

Enter the radius context

Context

configure system security aaa remote-servers radius

Tree

radius

Introduced

16.0.R1

Platforms

All

access-algorithm keyword

Synopsis

Algorithm used to access the set of RADIUS servers

Context

configure system security aaa remote-servers radius access-algorithm keyword

Tree

access-algorithm

Default

direct

Options

direct, round-robin

Introduced

16.0.R1

Platforms

All

accounting boolean

Synopsis

Enable RADIUS command accounting

Context

configure system security aaa remote-servers radius accounting boolean

Tree

accounting

Default

false

Introduced

16.0.R1

Platforms

All

accounting-port number

Synopsis

Port number on RADIUS server for accounting requests

Context

configure system security aaa remote-servers radius accounting-port number

Tree

accounting-port

Range

1 to 65535

Default

1813

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the authentication server

Context

configure system security aaa remote-servers radius admin-state keyword

Tree

admin-state

Default

enable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

authorization boolean

Synopsis

Enable RADIUS authorization

Context

configure system security aaa remote-servers radius authorization boolean

Tree

authorization

Default

false

Introduced

16.0.R1

Platforms

All

interactive-authentication boolean

Synopsis

Enable RADIUS interactive authentication

Context

configure system security aaa remote-servers radius interactive-authentication boolean

Tree

interactive-authentication

Default

false

Introduced

16.0.R1

Platforms

All

port number

Synopsis

UDP port number on which to contact RADIUS server

Context

configure system security aaa remote-servers radius port number

Tree

port

Range

1 to 65535

Default

1812

Introduced

16.0.R1

Platforms

All

route-preference keyword

Synopsis

Route preference to reach the AAA server

Context

configure system security aaa remote-servers radius route-preference keyword

Tree

route-preference

Description

This command specifies the routing preference to reach the AAA server. If the configured option is to use both in-band and out-of-band routes, the out-of-band routes in the Base routing instance are used to reach the server before the in-band routes in the management routing instance.

Default

both

Options

both, inband, outband

Introduced

21.5.R1

Platforms

All

server [index] number

Synopsis

Enter the server list instance

Context

configure system security aaa remote-servers radius server number

Tree

server

Max. Elements

5

Introduced

16.0.R1

Platforms

All

[index] number

Synopsis

RADIUS server ID

Context

configure system security aaa remote-servers radius server number

Range

1 to 5

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

address (ipv4-address-no-zone | ipv6-address-no-zone)

Synopsis

IP address of the RADIUS server

Context

configure system security aaa remote-servers radius server number address (ipv4-address-no-zone | ipv6-address-no-zone)

Tree

address

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

secret string

Synopsis

Secret key to access the RADIUS server

Context

configure system security aaa remote-servers radius server number secret string

Tree

secret

String Length

1 to 115

Introduced

16.0.R1

Platforms

All

tls-client-profile reference

Synopsis

TLS client profile for the RADIUS server

Context

configure system security aaa remote-servers radius server number tls-client-profile reference

Tree

tls-client-profile

Description

This command specifies the TLS client profile used to encrypt RADIUS communication. When configured, RADIUS messages are sent using TLS.

Reference

configure system security tls client-tls-profile string

Introduced

21.10.R1

Platforms

All

server-retry number

Synopsis

Number of attempts to retry contacting RADIUS server

Context

configure system security aaa remote-servers radius server-retry number

Tree

server-retry

Range

1 to 10

Default

3

Introduced

16.0.R1

Platforms

All

server-timeout number

Synopsis

Time to wait for a response from the RADIUS server

Context

configure system security aaa remote-servers radius server-timeout number

Tree

server-timeout

Range

1 to 90

Default

3

Units

seconds

Introduced

16.0.R1

Platforms

All

use-default-template boolean

Synopsis

Apply the RADIUS default user template to RADIUS user

Context

configure system security aaa remote-servers radius use-default-template boolean

Tree

use-default-template

Default

false

Introduced

16.0.R1

Platforms

All

tacplus

Synopsis

Enter the tacplus context

Context

configure system security aaa remote-servers tacplus

Tree

tacplus

Introduced

16.0.R1

Platforms

All

accounting

Synopsis

Enable the accounting context

Context

configure system security aaa remote-servers tacplus accounting

Tree

accounting

Introduced

16.0.R1

Platforms

All

record-type keyword

Synopsis

Type of accounting record packet sent to TACACS+ server

Context

configure system security aaa remote-servers tacplus accounting record-type keyword

Tree

record-type

Default

stop-only

Options

start-stop, stop-only

Introduced

16.0.R1

Platforms

All

admin-control

Synopsis

Enter the admin-control context

Context

configure system security aaa remote-servers tacplus admin-control

Tree

admin-control

Introduced

16.0.R1

Platforms

All

tacplus-map-to-priv-lvl number

Synopsis

Interactive authentication from node to TACACS+ server

Context

configure system security aaa remote-servers tacplus admin-control tacplus-map-to-priv-lvl number

Tree

tacplus-map-to-priv-lvl

Range

0 to 15

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the TACACS+ protocol

Context

configure system security aaa remote-servers tacplus admin-state keyword

Tree

admin-state

Default

enable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

authorization

Synopsis

Enable the authorization context

Context

configure system security aaa remote-servers tacplus authorization

Tree

authorization

Introduced

16.0.R1

Platforms

All

request-format

Synopsis

Enter the request-format context

Context

configure system security aaa remote-servers tacplus authorization request-format

Tree

request-format

Description

Commands in this context configure access operations that are sent to the TACACS+ server during authorization.

Introduced

21.10.R3

Platforms

All

access-operation-cmd keyword

Synopsis

Access operations sent in authorization requests

Context

configure system security aaa remote-servers tacplus authorization request-format access-operation-cmd keyword

Tree

access-operation-cmd

Description

This command sends an operation argument in authorization requests.

In model-driven interfaces, this command configures the system to send the operation in the cmd argument, and the path in the cmd-args argument, in TACACS+ authorization requests. This command does not apply to authorization requests in classic interfaces.

Options

delete

Max. Elements

1

Introduced

21.10.R3

Platforms

All

use-priv-lvl boolean

Synopsis

Allow privilege level mapping

Context

configure system security aaa remote-servers tacplus authorization use-priv-lvl boolean

Tree

use-priv-lvl

Description

When configured to true, this command automatically performs a single authorization request to the TACACS+ server for cmd* (all commands) immediately after login, and then uses the local profile associated (via the priv-lvl-map) with the priv-lvl returned by the TACACS+ server for all subsequent authorization (except enable-admin). After the initial authorization for cmd*, no further authorization requests are sent to the TACACS+ server (except enable-admin).

When configured to false, each command is sent to the TACACS+ server for authorization (this is true regardless of whether the tacplus use-default-template setting is enabled).

Default

false

Introduced

16.0.R1

Platforms

All

interactive-authentication boolean

Synopsis

Allows TACACS+ interactive authentication

Context

configure system security aaa remote-servers tacplus interactive-authentication boolean

Tree

interactive-authentication

Default

false

Introduced

16.0.R1

Platforms

All

priv-lvl-map

Synopsis

Enter the priv-lvl-map context

Context

configure system security aaa remote-servers tacplus priv-lvl-map

Tree

priv-lvl-map

Introduced

16.0.R1

Platforms

All

priv-lvl [level] number

Synopsis

Enter the priv-lvl list instance

Context

configure system security aaa remote-servers tacplus priv-lvl-map priv-lvl number

Tree

priv-lvl

Introduced

16.0.R1

Platforms

All

[level] number

Synopsis

Privilege level for the mapping

Context

configure system security aaa remote-servers tacplus priv-lvl-map priv-lvl number

Range

0 to 15

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

user-profile-name reference

Synopsis

User profile for the mapping

Context

configure system security aaa remote-servers tacplus priv-lvl-map priv-lvl number user-profile-name reference

Tree

user-profile-name

Reference

configure system security aaa local-profiles profile string

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

route-preference keyword

Synopsis

Route preference to reach the AAA server

Context

configure system security aaa remote-servers tacplus route-preference keyword

Tree

route-preference

Description

This command specifies the routing preference to reach the AAA server. If the configured option is to use both in-band and out-of-band routes, the out-of-band routes in the Base routing instance are used to reach the server before the in-band routes in the management routing instance.

Default

both

Options

both, inband, outband

Introduced

21.5.R1

Platforms

All

server [index] number

Synopsis

Enter the server list instance

Context

configure system security aaa remote-servers tacplus server number

Tree

server

Max. Elements

5

Introduced

16.0.R1

Platforms

All

[index] number

Synopsis

TACACS+ server ID

Context

configure system security aaa remote-servers tacplus server number

Range

1 to 5

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

address (ipv4-address-no-zone | ipv6-address-no-zone)

Synopsis

IP address of the TACACS+ server

Context

configure system security aaa remote-servers tacplus server number address (ipv4-address-no-zone | ipv6-address-no-zone)

Tree

address

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

port number

Synopsis

TCP port ID on which to contact TACACS+ server

Context

configure system security aaa remote-servers tacplus server number port number

Tree

port

Range

0 | 1 to 65535

Default

49

Introduced

16.0.R1

Platforms

All

secret string

Synopsis

Secret key to access the TACACS+ server

Context

configure system security aaa remote-servers tacplus server number secret string

Tree

secret

String Length

1 to 199

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

server-timeout number

Synopsis

Time to wait for a response from the TACACS+ server

Context

configure system security aaa remote-servers tacplus server-timeout number

Tree

server-timeout

Range

1 to 90

Default

3

Units

seconds

Introduced

16.0.R1

Platforms

All

use-default-template boolean

Synopsis

Apply TACACS+ default user-template to TACACS+ user

Context

configure system security aaa remote-servers tacplus use-default-template boolean

Tree

use-default-template

Default

true

Introduced

16.0.R1

Platforms

All

vprn-server

Synopsis

Enter the vprn-server context

Context

configure system security aaa remote-servers vprn-server

Tree

vprn-server

Introduced

22.2.R1

Platforms

All

inband reference

Synopsis

VPRN server used for AAA by in-band sessions

Context

configure system security aaa remote-servers vprn-server inband reference

Tree

inband

Description

This command configures TACACS+ or RADIUS servers in a VPRN to be used for AAA by that VPRN and by sessions in the Base routing instance.

Reference

configure service vprn string

Introduced

22.2.R1

Platforms

All

outband reference

Synopsis

VPRN server used for AAA by out-of-band sessions

Context

configure system security aaa remote-servers vprn-server outband reference

Tree

outband

Description

This command configures TACACS+ and RADIUS servers in a VPRN to be used for AAA by that VPRN and by sessions on the console or out-of-band (OOB) Ethernet ports.

Reference

configure service vprn string

Introduced

22.2.R1

Platforms

All

vprn reference

Synopsis

VPRN server used for AAA in VPRNs without a AAA server

Context

configure system security aaa remote-servers vprn-server vprn reference

Tree

vprn

Description

This command configures TACACS+ or RADIUS servers in a VPRN to be used for AAA by that VPRN and by sessions in VPRNs without a AAA server configured.

Reference

configure service vprn string

Introduced

22.2.R1

Platforms

All

user-template [user-template-name] keyword

Synopsis

Enter the user-template list instance

Context

configure system security aaa user-template keyword

Tree

user-template

Introduced

16.0.R1

Platforms

All

[user-template-name] keyword

Synopsis

Default user template applied to the system user

Context

configure system security aaa user-template keyword

Options

ldap-default, radius-default, tacplus-default

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

access

Synopsis

Enter the access context

Context

configure system security aaa user-template keyword access

Tree

access

Introduced

16.0.R1

Platforms

All

console boolean

Synopsis

Allow console access (serial port or Telnet)

Context

configure system security aaa user-template keyword access console boolean

Tree

console

Default

true

Introduced

16.0.R1

Platforms

All

ftp boolean

Synopsis

Allow FTP access

Context

configure system security aaa user-template keyword access ftp boolean

Tree

ftp

Default

false

Introduced

16.0.R1

Platforms

All

grpc boolean

Synopsis

Allow gRPC access

Context

configure system security aaa user-template keyword access grpc boolean

Tree

grpc

Default

false

Introduced

16.0.R1

Platforms

All

li boolean

Synopsis

Allow access to lawful intercept

Context

configure system security aaa user-template keyword access li boolean

Tree

li

Default

false

Introduced

19.10.R1

Platforms

All

netconf boolean

Synopsis

Allow NETCONF session access

Context

configure system security aaa user-template keyword access netconf boolean

Tree

netconf

Default

false

Introduced

16.0.R1

Platforms

All

console

Synopsis

Enter the console context

Context

configure system security aaa user-template keyword console

Tree

console

Introduced

16.0.R1

Platforms

All

login-exec string

Synopsis

File to execute for a successful user login via console

Context

configure system security aaa user-template keyword console login-exec string

Tree

login-exec

String Length

1 to 200

Introduced

16.0.R1

Platforms

All

home-directory (sat-url | cflash-without-slot-url)

Synopsis

User local home directory based on the template

Context

configure system security aaa user-template keyword home-directory (sat-url | cflash-without-slot-url)

Tree

home-directory

String Length

1 to 200

Introduced

16.0.R1

Platforms

All

profile string

Synopsis

User profile based on the template

Context

configure system security aaa user-template keyword profile string

Tree

profile

String Length

1 to 32

Introduced

16.0.R1

Platforms

All

restricted-to-home boolean

Synopsis

Prevent user navigation above the home directory

Context

configure system security aaa user-template keyword restricted-to-home boolean

Tree

restricted-to-home

Default

false

Introduced

16.0.R1

Platforms

All

cli-script

Synopsis

Enter the cli-script context

Context

configure system security cli-script

Tree

cli-script

Introduced

16.0.R1

Platforms

All

authorization

Synopsis

Enter the authorization context

Context

configure system security cli-script authorization

Tree

authorization

Introduced

16.0.R1

Platforms

All

cron

Synopsis

Enter the cron context

Context

configure system security cli-script authorization cron

Tree

cron

Description

Commands in this context configure authorization for the cron job scheduler.

Introduced

16.0.R1

Platforms

All

cli-user reference

Synopsis

User profile name for CLI command script authorization

Context

configure system security cli-script authorization cron cli-user reference

Tree

cli-user

Reference

configure system security user-params local-user user string

Introduced

16.0.R1

Platforms

All

event-handler

Synopsis

Enter the event-handler context

Context

configure system security cli-script authorization event-handler

Tree

event-handler

Description

Commands in this context configure authorization for the Event Handling System (EHS). EHS allows user-controlled programmatic exception handling by allowing a CLI script to be executed upon the detection of a log event.

Introduced

16.0.R1

Platforms

All

cli-user reference

Synopsis

User profile name for CLI command script authorization

Context

configure system security cli-script authorization event-handler cli-user reference

Tree

cli-user

Reference

configure system security user-params local-user user string

Introduced

16.0.R1

Platforms

All

vsd

Synopsis

Enter the vsd context

Context

configure system security cli-script authorization vsd

Tree

vsd

Description

Commands in this context configure authorization for the VSD server.

Introduced

16.0.R1

Platforms

All

cli-user reference

Synopsis

User profile name for CLI command script authorization

Context

configure system security cli-script authorization vsd cli-user reference

Tree

cli-user

Reference

configure system security user-params local-user user string

Introduced

16.0.R1

Platforms

All

cpm-filter

Synopsis

Enter the cpm-filter context

Context

configure system security cpm-filter

Tree

cpm-filter

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

default-action keyword

Synopsis

Action for packets that do not match any filter entries

Context

configure system security cpm-filter default-action keyword

Tree

default-action

Default

accept

Options

drop, accept

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ip-filter

Synopsis

Enter the ip-filter context

Context

configure system security cpm-filter ip-filter

Tree

ip-filter

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

admin-state keyword

Synopsis

Administrative state of the CPM filter

Context

configure system security cpm-filter ip-filter admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

entry [entry-id] number

Synopsis

Enter the entry list instance

Context

configure system security cpm-filter ip-filter entry number

Tree

entry

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

[entry-id] number

Synopsis

Filter entry ID

Context

configure system security cpm-filter ip-filter entry number

Range

1 to 131072

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

action

Synopsis

Enter the action context

Context

configure system security cpm-filter ip-filter entry number action

Tree

action

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

accept

Synopsis

Forward matching packets

Context

configure system security cpm-filter ip-filter entry number action accept

Tree

accept

Notes

The following elements are part of a choice: accept, default, drop, or queue.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

default

Synopsis

Use default action for matching packets

Context

configure system security cpm-filter ip-filter entry number action default

Tree

default

Notes

The following elements are part of a choice: accept, default, drop, or queue.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

drop

Synopsis

Drop matching packets

Context

configure system security cpm-filter ip-filter entry number action drop

Tree

drop

Notes

The following elements are part of a choice: accept, default, drop, or queue.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

queue reference

Synopsis

Forward matching packets to the CPM hardware queue

Context

configure system security cpm-filter ip-filter entry number action queue reference

Tree

queue

Reference

configure system security cpm-queue queue number

Notes

The following elements are part of a choice: accept, default, drop, or queue.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

description string

Synopsis

Text description

Context

configure system security cpm-filter ip-filter entry number description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

log reference

Synopsis

Log ID where matching packets are entered

Context

configure system security cpm-filter ip-filter entry number log reference

Tree

log

Reference

configure filter log number

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

match

Synopsis

Enter the match context

Context

configure system security cpm-filter ip-filter entry number match

Tree

match

Description

Commands in this context specify match criteria for the entry. When the match criteria have been satisfied, the action associated with the entry is executed.

If more than one match criterion is configured, all criteria must be met before the action associated with the entry is executed.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

dscp keyword

Synopsis

DSCP used as the match criterion on the packet

Context

configure system security cpm-filter ip-filter entry number match dscp keyword

Tree

dscp

Options

be, cp1, cp2, cp3, cp4, cp5, cp6, cp7, cs1, cp9, af11, cp11, af12, cp13, af13, cp15, cs2, cp17, af21, cp19, af22, cp21, af23, cp23, cs3, cp25, af31, cp27, af32, cp29, af33, cp31, cs4, cp33, af41, cp35, af42, cp37, af43, cp39, cs5, cp41, cp42, cp43, cp44, cp45, ef, cp47, nc1, cp49, cp50, cp51, cp52, cp53, cp54, cp55, nc2, cp57, cp58, cp59, cp60, cp61, cp62, cp63

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

dst-ip

Synopsis

Enter the dst-ip context

Context

configure system security cpm-filter ip-filter entry number match dst-ip

Tree

dst-ip

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

address (ipv4-address | ipv4-prefix-with-host-bits)

Synopsis

IPv4 address used as the match criterion

Context

configure system security cpm-filter ip-filter entry number match dst-ip address (ipv4-address | ipv4-prefix-with-host-bits)

Tree

address

Notes

The following elements are part of a choice: (address and mask) or ip-prefix-list.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ip-prefix-list reference

Synopsis

IP4 address prefix list used as match criterion

Context

configure system security cpm-filter ip-filter entry number match dst-ip ip-prefix-list reference

Tree

ip-prefix-list

Reference

configure filter match-list ip-prefix-list string

Notes

The following elements are part of a choice: (address and mask) or ip-prefix-list.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

mask string

Synopsis

IPv4 address mask used as the match criterion

Context

configure system security cpm-filter ip-filter entry number match dst-ip mask string

Tree

mask

Notes

The following elements are part of a choice: (address and mask) or ip-prefix-list.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

dst-port

Synopsis

Enter the dst-port context

Context

configure system security cpm-filter ip-filter entry number match dst-port

Tree

dst-port

Notes

The following elements are part of a choice: port or (dst-port and src-port).

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

eq number

Synopsis

Port number as the match criterion

Context

configure system security cpm-filter ip-filter entry number match dst-port eq number

Tree

eq

Range

0 to 65535

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

mask number

Synopsis

Port mask as the match criterion

Context

configure system security cpm-filter ip-filter entry number match dst-port mask number

Tree

mask

Range

1 to 65535

Default

65535

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

port-list reference

Synopsis

Port list as the match criterion

Context

configure system security cpm-filter ip-filter entry number match dst-port port-list reference

Tree

port-list

Reference

configure filter match-list port-list string

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

range

Synopsis

Enable the range context

Context

configure system security cpm-filter ip-filter entry number match dst-port range

Tree

range

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

end number

Synopsis

Upper bound of the port number to match

Context

configure system security cpm-filter ip-filter entry number match dst-port range end number

Tree

end

Range

0 to 65535

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

start number

Synopsis

Lower bound of the port number to match

Context

configure system security cpm-filter ip-filter entry number match dst-port range start number

Tree

start

Range

0 to 65535

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

fragment keyword

Synopsis

Match criterion based on presence of fragmented packets

Context

configure system security cpm-filter ip-filter entry number match fragment keyword

Tree

fragment

Description

This command specifies the match criterion based on the existence or absence of fragmented IP packets.

Matching on fragmented IPv4 packets occurs when all packets have either the MF (more fragment) bit set or have the Fragment Offset field of the IP header set to a non-zero value. For IPv6, the existence of the IPv6 Fragmentation Extension Header results in a fragmented packet match.

Matching on non-fragmented IPv4 packets occurs when all packets have the MF bit set to zero and the Fragment Offset field is also set to zero. For IPv6, the absence of an IPv6 Fragmentation Extension Header results in a non-fragmented packet match.

Options

false, true

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

icmp

Synopsis

Enter the icmp context

Context

configure system security cpm-filter ip-filter entry number match icmp

Tree

icmp

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

code number

Synopsis

ICMP code to match

Context

configure system security cpm-filter ip-filter entry number match icmp code number

Tree

code

Range

0 to 255

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

type number

Synopsis

ICMP type to match

Context

configure system security cpm-filter ip-filter entry number match icmp type number

Tree

type

Range

0 to 255

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ip-option

Synopsis

Enable the ip-option context

Context

configure system security cpm-filter ip-filter entry number match ip-option

Tree

ip-option

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

mask number

Synopsis

Mask that is ANDed with ip-option value in the packet header

Context

configure system security cpm-filter ip-filter entry number match ip-option mask number

Tree

mask

Range

1 to 255

Default

255

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

type number

Synopsis

Specific IP option to match

Context

configure system security cpm-filter ip-filter entry number match ip-option type number

Tree

type

Range

0 to 255

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

multiple-option boolean

Synopsis

Match on packets containing multiple option fields

Context

configure system security cpm-filter ip-filter entry number match multiple-option boolean

Tree

multiple-option

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

option-present boolean

Synopsis

Match on packets with option field present

Context

configure system security cpm-filter ip-filter entry number match option-present boolean

Tree

option-present

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

port

Synopsis

Enter the port context

Context

configure system security cpm-filter ip-filter entry number match port

Tree

port

Notes

The following elements are part of a choice: port or (dst-port and src-port).

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

eq number

Synopsis

Port number as the match criterion

Context

configure system security cpm-filter ip-filter entry number match port eq number

Tree

eq

Range

0 to 65535

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

mask number

Synopsis

Port mask as the match criterion

Context

configure system security cpm-filter ip-filter entry number match port mask number

Tree

mask

Range

1 to 65535

Default

65535

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

port-list reference

Synopsis

Port list as the match criterion

Context

configure system security cpm-filter ip-filter entry number match port port-list reference

Tree

port-list

Reference

configure filter match-list port-list string

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

range

Synopsis

Enable the range context

Context

configure system security cpm-filter ip-filter entry number match port range

Tree

range

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

end number

Synopsis

Upper bound of the port number to match

Context

configure system security cpm-filter ip-filter entry number match port range end number

Tree

end

Range

0 to 65535

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

start number

Synopsis

Lower bound of the port number to match

Context

configure system security cpm-filter ip-filter entry number match port range start number

Tree

start

Range

0 to 65535

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

protocol (number | keyword)

Synopsis

IP protocol as the match criterion

Context

configure system security cpm-filter ip-filter entry number match protocol (number | keyword)

Tree

protocol

Range

0 to 255

Options

tcp-udp, icmp, igmp, ip, tcp, egp, igp, udp, rdp, ipv6, ipv6-route, ipv6-frag, idrp, rsvp, gre, ipv6-icmp, ipv6-no-nxt, ipv6-opts, iso-ip, eigrp, ospf-igp, ether-ip, encap, pnni, pim, vrrp, l2tp, stp, ptp, isis, crtp, crudp, sctp

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

router-instance string

Synopsis

Router instance as the match criteria

Context

configure system security cpm-filter ip-filter entry number match router-instance string

Tree

router-instance

String Length

1 to 64

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

src-ip

Synopsis

Enter the src-ip context

Context

configure system security cpm-filter ip-filter entry number match src-ip

Tree

src-ip

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

address (ipv4-address | ipv4-prefix-with-host-bits)

Synopsis

IPv4 address used as the match criterion

Context

configure system security cpm-filter ip-filter entry number match src-ip address (ipv4-address | ipv4-prefix-with-host-bits)

Tree

address

Notes

The following elements are part of a choice: (address and mask) or ip-prefix-list.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ip-prefix-list reference

Synopsis

IP4 address prefix list used as match criterion

Context

configure system security cpm-filter ip-filter entry number match src-ip ip-prefix-list reference

Tree

ip-prefix-list

Reference

configure filter match-list ip-prefix-list string

Notes

The following elements are part of a choice: (address and mask) or ip-prefix-list.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

mask string

Synopsis

IPv4 address mask used as the match criterion

Context

configure system security cpm-filter ip-filter entry number match src-ip mask string

Tree

mask

Notes

The following elements are part of a choice: (address and mask) or ip-prefix-list.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

src-port

Synopsis

Enter the src-port context

Context

configure system security cpm-filter ip-filter entry number match src-port

Tree

src-port

Notes

The following elements are part of a choice: port or (dst-port and src-port).

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

eq number

Synopsis

Port number as the match criterion

Context

configure system security cpm-filter ip-filter entry number match src-port eq number

Tree

eq

Range

0 to 65535

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

mask number

Synopsis

Port mask as the match criterion

Context

configure system security cpm-filter ip-filter entry number match src-port mask number

Tree

mask

Range

1 to 65535

Default

65535

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

port-list reference

Synopsis

Port list as the match criterion

Context

configure system security cpm-filter ip-filter entry number match src-port port-list reference

Tree

port-list

Reference

configure filter match-list port-list string

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

range

Synopsis

Enable the range context

Context

configure system security cpm-filter ip-filter entry number match src-port range

Tree

range

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

end number

Synopsis

Upper bound of the port number to match

Context

configure system security cpm-filter ip-filter entry number match src-port range end number

Tree

end

Range

0 to 65535

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

start number

Synopsis

Lower bound of the port number to match

Context

configure system security cpm-filter ip-filter entry number match src-port range start number

Tree

start

Range

0 to 65535

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

tcp-flags

Synopsis

Enter the tcp-flags context

Context

configure system security cpm-filter ip-filter entry number match tcp-flags

Tree

tcp-flags

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ack boolean

Synopsis

ACK bit in TCP header control bits as match criterion

Context

configure system security cpm-filter ip-filter entry number match tcp-flags ack boolean

Tree

ack

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

syn boolean

Synopsis

SYN bit in TCP header control bits as match criterion

Context

configure system security cpm-filter ip-filter entry number match tcp-flags syn boolean

Tree

syn

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ipv6-filter

Synopsis

Enter the ipv6-filter context

Context

configure system security cpm-filter ipv6-filter

Tree

ipv6-filter

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

admin-state keyword

Synopsis

Administrative state of the CPM filter

Context

configure system security cpm-filter ipv6-filter admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

entry [entry-id] number

Synopsis

Enter the entry list instance

Context

configure system security cpm-filter ipv6-filter entry number

Tree

entry

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

[entry-id] number

Synopsis

Filter entry ID

Context

configure system security cpm-filter ipv6-filter entry number

Range

1 to 131072

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

action

Synopsis

Enter the action context

Context

configure system security cpm-filter ipv6-filter entry number action

Tree

action

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

accept

Synopsis

Forward matching packets

Context

configure system security cpm-filter ipv6-filter entry number action accept

Tree

accept

Notes

The following elements are part of a choice: accept, default, drop, or queue.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

default

Synopsis

Use default action for matching packets

Context

configure system security cpm-filter ipv6-filter entry number action default

Tree

default

Notes

The following elements are part of a choice: accept, default, drop, or queue.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

drop

Synopsis

Drop matching packets

Context

configure system security cpm-filter ipv6-filter entry number action drop

Tree

drop

Notes

The following elements are part of a choice: accept, default, drop, or queue.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

queue reference

Synopsis

Forward matching packets to the CPM hardware queue

Context

configure system security cpm-filter ipv6-filter entry number action queue reference

Tree

queue

Reference

configure system security cpm-queue queue number

Notes

The following elements are part of a choice: accept, default, drop, or queue.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

description string

Synopsis

Text description

Context

configure system security cpm-filter ipv6-filter entry number description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

log reference

Synopsis

Log ID where matching packets are entered

Context

configure system security cpm-filter ipv6-filter entry number log reference

Tree

log

Reference

configure filter log number

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

match

Synopsis

Enter the match context

Context

configure system security cpm-filter ipv6-filter entry number match

Tree

match

Description

Commands in this context specify match criteria for the entry. When the match criteria have been satisfied, the action associated with the entry is executed.

If more than one match criterion is configured, all criteria must be met before the action associated with the entry is executed.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

dscp keyword

Synopsis

DSCP used as the match criterion on the packet

Context

configure system security cpm-filter ipv6-filter entry number match dscp keyword

Tree

dscp

Options

be, cp1, cp2, cp3, cp4, cp5, cp6, cp7, cs1, cp9, af11, cp11, af12, cp13, af13, cp15, cs2, cp17, af21, cp19, af22, cp21, af23, cp23, cs3, cp25, af31, cp27, af32, cp29, af33, cp31, cs4, cp33, af41, cp35, af42, cp37, af43, cp39, cs5, cp41, cp42, cp43, cp44, cp45, ef, cp47, nc1, cp49, cp50, cp51, cp52, cp53, cp54, cp55, nc2, cp57, cp58, cp59, cp60, cp61, cp62, cp63

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

dst-ip

Synopsis

Enter the dst-ip context

Context

configure system security cpm-filter ipv6-filter entry number match dst-ip

Tree

dst-ip

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

address (ipv6-address | ipv6-prefix-with-host-bits)

Synopsis

IPv6 address used as the match criterion

Context

configure system security cpm-filter ipv6-filter entry number match dst-ip address (ipv6-address | ipv6-prefix-with-host-bits)

Tree

address

Notes

The following elements are part of a choice: (address and mask) or ipv6-prefix-list.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ipv6-prefix-list reference

Synopsis

IPv6 address prefix list used as match criterion

Context

configure system security cpm-filter ipv6-filter entry number match dst-ip ipv6-prefix-list reference

Tree

ipv6-prefix-list

Reference

configure filter match-list ipv6-prefix-list string

Notes

The following elements are part of a choice: (address and mask) or ipv6-prefix-list.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

mask string

Synopsis

IPv6 address mask used as the match criterion

Context

configure system security cpm-filter ipv6-filter entry number match dst-ip mask string

Tree

mask

Notes

The following elements are part of a choice: (address and mask) or ipv6-prefix-list.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

dst-port

Synopsis

Enter the dst-port context

Context

configure system security cpm-filter ipv6-filter entry number match dst-port

Tree

dst-port

Notes

The following elements are part of a choice: port or (dst-port and src-port).

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

eq number

Synopsis

Port number as the match criterion

Context

configure system security cpm-filter ipv6-filter entry number match dst-port eq number

Tree

eq

Range

0 to 65535

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

mask number

Synopsis

Port mask as the match criterion

Context

configure system security cpm-filter ipv6-filter entry number match dst-port mask number

Tree

mask

Range

1 to 65535

Default

65535

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

port-list reference

Synopsis

Port list as the match criterion

Context

configure system security cpm-filter ipv6-filter entry number match dst-port port-list reference

Tree

port-list

Reference

configure filter match-list port-list string

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

range

Synopsis

Enable the range context

Context

configure system security cpm-filter ipv6-filter entry number match dst-port range

Tree

range

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

end number

Synopsis

Upper bound of the port number to match

Context

configure system security cpm-filter ipv6-filter entry number match dst-port range end number

Tree

end

Range

0 to 65535

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

start number

Synopsis

Lower bound of the port number to match

Context

configure system security cpm-filter ipv6-filter entry number match dst-port range start number

Tree

start

Range

0 to 65535

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

extension-header

Synopsis

Enter the extension-header context

Context

configure system security cpm-filter ipv6-filter entry number match extension-header

Tree

extension-header

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

hop-by-hop boolean

Synopsis

Match on existence of Hop-By-Hop Options Header

Context

configure system security cpm-filter ipv6-filter entry number match extension-header hop-by-hop boolean

Tree

hop-by-hop

Description

When configured to true, a match occurs when the Hop-by-Hop Options Extension Header is present.

When configured to false, a match occurs when the Hop-by-Hop Options Extension Header is not present.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

flow-label number

Synopsis

Flow label in the IPv6 header as the match criterion

Context

configure system security cpm-filter ipv6-filter entry number match flow-label number

Tree

flow-label

Range

0 to 1048575

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

fragment keyword

Synopsis

Match criterion based on presence of fragmented packets

Context

configure system security cpm-filter ipv6-filter entry number match fragment keyword

Tree

fragment

Description

This command specifies the match criterion based on the existence or absence of fragmented IP packets.

Matching on fragmented IPv4 packets occurs when all packets have either the MF (more fragment) bit set or have the Fragment Offset field of the IP header set to a non-zero value. For IPv6, the existence of the IPv6 Fragmentation Extension Header results in a fragmented packet match.

Matching on non-fragmented IPv4 packets occurs when all packets have the MF bit set to zero and the Fragment Offset field is also set to zero. For IPv6, the absence of an IPv6 Fragmentation Extension Header results in a non-fragmented packet match.

Options

false, true

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

icmp

Synopsis

Enter the icmp context

Context

configure system security cpm-filter ipv6-filter entry number match icmp

Tree

icmp

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

code number

Synopsis

ICMP code as the match criterion

Context

configure system security cpm-filter ipv6-filter entry number match icmp code number

Tree

code

Range

0 to 255

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

type number

Synopsis

ICMP type as the match criterion

Context

configure system security cpm-filter ipv6-filter entry number match icmp type number

Tree

type

Range

0 to 255

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

next-header (number | keyword)

Synopsis

IP protocol to match

Context

configure system security cpm-filter ipv6-filter entry number match next-header (number | keyword)

Tree

next-header

Range

0 to 255

Options

tcp-udp, icmp, igmp, ip, tcp, egp, igp, udp, rdp, ipv6, ipv6-route, ipv6-frag, idrp, rsvp, gre, ipv6-icmp, ipv6-no-nxt, ipv6-opts, iso-ip, eigrp, ospf-igp, ether-ip, encap, pnni, pim, vrrp, l2tp, stp, ptp, isis, crtp, crudp, sctp

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

port

Synopsis

Enter the port context

Context

configure system security cpm-filter ipv6-filter entry number match port

Tree

port

Notes

The following elements are part of a choice: port or (dst-port and src-port).

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

eq number

Synopsis

Port number as the match criterion

Context

configure system security cpm-filter ipv6-filter entry number match port eq number

Tree

eq

Range

0 to 65535

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

mask number

Synopsis

Port mask as the match criterion

Context

configure system security cpm-filter ipv6-filter entry number match port mask number

Tree

mask

Range

1 to 65535

Default

65535

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

port-list reference

Synopsis

Port list as the match criterion

Context

configure system security cpm-filter ipv6-filter entry number match port port-list reference

Tree

port-list

Reference

configure filter match-list port-list string

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

range

Synopsis

Enable the range context

Context

configure system security cpm-filter ipv6-filter entry number match port range

Tree

range

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

end number

Synopsis

Upper bound of the port number to match

Context

configure system security cpm-filter ipv6-filter entry number match port range end number

Tree

end

Range

0 to 65535

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

start number

Synopsis

Lower bound of the port number to match

Context

configure system security cpm-filter ipv6-filter entry number match port range start number

Tree

start

Range

0 to 65535

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

router-instance string

Synopsis

Router instance as the match criteria

Context

configure system security cpm-filter ipv6-filter entry number match router-instance string

Tree

router-instance

String Length

1 to 64

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

src-ip

Synopsis

Enter the src-ip context

Context

configure system security cpm-filter ipv6-filter entry number match src-ip

Tree

src-ip

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

address (ipv6-address | ipv6-prefix-with-host-bits)

Synopsis

IPv6 address used as the match criterion

Context

configure system security cpm-filter ipv6-filter entry number match src-ip address (ipv6-address | ipv6-prefix-with-host-bits)

Tree

address

Notes

The following elements are part of a choice: (address and mask) or ipv6-prefix-list.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ipv6-prefix-list reference

Synopsis

IPv6 address prefix list used as match criterion

Context

configure system security cpm-filter ipv6-filter entry number match src-ip ipv6-prefix-list reference

Tree

ipv6-prefix-list

Reference

configure filter match-list ipv6-prefix-list string

Notes

The following elements are part of a choice: (address and mask) or ipv6-prefix-list.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

mask string

Synopsis

IPv6 address mask used as the match criterion

Context

configure system security cpm-filter ipv6-filter entry number match src-ip mask string

Tree

mask

Notes

The following elements are part of a choice: (address and mask) or ipv6-prefix-list.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

src-port

Synopsis

Enter the src-port context

Context

configure system security cpm-filter ipv6-filter entry number match src-port

Tree

src-port

Notes

The following elements are part of a choice: port or (dst-port and src-port).

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

eq number

Synopsis

Port number as the match criterion

Context

configure system security cpm-filter ipv6-filter entry number match src-port eq number

Tree

eq

Range

0 to 65535

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

mask number

Synopsis

Port mask as the match criterion

Context

configure system security cpm-filter ipv6-filter entry number match src-port mask number

Tree

mask

Range

1 to 65535

Default

65535

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

port-list reference

Synopsis

Port list as the match criterion

Context

configure system security cpm-filter ipv6-filter entry number match src-port port-list reference

Tree

port-list

Reference

configure filter match-list port-list string

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

range

Synopsis

Enable the range context

Context

configure system security cpm-filter ipv6-filter entry number match src-port range

Tree

range

Notes

The following elements are part of a choice: (eq and mask), port-list, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

end number

Synopsis

Upper bound of the port number to match

Context

configure system security cpm-filter ipv6-filter entry number match src-port range end number

Tree

end

Range

0 to 65535

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

start number

Synopsis

Lower bound of the port number to match

Context

configure system security cpm-filter ipv6-filter entry number match src-port range start number

Tree

start

Range

0 to 65535

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

tcp-flags

Synopsis

Enter the tcp-flags context

Context

configure system security cpm-filter ipv6-filter entry number match tcp-flags

Tree

tcp-flags

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ack boolean

Synopsis

ACK bit in TCP header control bits as match criterion

Context

configure system security cpm-filter ipv6-filter entry number match tcp-flags ack boolean

Tree

ack

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

syn boolean

Synopsis

SYN bit in TCP header control bits as match criterion

Context

configure system security cpm-filter ipv6-filter entry number match tcp-flags syn boolean

Tree

syn

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

mac-filter

Synopsis

Enter the mac-filter context

Context

configure system security cpm-filter mac-filter

Tree

mac-filter

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

admin-state keyword

Synopsis

Administrative state of the CPM filter

Context

configure system security cpm-filter mac-filter admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

entry [entry-id] number

Synopsis

Enter the entry list instance

Context

configure system security cpm-filter mac-filter entry number

Tree

entry

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

[entry-id] number

Synopsis

Filter entry ID

Context

configure system security cpm-filter mac-filter entry number

Range

1 to 131072

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

action

Synopsis

Enter the action context

Context

configure system security cpm-filter mac-filter entry number action

Tree

action

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

accept

Synopsis

Forward matching packets

Context

configure system security cpm-filter mac-filter entry number action accept

Tree

accept

Notes

The following elements are part of a choice: accept, default, drop, or queue.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

default

Synopsis

Use default action for matching packets

Context

configure system security cpm-filter mac-filter entry number action default

Tree

default

Notes

The following elements are part of a choice: accept, default, drop, or queue.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

drop

Synopsis

Drop matching packets

Context

configure system security cpm-filter mac-filter entry number action drop

Tree

drop

Notes

The following elements are part of a choice: accept, default, drop, or queue.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

queue reference

Synopsis

Forward matching packets to the CPM hardware queue

Context

configure system security cpm-filter mac-filter entry number action queue reference

Tree

queue

Reference

configure system security cpm-queue queue number

Notes

The following elements are part of a choice: accept, default, drop, or queue.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

description string

Synopsis

Text description

Context

configure system security cpm-filter mac-filter entry number description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

log reference

Synopsis

Log ID where matching packets are entered

Context

configure system security cpm-filter mac-filter entry number log reference

Tree

log

Reference

configure filter log number

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

match

Synopsis

Enter the match context

Context

configure system security cpm-filter mac-filter entry number match

Tree

match

Description

Commands in this context specify match criteria for the entry. When the match criteria have been satisfied, the action associated with the entry is executed.

If more than one match criterion is configured, all criteria must be met before the action associated with the entry is executed.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

cfm-opcode

Synopsis

Enter the cfm-opcode context

Context

configure system security cpm-filter mac-filter entry number match cfm-opcode

Tree

cfm-opcode

Description

Commands in this context specify match criteria based on the CFM opcode.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

eq number

Synopsis

Equal to comparison operator for the CFM opcode

Context

configure system security cpm-filter mac-filter entry number match cfm-opcode eq number

Tree

eq

Range

0 to 255

Notes

The following elements are part of a choice: eq, gt, lt, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

gt number

Synopsis

Greater than comparison operator for the CFM opcode

Context

configure system security cpm-filter mac-filter entry number match cfm-opcode gt number

Tree

gt

Range

0 to 254

Notes

The following elements are part of a choice: eq, gt, lt, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

lt number

Synopsis

Less than comparison operator for the CFM opcode

Context

configure system security cpm-filter mac-filter entry number match cfm-opcode lt number

Tree

lt

Range

1 to 255

Notes

The following elements are part of a choice: eq, gt, lt, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

range

Synopsis

Enable the range context

Context

configure system security cpm-filter mac-filter entry number match cfm-opcode range

Tree

range

Notes

The following elements are part of a choice: eq, gt, lt, or range.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

end number

Synopsis

Upper bound of the Opcode range to match

Context

configure system security cpm-filter mac-filter entry number match cfm-opcode range end number

Tree

end

Range

1 to 255

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

start number

Synopsis

Lower bound of the OpCode range to match

Context

configure system security cpm-filter mac-filter entry number match cfm-opcode range start number

Tree

start

Range

0 to 254

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

dst-mac

Synopsis

Enable the dst-mac context

Context

configure system security cpm-filter mac-filter entry number match dst-mac

Tree

dst-mac

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

address string

Synopsis

MAC address used as the match criterion

Context

configure system security cpm-filter mac-filter entry number match dst-mac address string

Tree

address

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

mask string

Synopsis

MAC address mask as the match criterion

Context

configure system security cpm-filter mac-filter entry number match dst-mac mask string

Tree

mask

Default

ff:ff:ff:ff:ff:ff

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

etype string

Synopsis

Ethernet type as the match criterion

Context

configure system security cpm-filter mac-filter entry number match etype string

Tree

etype

Description

This command specifies an Ethernet type II Ethertype value to be used as a MAC filter match criterion.

The Ethernet type field is used by the Ethernet version-II frames and does not apply to IEEE 802.3 Ethernet frames.

String Length

5 to 6

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

frame-type keyword

Synopsis

MAC frame type as the match criterion

Context

configure system security cpm-filter mac-filter entry number match frame-type keyword

Tree

frame-type

Options

802dot2-llc, ethernet-ii

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

llc-dsap

Synopsis

Enable the llc-dsap context

Context

configure system security cpm-filter mac-filter entry number match llc-dsap

Tree

llc-dsap

Description

Commands in this context specify match criteria based on the Destination Service Access Point (DSAP).

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

dsap number

Synopsis

8-bit DSAP as the match criterion

Context

configure system security cpm-filter mac-filter entry number match llc-dsap dsap number

Tree

dsap

Range

0 to 255

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

mask number

Synopsis

Mask for DSAP value as the match criterion

Context

configure system security cpm-filter mac-filter entry number match llc-dsap mask number

Tree

mask

Range

1 to 255

Default

255

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

llc-ssap

Synopsis

Enable the llc-ssap context

Context

configure system security cpm-filter mac-filter entry number match llc-ssap

Tree

llc-ssap

Description

Commands in this context specify match criteria based on the Source Service Access Point (SSAP).

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

mask number

Synopsis

Mask for SSAP value as the match criterion

Context

configure system security cpm-filter mac-filter entry number match llc-ssap mask number

Tree

mask

Range

1 to 255

Default

255

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

ssap number

Synopsis

8-bit SSAP as the match criterion

Context

configure system security cpm-filter mac-filter entry number match llc-ssap ssap number

Tree

ssap

Range

0 to 255

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

service reference

Synopsis

Service ID used as the match condition

Context

configure system security cpm-filter mac-filter entry number match service reference

Tree

service

Reference

configure service vpls string

Introduced

16.0.R4

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

src-mac

Synopsis

Enable the src-mac context

Context

configure system security cpm-filter mac-filter entry number match src-mac

Tree

src-mac

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

address string

Synopsis

MAC address used as the match criterion

Context

configure system security cpm-filter mac-filter entry number match src-mac address string

Tree

address

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

mask string

Synopsis

MAC address mask as the match criterion

Context

configure system security cpm-filter mac-filter entry number match src-mac mask string

Tree

mask

Default

ff:ff:ff:ff:ff:ff

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

cpm-queue

Synopsis

Enter the cpm-queue context

Context

configure system security cpm-queue

Tree

cpm-queue

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

queue [queue-id] number

Synopsis

Enter the queue list instance

Context

configure system security cpm-queue queue number

Tree

queue

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

[queue-id] number

Synopsis

CPM queue ID

Context

configure system security cpm-queue queue number

Range

33 to 2000

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

cbs number

Synopsis

Buffer size that can be drawn from queue buffer pool

Context

configure system security cpm-queue queue number cbs number

Tree

cbs

Description

This command specifies the amount of buffer that can be drawn from the reserved buffer portion of the buffer pool of the queue.

Range

0 to 131072

Units

kilobps

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

mbs number

Synopsis

Maximum queue depth to which the queue can grow

Context

configure system security cpm-queue queue number mbs number

Tree

mbs

Range

0 to 131072

Units

kilobps

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

rate

Synopsis

Enter the rate context

Context

configure system security cpm-queue queue number rate

Tree

rate

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

cir (number | keyword)

Synopsis

Amount of bandwidth committed to the queue

Context

configure system security cpm-queue queue number rate cir (number | keyword)

Tree

cir

Range

0 to 100000000

Default

max

Units

kilobps

Options

max

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

pir (number | keyword)

Synopsis

Peak Information Rate for the queue

Context

configure system security cpm-queue queue number rate pir (number | keyword)

Tree

pir

Range

1 to 100000000

Default

max

Units

kilobps

Options

max

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

cpu-protection

Synopsis

Enter the cpu-protection context

Context

configure system security cpu-protection

Tree

cpu-protection

Description

Commands in this context configure CPU protection policies.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

ip-src-monitoring

Synopsis

Enter the ip-src-monitoring context

Context

configure system security cpu-protection ip-src-monitoring

Tree

ip-src-monitoring

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

included-protocols

Synopsis

Enter the included-protocols context

Context

configure system security cpu-protection ip-src-monitoring included-protocols

Tree

included-protocols

Description

Commands in this context specify the protocols included in IP source monitoring. The protocol packets will be subject to the per-source-rate of CPU protection policies.

This configuration applies system wide and applies to CPU protection globally.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

dhcp boolean

Synopsis

Include extracted DHCP packets for IP source monitoring

Context

configure system security cpu-protection ip-src-monitoring included-protocols dhcp boolean

Tree

dhcp

Default

true

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

gtp boolean

Synopsis

Include extracted GTP packets for IP source monitoring

Context

configure system security cpu-protection ip-src-monitoring included-protocols gtp boolean

Tree

gtp

Default

false

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

icmp boolean

Synopsis

Include extracted ICMP packets for IP source monitoring

Context

configure system security cpu-protection ip-src-monitoring included-protocols icmp boolean

Tree

icmp

Default

false

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

igmp boolean

Synopsis

Include extracted IGMP packets for IP source monitoring

Context

configure system security cpu-protection ip-src-monitoring included-protocols igmp boolean

Tree

igmp

Default

false

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

link-specific-rate (number | keyword)

Synopsis

Packet arrival rate limit for link level protocols

Context

configure system security cpu-protection link-specific-rate (number | keyword)

Tree

link-specific-rate

Description

This command configures a link-specific rate for CPU protection. The limit is applied to all ports within the system. The CPU receives no more than the configured packet rate for all link level protocols, such as LACP, from any one port.

The measurement is cleared each second and is based on the ingress port.

Range

1 to 65535

Units

packets per second

Options

max

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

policy [policy-id] number

Synopsis

Enter the policy list instance

Context

configure system security cpu-protection policy number

Tree

policy

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

[policy-id] number

Synopsis

Policy ID

Context

configure system security cpu-protection policy number

Range

1 to 255

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

alarm boolean

Synopsis

Generate an event when the rate is exceeded

Context

configure system security cpu-protection policy number alarm boolean

Tree

alarm

Description

When configured to true, an event is generated when the rate is exceeded. The event includes information about the offending source. Only one event is generated per monitor period.

When configured to false, notifications are disabled.

Default

true

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

description string

Synopsis

Text description

Context

configure system security cpu-protection policy number description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

eth-cfm

Synopsis

Enter the eth-cfm context

Context

configure system security cpu-protection policy number eth-cfm

Tree

eth-cfm

Description

Commands in this context configure CPU policy entries that determine match criteria and overall arrival rate of the Ethernet Connectivity and Fault Management (ETH-CFM) packets at the CPU.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

entry [id] number

Synopsis

Enter the entry list instance

Context

configure system security cpu-protection policy number eth-cfm entry number

Tree

entry

Max. Elements

10

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

[id] number

Synopsis

Entry ID

Context

configure system security cpu-protection policy number eth-cfm entry number

Range

1 to 100

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

level start number end number

Synopsis

Add a list entry for level

Context

configure system security cpu-protection policy number eth-cfm entry number level start number end number

Tree

level

Description

Commands in this context specify the range of domain levels for the match criterion.

Min. Elements

1

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

start number

Synopsis

Lower bound of the level range

Context

configure system security cpu-protection policy number eth-cfm entry number level start number end number

Range

0 to 7

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

end number

Synopsis

Upper bound of the level range

Context

configure system security cpu-protection policy number eth-cfm entry number level start number end number

Range

0 to 7

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

opcode start number end number

Synopsis

Add a list entry for opcode

Context

configure system security cpu-protection policy number eth-cfm entry number opcode start number end number

Tree

opcode

Description

Commands in this context specify the range of operational codes (that identify the application) for the match criterion.

Min. Elements

1

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

start number

Synopsis

Lower bound of the OpCode range

Context

configure system security cpu-protection policy number eth-cfm entry number opcode start number end number

Range

0 to 255

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

end number

Synopsis

Upper bound of the OpCode range

Context

configure system security cpu-protection policy number eth-cfm entry number opcode start number end number

Range

0 to 255

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

pir (number | keyword)

Synopsis

Packet arrival rate limit

Context

configure system security cpu-protection policy number eth-cfm entry number pir (number | keyword)

Tree

pir

Range

0 to 65534

Default

max

Units

packets per second

Options

max

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

out-profile-rate

Synopsis

Enter the out-profile-rate context

Context

configure system security cpu-protection policy number out-profile-rate

Tree

out-profile-rate

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

log-events boolean

Synopsis

Generate a log event when the packet rate is exceeded

Context

configure system security cpu-protection policy number out-profile-rate log-events boolean

Tree

log-events

Default

false

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

pir (number | keyword)

Synopsis

Packet arrival rate limit

Context

configure system security cpu-protection policy number out-profile-rate pir (number | keyword)

Tree

pir

Range

1 to 65534

Units

packets per second

Options

max

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

overall-rate (number | keyword)

Synopsis

Overall packet arrival rate limit to apply for all sources of packets

Context

configure system security cpu-protection policy number overall-rate (number | keyword)

Tree

overall-rate

Range

1 to 65534

Units

packets per second

Options

max

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

per-source-parameters

Synopsis

Enter the per-source-parameters context

Context

configure system security cpu-protection policy number per-source-parameters

Tree

per-source-parameters

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

ip-src-monitoring

Synopsis

Enter the ip-src-monitoring context

Context

configure system security cpu-protection policy number per-source-parameters ip-src-monitoring

Tree

ip-src-monitoring

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

limit-dhcp-ci-addr-zero boolean

Synopsis

Apply per-source rate limiting to DHCP packets containing Client IP address zero

Context

configure system security cpu-protection policy number per-source-parameters ip-src-monitoring limit-dhcp-ci-addr-zero boolean

Tree

limit-dhcp-ci-addr-zero

Default

false

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

per-source-rate (number | keyword)

Synopsis

Per-source packet arrival rate limit

Context

configure system security cpu-protection policy number per-source-rate (number | keyword)

Tree

per-source-rate

Description

This command configures the per-source packet arrival rate limit.

A source is defined as a unique combination of SAP and MAC source address or SAP and source IP address. The CPU receives no more than the specified packet rate from each source. The measurement is cleared every second.

This configuration is applicable only if the policy is assigned to an interface (such as SAPs, subscriber interfaces, and spoke SDPs), and MAC monitoring or IP source monitoring is specified in the CPU protection configuration of the interface.

Range

1 to 65534

Default

max

Units

packets per second

Options

max

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

port-overall-rate

Synopsis

Enter the port-overall-rate context

Context

configure system security cpu-protection port-overall-rate

Tree

port-overall-rate

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

action-low-priority boolean

Synopsis

Mark packets that exceed the rate as low-priority

Context

configure system security cpu-protection port-overall-rate action-low-priority boolean

Tree

action-low-priority

Description

When configured to true, packets that exceed the per-port packet arrival rate limit are marked as low priority for preferential discard later (if there is congestion in the control plane) rather than discarded immediately.

Default

false

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

pir (number | keyword)

Synopsis

Per-port packet arrival rate limit

Context

configure system security cpu-protection port-overall-rate pir (number | keyword)

Tree

pir

Range

1 to 65535

Units

packets per second

Options

max

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

protocol-protection

Synopsis

Enable the protocol-protection context

Context

configure system security cpu-protection protocol-protection

Tree

protocol-protection

Description

When enabled, the network processor on the CPM discards all packets received for protocols that are not configured on the interface. This action helps to mitigate DoS attacks by filtering invalid control traffic before it ingresses the CPU. For example, if IS-IS is not configured on an interface, protocol protection discards any IS-IS packets received on the interface.

Commands in this context further define the action when the context is enabled.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

allow-sham-links boolean

Synopsis

Allow OSPF sham link traffic

Context

configure system security cpu-protection protocol-protection allow-sham-links boolean

Tree

allow-sham-links

Description

When configured to true, tunneled OSPF packets received over the backbone network must be explicitly allowed when OSPF sham links form an adjacency over the MPLS-VPRN backbone network.

Default

false

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

block-pim-tunneled boolean

Synopsis

Block extraction and processing of PIM packets

Context

configure system security cpu-protection protocol-protection block-pim-tunneled boolean

Tree

block-pim-tunneled

Description

When configured to true, PIM packets arriving at the SR OS node inside a tunnel (for example, MPLS or GRE) on a network interface are blocked and not processed. PIM in an mVPN on the egress DR will not switch traffic from the (*,G) to the (S,G) tree.

Default

false

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR-7/12/12e, 7750 SR-7s, 7750 SR-14s, 7950 XRS

dist-cpu-protection

Synopsis

Enter the dist-cpu-protection context

Context

configure system security dist-cpu-protection

Tree

dist-cpu-protection

Description

Commands in this context configure distributed CPU protection (DCP) attributes.

Introduced

16.0.R1

Platforms

All

policy [policy-name] string

Synopsis

Enter the policy list instance

Context

configure system security dist-cpu-protection policy string

Tree

policy

Description

Commands in this context configure the attributes of DCP policies. These policies can be applied to objects such as SAPs, network interfaces or ports

Max. Elements

18

Introduced

16.0.R1

Platforms

All

[policy-name] string

Synopsis

Policy name

Context

configure system security dist-cpu-protection policy string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system security dist-cpu-protection policy string description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

All

local-monitoring-policer [policer-name] string

Synopsis

Enter the local-monitoring-policer list instance

Context

configure system security dist-cpu-protection policy string local-monitoring-policer string

Tree

local-monitoring-policer

Max. Elements

1

Introduced

16.0.R1

Platforms

All

[policer-name] string

Synopsis

Local monitoring policer name

Context

configure system security dist-cpu-protection policy string local-monitoring-policer string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system security dist-cpu-protection policy string local-monitoring-policer string description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

All

exceed-action keyword

Synopsis

Action taken when policer rates are exceeded

Context

configure system security dist-cpu-protection policy string local-monitoring-policer string exceed-action keyword

Tree

exceed-action

Description

This command specifies the action taken on the extracted control packets when the configured policer rates are exceeded.

Default

none

Options

discard, low-priority, none

Introduced

16.0.R1

Platforms

All

log-events keyword

Synopsis

Control of log events creation for status and activity

Context

configure system security dist-cpu-protection policy string local-monitoring-policer string log-events keyword

Tree

log-events

Description

This command controls the creation of log events related to the status and activity of the local monitoring policer.

Default

true

Options

false, true, verbose

Introduced

16.0.R1

Platforms

All

rate

Synopsis

Enter the rate context

Context

configure system security dist-cpu-protection policy string local-monitoring-policer string rate

Tree

rate

Description

Commands in this context specify the rate and burst tolerance for the policer.

The actual hardware may not be able to perfectly rate limit to the exact configured parameters. In this case, the configured parameters will be adapted to the closest supported rate.

Introduced

16.0.R1

Platforms

All

kbps

Synopsis

Enter the kbps context

Context

configure system security dist-cpu-protection policy string local-monitoring-policer string rate kbps

Tree

kbps

Notes

The following elements are part of a choice: kbps or packets.

Introduced

16.0.R1

Platforms

All

limit (keyword | number)

Synopsis

Rate limit

Context

configure system security dist-cpu-protection policy string local-monitoring-policer string rate kbps limit (keyword | number)

Tree

limit

Range

1 to 20000000

Default

max

Units

kilobps

Options

max

Introduced

16.0.R1

Platforms

All

mbs number

Synopsis

Tolerance for the rate

Context

configure system security dist-cpu-protection policy string local-monitoring-policer string rate kbps mbs number

Tree

mbs

Range

0 to 4194304

Units

bytes

Introduced

16.0.R1

Platforms

All

packets

Synopsis

Enter the packets context

Context

configure system security dist-cpu-protection policy string local-monitoring-policer string rate packets

Tree

packets

Notes

This element is the default part of a choice.

The following elements are part of a choice: kbps or packets.

Introduced

16.0.R1

Platforms

All

initial-delay number

Synopsis

Additional packets allowed in an initial burst

Context

configure system security dist-cpu-protection policy string local-monitoring-policer string rate packets initial-delay number

Tree

initial-delay

Description

This command specifies the number of packets allowed in an initial burst (or a burst after the policer bucket has drained to zero) in addition to the packets per interval limit. The typical setting would be a value equal to the number of received packets in several full handshakes or negotiations of the protocol.

Range

0 to 255

Default

0

Units

packets

Introduced

16.0.R1

Platforms

All

limit (keyword | number)

Synopsis

Packets per interval limit

Context

configure system security dist-cpu-protection policy string local-monitoring-policer string rate packets limit (keyword | number)

Tree

limit

Range

0 to 8000

Default

max

Units

packets per interval

Options

max

Introduced

16.0.R1

Platforms

All

within number

Synopsis

Measurement interval for packets rate

Context

configure system security dist-cpu-protection policy string local-monitoring-policer string rate packets within number

Tree

within

Range

1 to 32767

Default

1

Units

seconds

Introduced

16.0.R1

Platforms

All

protocol [protocol-name] keyword

Synopsis

Enter the protocol list instance

Context

configure system security dist-cpu-protection policy string protocol keyword

Tree

protocol

Introduced

16.0.R1

Platforms

All

[protocol-name] keyword

Synopsis

Protocol name

Context

configure system security dist-cpu-protection policy string protocol keyword

Options

arp, dhcp, http-redirect, icmp, igmp, mld, ndis, pppoe-pppoa, all-unspecified, mpls-ttl, bfd-cpm, bgp, eth-cfm, isis, ldp, ospf, pim, rsvp, icmp-ping-check, lacp

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

dynamic-parameters

Synopsis

Enter the dynamic-parameters context

Context

configure system security dist-cpu-protection policy string protocol keyword dynamic-parameters

Tree

dynamic-parameters

Introduced

16.0.R1

Platforms

All

detection-time number

Synopsis

Minimum time the dynamic policer remains allocated

Context

configure system security dist-cpu-protection policy string protocol keyword dynamic-parameters detection-time number

Tree

detection-time

Range

1 to 128000

Default

30

Units

seconds

Introduced

16.0.R1

Platforms

All

exceed-action

Synopsis

Enter the exceed-action context

Context

configure system security dist-cpu-protection policy string protocol keyword dynamic-parameters exceed-action

Tree

exceed-action

Description

Commands in this context specify the settings for the scenario when the configured policer rates are exceeded.

Introduced

16.0.R1

Platforms

All

action keyword

Synopsis

Action taken on control packets when rates are exceeded

Context

configure system security dist-cpu-protection policy string protocol keyword dynamic-parameters exceed-action action keyword

Tree

action

Default

none

Options

discard, low-priority, none

Introduced

16.0.R1

Platforms

All

hold-down (keyword | number)

Synopsis

Hold down behavior

Context

configure system security dist-cpu-protection policy string protocol keyword dynamic-parameters exceed-action hold-down (keyword | number)

Tree

hold-down

Description

This command specifies the behavior when the system detects that an enforcement policer has marked or discarded one or more packets and there is no action specified for the scenario when the rates are exceeded.

The hold time condition is cleared after the specified time has expired. The detection time (the minimum time that the policer remains allocated) begins after the hold down is complete. The hold down behavior is not applicable to a local monitoring policer.

An indefinite hold down behavior must be cleared using the tools perform security dist-cpu-protection release-hold-down command.

Range

1 to 10080

Default

none

Units

seconds

Options

indefinite, none

Introduced

16.0.R1

Platforms

All

log-events keyword

Synopsis

Control of log events creation for status and activity

Context

configure system security dist-cpu-protection policy string protocol keyword dynamic-parameters log-events keyword

Tree

log-events

Description

This command controls the creation of log events related to the status and activity of the local monitoring policer.

Default

true

Options

false, true, verbose

Introduced

16.0.R1

Platforms

All

rate

Synopsis

Enter the rate context

Context

configure system security dist-cpu-protection policy string protocol keyword dynamic-parameters rate

Tree

rate

Description

Commands in this context specify the rate and burst tolerance for the policer.

The actual hardware may not be able to perfectly rate limit to the exact configured parameters. In this case, the configured parameters will be adapted to the closest supported rate.

Introduced

16.0.R1

Platforms

All

kbps

Synopsis

Enter the kbps context

Context

configure system security dist-cpu-protection policy string protocol keyword dynamic-parameters rate kbps

Tree

kbps

Notes

The following elements are part of a choice: kbps or packets.

Introduced

16.0.R1

Platforms

All

limit (keyword | number)

Synopsis

Rate limit

Context

configure system security dist-cpu-protection policy string protocol keyword dynamic-parameters rate kbps limit (keyword | number)

Tree

limit

Range

1 to 20000000

Default

max

Units

kilobps

Options

max

Introduced

16.0.R1

Platforms

All

mbs number

Synopsis

Tolerance for the rate

Context

configure system security dist-cpu-protection policy string protocol keyword dynamic-parameters rate kbps mbs number

Tree

mbs

Range

0 to 4194304

Units

bytes

Introduced

16.0.R1

Platforms

All

packets

Synopsis

Enter the packets context

Context

configure system security dist-cpu-protection policy string protocol keyword dynamic-parameters rate packets

Tree

packets

Notes

This element is the default part of a choice.

The following elements are part of a choice: kbps or packets.

Introduced

16.0.R1

Platforms

All

initial-delay number

Synopsis

Additional packets allowed in an initial burst

Context

configure system security dist-cpu-protection policy string protocol keyword dynamic-parameters rate packets initial-delay number

Tree

initial-delay

Description

This command specifies the number of packets allowed in an initial burst (or a burst after the policer bucket has drained to zero) in addition to the packets per interval limit. The typical setting would be a value equal to the number of received packets in several full handshakes or negotiations of the protocol.

Range

0 to 255

Default

0

Units

packets

Introduced

16.0.R1

Platforms

All

limit (keyword | number)

Synopsis

Packets per interval limit

Context

configure system security dist-cpu-protection policy string protocol keyword dynamic-parameters rate packets limit (keyword | number)

Tree

limit

Range

0 to 8000

Default

max

Units

packets per interval

Options

max

Introduced

16.0.R1

Platforms

All

within number

Synopsis

Measurement interval for packets rate

Context

configure system security dist-cpu-protection policy string protocol keyword dynamic-parameters rate packets within number

Tree

within

Range

1 to 32767

Default

1

Units

seconds

Introduced

16.0.R1

Platforms

All

enforcement

Synopsis

Enter the enforcement context

Context

configure system security dist-cpu-protection policy string protocol keyword enforcement

Tree

enforcement

Introduced

16.0.R1

Platforms

All

dynamic

Synopsis

Enter the dynamic context

Context

configure system security dist-cpu-protection policy string protocol keyword enforcement dynamic

Tree

dynamic

Notes

The following elements are part of a choice: dynamic, dynamic-local-mon-bypass, or static.

Introduced

16.0.R1

Platforms

All

mon-policer-name reference

Synopsis

Dynamic enforcement policer for the protocol

Context

configure system security dist-cpu-protection policy string protocol keyword enforcement dynamic mon-policer-name reference

Tree

mon-policer-name

Description

This command specifies the dynamic enforcement policer that is instantiated when the associated local monitoring policer is determined to be in a nonconforming state (at the end of a minimum monitoring time of 60 seconds to reduce thrashing).

Reference

configure system security dist-cpu-protection policy string local-monitoring-policer string

Introduced

16.0.R1

Platforms

All

dynamic-local-mon-bypass

Synopsis

Do not include packets in the local monitoring function

Context

configure system security dist-cpu-protection policy string protocol keyword enforcement dynamic-local-mon-bypass

Tree

dynamic-local-mon-bypass

Description

When configured, packets from the protocol are not included in the local monitoring function and the dynamic enforcement policer is not instantiated for the protocol.

Notes

This element is the default part of a choice.

The following elements are part of a choice: dynamic, dynamic-local-mon-bypass, or static.

Introduced

16.0.R1

Platforms

All

static

Synopsis

Enter the static context

Context

configure system security dist-cpu-protection policy string protocol keyword enforcement static

Tree

static

Notes

The following elements are part of a choice: dynamic, dynamic-local-mon-bypass, or static.

Introduced

16.0.R1

Platforms

All

policer-name reference

Synopsis

Static policer enforced by the protocol

Context

configure system security dist-cpu-protection policy string protocol keyword enforcement static policer-name reference

Tree

policer-name

Reference

configure system security dist-cpu-protection policy string static-policer string

Introduced

16.0.R1

Platforms

All

static-policer [policer-name] string

Synopsis

Enter the static-policer list instance

Context

configure system security dist-cpu-protection policy string static-policer string

Tree

static-policer

Description

Commands in this context configure a static enforcement policer that can be referenced by one or more protocols in the policy. When a policer is referenced by a protocol, the policer is instantiated for each object (for example, a SAP or network interface) that is created and references the policer.

If no policer resources are available on the associated card or FP, the object is not created.

Max. Elements

18

Introduced

16.0.R1

Platforms

All

[policer-name] string

Synopsis

Static policer name

Context

configure system security dist-cpu-protection policy string static-policer string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system security dist-cpu-protection policy string static-policer string description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

All

detection-time number

Synopsis

Minimum time the dynamic policer remains allocated

Context

configure system security dist-cpu-protection policy string static-policer string detection-time number

Tree

detection-time

Range

1 to 128000

Default

30

Units

seconds

Introduced

16.0.R1

Platforms

All

exceed-action

Synopsis

Enter the exceed-action context

Context

configure system security dist-cpu-protection policy string static-policer string exceed-action

Tree

exceed-action

Description

Commands in this context specify the settings for the scenario when the configured policer rates are exceeded.

Introduced

16.0.R1

Platforms

All

action keyword

Synopsis

Action taken on control packets when rates are exceeded

Context

configure system security dist-cpu-protection policy string static-policer string exceed-action action keyword

Tree

action

Default

none

Options

discard, low-priority, none

Introduced

16.0.R1

Platforms

All

hold-down (keyword | number)

Synopsis

Hold down behavior

Context

configure system security dist-cpu-protection policy string static-policer string exceed-action hold-down (keyword | number)

Tree

hold-down

Description

This command specifies the behavior when the system detects that an enforcement policer has marked or discarded one or more packets and there is no action specified for the scenario when the rates are exceeded.

The hold time condition is cleared after the specified time has expired. The detection time (the minimum time that the policer remains allocated) begins after the hold down is complete. The hold down behavior is not applicable to a local monitoring policer.

An indefinite hold down behavior must be cleared using the tools perform security dist-cpu-protection release-hold-down command.

Range

1 to 10080

Default

none

Units

seconds

Options

indefinite, none

Introduced

16.0.R1

Platforms

All

log-events keyword

Synopsis

Control of log events creation for status and activity

Context

configure system security dist-cpu-protection policy string static-policer string log-events keyword

Tree

log-events

Description

This command controls the creation of log events related to the status and activity of the local monitoring policer.

Default

true

Options

false, true, verbose

Introduced

16.0.R1

Platforms

All

rate

Synopsis

Enter the rate context

Context

configure system security dist-cpu-protection policy string static-policer string rate

Tree

rate

Description

Commands in this context specify the rate and burst tolerance for the policer.

The actual hardware may not be able to perfectly rate limit to the exact configured parameters. In this case, the configured parameters will be adapted to the closest supported rate.

Introduced

16.0.R1

Platforms

All

kbps

Synopsis

Enter the kbps context

Context

configure system security dist-cpu-protection policy string static-policer string rate kbps

Tree

kbps

Notes

The following elements are part of a choice: kbps or packets.

Introduced

16.0.R1

Platforms

All

limit (keyword | number)

Synopsis

Rate limit

Context

configure system security dist-cpu-protection policy string static-policer string rate kbps limit (keyword | number)

Tree

limit

Range

1 to 20000000

Default

max

Units

kilobps

Options

max

Introduced

16.0.R1

Platforms

All

mbs number

Synopsis

Tolerance for the rate

Context

configure system security dist-cpu-protection policy string static-policer string rate kbps mbs number

Tree

mbs

Range

0 to 4194304

Units

bytes

Introduced

16.0.R1

Platforms

All

packets

Synopsis

Enter the packets context

Context

configure system security dist-cpu-protection policy string static-policer string rate packets

Tree

packets

Notes

This element is the default part of a choice.

The following elements are part of a choice: kbps or packets.

Introduced

16.0.R1

Platforms

All

initial-delay number

Synopsis

Additional packets allowed in an initial burst

Context

configure system security dist-cpu-protection policy string static-policer string rate packets initial-delay number

Tree

initial-delay

Description

This command specifies the number of packets allowed in an initial burst (or a burst after the policer bucket has drained to zero) in addition to the packets per interval limit. The typical setting would be a value equal to the number of received packets in several full handshakes or negotiations of the protocol.

Range

0 to 255

Default

0

Units

packets

Introduced

16.0.R1

Platforms

All

limit (keyword | number)

Synopsis

Packets per interval limit

Context

configure system security dist-cpu-protection policy string static-policer string rate packets limit (keyword | number)

Tree

limit

Range

0 to 8000

Default

max

Units

packets per interval

Options

max

Introduced

16.0.R1

Platforms

All

within number

Synopsis

Measurement interval for packets rate

Context

configure system security dist-cpu-protection policy string static-policer string rate packets within number

Tree

within

Range

1 to 32767

Default

1

Units

seconds

Introduced

16.0.R1

Platforms

All

type keyword

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Policy type

Context

configure system security dist-cpu-protection policy string type keyword

Tree

type

Options

access-network, port

Introduced

21.5.R1

Platforms

All

dot1x

Synopsis

Enter the dot1x context

Context

configure system security dot1x

Tree

dot1x

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of 802.1x network access control

Context

configure system security dot1x admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

radius-policy [policy-name] string

Synopsis

Enter the radius-policy list instance

Context

configure system security dot1x radius-policy string

Tree

radius-policy

Introduced

16.0.R1

Platforms

All

[policy-name] string

Synopsis

RADIUS server policy name for 802.1X authentication

Context

configure system security dot1x radius-policy string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the server for authentication

Context

configure system security dot1x radius-policy string admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

retry number

Synopsis

Number of RADIUS requests toward the same RADIUS server

Context

configure system security dot1x radius-policy string retry number

Tree

retry

Range

1 to 10

Default

3

Introduced

16.0.R1

Platforms

All

server [server-index] number

Synopsis

Enter the server list instance

Context

configure system security dot1x radius-policy string server number

Tree

server

Max. Elements

5

Introduced

16.0.R1

Platforms

All

[server-index] number

Synopsis

RADIUS server index

Context

configure system security dot1x radius-policy string server number

Range

1 to 5

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

accounting-port number

Synopsis

UDP port number on which to contact the RADIUS server for accounting requests

Context

configure system security dot1x radius-policy string server number accounting-port number

Tree

accounting-port

Range

1 to 65535

Default

1813

Introduced

16.0.R1

Platforms

All

address string

Synopsis

IP address of the RADIUS dot1x server

Context

configure system security dot1x radius-policy string server number address string

Tree

address

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

authentication-port number

Synopsis

UDP port number on which to contact the RADIUS server for authentication

Context

configure system security dot1x radius-policy string server number authentication-port number

Tree

authentication-port

Range

1 to 65535

Default

1812

Introduced

16.0.R1

Platforms

All

secret string

Synopsis

Secret key associated with the RADIUS server

Context

configure system security dot1x radius-policy string server number secret string

Tree

secret

String Length

1 to 54

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

type keyword

Synopsis

RADIUS server type

Context

configure system security dot1x radius-policy string server number type keyword

Tree

type

Default

authorization

Options

authorization, accounting, combined

Introduced

16.0.R1

Platforms

All

source-address string

Synopsis

Source address of the RADIUS packet

Context

configure system security dot1x radius-policy string source-address string

Tree

source-address

Introduced

16.0.R1

Platforms

All

timeout number

Synopsis

Time assigned between the request retries toward the same RADIUS server

Context

configure system security dot1x radius-policy string timeout number

Tree

timeout

Range

1 to 90

Default

5

Units

seconds

Introduced

16.0.R1

Platforms

All

ftp-server boolean

Synopsis

Enable FTP servers running on the system

Context

configure system security ftp-server boolean

Tree

ftp-server

Default

false

Introduced

16.0.R1

Platforms

All

hash-control

Synopsis

Enter the hash-control context

Context

configure system security hash-control

Tree

hash-control

Introduced

16.0.R4

Platforms

All

management-interface

Synopsis

Enter the management-interface context

Context

configure system security hash-control management-interface

Tree

management-interface

Description

Commands in this context configure encryption parameters for different management interfaces.

Introduced

16.0.R4

Platforms

All

classic-cli

Synopsis

Enter the classic-cli context

Context

configure system security hash-control management-interface classic-cli

Tree

classic-cli

Introduced

16.0.R4

Platforms

All

read-algorithm keyword

Synopsis

Input encryption algorithm for configuration secrets

Context

configure system security hash-control management-interface classic-cli read-algorithm keyword

Tree

read-algorithm

Description

This command specifies how encrypted configuration secrets are interpreted and which encryption types are accepted when secrets are input into the system or read from a configuration file (for example, at system bootup time).

Default

all-hash

Options

all-hash, hash, hash2, custom

Introduced

16.0.R4

Platforms

All

write-algorithm keyword

Synopsis

Output encryption algorithm for configuration secrets

Context

configure system security hash-control management-interface classic-cli write-algorithm keyword

Tree

write-algorithm

Description

This command specifies the format of the output for encrypted configuration secrets (for example, in the saved configuration file, or in the output of the info or show commands).

Default

hash2

Options

cleartext, hash, hash2, custom

Introduced

16.0.R4

Platforms

All

grpc

Synopsis

Enter the grpc context

Context

configure system security hash-control management-interface grpc

Tree

grpc

Introduced

16.0.R4

Platforms

All

hash-algorithm keyword

Synopsis

Encryption algorithm for configuration secrets

Context

configure system security hash-control management-interface grpc hash-algorithm keyword

Tree

hash-algorithm

Description

This command specifies the format of the input and output for encrypted configuration secrets.

Default

hash2

Options

cleartext, hash, hash2, custom

Introduced

16.0.R4

Platforms

All

md-cli

Synopsis

Enter the md-cli context

Context

configure system security hash-control management-interface md-cli

Tree

md-cli

Introduced

16.0.R4

Platforms

All

hash-algorithm keyword

Synopsis

Encryption algorithm for configuration secrets

Context

configure system security hash-control management-interface md-cli hash-algorithm keyword

Tree

hash-algorithm

Description

This command specifies the format of the input and output for encrypted configuration secrets.

Default

hash2

Options

cleartext, hash, hash2, custom

Introduced

16.0.R4

Platforms

All

netconf

Synopsis

Enter the netconf context

Context

configure system security hash-control management-interface netconf

Tree

netconf

Introduced

16.0.R4

Platforms

All

hash-algorithm keyword

Synopsis

Encryption algorithm for configuration secrets

Context

configure system security hash-control management-interface netconf hash-algorithm keyword

Tree

hash-algorithm

Description

This command specifies the format of the input and output for encrypted configuration secrets.

Default

hash2

Options

cleartext, hash, hash2, custom

Introduced

16.0.R4

Platforms

All

keychains

Synopsis

Enter the keychains context

Context

configure system security keychains

Tree

keychains

Introduced

16.0.R1

Platforms

All

keychain [keychain-name] string

Synopsis

Enter the keychain list instance

Context

configure system security keychains keychain string

Tree

keychain

Max. Elements

256

Introduced

16.0.R1

Platforms

All

[keychain-name] string

Synopsis

Keychain name

Context

configure system security keychains keychain string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the keychain

Context

configure system security keychains keychain string admin-state keyword

Tree

admin-state

Default

enable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

bidirectional

Synopsis

Enter the bidirectional context

Context

configure system security keychains keychain string bidirectional

Tree

bidirectional

Introduced

16.0.R1

Platforms

All

entry [keychain-entry-index] number

Synopsis

Enter the entry list instance

Context

configure system security keychains keychain string bidirectional entry number

Tree

entry

Introduced

16.0.R1

Platforms

All

[keychain-entry-index] number

Synopsis

Keychain identifier

Context

configure system security keychains keychain string bidirectional entry number

Range

0 to 63 | 255

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the keychain entry

Context

configure system security keychains keychain string bidirectional entry number admin-state keyword

Tree

admin-state

Default

enable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

algorithm keyword

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Encryption algorithm used by the keychain key

Context

configure system security keychains keychain string bidirectional entry number algorithm keyword

Tree

algorithm

Options

aes-128-cmac-96, hmac-sha-1-96, password, message-digest, hmac-md5, hmac-sha-1, hmac-sha-256, aes-128-gcm-16

Introduced

16.0.R1

Platforms

All

authentication-key string

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Authentication key used by the encryption algorithm

Context

configure system security keychains keychain string bidirectional entry number authentication-key string

Tree

authentication-key

String Length

1 to 54

Introduced

16.0.R1

Platforms

All

begin-time string

Synopsis

Calendar date and time when the system starts using the key

Context

configure system security keychains keychain string bidirectional entry number begin-time string

Tree

begin-time

Introduced

16.0.R1

Platforms

All

option keyword

Synopsis

Keychain key option

Context

configure system security keychains keychain string bidirectional entry number option keyword

Tree

option

Default

none

Options

none, basic, isis-enhanced

Introduced

16.0.R1

Platforms

All

tolerance (number | keyword)

Synopsis

Time within which an eligible receive key should overlap with the active send key

Context

configure system security keychains keychain string bidirectional entry number tolerance (number | keyword)

Tree

tolerance

Range

0 to 4294967294

Default

300

Units

seconds

Options

infinite

Introduced

16.0.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system security keychains keychain string description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

All

receive

Synopsis

Enter the receive context

Context

configure system security keychains keychain string receive

Tree

receive

Introduced

16.0.R1

Platforms

All

entry [keychain-entry-index] number

Synopsis

Enter the entry list instance

Context

configure system security keychains keychain string receive entry number

Tree

entry

Introduced

16.0.R1

Platforms

All

[keychain-entry-index] number

Synopsis

Keychain identifier

Context

configure system security keychains keychain string receive entry number

Range

0 to 63 | 255

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the keychain entry

Context

configure system security keychains keychain string receive entry number admin-state keyword

Tree

admin-state

Default

enable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

algorithm keyword

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Encryption algorithm used by the keychain key

Context

configure system security keychains keychain string receive entry number algorithm keyword

Tree

algorithm

Options

aes-128-cmac-96, hmac-sha-1-96, password, message-digest, hmac-md5, hmac-sha-1, hmac-sha-256, aes-128-gcm-16

Introduced

16.0.R1

Platforms

All

authentication-key string

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Authentication key used by the encryption algorithm

Context

configure system security keychains keychain string receive entry number authentication-key string

Tree

authentication-key

String Length

1 to 54

Introduced

16.0.R1

Platforms

All

begin-time string

Synopsis

Calendar date and time when the system starts using the key

Context

configure system security keychains keychain string receive entry number begin-time string

Tree

begin-time

Introduced

16.0.R1

Platforms

All

end-time string

Synopsis

Calendar date and time when the system should stop using the key

Context

configure system security keychains keychain string receive entry number end-time string

Tree

end-time

Introduced

16.0.R1

Platforms

All

tolerance (number | keyword)

Synopsis

Time within which an eligible receive key should overlap with the active send key

Context

configure system security keychains keychain string receive entry number tolerance (number | keyword)

Tree

tolerance

Range

0 to 4294967294

Default

300

Units

seconds

Options

infinite

Introduced

16.0.R1

Platforms

All

send

Synopsis

Enter the send context

Context

configure system security keychains keychain string send

Tree

send

Introduced

16.0.R1

Platforms

All

entry [keychain-entry-index] number

Synopsis

Enter the entry list instance

Context

configure system security keychains keychain string send entry number

Tree

entry

Introduced

16.0.R1

Platforms

All

[keychain-entry-index] number

Synopsis

Keychain identifier

Context

configure system security keychains keychain string send entry number

Range

0 to 63 | 255

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the keychain entry

Context

configure system security keychains keychain string send entry number admin-state keyword

Tree

admin-state

Default

enable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

algorithm keyword

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Encryption algorithm used by the keychain key

Context

configure system security keychains keychain string send entry number algorithm keyword

Tree

algorithm

Options

aes-128-cmac-96, hmac-sha-1-96, password, message-digest, hmac-md5, hmac-sha-1, hmac-sha-256, aes-128-gcm-16

Introduced

16.0.R1

Platforms

All

authentication-key string

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Authentication key used by the encryption algorithm

Context

configure system security keychains keychain string send entry number authentication-key string

Tree

authentication-key

String Length

1 to 54

Introduced

16.0.R1

Platforms

All

begin-time string

Synopsis

Calendar date and time when the system starts using the key

Context

configure system security keychains keychain string send entry number begin-time string

Tree

begin-time

Introduced

16.0.R1

Platforms

All

tcp-option-number

Synopsis

Enter the tcp-option-number context

Context

configure system security keychains keychain string tcp-option-number

Tree

tcp-option-number

Introduced

16.0.R1

Platforms

All

receive keyword

Synopsis

TCP option value expected in the TCP header of received packets

Context

configure system security keychains keychain string tcp-option-number receive keyword

Tree

receive

Default

option-254

Options

option-253, option-254, both, tcp-ao

Introduced

16.0.R1

Platforms

All

send keyword

Synopsis

TCP option value assigned in the TCP header of transmitted packets

Context

configure system security keychains keychain string tcp-option-number send keyword

Tree

send

Default

option-254

Options

option-253, option-254, tcp-ao

Introduced

16.0.R1

Platforms

All

management

Synopsis

Enter the management context

Context

configure system security management

Tree

management

Description

Commands in this context control which management protocols can be used to access the SR OS router via the 'Base' and 'management' router instances.

Introduced

16.0.R5

Platforms

All

allow-ftp boolean

Synopsis

Allow access to the FTP server

Context

configure system security management allow-ftp boolean

Tree

allow-ftp

Description

When configured to true, this command allows FTP access to the SR OS router via the 'Base' and 'management' router instances.

When configured to false, this command disallows access to the SR OS FTP server.

Default

true

Introduced

16.0.R6

Platforms

All

allow-grpc boolean

Synopsis

Allow access to the gRPC server

Context

configure system security management allow-grpc boolean

Tree

allow-grpc

Description

When configured to true, the system allows access to the gRPC server via the 'Base' and 'management' router instances.

Default

true

Introduced

19.5.R1

Platforms

All

allow-netconf boolean

Synopsis

Allow access to the NETCONF server

Context

configure system security management allow-netconf boolean

Tree

allow-netconf

Description

When configured to true, the system allows NETCONF server access to the SR OS router via the 'Base' and 'management' router instances.

Default

true

Introduced

19.5.R1

Platforms

All

allow-ssh boolean

Synopsis

Allow access to the SSH server

Context

configure system security management allow-ssh boolean

Tree

allow-ssh

Description

When configured to true, this command allows SSH server access to the SR OS router via the 'Base' and 'management' router instances.

When configured to false, this command disallows SSH server access.

Default

true

Introduced

16.0.R5

Platforms

All

allow-telnet boolean

Synopsis

Allow access to the IPv4 Telnet server

Context

configure system security management allow-telnet boolean

Tree

allow-telnet

Description

When configured to true, this command allows IPv4 Telnet server access to the SR OS router via the 'Base' and 'management' router instances.

When configured to false, this command disallows access to the IPv4 Telnet server.

Default

true

Introduced

16.0.R5

Platforms

All

allow-telnet6 boolean

Synopsis

Allow access to the Telnet IPv6 server

Context

configure system security management allow-telnet6 boolean

Tree

allow-telnet6

Description

When configured to true, this command allows IPv6 Telnet server access to the SR OS router via the 'Base' and 'management' router instances.

When configured to false, this command disallows access to the IPv6 Telnet server.

Default

true

Introduced

16.0.R5

Platforms

All

management-access-filter

Synopsis

Enter the management-access-filter context

Context

configure system security management-access-filter

Tree

management-access-filter

Description

Commands in this context configure the attributes for management access filters.

Management access filters control all traffic in and out of the CPM. The filters can be used to restrict management of the router by other nodes outside of specific networks (or sub-networks) or through designated ports.

Management filters are enforced by the system software.

Introduced

16.0.R4

Platforms

All

ip-filter

Synopsis

Enter the ip-filter context

Context

configure system security management-access-filter ip-filter

Tree

ip-filter

Introduced

16.0.R4

Platforms

All

admin-state keyword

Synopsis

Administrative state of management-access filters

Context

configure system security management-access-filter ip-filter admin-state keyword

Tree

admin-state

Default

enable

Options

enable, disable

Introduced

16.0.R4

Platforms

All

default-action keyword

Synopsis

Default action for the management access filter

Context

configure system security management-access-filter ip-filter default-action keyword

Tree

default-action

Description

This command specifies the default action for management access in the absence of a specific management access filter match.

Default

ignore-match

Options

ignore-match, accept, drop, reject

Introduced

16.0.R4

Platforms

All

entry [entry-id] number

Synopsis

Enter the entry list instance

Context

configure system security management-access-filter ip-filter entry number

Tree

entry

Introduced

16.0.R4

Platforms

All

[entry-id] number

Synopsis

Entry ID to identify the match criteria and the action

Context

configure system security management-access-filter ip-filter entry number

Description

This command specifies the entry ID to identify the match criteria and the corresponding action. It is recommended that entries are numbered in staggered increments. This allows users to insert a new entry in an existing policy without having to renumber the existing entries.

Range

1 to 9999

Notes

This element is part of a list key.

Introduced

16.0.R4

Platforms

All

action keyword

Synopsis

Action associated with the management access filter

Context

configure system security management-access-filter ip-filter entry number action keyword

Tree

action

Description

This command specifies the action associated with the management access filter match criteria entry.

If the packet does not meet any of the match criteria, the configured default action is applied.

Default

ignore-match

Options

ignore-match, accept, drop, reject

Introduced

16.0.R4

Platforms

All

description string

Synopsis

Text description

Context

configure system security management-access-filter ip-filter entry number description string

Tree

description

String Length

1 to 80

Introduced

16.0.R4

Platforms

All

log-events boolean

Synopsis

Enable match logging

Context

configure system security management-access-filter ip-filter entry number log-events boolean

Tree

log-events

Description

When configured to true, this command enables match logging. When enabled, matches on the entry cause the Security event mafEntryMatch to be raised.

When configured to false, match logging is disabled.

Default

false

Introduced

16.0.R4

Platforms

All

match

Synopsis

Enter the match context

Context

configure system security management-access-filter ip-filter entry number match

Tree

match

Description

Commands in this context specify match criteria for the entry.

Introduced

16.0.R4

Platforms

All

dst-port

Synopsis

Enable the dst-port context

Context

configure system security management-access-filter ip-filter entry number match dst-port

Tree

dst-port

Description

Commands in this context specify match criteria based on the destination port.

Introduced

16.0.R4

Platforms

All

mask number

Synopsis

IP address mask as the match criterion

Context

configure system security management-access-filter ip-filter entry number match dst-port mask number

Tree

mask

Range

1 to 65535

Default

65535

Introduced

16.0.R4

Platforms

All

port number

Synopsis

TCP or UDP port number as the match criterion

Context

configure system security management-access-filter ip-filter entry number match dst-port port number

Tree

port

Range

1 to 65535

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

mgmt-port

Synopsis

Enter the mgmt-port context

Context

configure system security management-access-filter ip-filter entry number match mgmt-port

Tree

mgmt-port

Description

Commands in this context specify match criteria based on the Ethernet port.

Introduced

16.0.R4

Platforms

All

cpm

Synopsis

Match any traffic received on any Ethernet port

Context

configure system security management-access-filter ip-filter entry number match mgmt-port cpm

Tree

cpm

Notes

The following elements are part of a choice: cpm, (lag and lag-id), or port-id.

Introduced

16.0.R4

Platforms

All

lag string

Synopsis

LAG ID as the match criterion

Context

configure system security management-access-filter ip-filter entry number match mgmt-port lag string

Tree

lag

String Length

1 to 27

Notes

The following elements are part of a choice: cpm, (lag and lag-id), or port-id.

Introduced

21.2.R1

Platforms

All

port-id string

Synopsis

Port ID as the match criterion

Context

configure system security management-access-filter ip-filter entry number match mgmt-port port-id string

Tree

port-id

Notes

The following elements are part of a choice: cpm, (lag and lag-id), or port-id.

Introduced

16.0.R4

Platforms

All

protocol (number | keyword)

Synopsis

IP protocol as the match criterion

Context

configure system security management-access-filter ip-filter entry number match protocol (number | keyword)

Tree

protocol

Range

0 to 255

Options

tcp-udp, icmp, igmp, ip, tcp, egp, igp, udp, rdp, ipv6, ipv6-route, ipv6-frag, idrp, rsvp, gre, ipv6-icmp, ipv6-no-nxt, ipv6-opts, iso-ip, eigrp, ospf-igp, ether-ip, encap, pnni, pim, vrrp, l2tp, stp, ptp, isis, crtp, crudp, sctp

Introduced

16.0.R4

Platforms

All

router-instance string

Synopsis

Router instance as the match criterion

Context

configure system security management-access-filter ip-filter entry number match router-instance string

Tree

router-instance

Introduced

16.0.R4

Platforms

All

src-ip

Synopsis

Enter the src-ip context

Context

configure system security management-access-filter ip-filter entry number match src-ip

Tree

src-ip

Description

Commands in this context specify match criteria based on the source IP address.

Introduced

16.0.R4

Platforms

All

address (ipv4-prefix | ipv4-address)

Synopsis

IP address or IP prefix as the match criterion

Context

configure system security management-access-filter ip-filter entry number match src-ip address (ipv4-prefix | ipv4-address)

Tree

address

Notes

The following elements are part of a choice: (address and mask) or ip-prefix-list.

Introduced

16.0.R4

Platforms

All

ip-prefix-list reference

Synopsis

IP prefix list as the match criterion

Context

configure system security management-access-filter ip-filter entry number match src-ip ip-prefix-list reference

Tree

ip-prefix-list

Reference

configure filter match-list ip-prefix-list string

Notes

The following elements are part of a choice: (address and mask) or ip-prefix-list.

Introduced

20.7.R1

Platforms

All

mask string

Synopsis

IP address mask as the match criterion

Context

configure system security management-access-filter ip-filter entry number match src-ip mask string

Tree

mask

Notes

The following elements are part of a choice: (address and mask) or ip-prefix-list.

Introduced

16.0.R4

Platforms

All

src-port

Synopsis

Enable the src-port context

Context

configure system security management-access-filter ip-filter entry number match src-port

Tree

src-port

Introduced

21.7.R1

Platforms

All

mask number

Synopsis

IP address mask as the match criterion

Context

configure system security management-access-filter ip-filter entry number match src-port mask number

Tree

mask

Range

1 to 65535

Default

65535

Introduced

21.7.R1

Platforms

All

port number

Synopsis

TCP or UDP port number as the match criterion

Context

configure system security management-access-filter ip-filter entry number match src-port port number

Tree

port

Range

1 to 65535

Notes

This element is mandatory.

Introduced

21.7.R1

Platforms

All

ipv6-filter

Synopsis

Enter the ipv6-filter context

Context

configure system security management-access-filter ipv6-filter

Tree

ipv6-filter

Introduced

16.0.R4

Platforms

All

admin-state keyword

Synopsis

Administrative state of management-access filters

Context

configure system security management-access-filter ipv6-filter admin-state keyword

Tree

admin-state

Default

enable

Options

enable, disable

Introduced

16.0.R4

Platforms

All

default-action keyword

Synopsis

Default action for the management access filter

Context

configure system security management-access-filter ipv6-filter default-action keyword

Tree

default-action

Description

This command specifies the default action for management access in the absence of a specific management access filter match.

Default

ignore-match

Options

ignore-match, accept, drop, reject

Introduced

16.0.R4

Platforms

All

entry [entry-id] number

Synopsis

Enter the entry list instance

Context

configure system security management-access-filter ipv6-filter entry number

Tree

entry

Introduced

16.0.R4

Platforms

All

[entry-id] number

Synopsis

Entry ID to identify the match criteria and the action

Context

configure system security management-access-filter ipv6-filter entry number

Description

This command specifies the entry ID to identify the match criteria and the corresponding action. It is recommended that entries are numbered in staggered increments. This allows users to insert a new entry in an existing policy without having to renumber the existing entries.

Range

1 to 9999

Notes

This element is part of a list key.

Introduced

16.0.R4

Platforms

All

action keyword

Synopsis

Action associated with the management access filter

Context

configure system security management-access-filter ipv6-filter entry number action keyword

Tree

action

Description

This command specifies the action associated with the management access filter match criteria entry.

If the packet does not meet any of the match criteria, the configured default action is applied.

Default

ignore-match

Options

ignore-match, accept, drop, reject

Introduced

16.0.R4

Platforms

All

description string

Synopsis

Text description

Context

configure system security management-access-filter ipv6-filter entry number description string

Tree

description

String Length

1 to 80

Introduced

16.0.R4

Platforms

All

log-events boolean

Synopsis

Enable match logging

Context

configure system security management-access-filter ipv6-filter entry number log-events boolean

Tree

log-events

Description

When configured to true, this command enables match logging. When enabled, matches on the entry cause the Security event mafEntryMatch to be raised.

When configured to false, match logging is disabled.

Default

false

Introduced

16.0.R4

Platforms

All

match

Synopsis

Enter the match context

Context

configure system security management-access-filter ipv6-filter entry number match

Tree

match

Description

Commands in this context specify match criteria for the entry.

Introduced

16.0.R4

Platforms

All

dst-port

Synopsis

Enable the dst-port context

Context

configure system security management-access-filter ipv6-filter entry number match dst-port

Tree

dst-port

Description

Commands in this context specify match criteria based on the destination port.

Introduced

16.0.R4

Platforms

All

mask number

Synopsis

IP address mask as the match criterion

Context

configure system security management-access-filter ipv6-filter entry number match dst-port mask number

Tree

mask

Range

1 to 65535

Default

65535

Introduced

16.0.R4

Platforms

All

port number

Synopsis

TCP or UDP port number as the match criterion

Context

configure system security management-access-filter ipv6-filter entry number match dst-port port number

Tree

port

Range

1 to 65535

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

flow-label number

Synopsis

Flow identifier used to discriminate traffic flows

Context

configure system security management-access-filter ipv6-filter entry number match flow-label number

Tree

flow-label

Range

0 to 1048575

Introduced

16.0.R4

Platforms

All

mgmt-port

Synopsis

Enter the mgmt-port context

Context

configure system security management-access-filter ipv6-filter entry number match mgmt-port

Tree

mgmt-port

Description

Commands in this context specify match criteria based on the Ethernet port.

Introduced

16.0.R4

Platforms

All

cpm

Synopsis

Match any traffic received on any Ethernet port

Context

configure system security management-access-filter ipv6-filter entry number match mgmt-port cpm

Tree

cpm

Notes

The following elements are part of a choice: cpm, (lag and lag-id), or port-id.

Introduced

16.0.R4

Platforms

All

lag string

Synopsis

LAG ID as the match criterion

Context

configure system security management-access-filter ipv6-filter entry number match mgmt-port lag string

Tree

lag

String Length

1 to 27

Notes

The following elements are part of a choice: cpm, (lag and lag-id), or port-id.

Introduced

21.2.R1

Platforms

All

port-id string

Synopsis

Port ID as the match criterion

Context

configure system security management-access-filter ipv6-filter entry number match mgmt-port port-id string

Tree

port-id

Notes

The following elements are part of a choice: cpm, (lag and lag-id), or port-id.

Introduced

16.0.R4

Platforms

All

next-header (number | keyword)

Synopsis

IP protocol to match

Context

configure system security management-access-filter ipv6-filter entry number match next-header (number | keyword)

Tree

next-header

Range

0 to 255

Options

tcp-udp, icmp, igmp, ip, tcp, egp, igp, udp, rdp, ipv6, ipv6-route, ipv6-frag, idrp, rsvp, gre, ipv6-icmp, ipv6-no-nxt, ipv6-opts, iso-ip, eigrp, ospf-igp, ether-ip, encap, pnni, pim, vrrp, l2tp, stp, ptp, isis, crtp, crudp, sctp

Introduced

16.0.R4

Platforms

All

router-instance string

Synopsis

Router instance as the match criterion

Context

configure system security management-access-filter ipv6-filter entry number match router-instance string

Tree

router-instance

Introduced

16.0.R4

Platforms

All

src-ip

Synopsis

Enter the src-ip context

Context

configure system security management-access-filter ipv6-filter entry number match src-ip

Tree

src-ip

Description

Commands in this context specify match criteria based on the source port.

Introduced

16.0.R4

Platforms

All

address (ipv6-prefix | ipv6-address)

Synopsis

IPv6 address or IPv6 prefix to match

Context

configure system security management-access-filter ipv6-filter entry number match src-ip address (ipv6-prefix | ipv6-address)

Tree

address

Notes

The following elements are part of a choice: (address and mask) or ipv6-prefix-list.

Introduced

16.0.R4

Platforms

All

ipv6-prefix-list reference

Synopsis

IPv6 prefix list as the match criterion

Context

configure system security management-access-filter ipv6-filter entry number match src-ip ipv6-prefix-list reference

Tree

ipv6-prefix-list

Reference

configure filter match-list ipv6-prefix-list string

Notes

The following elements are part of a choice: (address and mask) or ipv6-prefix-list.

Introduced

20.7.R1

Platforms

All

mask string

Synopsis

IP address mask as the match criterion

Context

configure system security management-access-filter ipv6-filter entry number match src-ip mask string

Tree

mask

Notes

The following elements are part of a choice: (address and mask) or ipv6-prefix-list.

Introduced

16.0.R4

Platforms

All

src-port

Synopsis

Enable the src-port context

Context

configure system security management-access-filter ipv6-filter entry number match src-port

Tree

src-port

Description

Commands in this context specify match criteria based on the source port.

Introduced

21.7.R1

Platforms

All

mask number

Synopsis

IP address mask as the match criterion

Context

configure system security management-access-filter ipv6-filter entry number match src-port mask number

Tree

mask

Range

1 to 65535

Default

65535

Introduced

21.7.R1

Platforms

All

port number

Synopsis

TCP or UDP port number as the match criterion

Context

configure system security management-access-filter ipv6-filter entry number match src-port port number

Tree

port

Range

1 to 65535

Notes

This element is mandatory.

Introduced

21.7.R1

Platforms

All

mac-filter

Synopsis

Enter the mac-filter context

Context

configure system security management-access-filter mac-filter

Tree

mac-filter

Introduced

16.0.R4

Platforms

All

admin-state keyword

Synopsis

Administrative state of management access MAC filter

Context

configure system security management-access-filter mac-filter admin-state keyword

Tree

admin-state

Default

enable

Options

enable, disable

Introduced

16.0.R4

Platforms

All

default-action keyword

Synopsis

Default action for the management access filter

Context

configure system security management-access-filter mac-filter default-action keyword

Tree

default-action

Description

This command specifies the default action for management access in the absence of a specific management access filter match.

Default

ignore-match

Options

ignore-match, accept, drop

Introduced

16.0.R4

Platforms

All

entry [entry-id] number

Synopsis

Enter the entry list instance

Context

configure system security management-access-filter mac-filter entry number

Tree

entry

Introduced

16.0.R4

Platforms

All

[entry-id] number

Synopsis

Entry ID to identify the match criteria and the action

Context

configure system security management-access-filter mac-filter entry number

Description

This command specifies the entry ID to identify the match criteria and the corresponding action. It is recommended that entries are numbered in staggered increments. This allows users to insert a new entry in an existing policy without having to renumber the existing entries.

Range

1 to 9999

Notes

This element is part of a list key.

Introduced

16.0.R4

Platforms

All

action keyword

Synopsis

Action associated with the management access filter

Context

configure system security management-access-filter mac-filter entry number action keyword

Tree

action

Description

This command specifies the action associated with the management access filter match criteria entry.

If the packet does not meet any of the match criteria, the configured default action is applied.

Default

ignore-match

Options

ignore-match, accept, drop

Introduced

16.0.R4

Platforms

All

description string

Synopsis

Text description

Context

configure system security management-access-filter mac-filter entry number description string

Tree

description

String Length

1 to 80

Introduced

16.0.R4

Platforms

All

log-events boolean

Synopsis

Enable match logging

Context

configure system security management-access-filter mac-filter entry number log-events boolean

Tree

log-events

Description

When configured to true, this command enables match logging. When enabled, matches on the entry cause the Security event mafEntryMatch to be raised.

When configured to false, match logging is disabled.

Default

false

Introduced

16.0.R4

Platforms

All

match

Synopsis

Enter the match context

Context

configure system security management-access-filter mac-filter entry number match

Tree

match

Description

Commands in this context specify match criteria for the entry.

Introduced

16.0.R4

Platforms

All

cfm-opcode

Synopsis

Enter the cfm-opcode context

Context

configure system security management-access-filter mac-filter entry number match cfm-opcode

Tree

cfm-opcode

Description

Commands in this context specify match criteria based on the CFM opcode.

Introduced

16.0.R4

Platforms

All

eq number

Synopsis

Equal to comparison operator for the CFM opcode

Context

configure system security management-access-filter mac-filter entry number match cfm-opcode eq number

Tree

eq

Range

0 to 255

Notes

The following elements are part of a choice: eq, gt, lt, or range.

Introduced

16.0.R4

Platforms

All

gt number

Synopsis

Greater than comparison operator for the CFM opcode

Context

configure system security management-access-filter mac-filter entry number match cfm-opcode gt number

Tree

gt

Range

0 to 254

Notes

The following elements are part of a choice: eq, gt, lt, or range.

Introduced

16.0.R4

Platforms

All

lt number

Synopsis

Less than comparison operator for the CFM opcode

Context

configure system security management-access-filter mac-filter entry number match cfm-opcode lt number

Tree

lt

Range

1 to 255

Notes

The following elements are part of a choice: eq, gt, lt, or range.

Introduced

16.0.R4

Platforms

All

range

Synopsis

Enable the range context

Context

configure system security management-access-filter mac-filter entry number match cfm-opcode range

Tree

range

Notes

The following elements are part of a choice: eq, gt, lt, or range.

Introduced

16.0.R4

Platforms

All

end number

Synopsis

Upper bound of the range for the OpCode to match

Context

configure system security management-access-filter mac-filter entry number match cfm-opcode range end number

Tree

end

Range

1 to 255

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

start number

Synopsis

Lower bound of the range for the OpCode to match

Context

configure system security management-access-filter mac-filter entry number match cfm-opcode range start number

Tree

start

Range

0 to 254

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

dot1p

Synopsis

Enable the dot1p context

Context

configure system security management-access-filter mac-filter entry number match dot1p

Tree

dot1p

Description

Commands in this context specify match criteria based on the IEEE 802.1p value.

Introduced

16.0.R4

Platforms

All

mask number

Synopsis

3-bit mask as the match criterion

Context

configure system security management-access-filter mac-filter entry number match dot1p mask number

Tree

mask

Range

1 to 7

Default

7

Introduced

16.0.R4

Platforms

All

priority number

Synopsis

IEEE 802.1p value as the match criterion

Context

configure system security management-access-filter mac-filter entry number match dot1p priority number

Tree

priority

Range

0 to 7

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

dst-mac

Synopsis

Enable the dst-mac context

Context

configure system security management-access-filter mac-filter entry number match dst-mac

Tree

dst-mac

Description

Commands in this context specify match criteria based on the destination MAC.

Introduced

16.0.R4

Platforms

All

address string

Synopsis

MAC address used as the match criterion

Context

configure system security management-access-filter mac-filter entry number match dst-mac address string

Tree

address

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

mask string

Synopsis

MAC address mask as the match criterion

Context

configure system security management-access-filter mac-filter entry number match dst-mac mask string

Tree

mask

Default

ff:ff:ff:ff:ff:ff

Introduced

16.0.R4

Platforms

All

etype string

Synopsis

Ethernet type II Ethertype value as the match criterion

Context

configure system security management-access-filter mac-filter entry number match etype string

Tree

etype

Description

This command specifies an Ethernet type II Ethertype value to be used as a MAC filter match criterion.

The Ethernet type field is used by the Ethernet version-II frames and does not apply to IEEE 802.3 Ethernet frames.

String Length

5 to 6

Introduced

16.0.R4

Platforms

All

frame-type keyword

Synopsis

MAC frame type as the match criterion

Context

configure system security management-access-filter mac-filter entry number match frame-type keyword

Tree

frame-type

Default

802dot3

Options

802dot3, 802dot2-llc, 802dot2-snap, ethernet-ii, 802dot1-ag

Introduced

16.0.R4

Platforms

All

llc-dsap

Synopsis

Enable the llc-dsap context

Context

configure system security management-access-filter mac-filter entry number match llc-dsap

Tree

llc-dsap

Description

Commands in this context specify match criteria based on the Destination Service Access Point (DSAP).

Introduced

16.0.R4

Platforms

All

dsap number

Synopsis

8-bit DSAP as the match criterion

Context

configure system security management-access-filter mac-filter entry number match llc-dsap dsap number

Tree

dsap

Range

0 to 255

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

mask number

Synopsis

Mask for DSAP value as the match criterion

Context

configure system security management-access-filter mac-filter entry number match llc-dsap mask number

Tree

mask

Range

1 to 255

Default

255

Introduced

16.0.R4

Platforms

All

llc-ssap

Synopsis

Enable the llc-ssap context

Context

configure system security management-access-filter mac-filter entry number match llc-ssap

Tree

llc-ssap

Description

Commands in this context specify match criteria based on the Source Service Access Point (SSAP).

Introduced

16.0.R4

Platforms

All

mask number

Synopsis

Mask for SSAP value as the match criterion

Context

configure system security management-access-filter mac-filter entry number match llc-ssap mask number

Tree

mask

Range

1 to 255

Default

255

Introduced

16.0.R4

Platforms

All

ssap number

Synopsis

8-bit SSAP as the match criterion

Context

configure system security management-access-filter mac-filter entry number match llc-ssap ssap number

Tree

ssap

Range

0 to 255

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

service string

Synopsis

Service ID used as the match condition

Context

configure system security management-access-filter mac-filter entry number match service string

Tree

service

String Length

1 to 64

Introduced

16.0.R4

Platforms

All

snap-oui keyword

Synopsis

IEEE 802.3 LLC SNAP Ethernet Frame OUI value for match

Context

configure system security management-access-filter mac-filter entry number match snap-oui keyword

Tree

snap-oui

Description

This command specifies the IEEE 802.3 LLC SNAP Ethernet Frame OUI value as the MAC filter match criterion.

Options

zero, non-zero

Introduced

16.0.R4

Platforms

All

snap-pid number

Synopsis

IEEE 802.3 LLC SNAP Ethernet Frame PID as the match

Context

configure system security management-access-filter mac-filter entry number match snap-pid number

Tree

snap-pid

Description

This command specifies an IEEE 802.3 LLC SNAP Ethernet Frame PID value used as the MAC filter match criterion.

The SNAP PID match criterion is independent of the OUI field within the SNAP header. Two packets with different 3-byte OUI fields but the same PID field match the same filter entry based on a SNAP PID match criterion.

Range

0 to 65535

Introduced

16.0.R4

Platforms

All

src-mac

Synopsis

Enable the src-mac context

Context

configure system security management-access-filter mac-filter entry number match src-mac

Tree

src-mac

Description

Commands in this context specify match criteria based on the source MAC.

Introduced

16.0.R4

Platforms

All

address string

Synopsis

MAC address used as the match criterion

Context

configure system security management-access-filter mac-filter entry number match src-mac address string

Tree

address

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

mask string

Synopsis

MAC address mask as the match criterion

Context

configure system security management-access-filter mac-filter entry number match src-mac mask string

Tree

mask

Default

ff:ff:ff:ff:ff:ff

Introduced

16.0.R4

Platforms

All

per-peer-queuing boolean

Synopsis

Allow CPM hardware queuing per peer

Context

configure system security per-peer-queuing boolean

Tree

per-peer-queuing

Description

When configured to true, the router automatically allocates a separate CPM hardware queue for the peer when a peering session is established.

When configured to false, a separate CPM hardware queue is not allowed.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

pki

Synopsis

Enter the pki context

Context

configure system security pki

Tree

pki

Introduced

16.0.R1

Platforms

All

ca-profile [ca-profile-name] string

Synopsis

Enter the ca-profile list instance

Context

configure system security pki ca-profile string

Tree

ca-profile

Max. Elements

128

Introduced

16.0.R1

Platforms

All

[ca-profile-name] string

Synopsis

CA profile name

Context

configure system security pki ca-profile string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the CA profile

Context

configure system security pki ca-profile string admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

auto-crl-update

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Enable the auto-crl-update context

Context

configure system security pki ca-profile string auto-crl-update

Tree

auto-crl-update

Introduced

16.0.R1

Platforms

All

admin-state keyword

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Administrative state of the automatic CRL update

Context

configure system security pki ca-profile string auto-crl-update admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

crl-urls

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Enter the crl-urls context

Context

configure system security pki ca-profile string auto-crl-update crl-urls

Tree

crl-urls

Introduced

16.0.R1

Platforms

All

url-entry [entry-id] number

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Enter the url-entry list instance

Context

configure system security pki ca-profile string auto-crl-update crl-urls url-entry number

Tree

url-entry

Introduced

16.0.R1

Platforms

All

[entry-id] number

Synopsis

URL on this system

Context

configure system security pki ca-profile string auto-crl-update crl-urls url-entry number

Range

1 to 8

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

transmission-profile reference

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

File transmission profile to update CRL

Context

configure system security pki ca-profile string auto-crl-update crl-urls url-entry number transmission-profile reference

Tree

transmission-profile

Reference

configure system transmission-profile string

Introduced

16.0.R4

Platforms

All

url http-url-path-loose

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Location of updated CRL

Context

configure system security pki ca-profile string auto-crl-update crl-urls url-entry number url http-url-path-loose

Tree

url

String Length

1 to 180

Introduced

16.0.R1

Platforms

All

periodic-update-interval number

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Interval between two consecutive CRL updates

Context

configure system security pki ca-profile string auto-crl-update periodic-update-interval number

Tree

periodic-update-interval

Range

3600 to 31622400

Default

86400

Units

seconds

Introduced

16.0.R1

Platforms

All

pre-update-time number

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Time prior to the next update time of the current CRL

Context

configure system security pki ca-profile string auto-crl-update pre-update-time number

Tree

pre-update-time

Range

0 to 31622400

Default

3600

Units

seconds

Introduced

16.0.R1

Platforms

All

retry-interval number

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Interval before retrying to update CRL

Context

configure system security pki ca-profile string auto-crl-update retry-interval number

Tree

retry-interval

Range

0 to 31622400

Default

3600

Units

seconds

Introduced

16.0.R1

Platforms

All

schedule-type keyword

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Time scheduler type for an automated CRL update

Context

configure system security pki ca-profile string auto-crl-update schedule-type keyword

Tree

schedule-type

Default

next-update-based

Options

next-update-based, periodic

Introduced

16.0.R1

Platforms

All

cert-file string

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Certificate file name

Context

configure system security pki ca-profile string cert-file string

Tree

cert-file

String Length

1 to 95

Introduced

16.0.R1

Platforms

All

cmpv2

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Enter the cmpv2 context

Context

configure system security pki ca-profile string cmpv2

Tree

cmpv2

Introduced

16.0.R1

Platforms

All

accept-unprotected-message

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Enter the accept-unprotected-message context

Context

configure system security pki ca-profile string cmpv2 accept-unprotected-message

Tree

accept-unprotected-message

Introduced

16.0.R1

Platforms

All

error-message boolean

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Accept unprotected error messages

Context

configure system security pki ca-profile string cmpv2 accept-unprotected-message error-message boolean

Tree

error-message

Default

false

Introduced

16.0.R1

Platforms

All

pkiconf-message boolean

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Accept unprotected PKI confirmation messages

Context

configure system security pki ca-profile string cmpv2 accept-unprotected-message pkiconf-message boolean

Tree

pkiconf-message

Default

false

Introduced

16.0.R1

Platforms

All

always-set-sender-for-ir boolean

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Subject name in CMPv2 header for all Initial Registration (IR) messages

Context

configure system security pki ca-profile string cmpv2 always-set-sender-for-ir boolean

Tree

always-set-sender-for-ir

Default

false

Introduced

16.0.R1

Platforms

All

http

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Enter the http context

Context

configure system security pki ca-profile string cmpv2 http

Tree

http

Introduced

16.0.R1

Platforms

All

response-timeout number

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

HTTP response timeout

Context

configure system security pki ca-profile string cmpv2 http response-timeout number

Tree

response-timeout

Range

1 to 3600

Default

30

Units

seconds

Introduced

16.0.R1

Platforms

All

version keyword

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

HTTP version for CMPv2 messages

Context

configure system security pki ca-profile string cmpv2 http version keyword

Tree

version

Default

1.1

Options

1.0, 1.1

Introduced

16.0.R1

Platforms

All

key-list

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Enter the key-list context

Context

configure system security pki ca-profile string cmpv2 key-list

Tree

key-list

Introduced

16.0.R1

Platforms

All

key [reference-number] string

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Enter the key list instance

Context

configure system security pki ca-profile string cmpv2 key-list key string

Tree

key

Max. Elements

128

Introduced

16.0.R1

Platforms

All

[reference-number] string

Synopsis

Unique identifier for the CA initial authentication key

Context

configure system security pki ca-profile string cmpv2 key-list key string

String Length

1 to 64

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

password string

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Shared secret for this CA initial authentication key

Context

configure system security pki ca-profile string cmpv2 key-list key string password string

Tree

password

String Length

1 to 115

Introduced

16.0.R1

Platforms

All

response-signing-cert string

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

File name of the certificate to verify the signature of received CMPv2 responses

Context

configure system security pki ca-profile string cmpv2 response-signing-cert string

Tree

response-signing-cert

String Length

1 to 95

Introduced

16.0.R1

Platforms

All

same-recipient-nonce-for-poll-request boolean

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Same recipNonce as the last CMPv2 response for a poll request

Context

configure system security pki ca-profile string cmpv2 same-recipient-nonce-for-poll-request boolean

Tree

same-recipient-nonce-for-poll-request

Default

false

Introduced

16.0.R1

Platforms

All

url

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Enter the url context

Context

configure system security pki ca-profile string cmpv2 url

Tree

url

Introduced

16.0.R1

Platforms

All

service-name string

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Administrative service name

Context

configure system security pki ca-profile string cmpv2 url service-name string

Tree

service-name

String Length

1 to 64

Introduced

16.0.R1

Platforms

All

url-string http-optional-url-loose

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

URL for CMPv2

Context

configure system security pki ca-profile string cmpv2 url url-string http-optional-url-loose

Tree

url-string

String Length

1 to 180

Introduced

16.0.R1

Platforms

All

crl-file string

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Certificate Revocation List (CRL) file name

Context

configure system security pki ca-profile string crl-file string

Tree

crl-file

String Length

1 to 95

Introduced

16.0.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system security pki ca-profile string description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

All

ocsp

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Enter the ocsp context

Context

configure system security pki ca-profile string ocsp

Tree

ocsp

Introduced

16.0.R1

Platforms

All

responder-url http-optional-url-loose

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

HTTP URL of the OCSP responder for the CA

Context

configure system security pki ca-profile string ocsp responder-url http-optional-url-loose

Tree

responder-url

String Length

1 to 180

Introduced

16.0.R1

Platforms

All

service-name string

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Administrative service name

Context

configure system security pki ca-profile string ocsp service-name string

Tree

service-name

String Length

1 to 64

Introduced

16.0.R1

Platforms

All

transmission-profile reference

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Transmission profile for the OCSP

Context

configure system security pki ca-profile string ocsp transmission-profile reference

Tree

transmission-profile

Reference

configure system transmission-profile string

Introduced

16.0.R6

Platforms

All

revocation-check keyword

Warning:

Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.

Synopsis

Method to verify the revocation status of certificates issued by the CA

Context

configure system security pki ca-profile string revocation-check keyword

Tree

revocation-check

Default

crl

Options

crl, crl-optional

Introduced

16.0.R1

Platforms

All

certificate-display-format keyword

Synopsis

Display format for certificates and Certificate Revocation Lists (CRLs)

Context

configure system security pki certificate-display-format keyword

Tree

certificate-display-format

Default

ascii

Options

ascii, utf8

Introduced

16.0.R1

Platforms

All

certificate-expiration-warning

Synopsis

Enter the certificate-expiration-warning context

Context

configure system security pki certificate-expiration-warning

Tree

certificate-expiration-warning

Introduced

16.0.R1

Platforms

All

hours number

Synopsis

Time at which the system generates the certificate expiration warning trap for in-use certificates

Context

configure system security pki certificate-expiration-warning hours number

Tree

hours

Range

0 to 8760

Units

hours

Introduced

16.0.R1

Platforms

All

repeat-hours number

Synopsis

Time period when the system repeatedly generates the certificate expiration warning trap

Context

configure system security pki certificate-expiration-warning repeat-hours number

Tree

repeat-hours

Range

0 to 8760

Default

0

Units

hours

Introduced

16.0.R1

Platforms

All

common-name-list [cn-list-name] string

Synopsis

Enter the common-name-list list instance

Context

configure system security pki common-name-list string

Tree

common-name-list

Max. Elements

64

Introduced

16.0.R1

Platforms

All

[cn-list-name] string

Synopsis

CN list name

Context

configure system security pki common-name-list string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

common-name [cn-index] number

Synopsis

Enter the common-name list instance

Context

configure system security pki common-name-list string common-name number

Tree

common-name

Introduced

16.0.R1

Platforms

All

[cn-index] number

Synopsis

Common name index

Context

configure system security pki common-name-list string common-name number

Range

1 to 128

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

cn-type keyword

Synopsis

Common name type

Context

configure system security pki common-name-list string common-name number cn-type keyword

Tree

cn-type

Options

ip-address, domain-name

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

cn-value string

Synopsis

Common name value

Context

configure system security pki common-name-list string common-name number cn-value string

Tree

cn-value

String Length

1 to 255

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

crl-expiration-warning

Synopsis

Enter the crl-expiration-warning context

Context

configure system security pki crl-expiration-warning

Tree

crl-expiration-warning

Introduced

16.0.R1

Platforms

All

hours number

Synopsis

Time when the system generates the Certificate Revocation List (CRL) expiration warning trap

Context

configure system security pki crl-expiration-warning hours number

Tree

hours

Range

0 to 8760

Units

hours

Introduced

16.0.R1

Platforms

All

repeat-hours number

Synopsis

Time when the system repeatedly generates the Certificate Revocation List (CRL) expiration warning trap

Context

configure system security pki crl-expiration-warning repeat-hours number

Tree

repeat-hours

Range

0 to 8760

Default

0

Units

hours

Introduced

16.0.R1

Platforms

All

est-profile [name] string

Synopsis

Enter the est-profile list instance

Context

configure system security pki est-profile string

Tree

est-profile

Description

Commands in this context configure an Enrollment over Secure Transport (EST) profile.

Max. Elements

128

Introduced

21.10.R1

Platforms

All

[name] string

Synopsis

Enrollment over Secured Transport profile name

Context

configure system security pki est-profile string

Description

This command configures the EST profile name.

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

21.10.R1

Platforms

All

check-id-kp-cmcra-only boolean

Synopsis

Check id-kp-cmcra in the EST certificate

Context

configure system security pki est-profile string check-id-kp-cmcra-only boolean

Tree

check-id-kp-cmcra-only

Description

When configured to true, only the id-kp-cmcRA existence in the extended key usage extension of the EST server certificate is checked, instead of the subject or subject alternative name.

When configured to false, the subject or subject alternative name is also checked.

Default

false

Introduced

21.10.R1

Platforms

All

client-tls-profile string

Synopsis

TLS client profile assigned to applications

Context

configure system security pki est-profile string client-tls-profile string

Tree

client-tls-profile

Description

This command specifies the TLS client profile to be assigned to applications for encryption. The profile creates the TLS connection to the EST server.

String Length

1 to 32

Introduced

21.10.R1

Platforms

All

http-authentication

Synopsis

Enter the http-authentication context

Context

configure system security pki est-profile string http-authentication

Tree

http-authentication

Introduced

21.10.R1

Platforms

All

password string

Synopsis

Password for EST authentication

Context

configure system security pki est-profile string http-authentication password string

Tree

password

String Length

1 to 115

Introduced

21.10.R1

Platforms

All

username string

Synopsis

Username for the EST authentication

Context

configure system security pki est-profile string http-authentication username string

Tree

username

String Length

1 to 32

Introduced

21.10.R1

Platforms

All

server

Synopsis

Enter the server context

Context

configure system security pki est-profile string server

Tree

server

Description

Commands in this context configure EST server parameters.

Introduced

21.10.R1

Platforms

All

fqdn string

Synopsis

Fully Qualified Domain Name (FQDN) of the EST server

Context

configure system security pki est-profile string server fqdn string

Tree

fqdn

Description

This command specifies to use the FQDN of the EST server.

String Length

1 to 255

Notes

The following elements are part of a choice: fqdn, ipv4, or ipv6.

Introduced

21.10.R1

Platforms

All

ipv4 string

Synopsis

IPv4 address of the EST server

Context

configure system security pki est-profile string server ipv4 string

Tree

ipv4

Notes

The following elements are part of a choice: fqdn, ipv4, or ipv6.

Introduced

21.10.R1

Platforms

All

ipv6 (ipv4-address-no-zone | ipv6-address-no-zone)

Synopsis

IPv6 address of the EST server

Context

configure system security pki est-profile string server ipv6 (ipv4-address-no-zone | ipv6-address-no-zone)

Tree

ipv6

Notes

The following elements are part of a choice: fqdn, ipv4, or ipv6.

Introduced

21.10.R1

Platforms

All

port number

Synopsis

Port number of the EST server

Context

configure system security pki est-profile string server port number

Tree

port

Range

1 to 65535

Default

443

Introduced

21.10.R1

Platforms

All

transmission-profile string

Synopsis

Transmission profile name for EST

Context

configure system security pki est-profile string transmission-profile string

Tree

transmission-profile

Description

This command associates a file transmission profile to the EST profile.

The transmission profile defines transport parameters for protocol such as HTTP, include routing instance, source address, timeout value, and so on.

String Length

1 to 32

Introduced

21.10.R1

Platforms

All

imported-format keyword

Synopsis

The supported encrypted file formats

Context

configure system security pki imported-format keyword

Tree

imported-format

Default

any

Options

any, secure

Introduced

16.0.R6

Platforms

All

maximum-cert-chain-depth number

Synopsis

Maximum depth of certificate chain verification

Context

configure system security pki maximum-cert-chain-depth number

Tree

maximum-cert-chain-depth

Range

1 to 7

Default

7

Introduced

16.0.R1

Platforms

All

python-script

Synopsis

Enter the python-script context

Context

configure system security python-script

Tree

python-script

Introduced

21.10.R1

Platforms

All

authorization

Synopsis

Enter the authorization context

Context

configure system security python-script authorization

Tree

authorization

Introduced

21.10.R1

Platforms

All

cron

Synopsis

Enter the cron context

Context

configure system security python-script authorization cron

Tree

cron

Introduced

21.10.R1

Platforms

All

cli-user reference

Synopsis

User profile name when executing a Python application

Context

configure system security python-script authorization cron cli-user reference

Tree

cli-user

Reference

configure system security user-params local-user user string

Introduced

21.10.R1

Platforms

All

event-handler

Synopsis

Enter the event-handler context

Context

configure system security python-script authorization event-handler

Tree

event-handler

Introduced

21.10.R1

Platforms

All

cli-user reference

Synopsis

User profile name when executing a Python application

Context

configure system security python-script authorization event-handler cli-user reference

Tree

cli-user

Reference

configure system security user-params local-user user string

Introduced

21.10.R1

Platforms

All

snmp

Synopsis

Enter the snmp context

Context

configure system security snmp

Tree

snmp

Introduced

16.0.R1

Platforms

All

access [group] string context string security-model keyword security-level keyword

Synopsis

Enter the access list instance

Context

configure system security snmp access string context string security-model keyword security-level keyword

Tree

access

Introduced

16.0.R1

Platforms

All

[group] string

Synopsis

Group name

Context

configure system security snmp access string context string security-model keyword security-level keyword

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

context string

Synopsis

String against which the context name should match to gain access rights

Context

configure system security snmp access string context string security-model keyword security-level keyword

String Length

0 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

security-model keyword

Synopsis

Security model

Context

configure system security snmp access string context string security-model keyword security-level keyword

Options

snmpv1, snmpv2c, usm

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

security-level keyword

Synopsis

Minimum level of security required to gain the access rights allowed by this entry

Context

configure system security snmp access string context string security-model keyword security-level keyword

Options

no-auth-no-privacy, auth-no-privacy, privacy

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

notify string

Synopsis

SNMP view for notification access

Context

configure system security snmp access string context string security-model keyword security-level keyword notify string

Tree

notify

Description

This command specifies the SNMP view used to control which MIB objects can be accessed for notifications.

String Length

1 to 32

Introduced

16.0.R1

Platforms

All

prefix-match keyword

Synopsis

Match type for the context

Context

configure system security snmp access string context string security-model keyword security-level keyword prefix-match keyword

Tree

prefix-match

Options

exact, prefix

Introduced

16.0.R1

Platforms

All

read string

Synopsis

SNMP view for read access

Context

configure system security snmp access string context string security-model keyword security-level keyword read string

Tree

read

Description

This command specifies the SNMP view used to control which MIB objects can be accessed using a read (get) operation.

String Length

1 to 32

Introduced

16.0.R1

Platforms

All

write string

Synopsis

SNMP view for write access

Context

configure system security snmp access string context string security-model keyword security-level keyword write string

Tree

write

Description

This command specifies the SNMP view used to control which MIB objects can be accessed using a write (set) operation.

String Length

1 to 32

Introduced

16.0.R1

Platforms

All

attempts

Synopsis

Enter the attempts context

Context

configure system security snmp attempts

Tree

attempts

Introduced

16.0.R1

Platforms

All

count number

Synopsis

Maximum unsuccessful SNMP attempts that are allowed for the specified time

Context

configure system security snmp attempts count number

Tree

count

Range

1 to 64

Default

20

Introduced

16.0.R1

Platforms

All

lockout number

Synopsis

Lockout period during which the host is not allowed to log in

Context

configure system security snmp attempts lockout number

Tree

lockout

Range

0 to 1440

Default

10

Units

minutes

Introduced

16.0.R1

Platforms

All

time number

Synopsis

Time when a number of unsuccessful attempts are made before the host is locked out

Context

configure system security snmp attempts time number

Tree

time

Range

0 to 60

Default

5

Units

minutes

Introduced

16.0.R1

Platforms

All

community [community-string] string

Synopsis

Enter the community list instance

Context

configure system security snmp community string

Tree

community

Introduced

16.0.R1

Platforms

All

[community-string] string

Synopsis

Management information that is accessed when using the community string

Context

configure system security snmp community string

String Length

1 to 114

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

access-permissions keyword

Synopsis

SNMP community name(s) to be used with the associated VPRN instance

Context

configure system security snmp community string access-permissions keyword

Tree

access-permissions

Options

r, rw, rwa, mgmt, vpls-mgmt

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

source-access-list reference

Synopsis

Management information to be accessed when using the community string

Context

configure system security snmp community string source-access-list reference

Tree

source-access-list

Reference

configure system security snmp source-access-list string

Introduced

16.0.R1

Platforms

All

version keyword

Synopsis

SNMP version

Context

configure system security snmp community string version keyword

Tree

version

Default

both

Options

v1, v2c, both

Introduced

16.0.R1

Platforms

All

source-access-list [list-name] string

Synopsis

Enter the source-access-list list instance

Context

configure system security snmp source-access-list string

Tree

source-access-list

Max. Elements

16

Introduced

16.0.R1

Platforms

All

[list-name] string

Synopsis

Value for the name given to source access list

Context

configure system security snmp source-access-list string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

source-host [host-name] string

Synopsis

Enter the source-host list instance

Context

configure system security snmp source-access-list string source-host string

Tree

source-host

Max. Elements

16

Introduced

16.0.R1

Platforms

All

[host-name] string

Synopsis

Source host entry name

Context

configure system security snmp source-access-list string source-host string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

address (ipv4-address-no-zone | ipv6-address-no-zone)

Synopsis

Source IP address entry used to validate SNMP requests

Context

configure system security snmp source-access-list string source-host string address (ipv4-address-no-zone | ipv6-address-no-zone)

Tree

address

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

usm-community [community-string] string

Synopsis

Enter the usm-community list instance

Context

configure system security snmp usm-community string

Tree

usm-community

Introduced

16.0.R1

Platforms

All

[community-string] string

Synopsis

SNMPv1/SNMPv2 community string to determine the SNMPv3 access permission

Context

configure system security snmp usm-community string

String Length

1 to 114

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

group string

Synopsis

Group to manage the access rights of the community string

Context

configure system security snmp usm-community string group string

Tree

group

String Length

1 to 32

Introduced

16.0.R1

Platforms

All

source-access-list reference

Synopsis

Management information to be accessed when using the community string

Context

configure system security snmp usm-community string source-access-list reference

Tree

source-access-list

Reference

configure system security snmp source-access-list string

Introduced

16.0.R1

Platforms

All

view [view-name] string subtree string

Synopsis

Enter the view list instance

Context

configure system security snmp view string subtree string

Tree

view

Introduced

16.0.R1

Platforms

All

[view-name] string

Synopsis

View name

Context

configure system security snmp view string subtree string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

subtree string

Synopsis

Object Identifier (OID) value

Context

configure system security snmp view string subtree string

String Length

1 to 256

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

mask string

Synopsis

Mask value as binary value, or hex value

Context

configure system security snmp view string subtree string mask string

Tree

mask

String Length

1 to 16

Introduced

16.0.R1

Platforms

All

type keyword

Synopsis

Type of SNMP security view mask

Context

configure system security snmp view string subtree string type keyword

Tree

type

Options

included, excluded

Introduced

16.0.R1

Platforms

All

source-address

Synopsis

Enter the source-address context

Context

configure system security source-address

Tree

source-address

Description

Commands in this context configure the IP source address that is used in all unsolicited packets sent by the specified applications.

This configuration applies to packets transmitted in-band (for example, a network port on an IOM) and does not apply to packets transmitted out-of-band on the management interface on the CPM Ethernet port. Packets transmitted using the CPM Ethernet port use the address of the CPM Ethernet port as the IP source address in the packet.

When a source address is specified for the PTP application, the port-based 1588 hardware timestamping assist function is applied to PTP packets matching the IPv4 address of the router interface used to ingress the SR/ESS or IP address specified in this command. If the IP address is removed, the port-based 1588 hardware timestamping assist function is only applied to PTP packets matching the IPv4 address of the router interface.

Introduced

16.0.R1

Platforms

All

ipv4 [application] keyword

Synopsis

Enter the ipv4 list instance

Context

configure system security source-address ipv4 keyword

Tree

ipv4

Introduced

16.0.R1

Platforms

All

[application] keyword

Synopsis

Application that uses the source IP address

Context

configure system security source-address ipv4 keyword

Options

telnet, ftp, ssh, radius, tacplus, snmptrap, syslog, ping, traceroute, dns, sntp, ntp, cflowd, ptp, mcreporter, sflow, icmp-error, ldap

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

address string

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Source IPv4 address

Context

configure system security source-address ipv4 keyword address string

Tree

address

Notes

The following elements are part of a mandatory choice: address or interface-name.

Introduced

16.0.R1

Platforms

All

interface-name string

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

IP interface name

Context

configure system security source-address ipv4 keyword interface-name string

Tree

interface-name

String Length

1 to 32

Notes

The following elements are part of a mandatory choice: address or interface-name.

Introduced

16.0.R1

Platforms

All

ipv6 [application] keyword

Synopsis

Enter the ipv6 list instance

Context

configure system security source-address ipv6 keyword

Tree

ipv6

Introduced

16.0.R1

Platforms

All

[application] keyword

Synopsis

Application which uses the source IPv6 address

Context

configure system security source-address ipv6 keyword

Options

telnet, ftp, radius, tacplus, snmptrap, syslog, ping, traceroute, dns, cflowd, ntp, sflow, icmp6-error, ldap

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

address string

Warning:

Modifying this element recreates the parent element automatically for the new value to take effect.

Synopsis

Source IPv6 address

Context

configure system security source-address ipv6 keyword address string

Tree

address

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

ssh

Synopsis

Enter the ssh context

Context

configure system security ssh

Tree

ssh

Introduced

16.0.R1

Platforms

All

client-cipher-list-v1

Synopsis

Enter the client-cipher-list-v1 context

Context

configure system security ssh client-cipher-list-v1

Tree

client-cipher-list-v1

Introduced

16.0.R1

Platforms

All

cipher [index] number

Synopsis

Enter the cipher list instance

Context

configure system security ssh client-cipher-list-v1 cipher number

Tree

cipher

Description

Commands in this context configure a client-cipher instance. Client-ciphers are used when SR OS is acting as an SSH client.

Introduced

16.0.R1

Platforms

All

[index] number

Synopsis

Cipher index in the list

Context

configure system security ssh client-cipher-list-v1 cipher number

Range

1 to 255

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

name keyword

Synopsis

Algorithm for performing encryption or decryption

Context

configure system security ssh client-cipher-list-v1 cipher number name keyword

Tree

name

Options

des, 3des, blowfish

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

client-cipher-list-v2

Synopsis

Enter the client-cipher-list-v2 context

Context

configure system security ssh client-cipher-list-v2

Tree

client-cipher-list-v2

Introduced

16.0.R1

Platforms

All

cipher [index] number

Synopsis

Enter the cipher list instance

Context

configure system security ssh client-cipher-list-v2 cipher number

Tree

cipher

Description

Commands in this context configure a client-cipher instance. Client-ciphers are used when the SR OS is acting as an SSH client.

Introduced

16.0.R1

Platforms

All

[index] number

Synopsis

Cipher index in the list

Context

configure system security ssh client-cipher-list-v2 cipher number

Range

1 to 255

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

name keyword

Synopsis

Algorithm for performing encryption or decryption

Context

configure system security ssh client-cipher-list-v2 cipher number name keyword

Tree

name

Options

3des-cbc, blowfish-cbc, cast128-cbc, arcfour, aes128-cbc, aes192-cbc, aes256-cbc, rijndael-cbc, aes128-ctr, aes192-ctr, aes256-ctr

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

client-kex-list-v2

Synopsis

Enter the client-kex-list-v2 context

Context

configure system security ssh client-kex-list-v2

Tree

client-kex-list-v2

Introduced

19.10.R3

Platforms

All

kex [index] number

Synopsis

Enter the kex list instance

Context

configure system security ssh client-kex-list-v2 kex number

Tree

kex

Description

Commands in this context configure SSH Key Exchange (KEX) algorithms for SR OS as a client.

If a list is configured, SSH uses the list with the first-listed algorithm having the highest priority.

By default, the client list is empty. The default list contains the following:

  1. diffie-hellman-group16-sha512
  2. diffie-hellman-group14-sha256
  3. diffie-hellman-group14-sha1
  4. diffie-hellman-group1-sha1
Introduced

19.10.R3

Platforms

All

[index] number

Synopsis

SSHv2 KEX algorithm index

Context

configure system security ssh client-kex-list-v2 kex number

Description

This command configures the index of the KEX algorithm in the list. The lowest index in the list is negotiated first on the SSH negotiation list, while the highest index is at the bottom of the SSH negotiation list.

Range

1 to 255

Notes

This element is part of a list key.

Introduced

19.10.R3

Platforms

All

name keyword

Synopsis

KEX algorithm for computing a shared secret key

Context

configure system security ssh client-kex-list-v2 kex number name keyword

Tree

name

Options

diffie-hellman-group1-sha1, diffie-hellman-group14-sha1, diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha256, diffie-hellman-group16-sha512

Notes

This element is mandatory.

Introduced

19.10.R3

Platforms

All

client-mac-list-v2

Synopsis

Enter the client-mac-list-v2 context

Context

configure system security ssh client-mac-list-v2

Tree

client-mac-list-v2

Introduced

16.0.R1

Platforms

All

mac [index] number

Synopsis

Enter the mac list instance

Context

configure system security ssh client-mac-list-v2 mac number

Tree

mac

Description

Commands in this context configure SSH MAC algorithms for SR OS as a client.

Introduced

16.0.R1

Platforms

All

[index] number

Synopsis

MAC algorithm index

Context

configure system security ssh client-mac-list-v2 mac number

Range

1 to 255

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

name keyword

Synopsis

Algorithm for calculating message authentication code

Context

configure system security ssh client-mac-list-v2 mac number name keyword

Tree

name

Options

hmac-sha2-512, hmac-sha2-256, hmac-sha1, hmac-sha1-96, hmac-md5, hmac-ripemd160, hmac-ripemd160-openssh-com, hmac-md5-96

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

key-re-exchange

Synopsis

Enter the key-re-exchange context

Context

configure system security ssh key-re-exchange

Tree

key-re-exchange

Introduced

16.0.R1

Platforms

All

client

Synopsis

Enter the client context

Context

configure system security ssh key-re-exchange client

Tree

client

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the key re-exchange

Context

configure system security ssh key-re-exchange client admin-state keyword

Tree

admin-state

Default

enable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

mbytes (number | keyword)

Synopsis

Maximum bytes transmitted before key re-exchange begins

Context

configure system security ssh key-re-exchange client mbytes (number | keyword)

Tree

mbytes

Range

1 to 64000

Default

1024

Units

megabytes

Options

infinite

Introduced

16.0.R1

Platforms

All

minutes (number | keyword)

Synopsis

Maximum time before key re-exchange is initiated

Context

configure system security ssh key-re-exchange client minutes (number | keyword)

Tree

minutes

Range

1 to 1440

Default

60

Units

minutes

Options

infinite

Introduced

16.0.R1

Platforms

All

server

Synopsis

Enter the server context

Context

configure system security ssh key-re-exchange server

Tree

server

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the key re-exchange

Context

configure system security ssh key-re-exchange server admin-state keyword

Tree

admin-state

Default

enable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

mbytes (number | keyword)

Synopsis

Maximum bytes transmitted before key re-exchange begins

Context

configure system security ssh key-re-exchange server mbytes (number | keyword)

Tree

mbytes

Range

1 to 64000

Default

1024

Units

megabytes

Options

infinite

Introduced

16.0.R1

Platforms

All

minutes (number | keyword)

Synopsis

Maximum time before key re-exchange is initiated

Context

configure system security ssh key-re-exchange server minutes (number | keyword)

Tree

minutes

Range

1 to 1440

Default

60

Units

minutes

Options

infinite

Introduced

16.0.R1

Platforms

All

preserve-key boolean

Synopsis

Preserve keys and restore on system or server restart

Context

configure system security ssh preserve-key boolean

Tree

preserve-key

Description

When configured to true, private, public, and host keys are saved by the server. The keys are restored following a system reboot or a restart of an SSH server.

When configured to false, the keys are held in memory by an SSH server but are not restored following a system reboot.

Default

false

Introduced

16.0.R1

Platforms

All

server-admin-state keyword

Synopsis

Administrative state of the SSH server

Context

configure system security ssh server-admin-state keyword

Tree

server-admin-state

Default

enable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

server-cipher-list-v1

Synopsis

Enter the server-cipher-list-v1 context

Context

configure system security ssh server-cipher-list-v1

Tree

server-cipher-list-v1

Introduced

16.0.R1

Platforms

All

cipher [index] number

Synopsis

Enter the cipher list instance

Context

configure system security ssh server-cipher-list-v1 cipher number

Tree

cipher

Description

Commands in this context configure a server-cipher instance. Server-ciphers are used when SR OS is acting as an SSH server.

Introduced

16.0.R1

Platforms

All

[index] number

Synopsis

Cipher index in the list

Context

configure system security ssh server-cipher-list-v1 cipher number

Range

1 to 255

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

name keyword

Synopsis

Algorithm for performing encryption or decryption

Context

configure system security ssh server-cipher-list-v1 cipher number name keyword

Tree

name

Options

des, 3des, blowfish

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

server-cipher-list-v2

Synopsis

Enter the server-cipher-list-v2 context

Context

configure system security ssh server-cipher-list-v2

Tree

server-cipher-list-v2

Introduced

16.0.R1

Platforms

All

cipher [index] number

Synopsis

Enter the cipher list instance

Context

configure system security ssh server-cipher-list-v2 cipher number

Tree

cipher

Description

Commands in this context configure a server-cipher instance. Server-ciphers are used when SR OS is acting as an SSH server.

Introduced

16.0.R1

Platforms

All

[index] number

Synopsis

Cipher index in the list

Context

configure system security ssh server-cipher-list-v2 cipher number

Range

1 to 255

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

name keyword

Synopsis

Algorithm for performing encryption or decryption

Context

configure system security ssh server-cipher-list-v2 cipher number name keyword

Tree

name

Options

3des-cbc, blowfish-cbc, cast128-cbc, arcfour, aes128-cbc, aes192-cbc, aes256-cbc, rijndael-cbc, aes128-ctr, aes192-ctr, aes256-ctr

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

server-kex-list-v2

Synopsis

Enter the server-kex-list-v2 context

Context

configure system security ssh server-kex-list-v2

Tree

server-kex-list-v2

Introduced

19.10.R3

Platforms

All

kex [index] number

Synopsis

Enter the kex list instance

Context

configure system security ssh server-kex-list-v2 kex number

Tree

kex

Introduced

19.10.R3

Platforms

All

[index] number

Synopsis

SSHv2 KEX algorithm index

Context

configure system security ssh server-kex-list-v2 kex number

Description

This command configures the index of the KEX algorithm in the list. The lowest index in the list is negotiated first on the SSH negotiation list, while the highest index is at the bottom of the SSH negotiation list.

Range

1 to 255

Notes

This element is part of a list key.

Introduced

19.10.R3

Platforms

All

name keyword

Synopsis

KEX algorithm for computing a shared secret key

Context

configure system security ssh server-kex-list-v2 kex number name keyword

Tree

name

Options

diffie-hellman-group1-sha1, diffie-hellman-group14-sha1, diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha256, diffie-hellman-group16-sha512

Notes

This element is mandatory.

Introduced

19.10.R3

Platforms

All

server-mac-list-v2

Synopsis

Enter the server-mac-list-v2 context

Context

configure system security ssh server-mac-list-v2

Tree

server-mac-list-v2

Introduced

16.0.R1

Platforms

All

mac [index] number

Synopsis

Enter the mac list instance

Context

configure system security ssh server-mac-list-v2 mac number

Tree

mac

Introduced

16.0.R1

Platforms

All

[index] number

Synopsis

MAC algorithm index

Context

configure system security ssh server-mac-list-v2 mac number

Range

1 to 255

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

name keyword

Synopsis

Algorithm for calculating message authentication code

Context

configure system security ssh server-mac-list-v2 mac number name keyword

Tree

name

Options

hmac-sha2-512, hmac-sha2-256, hmac-sha1, hmac-sha1-96, hmac-md5, hmac-ripemd160, hmac-ripemd160-openssh-com, hmac-md5-96

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

version keyword

Synopsis

SSH protocol version supported by the SSH server

Context

configure system security ssh version keyword

Tree

version

Default

2

Options

1, 2, 1-2

Introduced

16.0.R1

Platforms

All

system-passwords

Synopsis

Enter the system-passwords context

Context

configure system security system-passwords

Tree

system-passwords

Introduced

16.0.R1

Platforms

All

admin-password string

Synopsis

Password that assigns the user as administrator

Context

configure system security system-passwords admin-password string

Tree

admin-password

String Length

3 to 136

Introduced

16.0.R1

Platforms

All

vsd-password string

Synopsis

Password that allows the user to assign VSD services

Context

configure system security system-passwords vsd-password string

Tree

vsd-password

String Length

3 to 136

Introduced

16.0.R1

Platforms

All

tech-support

Synopsis

Enter the tech-support context

Context

configure system security tech-support

Tree

tech-support

Introduced

16.0.R1

Platforms

All

ts-location (ts-sat-url | cflash-url | string)

Synopsis

Default file path for generated tech-support files

Context

configure system security tech-support ts-location (ts-sat-url | cflash-url | string)

Tree

ts-location

String Length

1 to 180

Introduced

16.0.R1

Platforms

All

telnet-server boolean

Synopsis

Enable Telnet servers running on the system

Context

configure system security telnet-server boolean

Tree

telnet-server

Default

false

Introduced

16.0.R1

Platforms

All

telnet6-server boolean

Synopsis

Enable Telnet IPv6 servers running on the system

Context

configure system security telnet6-server boolean

Tree

telnet6-server

Default

false

Introduced

16.0.R1

Platforms

All

tls

Synopsis

Enter the tls context

Context

configure system security tls

Tree

tls

Introduced

16.0.R1

Platforms

All

cert-profile [cert-profile-name] string

Synopsis

Enter the cert-profile list instance

Context

configure system security tls cert-profile string

Tree

cert-profile

Max. Elements

16

Introduced

16.0.R1

Platforms

All

[cert-profile-name] string

Synopsis

TLS certificate profile name

Context

configure system security tls cert-profile string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the certificate profile

Context

configure system security tls cert-profile string admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

entry [entry-id] number

Synopsis

Enter the entry list instance

Context

configure system security tls cert-profile string entry number

Tree

entry

Max. Elements

8

Introduced

16.0.R1

Platforms

All

[entry-id] number

Synopsis

Certificate profile ID

Context

configure system security tls cert-profile string entry number

Range

1 to 8

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

certificate-file string

Synopsis

Certificate file name

Context

configure system security tls cert-profile string entry number certificate-file string

Tree

certificate-file

String Length

1 to 95

Introduced

16.0.R1

Platforms

All

key-file string

Synopsis

Key file name

Context

configure system security tls cert-profile string entry number key-file string

Tree

key-file

String Length

1 to 95

Introduced

16.0.R1

Platforms

All

send-chain

Synopsis

Enter the send-chain context

Context

configure system security tls cert-profile string entry number send-chain

Tree

send-chain

Introduced

16.0.R1

Platforms

All

ca-profile [ca-profile-name] reference

Synopsis

Add a list entry for ca-profile

Context

configure system security tls cert-profile string entry number send-chain ca-profile reference

Tree

ca-profile

Max. Elements

7

Introduced

16.0.R1

Platforms

All

[ca-profile-name] reference

Synopsis

CA profile name

Context

configure system security tls cert-profile string entry number send-chain ca-profile reference

Reference

configure system security pki ca-profile string

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

client-cipher-list [client-cipher-list-name] string

Synopsis

Enter the client-cipher-list list instance

Context

configure system security tls client-cipher-list string

Tree

client-cipher-list

Max. Elements

16

Introduced

16.0.R1

Platforms

All

[client-cipher-list-name] string

Synopsis

Client cipher list name

Context

configure system security tls client-cipher-list string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

tls12-cipher [index] number

Synopsis

Enter the tls12-cipher list instance

Context

configure system security tls client-cipher-list string tls12-cipher number

Tree

tls12-cipher

Introduced

22.2.R1

Platforms

All

[index] number

Synopsis

Index of the cipher

Context

configure system security tls client-cipher-list string tls12-cipher number

Range

1 to 255

Notes

This element is part of a list key.

Introduced

22.2.R1

Platforms

All

name keyword

Synopsis

Cipher suite code

Context

configure system security tls client-cipher-list string tls12-cipher number name keyword

Tree

name

Options

tls-rsa-with3des-ede-cbc-sha, tls-rsa-with-aes128-cbc-sha, tls-rsa-with-aes256-cbc-sha, tls-rsa-with-aes128-cbc-sha256, tls-rsa-with-aes256-cbc-sha256, tls-rsa-with-aes128-gcm-sha256, tls-rsa-with-aes256-gcm-sha384

Notes

This element is mandatory.

Introduced

22.2.R1

Platforms

All

client-tls-profile [client-profile-name] string

Synopsis

Enter the client-tls-profile list instance

Context

configure system security tls client-tls-profile string

Tree

client-tls-profile

Max. Elements

16

Introduced

16.0.R1

Platforms

All

[client-profile-name] string

Synopsis

Client TLS profile name

Context

configure system security tls client-tls-profile string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the client TLS profile

Context

configure system security tls client-tls-profile string admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

cert-profile reference

Synopsis

Certificate profile ID

Context

configure system security tls client-tls-profile string cert-profile reference

Tree

cert-profile

Reference

configure system security tls cert-profile string

Introduced

16.0.R1

Platforms

All

cipher-list reference

Synopsis

Cipher list for negotiation in the client Hello message

Context

configure system security tls client-tls-profile string cipher-list reference

Tree

cipher-list

Reference

configure system security tls client-cipher-list string

Introduced

16.0.R1

Platforms

All

trust-anchor-profile reference

Synopsis

Trust anchor profile

Context

configure system security tls client-tls-profile string trust-anchor-profile reference

Tree

trust-anchor-profile

Reference

configure system security tls trust-anchor-profile string

Introduced

16.0.R1

Platforms

All

server-cipher-list [server-cipher-list-name] string

Synopsis

Enter the server-cipher-list list instance

Context

configure system security tls server-cipher-list string

Tree

server-cipher-list

Max. Elements

16

Introduced

16.0.R1

Platforms

All

[server-cipher-list-name] string

Synopsis

Server cipher list name

Context

configure system security tls server-cipher-list string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

tls12-cipher [index] number

Synopsis

Enter the tls12-cipher list instance

Context

configure system security tls server-cipher-list string tls12-cipher number

Tree

tls12-cipher

Introduced

22.2.R1

Platforms

All

[index] number

Synopsis

Index of the cipher

Context

configure system security tls server-cipher-list string tls12-cipher number

Range

1 to 255

Notes

This element is part of a list key.

Introduced

22.2.R1

Platforms

All

name keyword

Synopsis

Cipher suite code

Context

configure system security tls server-cipher-list string tls12-cipher number name keyword

Tree

name

Options

tls-rsa-with3des-ede-cbc-sha, tls-rsa-with-aes128-cbc-sha, tls-rsa-with-aes256-cbc-sha, tls-rsa-with-aes128-cbc-sha256, tls-rsa-with-aes256-cbc-sha256, tls-rsa-with-aes128-gcm-sha256, tls-rsa-with-aes256-gcm-sha384

Notes

This element is mandatory.

Introduced

22.2.R1

Platforms

All

server-tls-profile [server-profile-name] string

Synopsis

Enter the server-tls-profile list instance

Context

configure system security tls server-tls-profile string

Tree

server-tls-profile

Max. Elements

16

Introduced

16.0.R1

Platforms

All

[server-profile-name] string

Synopsis

TLS server profile name

Context

configure system security tls server-tls-profile string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the server TLS profile

Context

configure system security tls server-tls-profile string admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

authenticate-client

Synopsis

Enter the authenticate-client context

Context

configure system security tls server-tls-profile string authenticate-client

Tree

authenticate-client

Introduced

16.0.R1

Platforms

All

common-name-list reference

Synopsis

Common name list for TLS client certificate authentication

Context

configure system security tls server-tls-profile string authenticate-client common-name-list reference

Tree

common-name-list

Reference

configure system security pki common-name-list string

Introduced

16.0.R1

Platforms

All

trust-anchor-profile reference

Synopsis

Trust anchor profile for TLS client certificate authentication

Context

configure system security tls server-tls-profile string authenticate-client trust-anchor-profile reference

Tree

trust-anchor-profile

Reference

configure system security tls trust-anchor-profile string

Introduced

16.0.R1

Platforms

All

cert-profile reference

Synopsis

Certificate profile ID

Context

configure system security tls server-tls-profile string cert-profile reference

Tree

cert-profile

Reference

configure system security tls cert-profile string

Introduced

16.0.R1

Platforms

All

cipher-list reference

Synopsis

Cipher list used by the TLS server profile

Context

configure system security tls server-tls-profile string cipher-list reference

Tree

cipher-list

Reference

configure system security tls server-cipher-list string

Introduced

16.0.R1

Platforms

All

tls-re-negotiate-timer number

Synopsis

TLS HELLO request timer

Context

configure system security tls server-tls-profile string tls-re-negotiate-timer number

Tree

tls-re-negotiate-timer

Range

0 to 65000

Default

0

Units

minutes

Introduced

16.0.R1

Platforms

All

trust-anchor-profile [trust-anchor-profile-name] string

Synopsis

Enter the trust-anchor-profile list instance

Context

configure system security tls trust-anchor-profile string

Tree

trust-anchor-profile

Max. Elements

16

Introduced

16.0.R1

Platforms

All

[trust-anchor-profile-name] string

Synopsis

Trust anchor profile name

Context

configure system security tls trust-anchor-profile string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

trust-anchor [ca-profile-name] reference

Synopsis

Add a list entry for trust-anchor

Context

configure system security tls trust-anchor-profile string trust-anchor reference

Tree

trust-anchor

Max. Elements

8

Introduced

16.0.R1

Platforms

All

[ca-profile-name] reference

Synopsis

Trusted CA profile name

Context

configure system security tls trust-anchor-profile string trust-anchor reference

Reference

configure system security pki ca-profile string

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

user-params

Synopsis

Enter the user-params context

Context

configure system security user-params

Tree

user-params

Introduced

16.0.R1

Platforms

All

attempts

Synopsis

Enter the attempts context

Context

configure system security user-params attempts

Tree

attempts

Introduced

16.0.R1

Platforms

All

count number

Synopsis

Number of unsuccessful login attempts

Context

configure system security user-params attempts count number

Tree

count

Range

1 to 64

Default

3

Introduced

16.0.R1

Platforms

All

lockout number

Synopsis

Lockout period after unsuccessful login attempts

Context

configure system security user-params attempts lockout number

Tree

lockout

Range

0 to 1440

Default

10

Units

minutes

Introduced

16.0.R1

Platforms

All

time number

Synopsis

Time frame of unsuccessful login attempts

Context

configure system security user-params attempts time number

Tree

time

Range

0 to 60

Default

5

Units

minutes

Introduced

16.0.R1

Platforms

All

authentication-order

Synopsis

Enter the authentication-order context

Context

configure system security user-params authentication-order

Tree

authentication-order

Introduced

16.0.R1

Platforms

All

exit-on-reject boolean

Synopsis

Ignore subsequent AAA methods in authentication order when a reject is received

Context

configure system security user-params authentication-order exit-on-reject boolean

Tree

exit-on-reject

Default

false

Introduced

16.0.R1

Platforms

All

order keyword

Synopsis

Sequence of password authentication, authorization, and accounting

Context

configure system security user-params authentication-order order keyword

Tree

order

Options

local, radius, tacplus, ldap

Max. Elements

4

Notes

This element is ordered by the user.

Introduced

16.0.R1

Platforms

All

local-user

Synopsis

Enter the local-user context

Context

configure system security user-params local-user

Tree

local-user

Introduced

16.0.R1

Platforms

All

password

Synopsis

Enter the password context

Context

configure system security user-params local-user password

Tree

password

Introduced

16.0.R1

Platforms

All

aging number

Synopsis

Maximum time during which a user password is valid

Context

configure system security user-params local-user password aging number

Tree

aging

Range

1 to 500

Units

days

Introduced

16.0.R1

Platforms

All

complexity-rules

Synopsis

Enter the complexity-rules context

Context

configure system security user-params local-user password complexity-rules

Tree

complexity-rules

Introduced

16.0.R1

Platforms

All

allow-user-name boolean

Synopsis

Allow the username to be used as part of the password

Context

configure system security user-params local-user password complexity-rules allow-user-name boolean

Tree

allow-user-name

Default

false

Introduced

16.0.R1

Platforms

All

credits

Synopsis

Enter the credits context

Context

configure system security user-params local-user password complexity-rules credits

Tree

credits

Notes

The following elements are part of a choice: credits or required.

Introduced

16.0.R1

Platforms

All

lowercase number

Synopsis

Maximum credits given for the usage of lowercase letters

Context

configure system security user-params local-user password complexity-rules credits lowercase number

Tree

lowercase

Range

1 to 10

Introduced

16.0.R1

Platforms

All

numeric number

Synopsis

Maximum credits given for the usage of numeric characters

Context

configure system security user-params local-user password complexity-rules credits numeric number

Tree

numeric

Range

1 to 10

Introduced

16.0.R1

Platforms

All

special-character number

Synopsis

Maximum credits given for the usage of special characters

Context

configure system security user-params local-user password complexity-rules credits special-character number

Tree

special-character

Range

1 to 10

Introduced

16.0.R1

Platforms

All

uppercase number

Synopsis

Maximum credits given for the usage of uppercase letters

Context

configure system security user-params local-user password complexity-rules credits uppercase number

Tree

uppercase

Range

1 to 10

Introduced

16.0.R1

Platforms

All

minimum-classes number

Synopsis

Force the use of different character classes for a minimum number

Context

configure system security user-params local-user password complexity-rules minimum-classes number

Tree

minimum-classes

Range

2 to 4

Introduced

16.0.R1

Platforms

All

minimum-length number

Synopsis

Minimum length required for local passwords

Context

configure system security user-params local-user password complexity-rules minimum-length number

Tree

minimum-length

Range

6 to 50

Default

6

Introduced

16.0.R1

Platforms

All

repeated-characters number

Synopsis

Number of times the same character appears consecutively

Context

configure system security user-params local-user password complexity-rules repeated-characters number

Tree

repeated-characters

Range

2 to 8

Introduced

16.0.R1

Platforms

All

required

Synopsis

Enter the required context

Context

configure system security user-params local-user password complexity-rules required

Tree

required

Notes

The following elements are part of a choice: credits or required.

Introduced

16.0.R1

Platforms

All

lowercase number

Synopsis

Number required for lowercase letters

Context

configure system security user-params local-user password complexity-rules required lowercase number

Tree

lowercase

Range

1 to 10

Introduced

16.0.R1

Platforms

All

numeric number

Synopsis

Number required for numeric characters

Context

configure system security user-params local-user password complexity-rules required numeric number

Tree

numeric

Range

1 to 10

Introduced

16.0.R1

Platforms

All

special-character number

Synopsis

Number required for special characters

Context

configure system security user-params local-user password complexity-rules required special-character number

Tree

special-character

Range

1 to 10

Introduced

16.0.R1

Platforms

All

uppercase number

Synopsis

Number required for uppercase letters

Context

configure system security user-params local-user password complexity-rules required uppercase number

Tree

uppercase

Range

1 to 10

Introduced

16.0.R1

Platforms

All

hashing keyword

Synopsis

Password hashing algorithm

Context

configure system security user-params local-user password hashing keyword

Tree

hashing

Default

bcrypt

Options

bcrypt, sha2-pbkdf2, sha3-pbkdf2

Introduced

20.7.R1

Platforms

All

history-size number

Synopsis

New password to match against previous ones

Context

configure system security user-params local-user password history-size number

Tree

history-size

Range

0 to 20

Introduced

16.0.R1

Platforms

All

minimum-age number

Synopsis

Minimum age required for a password before changing it

Context

configure system security user-params local-user password minimum-age number

Tree

minimum-age

Range

0 to 86400

Default

600

Units

seconds

Introduced

16.0.R1

Platforms

All

minimum-change number

Synopsis

Minimum distance required between the old and the new password

Context

configure system security user-params local-user password minimum-change number

Tree

minimum-change

Range

1 to 20

Default

5

Introduced

16.0.R1

Platforms

All

user [user-name] string

Synopsis

Enter the user list instance

Context

configure system security user-params local-user user string

Tree

user

Introduced

16.0.R1

Platforms

All

[user-name] string

Synopsis

Local user name

Context

configure system security user-params local-user user string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

access

Synopsis

Enter the access context

Context

configure system security user-params local-user user string access

Tree

access

Introduced

16.0.R1

Platforms

All

console boolean

Synopsis

Allow console access (serial port or Telnet)

Context

configure system security user-params local-user user string access console boolean

Tree

console

Default

false

Introduced

16.0.R1

Platforms

All

ftp boolean

Synopsis

Allow FTP access

Context

configure system security user-params local-user user string access ftp boolean

Tree

ftp

Default

false

Introduced

16.0.R1

Platforms

All

grpc boolean

Synopsis

Allow gRPC access

Context

configure system security user-params local-user user string access grpc boolean

Tree

grpc

Default

false

Introduced

16.0.R1

Platforms

All

li boolean

Synopsis

Enable/disable access to LI.

Context

configure system security user-params local-user user string access li boolean

Tree

li

Default

false

Introduced

19.10.R1

Platforms

All

netconf boolean

Synopsis

Allow NETCONF session access

Context

configure system security user-params local-user user string access netconf boolean

Tree

netconf

Default

false

Introduced

16.0.R1

Platforms

All

snmp boolean

Synopsis

Allow SNMP access

Context

configure system security user-params local-user user string access snmp boolean

Tree

snmp

Default

false

Introduced

16.0.R1

Platforms

All

cli-engine keyword

Synopsis

User level override for CLI engine access

Context

configure system security user-params local-user user string cli-engine keyword

Tree

cli-engine

Default

md-cli

Options

classic-cli, md-cli

Max. Elements

2

Notes

This element is ordered by the user.

Introduced

16.0.R1

Platforms

All

console

Synopsis

Enter the console context

Context

configure system security user-params local-user user string console

Tree

console

Introduced

16.0.R1

Platforms

All

cannot-change-password boolean

Synopsis

Change password privileges

Context

configure system security user-params local-user user string console cannot-change-password boolean

Tree

cannot-change-password

Default

false

Introduced

16.0.R1

Platforms

All

login-exec (sat-url | cflash-url | ftp-tftp-url | filename)

Synopsis

File to execute when a user successfully logs in

Context

configure system security user-params local-user user string console login-exec (sat-url | cflash-url | ftp-tftp-url | filename)

Tree

login-exec

String Length

1 to 200

Introduced

16.0.R1

Platforms

All

member reference

Synopsis

User profiles for this user

Context

configure system security user-params local-user user string console member reference

Tree

member

Reference

configure system security aaa local-profiles profile string

Max. Elements

8

Notes

This element is ordered by the user.

Introduced

16.0.R1

Platforms

All

new-password-at-login boolean

Synopsis

Prompt a user to change password at next console login

Context

configure system security user-params local-user user string console new-password-at-login boolean

Tree

new-password-at-login

Default

false

Introduced

16.0.R1

Platforms

All

home-directory (sat-url | cflash-without-slot-url)

Synopsis

Home directory for the user

Context

configure system security user-params local-user user string home-directory (sat-url | cflash-without-slot-url)

Tree

home-directory

String Length

1 to 200

Introduced

16.0.R1

Platforms

All

password string

Synopsis

Password to authenticate the user for console and FTP access

Context

configure system security user-params local-user user string password string

Tree

password

String Length

3 to 136

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

public-keys

Synopsis

Enter the public-keys context

Context

configure system security user-params local-user user string public-keys

Tree

public-keys

Introduced

16.0.R1

Platforms

All

ecdsa

Synopsis

Enter the ecdsa context

Context

configure system security user-params local-user user string public-keys ecdsa

Tree

ecdsa

Introduced

16.0.R1

Platforms

All

ecdsa-key [ecdsa-public-key-id] number

Synopsis

Enter the ecdsa-key list instance

Context

configure system security user-params local-user user string public-keys ecdsa ecdsa-key number

Tree

ecdsa-key

Introduced

16.0.R1

Platforms

All

[ecdsa-public-key-id] number

Synopsis

Number of the Secure Shell version 2 (SSHv2) ECDSA public key that is associated with system user

Context

configure system security user-params local-user user string public-keys ecdsa ecdsa-key number

Range

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system security user-params local-user user string public-keys ecdsa ecdsa-key number description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

All

key-value string

Synopsis

Number of the Secure Shell version 2 (SSHv2) ECDSA public key that is associated with system user

Context

configure system security user-params local-user user string public-keys ecdsa ecdsa-key number key-value string

Tree

key-value

String Length

1 to 255

Introduced

16.0.R1

Platforms

All

rsa

Synopsis

Enter the rsa context

Context

configure system security user-params local-user user string public-keys rsa

Tree

rsa

Introduced

16.0.R1

Platforms

All

rsa-key [rsa-public-key-id] number

Synopsis

Enter the rsa-key list instance

Context

configure system security user-params local-user user string public-keys rsa rsa-key number

Tree

rsa-key

Introduced

16.0.R1

Platforms

All

[rsa-public-key-id] number

Synopsis

Number of the Secure Shell version 2 (SSHv2) RSA public key that is associated with system user

Context

configure system security user-params local-user user string public-keys rsa rsa-key number

Range

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system security user-params local-user user string public-keys rsa rsa-key number description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

All

key-value string

Synopsis

Number of the Secure Shell version 2 (SSHv2) RSA public key that is associated with system user

Context

configure system security user-params local-user user string public-keys rsa rsa-key number key-value string

Tree

key-value

String Length

1 to 800

Introduced

16.0.R1

Platforms

All

restricted-to-home boolean

Synopsis

Users prevented from navigating above their home directories to access file

Context

configure system security user-params local-user user string restricted-to-home boolean

Tree

restricted-to-home

Default

false

Introduced

16.0.R1

Platforms

All

snmp

Synopsis

Enter the snmp context

Context

configure system security user-params local-user user string snmp

Tree

snmp

Introduced

16.0.R1

Platforms

All

authentication

Synopsis

Enable the authentication context

Context

configure system security user-params local-user user string snmp authentication

Tree

authentication

Description

Commands in this context configure the SNMPv3 authentication and privacy protocols for the user to communicate with the router. The keys are stored in an encrypted format in the configuration.

The keys configured with these commands must be localized keys, which are a hash of the SNMP engine ID and a password. The password is not entered directly in this command. Use the tools perform system management-interface snmp generate-key command to generate localized authentication and privacy keys.

Introduced

16.0.R1

Platforms

All

authentication-key string

Synopsis

Localized authentication key

Context

configure system security user-params local-user user string snmp authentication authentication-key string

Tree

authentication-key

Description

This command specifies the authentication key for the authentication protocol. The key must be a localized key, which is a hash of the SNMP engine ID and a password. The password is not entered directly in this command. Use the tools perform system management-interface snmp generate-key command to generate a localized authentication key.

String Length

1 to 115

Introduced

16.0.R1

Platforms

All

authentication-protocol keyword

Synopsis

Authentication protocol

Context

configure system security user-params local-user user string snmp authentication authentication-protocol keyword

Tree

authentication-protocol

Options

hmac-md5-96, hmac-sha1-96, hmac-sha2-224, hmac-sha2-256, hmac-sha2-384, hmac-sha2-512

Introduced

16.0.R1

Platforms

All

privacy

Synopsis

Enable the privacy context

Context

configure system security user-params local-user user string snmp authentication privacy

Tree

privacy

Introduced

16.0.R1

Platforms

All

privacy-key string

Synopsis

Localized privacy key

Context

configure system security user-params local-user user string snmp authentication privacy privacy-key string

Tree

privacy-key

Description

This command specifies the privacy key for the privacy protocol. The key must be a localized key, which is a hash of the SNMP engine ID and a password. The password is not entered directly in this command. Use the tools perform system management-interface snmp generate-key command to generate a localized privacy key.

String Length

1 to 71

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

privacy-protocol keyword

Synopsis

Privacy protocol

Context

configure system security user-params local-user user string snmp authentication privacy privacy-protocol keyword

Tree

privacy-protocol

Options

cbc-des, cfb128-aes-128, cfb128-aes-192, cfb128-aes-256

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

group string

Synopsis

User to associate with a group name

Context

configure system security user-params local-user user string snmp group string

Tree

group

String Length

1 to 32

Introduced

16.0.R1

Platforms

All

vprn-network-exceptions

Synopsis

Enable the vprn-network-exceptions context

Context

configure system security vprn-network-exceptions

Tree

vprn-network-exceptions

Description

Commands in this context configure the rate limiting attributes for processing packets with label TTL expiry received within an LSP shortcut or VPRN instances in the system and from all network IP interfaces. This includes labeled user and control plan packets, ping, and traceroute packets within GRT and VPRN, and ICMP replies.

These commands do not rate limit MPLS or service OAM packets.

Introduced

16.0.R1

Platforms

All

count number

Synopsis

Limit of exception messages received

Context

configure system security vprn-network-exceptions count number

Tree

count

Description

This command specifies the threshold limit of exception messages. If the threshold value is exceeded within the configured time interval, packets are dropped.

Range

10 to 1000

Default

100

Introduced

16.0.R1

Platforms

All

window number

Synopsis

Time interval to measure exception messages

Context

configure system security vprn-network-exceptions window number

Tree

window

Description

This command configures the time interval within which exception messages are counted. If the threshold value is exceeded within the configured time interval, packets are dropped.

Range

1 to 60

Default

10

Units

seconds

Introduced

16.0.R1

Platforms

All

selective-fib boolean

Synopsis

FIB assigned to the system

Context

configure system selective-fib boolean

Tree

selective-fib

Default

false

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

software-repository [repository-name] string

Synopsis

Enter the software-repository list instance

Context

configure system software-repository string

Tree

software-repository

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

[repository-name] string

Synopsis

Software repository name

Context

configure system software-repository string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

description string

Synopsis

Text description

Context

configure system software-repository string description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

primary-location string

Synopsis

Primary location for the files in the software repository

Context

configure system software-repository string primary-location string

Tree

primary-location

String Length

1 to 180

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

secondary-location string

Synopsis

Secondary location for the files in the software repository

Context

configure system software-repository string secondary-location string

Tree

secondary-location

String Length

1 to 180

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

tertiary-location string

Synopsis

Tertiary location for the files in the software repository

Context

configure system software-repository string tertiary-location string

Tree

tertiary-location

String Length

1 to 180

Introduced

16.0.R1

Platforms

7450 ESS, 7750 SR, 7750 SR-a, 7750 SR-e, 7750 SR-s, 7950 XRS

switch-fabric

Synopsis

Enter the switch-fabric context

Context

configure system switch-fabric

Tree

switch-fabric

Description

Commands in this context configure system level attributes related to the switch fabric.

Introduced

20.5.R1

Platforms

7450 ESS, 7750 SR-7, 7750 SR-7s, 7750 SR-14s, 7950 XRS

failure-recovery

Synopsis

Enter the failure-recovery context

Context

configure system switch-fabric failure-recovery

Tree

failure-recovery

Description

Commands in this context configure the attributes related to the automatic switch fabric recovery process. This process is triggered when there are two resets of an IOM/XCM due to ICC failures within a small time frame. The recovery process involves the sequential resetting of SFM in case the issues are due to one of the SFM in the ICC communication path. As the final step in the recovery process, a CPM switchover is triggered to reset the active CPM.

Introduced

21.2.R1

Platforms

7450 ESS, 7750 SR-7, 7950 XRS

admin-state keyword

Synopsis

Administrative state of the failure recovery process

Context

configure system switch-fabric failure-recovery admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

21.2.R1

Platforms

7450 ESS, 7750 SR-7, 7950 XRS

sfm-loss-threshold number

Synopsis

Number of SFMs that can fail before SFM overload state

Context

configure system switch-fabric sfm-loss-threshold number

Tree

sfm-loss-threshold

Description

This command specifies the number of SFMs that are permitted to fail before the system goes into SFM overload state.

The default value for the 7750 SR-7s is 1 and the default value for the 7750 SR-14s is 2. Users can select the SFM limit based on the number possible for the system minus one. For the 7750 SR-7s, the limit is 3 and the limit for the 7750 SR-14s is 7.

Range

1 to 7

Introduced

20.5.R1

Platforms

7750 SR-7s, 7750 SR-14s

telemetry

Synopsis

Enter the telemetry context

Context

configure system telemetry

Tree

telemetry

Description

Commands in this context configure the parameters for the dial-out telemetry functionality.

Introduced

20.2.R1

Platforms

All

destination-group [name] string

Synopsis

Enter the destination-group list instance

Context

configure system telemetry destination-group string

Tree

destination-group

Description

Commands in this context configure parameters for destination groups.

Max. Elements

225

Introduced

20.5.R1

Platforms

All

[name] string

Synopsis

Destination group name

Context

configure system telemetry destination-group string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

20.5.R1

Platforms

All

allow-unsecure-connection

Synopsis

Allow connection without secured transport protocol

Context

configure system telemetry destination-group string allow-unsecure-connection

Tree

allow-unsecure-connection

Description

When configured, this command allows an unsecured connection to remote managers; TCP connections are not encrypted, including username and password information.

Notes

The following elements are part of a choice: allow-unsecure-connection or tls-client-profile.

Introduced

20.5.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system telemetry destination-group string description string

Tree

description

String Length

1 to 80

Introduced

20.5.R1

Platforms

All

destination [address] (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number

Synopsis

Enter the destination list instance

Context

configure system telemetry destination-group string destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number

Tree

destination

Max. Elements

4

Notes

This element is ordered by the user.

Introduced

20.5.R1

Platforms

All

[address] (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name)

Synopsis

Address of the destination within the destination group

Context

configure system telemetry destination-group string destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number

String Length

1 to 255

Notes

This element is part of a list key.

Introduced

20.5.R1

Platforms

All

port number

Synopsis

TCP port number for the destination

Context

configure system telemetry destination-group string destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number

Range

0 | 1 to 65535

Notes

This element is part of a list key.

Introduced

20.5.R1

Platforms

All

router-instance string

Synopsis

Router instance for the destination group

Context

configure system telemetry destination-group string destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number router-instance string

Tree

router-instance

Introduced

20.5.R1

Platforms

All

tcp-keepalive

Synopsis

Enter the tcp-keepalive context

Context

configure system telemetry destination-group string tcp-keepalive

Tree

tcp-keepalive

Introduced

20.5.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the TCP keep-alive algorithm

Context

configure system telemetry destination-group string tcp-keepalive admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

20.5.R1

Platforms

All

idle-time number

Synopsis

Time until the first TCP keepalive probe is sent

Context

configure system telemetry destination-group string tcp-keepalive idle-time number

Tree

idle-time

Range

1 to 100000

Default

600

Units

seconds

Introduced

20.5.R1

Platforms

All

interval number

Synopsis

Time between TCP keepalive probes

Context

configure system telemetry destination-group string tcp-keepalive interval number

Tree

interval

Range

1 to 100000

Default

15

Units

seconds

Introduced

20.5.R1

Platforms

All

retries number

Synopsis

Number of probe retries before closing the connection

Context

configure system telemetry destination-group string tcp-keepalive retries number

Tree

retries

Description

This command configures the number of missed TCP keepalive probes before closing the TCP connection and attempting to reach the other destinations within the same destination group.

Range

3 to 100

Default

4

Introduced

20.5.R1

Platforms

All

tls-client-profile reference

Synopsis

TLS client profile assigned to the destination group

Context

configure system telemetry destination-group string tls-client-profile reference

Tree

tls-client-profile

Reference

configure system security tls client-tls-profile string

Notes

The following elements are part of a choice: allow-unsecure-connection or tls-client-profile.

Introduced

20.5.R1

Platforms

All

notification-bundling

Synopsis

Enter the notification-bundling context

Context

configure system telemetry notification-bundling

Tree

notification-bundling

Description

Commands in this context configure the bundling of multiple notifications into one telemetry message.

Introduced

21.10.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of notification bundling

Context

configure system telemetry notification-bundling admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

21.10.R1

Platforms

All

max-msg-count number

Synopsis

Max number of notifications in telemetry message bundle

Context

configure system telemetry notification-bundling max-msg-count number

Tree

max-msg-count

Range

2 to 1000

Default

100

Introduced

21.10.R1

Platforms

All

max-time-granularity number

Synopsis

Max time interval when bundling of notifications occurs

Context

configure system telemetry notification-bundling max-time-granularity number

Tree

max-time-granularity

Description

This command sets the maximum time interval during which telemetry notifications are bundled. All bundled notifications will have the same timestamp, which is the timestamp of the bundle.

Range

1 to 1000

Default

100

Units

milliseconds

Introduced

21.10.R1

Platforms

All

persistent-subscriptions

Synopsis

Enter the persistent-subscriptions context

Context

configure system telemetry persistent-subscriptions

Tree

persistent-subscriptions

Introduced

20.5.R1

Platforms

All

subscription [name] string

Synopsis

Enter the subscription list instance

Context

configure system telemetry persistent-subscriptions subscription string

Tree

subscription

Max. Elements

225

Introduced

20.5.R1

Platforms

All

[name] string

Synopsis

Persistent subscription name

Context

configure system telemetry persistent-subscriptions subscription string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

20.5.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of the persistent subscription

Context

configure system telemetry persistent-subscriptions subscription string admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

20.5.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system telemetry persistent-subscriptions subscription string description string

Tree

description

String Length

1 to 80

Introduced

20.5.R1

Platforms

All

destination-group reference

Synopsis

Name of the destination group used in the subscription

Context

configure system telemetry persistent-subscriptions subscription string destination-group reference

Tree

destination-group

Reference

configure system telemetry destination-group string

Introduced

20.5.R1

Platforms

All

encoding keyword

Synopsis

Encoding used for telemetry notifications

Context

configure system telemetry persistent-subscriptions subscription string encoding keyword

Tree

encoding

Description

This command specifies the encoding used for telemetry notifications as defined by the gNMI OpenConfig standard.

Default

json

Options

json, bytes, proto, json-ietf

Introduced

20.5.R1

Platforms

All

local-source-address (ipv4-address-no-zone | ipv6-address-no-zone)

Synopsis

Local IP address of packets sent from the source

Context

configure system telemetry persistent-subscriptions subscription string local-source-address (ipv4-address-no-zone | ipv6-address-no-zone)

Tree

local-source-address

Introduced

20.5.R1

Platforms

All

mode keyword

Synopsis

Mode for telemetry notifications

Context

configure system telemetry persistent-subscriptions subscription string mode keyword

Tree

mode

Description

This command specifies the subscription path mode for telemetry notifications sent out for the persistent subscription.

Options

target-defined, on-change, sample

Introduced

20.5.R1

Platforms

All

originated-qos-marking keyword

Synopsis

QoS marking used for telemetry notification packets

Context

configure system telemetry persistent-subscriptions subscription string originated-qos-marking keyword

Tree

originated-qos-marking

Options

be, cp1, cp2, cp3, cp4, cp5, cp6, cp7, cs1, cp9, af11, cp11, af12, cp13, af13, cp15, cs2, cp17, af21, cp19, af22, cp21, af23, cp23, cs3, cp25, af31, cp27, af32, cp29, af33, cp31, cs4, cp33, af41, cp35, af42, cp37, af43, cp39, cs5, cp41, cp42, cp43, cp44, cp45, ef, cp47, nc1, cp49, cp50, cp51, cp52, cp53, cp54, cp55, nc2, cp57, cp58, cp59, cp60, cp61, cp62, cp63

Introduced

20.5.R1

Platforms

All

sample-interval number

Synopsis

Sampling interval for the persistent subscription

Context

configure system telemetry persistent-subscriptions subscription string sample-interval number

Tree

sample-interval

Description

This command configures the sampling interval for the persistent subscription. The interval applies only in sampling or target-defined modes.

Range

1000 to 18446744073709551615

Default

10000

Units

milliseconds

Introduced

20.5.R1

Platforms

All

sensor-group reference

Synopsis

Sensor group used in the persistent subscription

Context

configure system telemetry persistent-subscriptions subscription string sensor-group reference

Tree

sensor-group

Description

This command specifies the sensor group to be used in the persistent subscription. If no valid paths exist in the sensor group, the configuration is accepted, however, no gRPC connection is established when persistent subscription is activated.

Reference

configure system telemetry sensor-groups sensor-group string

Introduced

20.5.R1

Platforms

All

sensor-groups

Synopsis

Enter the sensor-groups context

Context

configure system telemetry sensor-groups

Tree

sensor-groups

Introduced

20.5.R1

Platforms

All

sensor-group [name] string

Synopsis

Enter the sensor-group list instance

Context

configure system telemetry sensor-groups sensor-group string

Tree

sensor-group

Max. Elements

225

Introduced

20.5.R1

Platforms

All

[name] string

Synopsis

Sensor group name

Context

configure system telemetry sensor-groups sensor-group string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

20.5.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system telemetry sensor-groups sensor-group string description string

Tree

description

String Length

1 to 80

Introduced

20.5.R1

Platforms

All

path [xpath] string

Synopsis

Add a list entry for path

Context

configure system telemetry sensor-groups sensor-group string path string

Tree

path

Max. Elements

4500

Introduced

20.5.R1

Platforms

All

[xpath] string

Synopsis

YANG model path indicating the data to be streamed

Context

configure system telemetry sensor-groups sensor-group string path string

Description

The command specifies the path from which data is streamed to the collector. Streamed data includes all descendants of the tree indicated by the path.

String Length

1 to 512

Notes

This element is part of a list key.

Introduced

20.5.R1

Platforms

All

thresholds

Synopsis

Enter the thresholds context

Context

configure system thresholds

Tree

thresholds

Introduced

16.0.R1

Platforms

All

cflash-cap-alarm-percent [cflash-id] string

Synopsis

Enter the cflash-cap-alarm-percent list instance

Context

configure system thresholds cflash-cap-alarm-percent string

Tree

cflash-cap-alarm-percent

Introduced

16.0.R1

Platforms

All

[cflash-id] string

Synopsis

cflash device name monitored for capacity

Context

configure system thresholds cflash-cap-alarm-percent string

String Length

1 to 200

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

falling-threshold number

Synopsis

Falling threshold for the sampled statistic

Context

configure system thresholds cflash-cap-alarm-percent string falling-threshold number

Tree

falling-threshold

Description

This command specifies a falling threshold for the sampled statistic. When the current sampled value is less than or equal to this threshold, and the value at the last sampling interval was greater than this threshold, a single threshold-crossing event is generated. A single threshold-crossing event is also generated if the first sample taken is less than or equal to this threshold and the associated startup-alarm command is equal to the falling or either values.

After a falling threshold-crossing event is generated, another such event is not generated until the sampled value rises above this threshold and reaches greater than or equal to the rising-threshold command.

Range

0 to 100

Units

percent

Introduced

16.0.R4

Platforms

All

interval number

Synopsis

Polling period over which data is sampled and compared

Context

configure system thresholds cflash-cap-alarm-percent string interval number

Tree

interval

Description

This command specifies the polling interval over which the data is sampled and compared with the rising and falling thresholds.

Range

1 to 2147483647

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

rising-threshold number

Synopsis

Rising threshold for the sampled statistic

Context

configure system thresholds cflash-cap-alarm-percent string rising-threshold number

Tree

rising-threshold

Description

This command specifies a rising threshold for the sampled statistic. When the current sampled value is greater than or equal to this threshold, and the value at the last sampling interval was less than this threshold, a single threshold-crossing event is generated. A single threshold crossing event is also generated if the first sample taken is greater than or equal to this threshold and the associated startup-alarm command is equal to the rising or either values.

After a rising threshold-crossing event is generated, another such event is not generated until the sampled value falls below this threshold and reaches less than or equal the falling-threshold command.

Range

0 to 100

Units

percent

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

rmon-event-type keyword

Synopsis

Notification type specifying action when event occurs

Context

configure system thresholds cflash-cap-alarm-percent string rmon-event-type keyword

Tree

rmon-event-type

Default

both

Options

none, log, trap, both

Introduced

16.0.R1

Platforms

All

startup-alarm keyword

Synopsis

Alarm type when the alarm is first created

Context

configure system thresholds cflash-cap-alarm-percent string startup-alarm keyword

Tree

startup-alarm

Description

This command specifies the alarm type that may be sent when this alarm is first created.

If the first sample is greater than or equal to the rising threshold value and startup-alarm is equal to rising or either, a single rising threshold crossing event is generated.

If the first sample is less than or equal to the falling threshold value and startup-alarm is equal to falling or either, a single falling threshold crossing event is generated.

Default

either

Options

rising, falling, either

Introduced

16.0.R1

Platforms

All

cflash-cap-warn-percent [cflash-id] string

Synopsis

Enter the cflash-cap-warn-percent list instance

Context

configure system thresholds cflash-cap-warn-percent string

Tree

cflash-cap-warn-percent

Description

Commands in this context configure the capacity monitoring of the compact flash. The usage is monitored as a percentage of the capacity of the compact flash. The severity level is warning. Both a rising and falling threshold can be specified. 

Introduced

16.0.R1

Platforms

All

[cflash-id] string

Synopsis

cflash device name monitored for capacity

Context

configure system thresholds cflash-cap-warn-percent string

String Length

1 to 200

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

falling-threshold number

Synopsis

Falling threshold for the sampled statistic

Context

configure system thresholds cflash-cap-warn-percent string falling-threshold number

Tree

falling-threshold

Description

This command specifies a falling threshold for the sampled statistic. When the current sampled value is less than or equal to this threshold, and the value at the last sampling interval was greater than this threshold, a single threshold-crossing event is generated. A single threshold-crossing event is also generated if the first sample taken is less than or equal to this threshold and the associated startup-alarm command is equal to the falling or either values.

After a falling threshold-crossing event is generated, another such event is not generated until the sampled value rises above this threshold and reaches greater than or equal to the rising-threshold command.

Range

0 to 100

Units

percent

Introduced

16.0.R4

Platforms

All

interval number

Synopsis

Polling period over which data is sampled and compared

Context

configure system thresholds cflash-cap-warn-percent string interval number

Tree

interval

Description

This command specifies the polling interval over which the data is sampled and compared with the rising and falling thresholds.

Range

1 to 2147483647

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

rising-threshold number

Synopsis

Rising threshold for the sampled statistic

Context

configure system thresholds cflash-cap-warn-percent string rising-threshold number

Tree

rising-threshold

Description

This command specifies a rising threshold for the sampled statistic. When the current sampled value is greater than or equal to this threshold, and the value at the last sampling interval was less than this threshold, a single threshold-crossing event is generated. A single threshold crossing event is also generated if the first sample taken is greater than or equal to this threshold and the associated startup-alarm command is equal to the rising or either values.

After a rising threshold-crossing event is generated, another such event is not generated until the sampled value falls below this threshold and reaches less than or equal the falling-threshold command.

Range

0 to 100

Units

percent

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

rmon-event-type keyword

Synopsis

Notification type specifying action when event occurs

Context

configure system thresholds cflash-cap-warn-percent string rmon-event-type keyword

Tree

rmon-event-type

Default

both

Options

none, log, trap, both

Introduced

16.0.R1

Platforms

All

startup-alarm keyword

Synopsis

Alarm type when the alarm is first created

Context

configure system thresholds cflash-cap-warn-percent string startup-alarm keyword

Tree

startup-alarm

Description

This command specifies the alarm type that may be sent when this alarm is first created.

If the first sample is greater than or equal to the rising threshold value and startup-alarm is equal to rising or either, a single rising threshold crossing event is generated.

If the first sample is less than or equal to the falling threshold value and startup-alarm is equal to falling or either, a single falling threshold crossing event is generated.

Default

either

Options

rising, falling, either

Introduced

16.0.R1

Platforms

All

kb-memory-use-alarm

Synopsis

Enable the kb-memory-use-alarm context

Context

configure system thresholds kb-memory-use-alarm

Tree

kb-memory-use-alarm

Introduced

16.0.R4

Platforms

All

falling-threshold number

Synopsis

Falling threshold for the sampled statistic

Context

configure system thresholds kb-memory-use-alarm falling-threshold number

Tree

falling-threshold

Description

This command specifies a falling threshold for the sampled statistic. When the current sampled value is less than or equal to this threshold, and the value at the last sampling interval was greater than this threshold, a single threshold-crossing event is generated. A single threshold-crossing event is also generated if the first sample taken is less than or equal to this threshold and the associated startup-alarm command is equal to the falling or either values.

After a falling threshold-crossing event is generated, another such event is not generated until the sampled value rises above this threshold and reaches greater than or equal to the rising-threshold command.

Range

-2147483648 to 2147483647

Introduced

16.0.R4

Platforms

All

interval number

Synopsis

Polling period over which data is sampled and compared

Context

configure system thresholds kb-memory-use-alarm interval number

Tree

interval

Description

This command specifies the polling interval over which the data is sampled and compared with the rising and falling thresholds.

Range

1 to 2147483647

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

rising-threshold number

Synopsis

Rising threshold for the sampled statistic

Context

configure system thresholds kb-memory-use-alarm rising-threshold number

Tree

rising-threshold

Description

This command specifies a rising threshold for the sampled statistic. When the current sampled value is greater than or equal to this threshold, and the value at the last sampling interval was less than this threshold, a single threshold-crossing event is generated. A single threshold crossing event is also generated if the first sample taken is greater than or equal to this threshold and the associated startup-alarm command is equal to the rising or either values.

After a rising threshold-crossing event is generated, another such event is not generated until the sampled value falls below this threshold and reaches less than or equal the falling-threshold command.

Range

-2147483648 to 2147483647

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

rmon-event-type keyword

Synopsis

Notification type specifying action when event occurs

Context

configure system thresholds kb-memory-use-alarm rmon-event-type keyword

Tree

rmon-event-type

Default

both

Options

none, log, trap, both

Introduced

16.0.R4

Platforms

All

startup-alarm keyword

Synopsis

Alarm type when the alarm is first created

Context

configure system thresholds kb-memory-use-alarm startup-alarm keyword

Tree

startup-alarm

Description

This command specifies the alarm type that may be sent when this alarm is first created.

If the first sample is greater than or equal to the rising threshold value and startup-alarm is equal to rising or either, a single rising threshold crossing event is generated.

If the first sample is less than or equal to the falling threshold value and startup-alarm is equal to falling or either, a single falling threshold crossing event is generated.

Default

either

Options

rising, falling, either

Introduced

16.0.R4

Platforms

All

kb-memory-use-warn

Synopsis

Enable the kb-memory-use-warn context

Context

configure system thresholds kb-memory-use-warn

Tree

kb-memory-use-warn

Introduced

16.0.R4

Platforms

All

falling-threshold number

Synopsis

Falling threshold for the sampled statistic

Context

configure system thresholds kb-memory-use-warn falling-threshold number

Tree

falling-threshold

Description

This command specifies a falling threshold for the sampled statistic. When the current sampled value is less than or equal to this threshold, and the value at the last sampling interval was greater than this threshold, a single threshold-crossing event is generated. A single threshold-crossing event is also generated if the first sample taken is less than or equal to this threshold and the associated startup-alarm command is equal to the falling or either values.

After a falling threshold-crossing event is generated, another such event is not generated until the sampled value rises above this threshold and reaches greater than or equal to the rising-threshold command.

Range

-2147483648 to 2147483647

Introduced

16.0.R4

Platforms

All

interval number

Synopsis

Polling period over which data is sampled and compared

Context

configure system thresholds kb-memory-use-warn interval number

Tree

interval

Description

This command specifies the polling interval over which the data is sampled and compared with the rising and falling thresholds.

Range

1 to 2147483647

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

rising-threshold number

Synopsis

Rising threshold for the sampled statistic

Context

configure system thresholds kb-memory-use-warn rising-threshold number

Tree

rising-threshold

Description

This command specifies a rising threshold for the sampled statistic. When the current sampled value is greater than or equal to this threshold, and the value at the last sampling interval was less than this threshold, a single threshold-crossing event is generated. A single threshold crossing event is also generated if the first sample taken is greater than or equal to this threshold and the associated startup-alarm command is equal to the rising or either values.

After a rising threshold-crossing event is generated, another such event is not generated until the sampled value falls below this threshold and reaches less than or equal the falling-threshold command.

Range

-2147483648 to 2147483647

Notes

This element is mandatory.

Introduced

16.0.R4

Platforms

All

rmon-event-type keyword

Synopsis

Notification type specifying action when event occurs

Context

configure system thresholds kb-memory-use-warn rmon-event-type keyword

Tree

rmon-event-type

Default

both

Options

none, log, trap, both

Introduced

16.0.R4

Platforms

All

startup-alarm keyword

Synopsis

Alarm type when the alarm is first created

Context

configure system thresholds kb-memory-use-warn startup-alarm keyword

Tree

startup-alarm

Description

This command specifies the alarm type that may be sent when this alarm is first created.

If the first sample is greater than or equal to the rising threshold value and startup-alarm is equal to rising or either, a single rising threshold crossing event is generated.

If the first sample is less than or equal to the falling threshold value and startup-alarm is equal to falling or either, a single falling threshold crossing event is generated.

Default

either

Options

rising, falling, either

Introduced

16.0.R4

Platforms

All

rmon

Synopsis

Enter the rmon context

Context

configure system thresholds rmon

Tree

rmon

Introduced

16.0.R1

Platforms

All

alarm [rmon-alarm-id] number

Synopsis

Enter the alarm list instance

Context

configure system thresholds rmon alarm number

Tree

alarm

Max. Elements

1200

Introduced

16.0.R1

Platforms

All

[rmon-alarm-id] number

Synopsis

Index ID for an entry in the alarm table

Context

configure system thresholds rmon alarm number

Range

0 to 65400

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

falling-event number

Synopsis

RMON event ID used when a falling threshold crossing event occurs

Context

configure system thresholds rmon alarm number falling-event number

Tree

falling-event

Range

0 to 65400

Introduced

16.0.R1

Platforms

All

falling-threshold number

Synopsis

Falling threshold for the sampled statistic

Context

configure system thresholds rmon alarm number falling-threshold number

Tree

falling-threshold

Description

This command specifies a falling threshold for the sampled statistic. When the current sampled value is less than or equal to this threshold and the value at the last sampling interval was greater than this threshold, a single threshold crossing event is generated. A single threshold crossing event is also generated if the first sample taken is less than or equal to this threshold and the associated startup-alarm command is set to falling or either.

After a falling threshold crossing event is generated, another such event is not generated until the sampled value exceeds this threshold and reaches or exceeds the rising-threshold command setting.

Range

-2147483648 to 2147483647

Introduced

16.0.R1

Platforms

All

interval number

Synopsis

Polling period over which data is sampled and compared

Context

configure system thresholds rmon alarm number interval number

Tree

interval

Description

This command specifies the polling interval over which the data is sampled and compared with the rising and falling thresholds

Range

1 to 2147483647

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

owner string

Synopsis

Owner that created this entry and uses the resources

Context

configure system thresholds rmon alarm number owner string

Tree

owner

String Length

1 to 80

Default

TiMOS CLI

Introduced

16.0.R1

Platforms

All

rising-event number

Synopsis

RMON event ID used when a rising event threshold event occurs

Context

configure system thresholds rmon alarm number rising-event number

Tree

rising-event

Range

0 to 65400

Introduced

16.0.R1

Platforms

All

rising-threshold number

Synopsis

Rising threshold for the sampled statistic

Context

configure system thresholds rmon alarm number rising-threshold number

Tree

rising-threshold

Description

This command specifies the rising threshold for the sampled statistic. When the current sampled value is greater than or equal to this threshold and the value at the last sampling interval was below this threshold, a single threshold crossing event is generated. A single threshold crossing event is also generated if the first sample taken is greater than or equal to this threshold and the associated startup-alarm command is set to rising or either.

After a rising threshold crossing event is generated, another such event is not generated until the sampled value falls below this threshold and reaches or falls below the falling-threshold command setting.

Range

-2147483648 to 2147483647

Introduced

16.0.R1

Platforms

All

sample-type keyword

Synopsis

Method to sample the selected variable and calculate the value comparing against the thresholds

Context

configure system thresholds rmon alarm number sample-type keyword

Tree

sample-type

Default

absolute

Options

absolute, delta

Introduced

16.0.R1

Platforms

All

startup-alarm keyword

Synopsis

Alarm to send when this entry is first set to valid

Context

configure system thresholds rmon alarm number startup-alarm keyword

Tree

startup-alarm

Default

either

Options

rising, falling, either

Introduced

16.0.R1

Platforms

All

variable-oid string

Synopsis

Object identifier to sample the specific variable

Context

configure system thresholds rmon alarm number variable-oid string

Tree

variable-oid

String Length

1 to 255

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

event [rmon-event-id] number

Synopsis

Enter the event list instance

Context

configure system thresholds rmon event number

Tree

event

Max. Elements

1200

Introduced

16.0.R1

Platforms

All

[rmon-event-id] number

Synopsis

Index ID for an entry in the event table

Context

configure system thresholds rmon event number

Range

1 to 65400

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

description string

Synopsis

Text description

Context

configure system thresholds rmon event number description string

Tree

description

String Length

1 to 80

Introduced

16.0.R1

Platforms

All

event-type keyword

Synopsis

Type of notification action to be taken when this event occurs

Context

configure system thresholds rmon event number event-type keyword

Tree

event-type

Default

both

Options

none, log, trap, both

Introduced

16.0.R1

Platforms

All

owner string

Synopsis

Owner that created this entry and uses the resources

Context

configure system thresholds rmon event number owner string

Tree

owner

String Length

1 to 80

Default

TiMOS CLI

Introduced

16.0.R1

Platforms

All

time

Synopsis

Enter the time context

Context

configure system time

Tree

time

Introduced

16.0.R1

Platforms

All

dst-zone [summer-time-zone] string

Synopsis

Enter the dst-zone list instance

Context

configure system time dst-zone string

Tree

dst-zone

Max. Elements

1

Introduced

16.0.R1

Platforms

All

[summer-time-zone] string

Synopsis

Name of a summer time zone

Context

configure system time dst-zone string

String Length

1 to 5

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

end

Synopsis

Enter the end context

Context

configure system time dst-zone string end

Tree

end

Introduced

16.0.R1

Platforms

All

day keyword

Synopsis

Day of the week when the daylight savings time setting ends

Context

configure system time dst-zone string end day keyword

Tree

day

Default

sunday

Options

sunday, monday, tuesday, wednesday, thursday, friday, saturday

Introduced

16.0.R1

Platforms

All

hours-minutes string

Synopsis

Hour and number of minutes after which the daylight savings time ends

Context

configure system time dst-zone string end hours-minutes string

Tree

hours-minutes

String Length

5

Default

00:00

Introduced

16.0.R1

Platforms

All

month keyword

Synopsis

Month of the week when the daylight savings time setting ends

Context

configure system time dst-zone string end month keyword

Tree

month

Default

january

Options

january, february, march, april, may, june, july, august, september, october, november, december

Introduced

16.0.R1

Platforms

All

week keyword

Synopsis

Week of the month when the daylight savings time setting ends

Context

configure system time dst-zone string end week keyword

Tree

week

Default

first

Options

first, second, third, fourth, last

Introduced

16.0.R1

Platforms

All

offset number

Synopsis

Offset for summer time setting

Context

configure system time dst-zone string offset number

Tree

offset

Range

0 to 60

Default

60

Units

minutes

Introduced

16.0.R1

Platforms

All

start

Synopsis

Enter the start context

Context

configure system time dst-zone string start

Tree

start

Introduced

16.0.R1

Platforms

All

day keyword

Synopsis

Day of the week when the daylight savings time setting starts

Context

configure system time dst-zone string start day keyword

Tree

day

Default

sunday

Options

sunday, monday, tuesday, wednesday, thursday, friday, saturday

Introduced

16.0.R1

Platforms

All

hours-minutes string

Synopsis

Hour and number of minutes after which the daylight savings time starts

Context

configure system time dst-zone string start hours-minutes string

Tree

hours-minutes

String Length

5

Default

00:00

Introduced

16.0.R1

Platforms

All

month keyword

Synopsis

Month of the week when the daylight savings time setting starts

Context

configure system time dst-zone string start month keyword

Tree

month

Default

january

Options

january, february, march, april, may, june, july, august, september, october, november, december

Introduced

16.0.R1

Platforms

All

week keyword

Synopsis

Week of the month when the daylight savings time setting starts

Context

configure system time dst-zone string start week keyword

Tree

week

Default

first

Options

first, second, third, fourth, last

Introduced

16.0.R1

Platforms

All

ntp

Synopsis

Enable the ntp context

Context

configure system time ntp

Tree

ntp

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of NTP execution

Context

configure system time ntp admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

authentication-check boolean

Synopsis

Reject NTP PDUs that do not match the authentication key-id, type, or key requirements

Context

configure system time ntp authentication-check boolean

Tree

authentication-check

Default

true

Introduced

16.0.R1

Platforms

All

authentication-key [key-id] number

Synopsis

Enter the authentication-key list instance

Context

configure system time ntp authentication-key number

Tree

authentication-key

Introduced

16.0.R1

Platforms

All

[key-id] number

Synopsis

Index of the NTP authentication key table that uniquely identifies an authentication key and type

Context

configure system time ntp authentication-key number

Range

1 to 255

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

key string

Synopsis

Key to authenticate NTP packets

Context

configure system time ntp authentication-key number key string

Tree

key

String Length

1 to 71

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

type keyword

Synopsis

Type of authentication method to authenticate NTP packet

Context

configure system time ntp authentication-key number type keyword

Tree

type

Options

des, message-digest

Notes

This element is mandatory.

Introduced

16.0.R1

Platforms

All

broadcast [router-instance] reference interface-name string

Synopsis

Enter the broadcast list instance

Context

configure system time ntp broadcast reference interface-name string

Tree

broadcast

Introduced

16.0.R1

Platforms

All

[router-instance] reference

Synopsis

Router name

Context

configure system time ntp broadcast reference interface-name string

Reference

configure router string

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

interface-name string

Synopsis

Interface to transmit or receive NTP broadcast packets

Context

configure system time ntp broadcast reference interface-name string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

key-id reference

Synopsis

Specifies the key-id of the authentication key and its authentication type used by this node to receive and transmit NTP packets to and from an NTP node.

Context

configure system time ntp broadcast reference interface-name string key-id reference

Tree

key-id

Reference

configure system time ntp authentication-key number

Introduced

16.0.R1

Platforms

All

ttl number

Synopsis

TTL value of messages transmitted by this broadcast address

Context

configure system time ntp broadcast reference interface-name string ttl number

Tree

ttl

Range

1 to 255

Default

127

Introduced

16.0.R1

Platforms

All

version number

Synopsis

NTP version number generated or accepted by this node in NTP packets

Context

configure system time ntp broadcast reference interface-name string version number

Tree

version

Range

2 to 4

Default

4

Introduced

16.0.R1

Platforms

All

broadcast-client [router-instance] string interface-name string

Synopsis

Enter the broadcast-client list instance

Context

configure system time ntp broadcast-client string interface-name string

Tree

broadcast-client

Introduced

16.0.R1

Platforms

All

[router-instance] string

Synopsis

Router name or VPRN service name

Context

configure system time ntp broadcast-client string interface-name string

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

interface-name string

Synopsis

Interface to transmit or receive NTP broadcast packets

Context

configure system time ntp broadcast-client string interface-name string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

authenticate boolean

Synopsis

NTP PDUs authentication required when acting as a broadcast client

Context

configure system time ntp broadcast-client string interface-name string authenticate boolean

Tree

authenticate

Default

false

Introduced

16.0.R1

Platforms

All

multicast

Synopsis

Enable the multicast context

Context

configure system time ntp multicast

Tree

multicast

Introduced

16.0.R1

Platforms

All

key-id reference

Synopsis

Specifies the key-id of the authentication key and its authentication type used by this node to receive and transmit NTP packets to and from an NTP node.

Context

configure system time ntp multicast key-id reference

Tree

key-id

Reference

configure system time ntp authentication-key number

Introduced

16.0.R1

Platforms

All

version number

Synopsis

NTP version number generated by the node

Context

configure system time ntp multicast version number

Tree

version

Description

This command specifies the NTP version number that is generated by the node. This command does not need to be configured when in client mode, in which case all three versions are accepted.

Range

2 to 4

Default

4

Introduced

16.0.R1

Platforms

All

multicast-client

Synopsis

Enable the multicast-client context

Context

configure system time ntp multicast-client

Tree

multicast-client

Introduced

16.0.R1

Platforms

All

authenticate boolean

Synopsis

Authentication of NTP PDUs required when acting as a client

Context

configure system time ntp multicast-client authenticate boolean

Tree

authenticate

Default

false

Introduced

16.0.R1

Platforms

All

ntp-server

Synopsis

Enable the ntp-server context

Context

configure system time ntp ntp-server

Tree

ntp-server

Introduced

16.0.R1

Platforms

All

authenticate boolean

Synopsis

Authentication of NTP PDUs when acting as a server

Context

configure system time ntp ntp-server authenticate boolean

Tree

authenticate

Default

false

Introduced

16.0.R1

Platforms

All

peer [ip-address] (ipv4-address-no-zone | ipv6-address-no-zone) router-instance string

Synopsis

Enter the peer list instance

Context

configure system time ntp peer (ipv4-address-no-zone | ipv6-address-no-zone) router-instance string

Tree

peer

Introduced

16.0.R1

Platforms

All

[ip-address] (ipv4-address-no-zone | ipv6-address-no-zone)

Synopsis

IP address of the peer for a peering relationship

Context

configure system time ntp peer (ipv4-address-no-zone | ipv6-address-no-zone) router-instance string

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

router-instance string

Synopsis

Router name or VPRN service name

Context

configure system time ntp peer (ipv4-address-no-zone | ipv6-address-no-zone) router-instance string

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

key-id reference

Synopsis

Specifies the key-id of the authentication key and its authentication type used by this node to receive and transmit NTP packets to and from an NTP node.

Context

configure system time ntp peer (ipv4-address-no-zone | ipv6-address-no-zone) router-instance string key-id reference

Tree

key-id

Reference

configure system time ntp authentication-key number

Introduced

16.0.R1

Platforms

All

prefer boolean

Synopsis

NTP server from which is preferred to receive time

Context

configure system time ntp peer (ipv4-address-no-zone | ipv6-address-no-zone) router-instance string prefer boolean

Tree

prefer

Default

false

Introduced

16.0.R1

Platforms

All

version number

Synopsis

NTP version number generated by the node

Context

configure system time ntp peer (ipv4-address-no-zone | ipv6-address-no-zone) router-instance string version number

Tree

version

Description

This command specifies the NTP version number that is generated by the node. This command does not need to be configured when in client mode, in which case all three versions are accepted.

Range

2 to 4

Default

4

Introduced

16.0.R1

Platforms

All

server [ip-address] (ipv4-address-no-zone | ipv6-address-no-zone | keyword) router-instance string

Synopsis

Enter the server list instance

Context

configure system time ntp server (ipv4-address-no-zone | ipv6-address-no-zone | keyword) router-instance string

Tree

server

Introduced

16.0.R1

Platforms

All

[ip-address] (ipv4-address-no-zone | ipv6-address-no-zone | keyword)

Synopsis

IP address of an external NTP server

Context

configure system time ntp server (ipv4-address-no-zone | ipv6-address-no-zone | keyword) router-instance string

Options

ptp

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

router-instance string

Synopsis

Router name or VPRN service name

Context

configure system time ntp server (ipv4-address-no-zone | ipv6-address-no-zone | keyword) router-instance string

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

key-id reference

Synopsis

Specifies the key-id of the authentication key and its authentication type used by this node to receive and transmit NTP packets to and from an NTP node.

Context

configure system time ntp server (ipv4-address-no-zone | ipv6-address-no-zone | keyword) router-instance string key-id reference

Tree

key-id

Reference

configure system time ntp authentication-key number

Introduced

16.0.R1

Platforms

All

prefer boolean

Synopsis

NTP server from which is preferred to receive time

Context

configure system time ntp server (ipv4-address-no-zone | ipv6-address-no-zone | keyword) router-instance string prefer boolean

Tree

prefer

Default

false

Introduced

16.0.R1

Platforms

All

version number

Synopsis

NTP version number generated by the node

Context

configure system time ntp server (ipv4-address-no-zone | ipv6-address-no-zone | keyword) router-instance string version number

Tree

version

Description

This command specifies the NTP version number that is generated by the node. This command does not need to be configured when in client mode, in which case all three versions are accepted.

Range

2 to 4

Default

4

Introduced

16.0.R1

Platforms

All

prefer-local-time boolean

Synopsis

Use local time over UTC time in the system

Context

configure system time prefer-local-time boolean

Tree

prefer-local-time

Description

When configured to true, the system uses local time. This preference is applied to objects such as log file names, created and completed times reported in log files, NETCONF and gRPC date-and-time leafs, and rollback times displayed in show command outputs.

When configured to false, the system uses UTC time.

Note: The timezone used for show command outputs during a CLI session can be controlled using the environment time-display command.

Note: The format used for the date-time strings may change, depending on the command setting. For example, when this command is set to true, all date-time strings include a suffix of three to five characters that indicates the timezone used.

Note: The time format for timestamps on log events is controlled on a per-log basis, using the configure log log-id time-format command.

Default

false

Introduced

16.0.R1

Platforms

All

sntp

Synopsis

Enter the sntp context

Context

configure system time sntp

Tree

sntp

Introduced

16.0.R1

Platforms

All

admin-state keyword

Synopsis

Administrative state of SNTP

Context

configure system time sntp admin-state keyword

Tree

admin-state

Default

disable

Options

enable, disable

Introduced

16.0.R1

Platforms

All

server [ip-address] (ipv4-address-no-zone | ipv6-address-no-zone)

Synopsis

Enter the server list instance

Context

configure system time sntp server (ipv4-address-no-zone | ipv6-address-no-zone)

Tree

server

Introduced

16.0.R1

Platforms

All

[ip-address] (ipv4-address-no-zone | ipv6-address-no-zone)

Synopsis

IP address of the SNTP server

Context

configure system time sntp server (ipv4-address-no-zone | ipv6-address-no-zone)

Notes

This element is part of a list key.

Introduced

16.0.R1

Platforms

All

interval number

Synopsis

Frequency of querying the server

Context

configure system time sntp server (ipv4-address-no-zone | ipv6-address-no-zone) interval number

Tree

interval

Range

64 to 1024

Default

64

Units

seconds

Introduced

16.0.R1

Platforms

All

prefer boolean

Synopsis

Preference value for this SNTP server

Context

configure system time sntp server (ipv4-address-no-zone | ipv6-address-no-zone) prefer boolean

Tree

prefer

Default

false

Introduced

16.0.R1

Platforms

All

version number

Synopsis

SNTP version supported by this server

Context

configure system time sntp server (ipv4-address-no-zone | ipv6-address-no-zone) version number

Tree

version

Range

1 to 3

Default

3

Introduced

16.0.R1

Platforms

All

sntp-state keyword

Synopsis

Mode for Simple Network Time Protocol (SNTP)

Context

configure system time sntp sntp-state keyword

Tree

sntp-state

Default

unicast

Options

unicast, broadcast

Introduced

16.0.R1

Platforms

All

zone

Synopsis

Enter the zone context

Context

configure system time zone

Tree

zone

Introduced

16.0.R1

Platforms

All

non-standard

Synopsis

Enter the non-standard context

Context

configure system time zone non-standard

Tree

non-standard

Notes

The following elements are part of a choice: non-standard or standard.

Introduced

16.0.R1

Platforms

All

name string

Synopsis

Non-standard time zone name

Context

configure system time zone non-standard name string

Tree

name

String Length

1 to 5

Introduced

16.0.R1

Platforms

All

offset string

Synopsis

Number of hours and minutes by which the time zone offsets from UTC

Context

configure system time zone non-standard offset string

Tree

offset

String Length

5 to 6

Introduced

16.0.R1

Platforms

All

standard

Synopsis

Enter the standard context

Context

configure system time zone standard

Tree

standard

Notes

The following elements are part of a choice: non-standard or standard.

Introduced

16.0.R1

Platforms

All

name keyword

Synopsis

Standard time zone name

Context

configure system time zone standard name keyword

Tree

name

Default

utc

Options

hst, akst, pst, mst, cst, est, ast, nst, utc, gmt, wet, cet, eet, msk, msd, awst, acst, aest, nzst

Introduced

16.0.R1

Platforms

All

transmission-profile [name] string

Synopsis

Enter the transmission-profile list instance

Context

configure system transmission-profile string

Tree

transmission-profile

Introduced

16.0.R4

Platforms

All

[name] string

Synopsis

File transmission profile name

Context

configure system transmission-profile string

String Length

1 to 32

Notes

This element is part of a list key.

Introduced

16.0.R4

Platforms

All

ipv4-source-address string

Synopsis

IPv4 source address of the file transmission connections

Context

configure system transmission-profile string ipv4-source-address string

Tree

ipv4-source-address

Introduced

16.0.R4

Platforms

All

ipv6-source-address string

Synopsis

IPv6 source address of the file transmission connections

Context

configure system transmission-profile string ipv6-source-address string

Tree

ipv6-source-address

Introduced

16.0.R4

Platforms

All

redirection number

Synopsis

Maximum level of redirection

Context

configure system transmission-profile string redirection number

Tree

redirection

Range

1 to 8

Introduced

16.0.R4

Platforms

All

retry number

Synopsis

Number of attempts to reconnecting to the server

Context

configure system transmission-profile string retry number

Tree

retry

Range

1 to 256

Introduced

16.0.R4

Platforms

All

router-instance string

Synopsis

Router instance that hosts the file transmission connection

Context

configure system transmission-profile string router-instance string

Tree

router-instance

String Length

1 to 64

Default

Base

Introduced

16.0.R4

Platforms

All

timeout number

Synopsis

Timeout for a response from the server

Context

configure system transmission-profile string timeout number

Tree

timeout

Range

1 to 3600

Default

60

Units

seconds

Introduced

16.0.R4

Platforms

All