system commands
configure
— system
— alarms
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— max-cleared number
— allow-boot-license-violations boolean
— apply-groups reference
— apply-groups-exclude reference
— boot-bad-exec url
— boot-good-exec url
— clli-code clli-description
— congestion-management boolean
— contact description
— coordinates description
— cron
— apply-groups reference
— apply-groups-exclude reference
— schedule named-item owner named-item
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— count number
— day-of-month number
— description description
— end-time
— date-and-time date-and-time
— day keyword
— time hours-minutes-twenty-four
— hour number
— interval number
— minute number
— month (keyword | number)
— script-policy
— name named-item
— owner named-item
— type keyword
— weekday (keyword | number)
— dhcp6
— adv-noaddrs-global keyword
— apply-groups reference
— apply-groups-exclude reference
— dns
— address-pref keyword
— apply-groups reference
— apply-groups-exclude reference
— dnssec
— ad-validation keyword
— grpc
— admin-state keyword
— allow-unsecure-connection
— apply-groups reference
— apply-groups-exclude reference
— delay-on-boot number
— gnmi
— admin-state keyword
— auto-config-save boolean
— proto-version keyword
— gnoi
— cert-mgmt
— admin-state keyword
— file
— admin-state keyword
— system
— admin-state keyword
— listening-port number
— max-msg-size number
— md-cli
— admin-state keyword
— tcp-keepalive
— admin-state keyword
— idle-time number
— interval number
— retries number
— tls-server-profile reference
— grpc-tunnel
— apply-groups reference
— apply-groups-exclude reference
— delay-on-boot number
— destination-group named-item
— allow-unsecure-connection
— apply-groups reference
— apply-groups-exclude reference
— description description
— destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number
— apply-groups reference
— apply-groups-exclude reference
— local-source-address (ipv4-address-no-zone | ipv6-address-no-zone)
— originated-qos-marking keyword
— router-instance string
— tcp-keepalive
— admin-state keyword
— idle-time number
— interval number
— retries number
— tls-client-profile reference
— tunnel named-item
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— description description
— destination-group reference
— handler named-item
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— port number
— target-type
— custom-type string
— grpc-server
— ssh-server
— target-name
— custom-string named-item-64
— node-name
— user-agent
— icmp-vse boolean
— ip
— apply-groups reference
— apply-groups-exclude reference
— buffer-unresolved-packets boolean
— enforce-unique-if-index boolean
— forward-6in4 boolean
— forward-ip-over-gre boolean
— ipv6-eh keyword
— lacp
— apply-groups reference
— apply-groups-exclude reference
— system-priority number
— lldp
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— message-fast-tx number
— message-fast-tx-init number
— notification-interval number
— reinit-delay number
— tx-credit-max number
— tx-hold-multiplier number
— tx-interval number
— load-balancing
— apply-groups reference
— apply-groups-exclude reference
— l4-load-balancing boolean
— lsr-load-balancing keyword
— service-id-lag-hashing boolean
— location description
— login-control
— apply-groups reference
— apply-groups-exclude reference
— exponential-backoff boolean
— ftp
— inbound-max-sessions number
— idle-timeout (keyword | number)
— login-banner boolean
— login-scripts
— global-script string-not-all-spaces
— per-user-script
— file-name filename
— user-directory string-not-all-spaces
— motd
— text string-not-all-spaces
— url string-not-all-spaces
— pre-login-message
— message string-not-all-spaces
— name boolean
— ssh
— graceful-shutdown boolean
— inbound-max-sessions number
— max-channels-per-connection number
— outbound-max-sessions number
— ttl-security number
— telnet
— graceful-shutdown boolean
— inbound-max-sessions number
— outbound-max-sessions number
— ttl-security number
— management-interface
— apply-groups reference
— apply-groups-exclude reference
— cli
— apply-groups reference
— apply-groups-exclude reference
— classic-cli
— allow-immediate boolean
— rollback
— apply-groups reference
— apply-groups-exclude reference
— local-checkpoints number
— location url
— remote-checkpoints number
— rescue
— location url
— cli-engine keyword
— md-cli
— apply-groups reference
— apply-groups-exclude reference
— auto-config-save boolean
— environment
— command-alias
— alias string
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— cli-command string
— description string-not-all-spaces
— mount-point (keyword | string)
— command-completion
— enter boolean
— space boolean
— tab boolean
— commit-options
— comment boolean
— confirm boolean
— console
— length number
— width number
— history
— recall boolean
— size number
— info-output
— always-display
— admin-state boolean
— message-severity-level
— cli keyword
— more boolean
— progress-indicator
— admin-state keyword
— delay number
— type keyword
— prompt
— context boolean
— newline boolean
— timestamp boolean
— uncommitted-changes-indicator boolean
— python
— memory-reservation number
— minimum-available-memory number
— timeout number
— time-display keyword
— time-format keyword
— commit-history number
— configuration-mode keyword
— configuration-save
— apply-groups reference
— apply-groups-exclude reference
— configuration-backups number
— incremental-saves boolean
— netconf
— apply-groups reference
— apply-groups-exclude reference
— auto-config-save boolean
— call-home
— device-labels
— advertise-operating-system boolean
— advertise-software-version boolean
— advertise-system-name boolean
— apply-groups reference
— apply-groups-exclude reference
— device-label string
— netconf-client named-item
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— connection-type keyword
— delay-on-boot number
— description description
— remote-address (ipv4-address-no-zone | ipv6-address-no-zone)
— remote-port number
— router-instance string
— transport keyword
— capabilities
— candidate boolean
— listen
— admin-state keyword
— delay-on-boot number
— port number
— operations
— apply-groups reference
— apply-groups-exclude reference
— global-timeouts
— asynchronous-execution (number | keyword)
— asynchronous-retention (number | keyword)
— synchronous-execution (number | keyword)
— remote-management
— admin-state keyword
— allow-unsecure-connection
— apply-groups reference
— apply-groups-exclude reference
— client-tls-profile reference
— connection-timeout number
— delay-on-boot number
— device-label named-item-64
— device-name named-item-64
— hello-interval number
— manager named-item-64
— admin-state keyword
— allow-unsecure-connection
— apply-groups reference
— apply-groups-exclude reference
— client-tls-profile reference
— connection-timeout number
— description description
— device-label named-item-64
— device-name named-item-64
— manager-address (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name)
— manager-port number
— router-instance string
— source-address (ipv4-address-no-zone | ipv6-address-no-zone)
— source-port (number | keyword)
— router-instance string
— source-address (ipv4-address-no-zone | ipv6-address-no-zone)
— source-port (number | keyword)
— schema-path url
— snmp
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— engine-id engine-id-as-string
— general-port number
— max-bulk-duration number
— packet-size number
— streaming
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— transport keyword
— yang-modules
— apply-groups reference
— apply-groups-exclude reference
— nmda
— nmda-support boolean
— nokia-combined-modules boolean
— nokia-submodules boolean
— name named-item-64
— network-element-discovery
— apply-groups reference
— apply-groups-exclude reference
— generate-traps boolean
— profile named-item
— apply-groups reference
— apply-groups-exclude reference
— neid string
— neip
— apply-groups reference
— apply-groups-exclude reference
— auto-generate
— ipv4
— vendor-id-value number
— ipv6
— vendor-id-value number
— ipv4 ipv4-unicast-address
— ipv6 ipv6-address
— platform-type named-item-255
— system-mac mac-unicast-address-no-zero
— vendor-id named-item-255
— ospf-dynamic-hostnames boolean
— persistence
— ancp
— apply-groups reference
— apply-groups-exclude reference
— description description
— location keyword
— apply-groups reference
— apply-groups-exclude reference
— dhcp-server
— apply-groups reference
— apply-groups-exclude reference
— description description
— location keyword
— nat-port-forwarding
— apply-groups reference
— apply-groups-exclude reference
— description description
— location keyword
— script-control
— apply-groups reference
— apply-groups-exclude reference
— script named-item owner named-item
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— description description
— location string-not-all-spaces
— script-policy named-item owner named-item
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— expire-time (number | keyword)
— lifetime (number | keyword)
— lock-override boolean
— max-completed number
— python-lifetime number
— python-script
— results string-not-all-spaces
— script
— name named-item
— owner named-item
— security
— aaa
— apply-groups reference
— apply-groups-exclude reference
— cli-session-group named-item
— apply-groups reference
— apply-groups-exclude reference
— combined-max-sessions number
— description description
— ssh-max-sessions number
— telnet-max-sessions number
— health-check (number | keyword)
— local-profiles
— apply-groups reference
— apply-groups-exclude reference
— profile named-item
— apply-groups reference
— apply-groups-exclude reference
— cli-session-group reference
— combined-max-sessions number
— default-action keyword
— entry number
— action keyword
— apply-groups reference
— apply-groups-exclude reference
— description description
— match display-string
— grpc
— rpc-authorization
— gnmi-capabilities keyword
— gnmi-get keyword
— gnmi-set keyword
— gnmi-subscribe keyword
— gnoi-cert-mgmt-cangenerate keyword
— gnoi-cert-mgmt-getcert keyword
— gnoi-cert-mgmt-install keyword
— gnoi-cert-mgmt-revoke keyword
— gnoi-cert-mgmt-rotate keyword
— gnoi-file-get keyword
— gnoi-file-put keyword
— gnoi-file-remove keyword
— gnoi-file-stat keyword
— gnoi-file-transfertoremote keyword
— gnoi-system-cancelreboot keyword
— gnoi-system-ping keyword
— gnoi-system-reboot keyword
— gnoi-system-rebootstatus keyword
— gnoi-system-setpackage keyword
— gnoi-system-switchcontrolprocessor keyword
— gnoi-system-time keyword
— gnoi-system-traceroute keyword
— md-cli-session keyword
— netconf
— base-op-authorization
— action boolean
— cancel-commit boolean
— close-session boolean
— commit boolean
— copy-config boolean
— create-subscription boolean
— delete-config boolean
— discard-changes boolean
— edit-config boolean
— get boolean
— get-config boolean
— get-data boolean
— get-schema boolean
— kill-session boolean
— lock boolean
— validate boolean
— ssh-max-sessions number
— telnet-max-sessions number
— management-interface
— apply-groups reference
— apply-groups-exclude reference
— md-cli
— command-accounting-during-load boolean
— output-authorization
— md-interfaces boolean
— telemetry-data boolean
— telemetry-default-user reference
— remote-servers
— apply-groups reference
— apply-groups-exclude reference
— ldap
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— public-key-authentication boolean
— route-preference keyword
— server number
— address (ipv4-address-no-zone | ipv6-address-no-zone)
— apply-groups reference
— apply-groups-exclude reference
— port number
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— bind-authentication
— password encrypted-leaf
— root-dn string-not-all-spaces
— search
— base-dn string-not-all-spaces
— server-name named-item
— tls-profile reference
— server-retry number
— server-timeout number
— use-default-template boolean
— radius
— access-algorithm keyword
— accounting boolean
— accounting-port number
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— authorization boolean
— interactive-authentication boolean
— port number
— route-preference keyword
— server number
— address (ipv4-address-no-zone | ipv6-address-no-zone)
— apply-groups reference
— apply-groups-exclude reference
— authenticator keyword
— secret encrypted-leaf
— tls-client-profile reference
— server-retry number
— server-timeout number
— use-default-template boolean
— tacplus
— accounting
— record-type keyword
— admin-control
— tacplus-map-to-priv-lvl number
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— authorization
— request-format
— access-operation-cmd keyword
— use-priv-lvl boolean
— ignore-unknown-mandatory-vsas boolean
— interactive-authentication boolean
— priv-lvl-map
— apply-groups reference
— apply-groups-exclude reference
— priv-lvl number
— apply-groups reference
— apply-groups-exclude reference
— user-profile-name reference
— route-preference keyword
— server number
— address (ipv4-address-no-zone | ipv6-address-no-zone)
— apply-groups reference
— apply-groups-exclude reference
— port number
— secret encrypted-leaf
— server-retry-timeout (number | keyword)
— server-timeout number
— service-request
— nokia-grpc-rpc-authorization boolean
— nokia-netconf-base-op-authorization boolean
— nokia-user boolean
— nokia-user-profile boolean
— use-default-template boolean
— vprn-server
— apply-groups reference
— apply-groups-exclude reference
— inband reference
— outband reference
— vprn reference
— user-template keyword
— access
— bluetooth boolean
— console boolean
— console-port-cli boolean
— ftp boolean
— grpc boolean
— netconf boolean
— scp-sftp boolean
— ssh-cli boolean
— telnet-cli boolean
— apply-groups reference
— apply-groups-exclude reference
— console
— login-exec string-not-all-spaces
— home-directory cflash-without-slot-url
— profile named-item
— restricted-to-home boolean
— save-when-restricted boolean
— apply-groups reference
— apply-groups-exclude reference
— cli-script
— apply-groups reference
— apply-groups-exclude reference
— authorization
— cron
— cli-user reference
— event-handler
— cli-user reference
— dist-cpu-protection
— apply-groups reference
— apply-groups-exclude reference
— policy named-item
— apply-groups reference
— apply-groups-exclude reference
— description description
— local-monitoring-policer named-item
— apply-groups reference
— apply-groups-exclude reference
— description description
— exceed-action keyword
— log-events keyword
— rate
— kbps
— limit (keyword | number)
— mbs number
— packets
— initial-delay number
— limit (keyword | number)
— within number
— protocol keyword
— apply-groups reference
— apply-groups-exclude reference
— dynamic-parameters
— detection-time number
— exceed-action
— action keyword
— hold-down (keyword | number)
— log-events keyword
— rate
— kbps
— limit (keyword | number)
— mbs number
— packets
— initial-delay number
— limit (keyword | number)
— within number
— enforcement
— dynamic
— mon-policer-name reference
— dynamic-local-mon-bypass
— static
— policer-name reference
— static-policer named-item
— apply-groups reference
— apply-groups-exclude reference
— description description
— detection-time number
— exceed-action
— action keyword
— hold-down (keyword | number)
— log-events keyword
— rate
— kbps
— limit (keyword | number)
— mbs number
— packets
— initial-delay number
— limit (keyword | number)
— within number
— type keyword
— ftp-server boolean
— hash-control
— apply-groups reference
— apply-groups-exclude reference
— management-interface
— classic-cli
— read-algorithm keyword
— write-algorithm keyword
— grpc
— hash-algorithm keyword
— md-cli
— hash-algorithm keyword
— netconf
— hash-algorithm keyword
— keychains
— keychain named-item
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— bidirectional
— entry number
— admin-state keyword
— algorithm keyword
— apply-groups reference
— apply-groups-exclude reference
— authentication-key encrypted-leaf
— begin-time date-and-time
— option keyword
— tolerance (number | keyword)
— description description
— receive
— entry number
— admin-state keyword
— algorithm keyword
— apply-groups reference
— apply-groups-exclude reference
— authentication-key encrypted-leaf
— begin-time date-and-time
— end-time date-and-time
— tolerance (number | keyword)
— send
— entry number
— admin-state keyword
— algorithm keyword
— apply-groups reference
— apply-groups-exclude reference
— authentication-key encrypted-leaf
— begin-time date-and-time
— tcp-option-number
— receive keyword
— send keyword
— management
— allow-ftp boolean
— allow-grpc boolean
— allow-netconf boolean
— allow-ssh boolean
— allow-telnet boolean
— allow-telnet6 boolean
— apply-groups reference
— apply-groups-exclude reference
— management-access-filter
— apply-groups reference
— apply-groups-exclude reference
— ip-filter
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— default-action keyword
— entry number
— action keyword
— apply-groups reference
— apply-groups-exclude reference
— description description
— log-events boolean
— match
— dst-port
— mask number
— port number
— mgmt-port
— cpm
— lag lag-interface
— port-id port
— protocol (number | keyword)
— router-instance string
— src-ip
— address (ipv4-prefix | ipv4-address)
— ip-prefix-list reference
— mask ipv4-address
— src-port
— mask number
— port number
— ipv6-filter
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— default-action keyword
— entry number
— action keyword
— apply-groups reference
— apply-groups-exclude reference
— description description
— log-events boolean
— match
— dst-port
— mask number
— port number
— flow-label number
— mgmt-port
— cpm
— lag lag-interface
— port-id port
— next-header (number | keyword)
— router-instance string
— src-ip
— address (ipv6-prefix | ipv6-address)
— ipv6-prefix-list reference
— mask ipv6-address
— src-port
— mask number
— port number
— mac-filter
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— default-action keyword
— entry number
— action keyword
— apply-groups reference
— apply-groups-exclude reference
— description description
— log-events boolean
— match
— dot1p
— mask number
— priority number
— dst-mac
— address mac-address
— mask mac-address
— etype etype-value
— frame-type keyword
— llc-dsap
— dsap number
— mask number
— llc-ssap
— mask number
— ssap number
— service service-name
— snap-oui keyword
— snap-pid number
— src-mac
— address mac-address
— mask mac-address
— pki
— apply-groups reference
— apply-groups-exclude reference
— ca-profile named-item
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— auto-crl-update
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— crl-urls
— url-entry number
— apply-groups reference
— apply-groups-exclude reference
— transmission-profile reference
— url http-url-path-loose
— periodic-update-interval number
— pre-update-time number
— retry-interval number
— schedule-type keyword
— cert-file pki-file-name
— cmpv2
— accept-unprotected-message
— error-message boolean
— pkiconf-message boolean
— always-set-sender-for-ir boolean
— http
— response-timeout number
— version keyword
— key-list
— key display-string
— apply-groups reference
— apply-groups-exclude reference
— password encrypted-leaf
— recipient-subject string
— response-signing-cert pki-file-name
— response-signing-use-extracert
— same-recipient-nonce-for-poll-request boolean
— signing-cert-subject string
— url
— service-name service-name
— transmission-profile reference
— url-string http-optional-url-loose
— use-ca-subject
— crl-file pki-file-name
— description description
— ocsp
— responder-url http-optional-url-loose
— service-name service-name
— transmission-profile reference
— revocation-check keyword
— certificate-auto-update pki-file-name
— apply-groups reference
— apply-groups-exclude reference
— key-file-name pki-file-name
— profile reference
— certificate-display-format keyword
— certificate-expiration-warning
— hours number
— repeat-hours number
— certificate-update-profile named-item
— after-issue number
— apply-groups reference
— apply-groups-exclude reference
— before-expiry number
— cmpv2
— ca-profile reference
— dsa
— key-size number
— ecdsa
— curve keyword
— est
— est-profile reference
— hash-algorithm keyword
— retry-interval number
— rsa
— key-size number
— same-as-existing-key
— common-name-list named-item
— apply-groups reference
— apply-groups-exclude reference
— common-name number
— apply-groups reference
— apply-groups-exclude reference
— cn-type keyword
— cn-value regular-expression-not-all-spaces
— crl-expiration-warning
— hours number
— repeat-hours number
— dynamic-ca boolean
— est-profile named-item
— apply-groups reference
— apply-groups-exclude reference
— check-id-kp-cmcra-only boolean
— client-tls-profile named-item
— http-authentication
— password encrypted-leaf
— username string
— server
— fqdn fully-qualified-domain-name
— ipv4 ipv4-unicast-address
— ipv6 (ipv4-address-no-zone | ipv6-address-no-zone)
— port number
— transmission-profile named-item
— imported-format keyword
— maximum-cert-chain-depth number
— python-script
— apply-groups reference
— apply-groups-exclude reference
— authorization
— cron
— cli-user reference
— event-handler
— cli-user reference
— subscriber-mgmt
— cli-user reference
— snmp
— access named-item context named-item-or-empty security-model keyword security-level keyword
— apply-groups reference
— apply-groups-exclude reference
— notify named-item
— prefix-match keyword
— read named-item
— write named-item
— apply-groups reference
— apply-groups-exclude reference
— attempts
— apply-groups reference
— apply-groups-exclude reference
— count number
— lockout number
— time number
— community encrypted-leaf
— access-permissions keyword
— apply-groups reference
— apply-groups-exclude reference
— source-access-list reference
— version keyword
— source-access-list string-not-all-spaces
— apply-groups reference
— apply-groups-exclude reference
— source-host named-item
— address (ipv4-address-no-zone | ipv6-address-no-zone)
— apply-groups reference
— apply-groups-exclude reference
— usm-community encrypted-leaf
— apply-groups reference
— apply-groups-exclude reference
— group named-item
— source-access-list reference
— view named-item subtree string
— apply-groups reference
— apply-groups-exclude reference
— mask string
— type keyword
— source-address
— ipv4 keyword
— address ipv4-address
— apply-groups reference
— apply-groups-exclude reference
— interface-name interface-name
— ipv6 keyword
— address ipv6-address
— apply-groups reference
— apply-groups-exclude reference
— ssh
— apply-groups reference
— apply-groups-exclude reference
— authentication-method
— client
— public-key-only boolean
— server
— public-key-only boolean
— client-cipher-list-v2
— apply-groups reference
— apply-groups-exclude reference
— cipher number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— client-host-key-list-v2
— host-key number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— client-kex-list-v2
— kex number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— client-mac-list-v2
— mac number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— key-re-exchange
— client
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— mbytes (number | keyword)
— minutes (number | keyword)
— server
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— mbytes (number | keyword)
— minutes (number | keyword)
— listening-port number
— permit-empty-passwords boolean
— preserve-key boolean
— server-admin-state keyword
— server-cipher-list-v2
— apply-groups reference
— apply-groups-exclude reference
— cipher number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— server-host-key-list-v2
— host-key number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— server-kex-list-v2
— kex number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— server-mac-list-v2
— mac number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— system-passwords
— admin-password hashed-leaf
— apply-groups reference
— apply-groups-exclude reference
— tech-support
— apply-groups reference
— apply-groups-exclude reference
— ts-location (ts-sat-url | cflash-url | string)
— telnet
— apply-groups reference
— apply-groups-exclude reference
— listening-port number
— telnet-server boolean
— telnet6-server boolean
— tls
— apply-groups reference
— apply-groups-exclude reference
— cert-profile named-item
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— entry number
— apply-groups reference
— apply-groups-exclude reference
— certificate-file string-not-all-spaces
— key-file string-not-all-spaces
— send-chain
— ca-profile reference
— client-cipher-list named-item
— apply-groups reference
— apply-groups-exclude reference
— tls12-cipher number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— tls13-cipher number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— client-group-list named-item
— apply-groups reference
— apply-groups-exclude reference
— tls13-group number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— client-signature-list named-item
— apply-groups reference
— apply-groups-exclude reference
— tls13-signature number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— client-tls-profile named-item
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— cert-profile reference
— cipher-list reference
— group-list reference
— protocol-version keyword
— signature-list reference
— status-verify
— default-result keyword
— ee-revocation
— primary keyword
— secondary keyword
— trust-anchor-profile reference
— server-cipher-list named-item
— apply-groups reference
— apply-groups-exclude reference
— tls12-cipher number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— tls13-cipher number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— server-group-list named-item
— apply-groups reference
— apply-groups-exclude reference
— tls13-group number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— server-signature-list named-item
— apply-groups reference
— apply-groups-exclude reference
— tls13-signature number
— apply-groups reference
— apply-groups-exclude reference
— name keyword
— server-tls-profile named-item
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— authenticate-client
— common-name-list reference
— trust-anchor-profile reference
— cert-profile reference
— cipher-list reference
— group-list reference
— protocol-version keyword
— signature-list reference
— status-verify
— default-result keyword
— ee-revocation
— primary keyword
— secondary keyword
— tls-re-negotiate-timer number
— trust-anchor-profile named-item
— apply-groups reference
— apply-groups-exclude reference
— trust-anchor reference
— user-params
— apply-groups reference
— apply-groups-exclude reference
— attempts
— count number
— lockout number
— time number
— authentication-order
— exit-on-reject boolean
— order keyword
— local-user
— password
— aging number
— apply-groups reference
— apply-groups-exclude reference
— complexity-rules
— allow-user-name boolean
— credits
— lowercase number
— numeric number
— special-character number
— uppercase number
— disallow-sequence-keys number
— minimum-classes number
— minimum-length number
— repeated-characters number
— required
— lowercase number
— numeric number
— special-character number
— uppercase number
— hashing keyword
— history-size number
— minimum-age number
— minimum-change number
— user named-item
— access
— bluetooth boolean
— console boolean
— console-port-cli boolean
— ftp boolean
— grpc boolean
— netconf boolean
— scp-sftp boolean
— snmp boolean
— ssh-cli boolean
— telnet-cli boolean
— apply-groups reference
— apply-groups-exclude reference
— cli-engine keyword
— console
— cannot-change-password boolean
— login-exec (sat-url | cflash-url | ftp-tftp-url | filename)
— member reference
— new-password-at-login boolean
— home-directory cflash-without-slot-url
— password hashed-leaf
— public-keys
— ecdsa
— ecdsa-key number
— apply-groups reference
— apply-groups-exclude reference
— description description
— key-value string-not-all-spaces
— rsa
— rsa-key number
— apply-groups reference
— apply-groups-exclude reference
— description description
— key-value string-not-all-spaces
— restricted-to-home boolean
— save-when-restricted boolean
— snmp
— apply-groups reference
— apply-groups-exclude reference
— authentication
— authentication-key encrypted-leaf-hex-without-prefix
— authentication-protocol keyword
— privacy
— privacy-key encrypted-leaf-hex-without-prefix
— privacy-protocol keyword
— group named-item
— ssh-authentication-method
— client
— public-key-only keyword
— server
— public-key-only keyword
— vprn-network-exceptions
— count number
— window number
— telemetry
— apply-groups reference
— apply-groups-exclude reference
— destination-group named-item
— allow-unsecure-connection
— apply-groups reference
— apply-groups-exclude reference
— description description
— destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number
— apply-groups reference
— apply-groups-exclude reference
— router-instance string
— tcp-keepalive
— admin-state keyword
— idle-time number
— interval number
— retries number
— tls-client-profile reference
— notification-bundling
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— max-msg-count number
— max-time-granularity number
— persistent-subscriptions
— delay-on-boot number
— subscription named-item
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— description description
— destination-group reference
— encoding keyword
— local-source-address (ipv4-address-no-zone | ipv6-address-no-zone)
— mode keyword
— originated-qos-marking keyword
— sample-interval number
— sensor-group reference
— sensor-groups
— sensor-group named-item
— apply-groups reference
— apply-groups-exclude reference
— description description
— path string
— thresholds
— cflash-cap-alarm-percent thresholds-cflash-url
— apply-groups reference
— apply-groups-exclude reference
— falling-threshold number
— interval number
— rising-threshold number
— rmon-event-type keyword
— startup-alarm keyword
— cflash-cap-warn-percent thresholds-cflash-url
— apply-groups reference
— apply-groups-exclude reference
— falling-threshold number
— interval number
— rising-threshold number
— rmon-event-type keyword
— startup-alarm keyword
— kb-memory-use-alarm
— apply-groups reference
— apply-groups-exclude reference
— falling-threshold number
— interval number
— rising-threshold number
— rmon-event-type keyword
— startup-alarm keyword
— kb-memory-use-warn
— apply-groups reference
— apply-groups-exclude reference
— falling-threshold number
— interval number
— rising-threshold number
— rmon-event-type keyword
— startup-alarm keyword
— rmon
— alarm number
— apply-groups reference
— apply-groups-exclude reference
— falling-event number
— falling-threshold number
— interval number
— owner string
— rising-event number
— rising-threshold number
— sample-type keyword
— startup-alarm keyword
— variable-oid string
— event number
— apply-groups reference
— apply-groups-exclude reference
— description description
— event-type keyword
— owner string
— time
— apply-groups reference
— apply-groups-exclude reference
— daylight-saving-time-zone
— apply-groups reference
— apply-groups-exclude reference
— non-standard
— end
— day keyword
— hours-minutes hours-minutes-twenty-four
— month keyword
— week keyword
— name string
— offset number
— start
— day keyword
— hours-minutes hours-minutes-twenty-four
— month keyword
— week keyword
— standard
— name keyword
— ntp
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— authentication-check boolean
— authentication-key number
— apply-groups reference
— apply-groups-exclude reference
— key encrypted-leaf
— type keyword
— authentication-keychain reference
— broadcast reference interface-name interface-name
— apply-groups reference
— apply-groups-exclude reference
— authentication-keychain reference
— key-id reference
— ttl number
— version number
— broadcast-client string interface-name interface-name
— apply-groups reference
— apply-groups-exclude reference
— authenticate boolean
— multicast
— apply-groups reference
— apply-groups-exclude reference
— authentication-keychain reference
— key-id reference
— version number
— multicast-client
— apply-groups reference
— apply-groups-exclude reference
— authenticate boolean
— ntp-server
— authenticate boolean
— peer (ipv4-address-no-zone | ipv6-address-no-zone) router-instance string
— apply-groups reference
— apply-groups-exclude reference
— authentication-keychain reference
— key-id reference
— prefer boolean
— version number
— server (ipv4-address-no-zone | ipv6-address-no-zone | keyword) router-instance string
— apply-groups reference
— apply-groups-exclude reference
— authentication-keychain reference
— key-id reference
— prefer boolean
— version number
— prefer-local-time boolean
— sntp
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
— server (ipv4-address-no-zone | ipv6-address-no-zone)
— apply-groups reference
— apply-groups-exclude reference
— interval number
— prefer boolean
— version number
— sntp-state keyword
— zone
— non-standard
— name string
— offset hours-minutes-with-range
— standard
— name keyword
— transmission-profile named-item
— apply-groups reference
— apply-groups-exclude reference
— http-version keyword
— ipv4-source-address ipv4-unicast-address
— ipv6-source-address ipv6-address
— redirection number
— retry number
— router-instance router-instance-base-management-vprn-loose
— timeout number
— usb keyword
— admin-state keyword
— apply-groups reference
— apply-groups-exclude reference
system command descriptions
system
alarms
admin-state keyword
| Synopsis | Administrative state of the system alarm | |
| Context | configure system alarms admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | enable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
max-cleared number
| Synopsis | Maximum number of cleared alarms | |
| Context | configure system alarms max-cleared number | |
| Tree | max-cleared | |
| Range | 0 to 500 | |
| Default | 500 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
allow-boot-license-violations boolean
| Synopsis | Allow boot license violations in boot-up configuration | |
| Context | configure system allow-boot-license-violations boolean | |
| Tree | allow-boot-license-violations | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
boot-bad-exec url
| Synopsis | CLI script file to execute following a failed boot-up | |
| Context | configure system boot-bad-exec url | |
| Tree | boot-bad-exec | |
Description | This command configures the name of the CLI script file to be run following the failure of a boot-up configuration. Note: This command has no effect in model-driven mode. | |
| String length | 1 to 180 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
boot-good-exec url
| Synopsis | CLI script file to execute following successful boot-up | |
| Context | configure system boot-good-exec url | |
| Tree | boot-good-exec | |
Description | This command configures a URL for a CLI script to exec following the success of a bootup configuration. Related Commands global-commands exec - This command executes the contents of a text file as if they were CLI commands entered at the console. | |
| String length | 1 to 180 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
clli-code clli-description
congestion-management boolean
| Synopsis | Enable Virtual Service Router congestion management | |
| Context | configure system congestion-management boolean | |
| Tree | congestion-management | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
contact description
coordinates description
| Synopsis | GPS coordinates for the system location | |
| Context | configure system coordinates description | |
| Tree | coordinates | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cron
schedule [schedule-name] named-item owner named-item
[schedule-name] named-item
owner named-item
admin-state keyword
| Synopsis | Administrative state of the CRON schedule | |
| Context | configure system cron schedule named-item owner named-item admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
count number
day-of-month number
| Synopsis | Days in a month when a schedule runs | |
| Context | configure system cron schedule named-item owner named-item day-of-month number | |
| Tree | day-of-month | |
| Range | -31 to -1 | 1 to 31 | |
| Max. instances | 62 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system cron schedule named-item owner named-item description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
end-time
date-and-time date-and-time
| Synopsis | Date and time to stop triggering the schedule | |
| Context | configure system cron schedule named-item owner named-item end-time date-and-time date-and-time | |
| Tree | date-and-time | |
Notes | The following elements are part of a choice: date-and-time or (day and time). | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
day keyword
time hours-minutes-twenty-four
| Synopsis | Time to stop triggering the schedule | |
| Context | configure system cron schedule named-item owner named-item end-time time hours-minutes-twenty-four | |
| Tree | time | |
| String length | 5 | |
Notes | The following elements are part of a choice: date-and-time or (day and time). | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
hour number
interval number
minute number
month (keyword | number)
script-policy
| Synopsis | Enter the script-policy context | |
| Context | configure system cron schedule named-item owner named-item script-policy | |
| Tree | script-policy | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
name named-item
owner named-item
type keyword
weekday (keyword | number)
dhcp6
adv-noaddrs-global keyword
| Synopsis | Applications to send NoAddrsAvail in Advertise messages | |
| Context | configure system dhcp6 adv-noaddrs-global keyword | |
| Tree | adv-noaddrs-global | |
| Options | ||
| Max. instances | 2 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
dns
address-pref keyword
| Synopsis | Preference in DNS address resolving order | |
| Context | configure system dns address-pref keyword | |
| Tree | address-pref | |
| Options | ||
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
dnssec
ad-validation keyword
| Synopsis | Validation of AD-bit presence in DNS server responses | |
| Context | configure system dns dnssec ad-validation keyword | |
| Tree | ad-validation | |
| Options | fall-through – Allow non-DNSSEC responses to fall-through to permit resolution in case of validation failure drop – Drop non-DNSSEC responses in case of validation failure | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
grpc
admin-state keyword
| Synopsis | Administrative state of the gRPC server | |
| Context | configure system grpc admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
allow-unsecure-connection
| Synopsis | Allow connection without secured transport protocol | |
| Context | configure system grpc allow-unsecure-connection | |
| Tree | allow-unsecure-connection | |
Description | When configured, the system allows an unsecured connection to remote managers; TCP connections are not encrypted, including username and password information. | |
Notes | The following elements are part of a choice: allow-unsecure-connection or tls-server-profile. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
delay-on-boot number
| Synopsis | Delay for gRPC connections after system boot | |
| Context | configure system grpc delay-on-boot number | |
| Tree | delay-on-boot | |
Description | This command configures the delay timer for gRPC connections. When the timer expires, gRPC becomes operational and connections are accepted. This delay prevents automation from managing the system while it is still converging. When no delay is configured, connections are accepted after the system boots and gRPC becomes operational. | |
| Range | 1 to 3600 | |
| Units | seconds | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
gnmi
admin-state keyword
| Synopsis | Administrative state of the gNMI service | |
| Context | configure system grpc gnmi admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | enable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
auto-config-save boolean
| Synopsis | Automatically save configuration as part of commit | |
| Context | configure system grpc gnmi auto-config-save boolean | |
| Tree | auto-config-save | |
Description | When configured to true, the system automatically writes the running configuration to the saved configuration file as part of a successful commit operation. | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
proto-version keyword
| Synopsis | gnmi.proto version | |
| Context | configure system grpc gnmi proto-version keyword | |
| Tree | proto-version | |
Description | This command sets the gnmi.proto version that the gRPC server should use for all gNMI RPCs. Only use options other than latest for backward compatibility with legacy collectors. | |
| Options | latest – Latest supported version v070 – gNMI version 0.7.0 | |
| Default | latest | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnoi
cert-mgmt
admin-state keyword
| Synopsis | Administrative state of gNOI CertificateManagement | |
| Context | configure system grpc gnoi cert-mgmt admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
file
admin-state keyword
| Synopsis | Administrative state of the gNOI File service | |
| Context | configure system grpc gnoi file admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
system
admin-state keyword
| Synopsis | Administrative state of the gNOI System service | |
| Context | configure system grpc gnoi system admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
listening-port number
| Synopsis | Listening port for the gRPC server | |
| Context | configure system grpc listening-port number | |
| Tree | listening-port | |
| Range | 1024 to 49151 | 57400 | |
| Default | 57400 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
max-msg-size number
| Synopsis | Maximum size of received message | |
| Context | configure system grpc max-msg-size number | |
| Tree | max-msg-size | |
| Range | 1 to 1024 | |
| Units | megabytes | |
| Default | 512 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
md-cli
admin-state keyword
| Synopsis | Administrative state of the MD-CLI service | |
| Context | configure system grpc md-cli admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
tcp-keepalive
| Synopsis | Enter the tcp-keepalive context | |
| Context | configure system grpc tcp-keepalive | |
| Tree | tcp-keepalive | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of the TCP keepalive algorithm | |
| Context | configure system grpc tcp-keepalive admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
idle-time number
| Synopsis | Time until the first TCP keepalive probe is sent | |
| Context | configure system grpc tcp-keepalive idle-time number | |
| Tree | idle-time | |
Description | This command configures the amount of time the connection must be idle before TCP keepalives are sent. | |
| Range | 1 to 100000 | |
| Units | seconds | |
| Default | 600 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
interval number
| Synopsis | Time between TCP keep-alive probes | |
| Context | configure system grpc tcp-keepalive interval number | |
| Tree | interval | |
| Range | 1 to 100000 | |
| Units | seconds | |
| Default | 15 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
retries number
| Synopsis | Number of probe retries before closing the connection | |
| Context | configure system grpc tcp-keepalive retries number | |
| Tree | retries | |
Description | This command configures the number of missed TCP keepalive probes before closing the TCP connection and attempting to reach the other destinations within the same destination group. | |
| Range | 3 to 100 | |
| Default | 4 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
tls-server-profile reference
| Synopsis | Preferred TLS server profile | |
| Context | configure system grpc tls-server-profile reference | |
| Tree | tls-server-profile | |
Reference | configure system security tls server-tls-profile named-item | |
Notes | The following elements are part of a choice: allow-unsecure-connection or tls-server-profile. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
grpc-tunnel
| Synopsis | Enter the grpc-tunnel context | |
| Context | configure system grpc-tunnel | |
| Tree | grpc-tunnel | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
delay-on-boot number
| Synopsis | Delay for gRPC tunnels after system boot | |
| Context | configure system grpc-tunnel delay-on-boot number | |
| Tree | delay-on-boot | |
Description | This command configures the delay timer for gRPC tunnels. When the timer expires, gRPC tunnels become operational and connections are accepted. This delay prevents the system from trying to initiate gRPC tunnels while it is still converging. When no delay is configured, gRPC tunnels are initiated after the system boots and gRPC becomes operational. | |
| Range | 1 to 3600 | |
| Units | seconds | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
destination-group [name] named-item
| Synopsis | Enter the destination-group list instance | |
| Context | configure system grpc-tunnel destination-group named-item | |
| Tree | destination-group | |
Description | Commands in this context configure parameters for destination groups. | |
| Max. instances | 4 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[name] named-item
| Synopsis | Destination group name | |
| Context | configure system grpc-tunnel destination-group named-item | |
| Tree | destination-group | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
allow-unsecure-connection
| Synopsis | Allow unsecured operation of gRPC connections | |
| Context | configure system grpc-tunnel destination-group named-item allow-unsecure-connection | |
| Tree | allow-unsecure-connection | |
Description | This command allows a gRPC tunnel to run without a secured transport protocol. Data is transferred in unencrypted form. | |
Notes | The following elements are part of a choice: allow-unsecure-connection or tls-client-profile. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system grpc-tunnel destination-group named-item description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
destination [address] (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number
| Synopsis | Enter the destination list instance | |
| Context | configure system grpc-tunnel destination-group named-item destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number | |
| Tree | destination | |
| Max. instances | 4 | |
Notes | This element is ordered by the user. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[address] (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name)
| Synopsis | Address of the destination within the destination group | |
| Context | configure system grpc-tunnel destination-group named-item destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number | |
| Tree | destination | |
| String length | 1 to 255 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
port number
| Synopsis | TCP port number for the destination | |
| Context | configure system grpc-tunnel destination-group named-item destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number | |
| Tree | destination | |
| Range | 1 to 65535 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
local-source-address (ipv4-address-no-zone | ipv6-address-no-zone)
| Synopsis | Local IP address of packets sent from the source | |
| Context | configure system grpc-tunnel destination-group named-item destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number local-source-address (ipv4-address-no-zone | ipv6-address-no-zone) | |
| Tree | local-source-address | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
originated-qos-marking keyword
| Synopsis | QoS marking used for gRPC tunnel packets | |
| Context | configure system grpc-tunnel destination-group named-item destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number originated-qos-marking keyword | |
| Tree | originated-qos-marking | |
| Options | ||
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
router-instance string
| Synopsis | Router instance for the destination group | |
| Context | configure system grpc-tunnel destination-group named-item destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number router-instance string | |
| Tree | router-instance | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
tcp-keepalive
| Synopsis | Enter the tcp-keepalive context | |
| Context | configure system grpc-tunnel destination-group named-item tcp-keepalive | |
| Tree | tcp-keepalive | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of the TCP keepalive algorithm | |
| Context | configure system grpc-tunnel destination-group named-item tcp-keepalive admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
idle-time number
| Synopsis | Time until the first TCP keepalive probe is sent | |
| Context | configure system grpc-tunnel destination-group named-item tcp-keepalive idle-time number | |
| Tree | idle-time | |
Description | This command configures the amount of time the connection must be idle before TCP keepalives are sent. | |
| Range | 1 to 100000 | |
| Units | seconds | |
| Default | 600 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
interval number
| Synopsis | Time between TCP keep-alive probes | |
| Context | configure system grpc-tunnel destination-group named-item tcp-keepalive interval number | |
| Tree | interval | |
| Range | 1 to 100000 | |
| Units | seconds | |
| Default | 15 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
retries number
| Synopsis | Number of probe retries before closing the connection | |
| Context | configure system grpc-tunnel destination-group named-item tcp-keepalive retries number | |
| Tree | retries | |
Description | This command configures the number of missed TCP keepalive probes before closing the TCP connection and attempting to reach the other destinations within the same destination group. | |
| Range | 3 to 100 | |
| Default | 4 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
tls-client-profile reference
| Synopsis | TLS client profile assigned to the destination group | |
| Context | configure system grpc-tunnel destination-group named-item tls-client-profile reference | |
| Tree | tls-client-profile | |
Reference | configure system security tls client-tls-profile named-item | |
Notes | The following elements are part of a choice: allow-unsecure-connection or tls-client-profile. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
tunnel [name] named-item
| Synopsis | Enter the tunnel list instance | |
| Context | configure system grpc-tunnel tunnel named-item | |
| Tree | tunnel | |
Description | Commands in this context configure gRPC-tunnel-related parameters. | |
| Max. instances | 4 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[name] named-item
| Synopsis | Tunnel name | |
| Context | configure system grpc-tunnel tunnel named-item | |
| Tree | tunnel | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of the tunnel | |
| Context | configure system grpc-tunnel tunnel named-item admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system grpc-tunnel tunnel named-item description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
destination-group reference
| Synopsis | Destination group used in the tunnel | |
| Context | configure system grpc-tunnel tunnel named-item destination-group reference | |
| Tree | destination-group | |
Reference | configure system grpc-tunnel destination-group named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
handler [name] named-item
| Synopsis | Enter the handler list instance | |
| Context | configure system grpc-tunnel tunnel named-item handler named-item | |
| Tree | handler | |
Description | Commands in this context configure handler parameters for this instance. Multiple handlers can be created for any tunnel. | |
| Max. instances | 8 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[name] named-item
| Synopsis | Handler name | |
| Context | configure system grpc-tunnel tunnel named-item handler named-item | |
| Tree | handler | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of the handler | |
| Context | configure system grpc-tunnel tunnel named-item handler named-item admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
port number
target-type
| Synopsis | Enter the target-type context | |
| Context | configure system grpc-tunnel tunnel named-item handler named-item target-type | |
| Tree | target-type | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
custom-type string
| Synopsis | Custom string for target type | |
| Context | configure system grpc-tunnel tunnel named-item handler named-item target-type custom-type string | |
| Tree | custom-type | |
Description | This command configures a custom string for the target type. This string can correspond to specific values used by the gRPC tunnel protocol, such as GNMI_GNOI or SSH. If a custom string is defined, the gRPC tunnel client must specify the string to request a session for that handler. The string must be unique within a tunnel. | |
| String length | 1 to 64 | |
Notes | The following elements are part of a choice: custom-type, grpc-server, or ssh-server. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
grpc-server
| Synopsis | Target type set to GNMI_GNOI | |
| Context | configure system grpc-tunnel tunnel named-item handler named-item target-type grpc-server | |
| Tree | grpc-server | |
Description | When configured, this command assigns the gRPC server as a handler for all tunnels sessions. At the gRPC tunnel protocol level, this corresponds to a value of GNMI_GNOI. | |
Notes | The following elements are part of a choice: custom-type, grpc-server, or ssh-server. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ssh-server
| Synopsis | Target type is SSH | |
| Context | configure system grpc-tunnel tunnel named-item handler named-item target-type ssh-server | |
| Tree | ssh-server | |
Description | When configured, this command assigns the SSH server as a handler for all tunnels sessions. At the gRPC tunnel protocol level, this corresponds to a value of SSH. | |
Notes | The following elements are part of a choice: custom-type, grpc-server, or ssh-server. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
target-name
| Synopsis | Enter the target-name context | |
| Context | configure system grpc-tunnel tunnel named-item target-name | |
| Tree | target-name | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
custom-string named-item-64
| Synopsis | Custom target name | |
| Context | configure system grpc-tunnel tunnel named-item target-name custom-string named-item-64 | |
| Tree | custom-string | |
| String length | 1 to 64 | |
Notes | The following elements are part of a choice: custom-string, node-name, or user-agent. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
node-name
| Synopsis | Set the node name as target name | |
| Context | configure system grpc-tunnel tunnel named-item target-name node-name | |
| Tree | node-name | |
Description | When configured, this command uses the node name as the target name. The node name is configured by the configure system name command. | |
Notes | The following elements are part of a choice: custom-string, node-name, or user-agent. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
user-agent
| Synopsis | Set the user agent as the target name | |
| Context | configure system grpc-tunnel tunnel named-item target-name user-agent | |
| Tree | user-agent | |
Description | When configured, this command uses the user agent as the target name. The agent is a string consisting of node-name:vendor:model:software-version. | |
Notes | The following elements are part of a choice: custom-string, node-name, or user-agent. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
icmp-vse boolean
ip
buffer-unresolved-packets boolean
| Synopsis | Buffer unresolved packets during ARP | |
| Context | configure system ip buffer-unresolved-packets boolean | |
| Tree | buffer-unresolved-packets | |
Description | When configured to true, the system buffers IPv4 and IPv6 packets waiting for the address resolution process (ARP) or neighbor discovery (ND) reply. When configured to false, the system discards packets during the address resolution process. The system discards IPv4 and IPv6 traffic needing a destination resolution that is buffered while waiting for a response to avoid any potential of out-of-order delivery of packets to the resolved destination. As a result, after the ARP or ND entry is populated, the system delivers only newly received packets in order. | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
enforce-unique-if-index boolean
| Synopsis | Force creation of globally unique IP interface indexes | |
| Context | configure system ip enforce-unique-if-index boolean | |
| Tree | enforce-unique-if-index | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
forward-6in4 boolean
| Synopsis | Allow forwarding of IPv6 over IPv4 to system IP address | |
| Context | configure system ip forward-6in4 boolean | |
| Tree | forward-6in4 | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
forward-ip-over-gre boolean
| Synopsis | Allow forwarding of IP over GRE to system IP address | |
| Context | configure system ip forward-ip-over-gre boolean | |
| Tree | forward-ip-over-gre | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
ipv6-eh keyword
lacp
system-priority number
| Synopsis | LACP system priority on aggregated Ethernet interfaces | |
| Context | configure system lacp system-priority number | |
| Tree | system-priority | |
| Range | 1 to 65535 | |
| Default | 32768 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
lldp
admin-state keyword
| Synopsis | Administrative state of LLDP | |
| Context | configure system lldp admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | enable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
message-fast-tx number
| Synopsis | Interval at which LLDP frames are transmitted | |
| Context | configure system lldp message-fast-tx number | |
| Tree | message-fast-tx | |
Description | This command configures the interval at which LLDP frames are transmitted on behalf of the LLDP during a fast transmission period. | |
| Range | 1 to 3600 | |
| Units | seconds | |
| Default | 1 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
message-fast-tx-init number
| Synopsis | PDUs to transmit during the fast transmission period | |
| Context | configure system lldp message-fast-tx-init number | |
| Tree | message-fast-tx-init | |
| Range | 1 to 8 | |
| Default | 4 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
notification-interval number
| Synopsis | Minimum interval between change notifications | |
| Context | configure system lldp notification-interval number | |
| Tree | notification-interval | |
| Range | 5 to 3600 | |
| Units | seconds | |
| Default | 5 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
reinit-delay number
| Synopsis | Time required before re-initializing LLDP on a port | |
| Context | configure system lldp reinit-delay number | |
| Tree | reinit-delay | |
| Range | 1 to 10 | |
| Units | seconds | |
| Default | 2 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
tx-credit-max number
| Synopsis | Maximum consecutive LLDPDUs that can be transmitted | |
| Context | configure system lldp tx-credit-max number | |
| Tree | tx-credit-max | |
| Range | 1 to 100 | |
| Default | 5 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
tx-hold-multiplier number
| Synopsis | Transmit interval multiplier | |
| Context | configure system lldp tx-hold-multiplier number | |
| Tree | tx-hold-multiplier | |
| Range | 2 to 10 | |
| Default | 4 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
tx-interval number
| Synopsis | LLDP transmit interval | |
| Context | configure system lldp tx-interval number | |
| Tree | tx-interval | |
| Range | 5 to 32768 | |
| Units | seconds | |
| Default | 30 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
load-balancing
| Synopsis | Enter the load-balancing context | |
| Context | configure system load-balancing | |
| Tree | load-balancing | |
Description | Commands in this context configure the interface per-flow load-balancing options that apply to traffic entering this interface and egressing over a LAG or ECMP on system egress. This setting is per interface. Load-balancing options configured at the interface level overwrite load-balancing options configured at the system level. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
l4-load-balancing boolean
| Synopsis | Use load balancing based on Layer 4 fields | |
| Context | configure system load-balancing l4-load-balancing boolean | |
| Tree | l4-load-balancing | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
lsr-load-balancing keyword
| Synopsis | Algorithm for system-wide LSR load balancing | |
| Context | configure system load-balancing lsr-load-balancing keyword | |
| Tree | lsr-load-balancing | |
Description | This command configures system-wide LSR load balancing. Hashing can be enabled on the label stack, IP header, or both. The hashing can be at an LSR for spraying labeled IP packets over multiple equal-cost paths, or over multiple links of a LAG group. The LSR hash routine operates on the label stack and the IP header, if a packet is IPv4. An LSR considers a packet to be IPv4 if the first nibble following the bottom of the label stack is 4. The hash on the label stack and IPv4 and IPv6 headers can be enabled or disabled at the system level or incoming network IP interface level. lbl-ip-l4-teid - Specifies that the hashing applies as follows for Layer 2 and Layer 3 encapsulated traffic:
eth-encap-ip - Specifies that the hash algorithm parses down the label stack and after it reaches the bottom, the stack assumes the Ethernet II non-tagged, dot1q, or QinQ header follows. At the expected Ethertype offset location, the algorithm checks whether the value present is IPv4/IPv6 (0x0800/0x86DD). If the check passes, the hash algorithm checks the first nibble at the expected IP header location for IPv4/IPv6 (0x0100/0x0110). If the secondary check passes, the algorithm performs the hash using the IP SA/DA fields in the expected IP header. If any of the checks fail, the label-stack hash is performed. | |
| Options | ||
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
service-id-lag-hashing boolean
| Synopsis | Enable enhanced VLL LAG service ID hashing | |
| Context | configure system load-balancing service-id-lag-hashing boolean | |
| Tree | service-id-lag-hashing | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
location description
login-control
| Synopsis | Enter the login-control context | |
| Context | configure system login-control | |
| Tree | login-control | |
Description | Commands in this context configure the session control for console, Telnet, SSH, and FTP sessions. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
exponential-backoff boolean
| Synopsis | Enable exponential-backoff of the login prompt | |
| Context | configure system login-control exponential-backoff boolean | |
| Tree | exponential-backoff | |
Description | When configured to true, the router enables exponential backoff for the login prompt. The exponential-backoff command is used to deter dictionary attacks, when a malicious user can gain access to the CLI by using a script to attempt to log in to the admin account with any conceivable password. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
ftp
| Synopsis | Enter the ftp context | |
| Context | configure system login-control ftp | |
| Tree | ftp | |
Description | Commands in this context configure FTP login control command options. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
inbound-max-sessions number
| Synopsis | Maximum number of concurrent inbound FTP sessions | |
| Context | configure system login-control ftp inbound-max-sessions number | |
| Tree | inbound-max-sessions | |
Description | This command configures the maximum number of concurrent inbound FTP sessions. This value is the combined total of inbound and outbound sessions. | |
| Range | 0 to 5 | |
| Default | 3 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
idle-timeout (keyword | number)
| Synopsis | Idle timeout for console, FTP, Telnet, and SSH sessions | |
| Context | configure system login-control idle-timeout (keyword | number) | |
| Tree | idle-timeout | |
| Range | 1 to 1440 | |
| Units | minutes | |
| Options | ||
| Default | 30 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
login-banner boolean
| Synopsis | Display login banner | |
| Context | configure system login-control login-banner boolean | |
| Tree | login-banner | |
Description | When configured to true, the system displays a login banner. The login banner contains the SR OS copyright and build date information for a console login attempt. When configured to false, the system displays only the configured pre-login-message and a generic login prompt. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
login-scripts
| Synopsis | Enter the login-scripts context | |
| Context | configure system login-control login-scripts | |
| Tree | login-scripts | |
Description | Commands in this context configure CLI scripts that execute when a user (authenticated via any method including local user database, TACACS+, or RADIUS) first logs into a CLI session. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
global-script string-not-all-spaces
| Synopsis | URL of the global CLI login script | |
| Context | configure system login-control login-scripts global-script string-not-all-spaces | |
| Tree | global-script | |
Description | This command specifies a common CLI script that executes when any user logs into a CLI session. This login exec script is executed when any user (authenticated by any means including local user database, TACACS+, or RADIUS) opens a CLI session. This allows a user, for example, to define a common set of CLI aliases that are made available on the router for all users. This global login exec script is executed before any user-specific login exec files that may be configured. This CLI script executes in the context of the user who opens the CLI session. Any commands in the script that the user is not authorized to execute will fail. | |
| String length | 1 to 180 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
per-user-script
| Synopsis | Enter the per-user-script context | |
| Context | configure system login-control login-scripts per-user-script | |
| Tree | per-user-script | |
Description | Commands in this context allow users to define their own login scripts that can be executed each time they first login to a CLI session. The command executes the script “file-url / username / file-name" when the user username logs into a CLI session (authenticated by any means including local user database, TACACS+, or RADIUS). For example: per-user user-directory "cf1:/local/users" file-name "login-script.txt" would search for the following script when user “admin” logs in and authenticates via RADIUS: cf1:/local/users/admin/login-script.txt The per user login script is executed after any global script executes and before any login-exec script configured against a local user is executed. This allows users, for example, who are authenticated via TACACS+ or RADIUS to define their own login scripts. This CLI script executes in the context of the user who opens the CLI session. Any commands in the script that the user is not authorized to execute will fail. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
file-name filename
| Synopsis | File name of the per-user login script | |
| Context | configure system login-control login-scripts per-user-script file-name filename | |
| Tree | file-name | |
Description | This command specifies the name of the file (located in the configure system login-control login-scripts per-user-script user-directory directory) including the extension. | |
| String length | 1 to 180 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
user-directory string-not-all-spaces
| Synopsis | Directory name of user-defined login script | |
| Context | configure system login-control login-scripts per-user-script user-directory string-not-all-spaces | |
| Tree | user-directory | |
| String length | 1 to 180 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
motd
| Synopsis | Enter the motd context | |
| Context | configure system login-control motd | |
| Tree | motd | |
Description | Commands in this context create the message of the day displayed after a successful console login. Only one message can be configured. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
text string-not-all-spaces
| Synopsis | Message of the day displayed after console login | |
| Context | configure system login-control motd text string-not-all-spaces | |
| Tree | text | |
| String length | 1 to 900 | |
Notes | The following elements are part of a choice: text or url. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
url string-not-all-spaces
| Synopsis | URL of the location of message of the day | |
| Context | configure system login-control motd url string-not-all-spaces | |
| Tree | url | |
| String length | 1 to 180 | |
Notes | The following elements are part of a choice: text or url. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
pre-login-message
| Synopsis | Enter the pre-login-message context | |
| Context | configure system login-control pre-login-message | |
| Tree | pre-login-message | |
Description | Commands in this context configure a message to display before logging in to the router using Telnet, SSH, or the console port. Only one message can be configured. If a new pre-login message is configured, the new message overwrites the previous message. Note: The pre-login message is displayed on both active and standby systems. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
message string-not-all-spaces
| Synopsis | Message displayed before the login prompt | |
| Context | configure system login-control pre-login-message message string-not-all-spaces | |
| Tree | message | |
Description | This command configures the pre-login message. Any printable, 7-bit ASCII characters can be used. If the string contains special characters (#, $, spaces, and so on), the entire string must be enclosed within double quotes. Some special characters can be used to format the message text. Use the newline (\n) character to create multiline messages. A newline (\n) character in the message moves to the beginning of the next line by sending ASCII/UTF-8 characters 0xA (LF) and 0xD (CR) to the client terminal. A carriage return (\r) character in the message sends the ASCII/UTF-8 character 0xD (CR) to the client terminal. | |
| String length | 1 to 900 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
name boolean
| Synopsis | Display the system name before the pre-login message | |
| Context | configure system login-control pre-login-message name boolean | |
| Tree | name | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
ssh
| Synopsis | Enter the ssh context | |
| Context | configure system login-control ssh | |
| Tree | ssh | |
Description | Commands in this context configure the SSH command options. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
graceful-shutdown boolean
| Synopsis | Allow graceful shutdown of SSH sessions | |
| Context | configure system login-control ssh graceful-shutdown boolean | |
| Tree | graceful-shutdown | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
inbound-max-sessions number
| Synopsis | Maximum number of concurrent inbound sessions | |
| Context | configure system login-control ssh inbound-max-sessions number | |
| Tree | inbound-max-sessions | |
| Range | 0 to 50 | |
| Default | 5 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
max-channels-per-connection number
| Synopsis | Maximum number of channels per SSH connection | |
| Context | configure system login-control ssh max-channels-per-connection number | |
| Tree | max-channels-per-connection | |
| Range | 1 to 50 | |
| Default | 5 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
outbound-max-sessions number
| Synopsis | Maximum number of concurrent outbound sessions | |
| Context | configure system login-control ssh outbound-max-sessions number | |
| Tree | outbound-max-sessions | |
Description | This command configures the maximum number of outbound Telnet and SSH sessions. The local serial port cannot be disabled. | |
| Range | 0 to 15 | |
| Default | 5 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
ttl-security number
| Synopsis | Minimum TTL value for incoming packets | |
| Context | configure system login-control ssh ttl-security number | |
| Tree | ttl-security | |
Description | This command configures TTL security command options for incoming packets. When the feature is enabled, LDP accepts incoming IP packets from a peer only if the TTL value in the packet is greater than or equal to the minimum TTL value configured for that peer. Per-peer-queueing must be enabled in order for TTL protection to operate. | |
| Range | 1 to 255 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
telnet
| Synopsis | Enter the telnet context | |
| Context | configure system login-control telnet | |
| Tree | telnet | |
Description | Commands in this context configure the Telnet command options. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
graceful-shutdown boolean
| Synopsis | Allow graceful shutdown of Telnet sessions | |
| Context | configure system login-control telnet graceful-shutdown boolean | |
| Tree | graceful-shutdown | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
inbound-max-sessions number
| Synopsis | Maximum number of concurrent inbound sessions | |
| Context | configure system login-control telnet inbound-max-sessions number | |
| Tree | inbound-max-sessions | |
| Range | 0 to 50 | |
| Default | 5 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
outbound-max-sessions number
| Synopsis | Maximum number of concurrent outbound sessions | |
| Context | configure system login-control telnet outbound-max-sessions number | |
| Tree | outbound-max-sessions | |
Description | This command configures the maximum number of outbound Telnet and SSH sessions. The local serial port cannot be disabled. | |
| Range | 0 to 15 | |
| Default | 5 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
ttl-security number
| Synopsis | Minimum TTL value for incoming packets | |
| Context | configure system login-control telnet ttl-security number | |
| Tree | ttl-security | |
Description | This command configures TTL security command options for incoming packets. When the feature is enabled, LDP accepts incoming IP packets from a peer only if the TTL value in the packet is greater than or equal to the minimum TTL value configured for that peer. Per-peer-queueing must be enabled in order for TTL protection to operate. | |
| Range | 1 to 255 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
management-interface
| Synopsis | Enter the management-interface context | |
| Context | configure system management-interface | |
| Tree | management-interface | |
Description | Commands in this context configure the capabilities of router management interfaces such as CLI and NETCONF. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cli
| Synopsis | Enter the cli context | |
| Context | configure system management-interface cli | |
| Tree | cli | |
Description | Commands in this context configure the CLI management interfaces. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
classic-cli
| Synopsis | Enter the classic-cli context | |
| Context | configure system management-interface cli classic-cli | |
| Tree | classic-cli | |
Description | Commands in this context configure the classic CLI management interface. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
allow-immediate boolean
| Synopsis | Allow writable access in classic CLI configure branch | |
| Context | configure system management-interface cli classic-cli allow-immediate boolean | |
| Tree | allow-immediate | |
Description | When configured to true, this command enables write access in the classic CLI configuration branch without having to use the classic CLI candidate edit functionality. When configured to false, this command blocks write access and configuration changes in the classic CLI configuration branch, and the classic CLI configuration branch is read-only. This enforces using the classic CLI candidate edit functionality, including candidate commit, to modify the router configuration, instead of allowing immediate line-by-line configuration changes. | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
rollback
| Synopsis | Enter the rollback context | |
| Context | configure system management-interface cli classic-cli rollback | |
| Tree | rollback | |
Description | Commands in this context control classic CLI configuration rollback functionality, such as the maximum number of rollback checkpoints the system maintains. Configuration rollback allows the operator to revert to previous router configuration states while minimizing impacts to services. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
local-checkpoints number
| Synopsis | Maximum number of rollback files on local storage | |
| Context | configure system management-interface cli classic-cli rollback local-checkpoints number | |
| Tree | local-checkpoints | |
| Range | 1 to 50 | |
| Default | 10 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
location url
| Synopsis | Path and filename prefix for rollback checkpoint files | |
| Context | configure system management-interface cli classic-cli rollback location url | |
| Tree | location | |
Description | This command configures the local (for example, compact flash) or remote location and name of the classic CLI rollback checkpoint files. The filename must not contain a suffix. The suffixes for rollback checkpoint files are, for example, .rb, .rb.1, .rb.2, and so on. The suffixes are automatically appended to rollback checkpoint files. | |
| String length | 1 to 180 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
remote-checkpoints number
| Synopsis | Maximum rollback files saved at a remote location | |
| Context | configure system management-interface cli classic-cli rollback remote-checkpoints number | |
| Tree | remote-checkpoints | |
| Range | 1 to 200 | |
| Default | 10 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
rescue
| Synopsis | Enter the rescue context | |
| Context | configure system management-interface cli classic-cli rollback rescue | |
| Tree | rescue | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
location url
| Synopsis | Location of the rescue configuration file | |
| Context | configure system management-interface cli classic-cli rollback rescue location url | |
| Tree | location | |
Description | This command configures the local or remote location and filename of the classic CLI rescue configuration file. The suffix (.rc) is automatically appended to the filename when a rescue configuration file is saved. Trivial FTP (TFTP) is not supported for remote locations. | |
| String length | 1 to 180 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cli-engine keyword
| Synopsis | System-wide CLI engine access | |
| Context | configure system management-interface cli cli-engine keyword | |
| Tree | cli-engine | |
Description | This command configures the system-wide CLI engine. The operator can configure one or both engines. For the configuration to take effect, exit the running CLI session and start a new session after committing the new value. | |
| Options | ||
| Max. instances | 2 | |
Notes | This element is ordered by the user. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
md-cli
| Synopsis | Enter the md-cli context | |
| Context | configure system management-interface cli md-cli | |
| Tree | md-cli | |
Description | Commands in this context configure the MD-CLI management interface. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
auto-config-save boolean
| Synopsis | Automatically save configuration as part of commit | |
| Context | configure system management-interface cli md-cli auto-config-save boolean | |
| Tree | auto-config-save | |
Description | When configured to true, the system automatically writes the running configuration to the saved configuration file as part of a successful commit operation. | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
environment
| Synopsis | Enter the environment context | |
| Context | configure system management-interface cli md-cli environment | |
| Tree | environment | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
command-alias
| Synopsis | Enter the command-alias context | |
| Context | configure system management-interface cli md-cli environment command-alias | |
| Tree | command-alias | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
alias [alias-name] string
| Synopsis | Enter the alias list instance | |
| Context | configure system management-interface cli md-cli environment command-alias alias string | |
| Tree | alias | |
Description | Commands in this context create aliases to existing MD-CLI commands or to Python applications. Aliases may be mounted for use globally or for selected context paths. Arguments and output modifiers may be provided to aliases at configuration or run time. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[alias-name] string
| Synopsis | Alias name | |
| Context | configure system management-interface cli md-cli environment command-alias alias string | |
| Tree | alias | |
| String length | 1 to 64 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of the alias | |
| Context | configure system management-interface cli md-cli environment command-alias alias string admin-state keyword | |
| Tree | admin-state | |
Description | This command controls the administrative state of the MD-CLI alias. MD-CLI aliases that are administratively disabled cannot be executed, are not displayed in command completion, and do not appear in ? help. | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cli-command string
| Synopsis | CLI command to run when executing the alias | |
| Context | configure system management-interface cli md-cli environment command-alias alias string cli-command string | |
| Tree | cli-command | |
| String length | 1 to 255 | |
Notes | The following elements are part of a mandatory choice: cli-command or python-script. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
description string-not-all-spaces
| Synopsis | Alias description | |
| Context | configure system management-interface cli md-cli environment command-alias alias string description string-not-all-spaces | |
| Tree | description | |
| String length | 1 to 110 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mount-point [path] (keyword | string)
| Synopsis | Add a list entry for mount-point | |
| Context | configure system management-interface cli md-cli environment command-alias alias string mount-point (keyword | string) | |
| Tree | mount-point | |
| Min. instances | 1 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[path] (keyword | string)
| Synopsis | Mount point where the alias is available | |
| Context | configure system management-interface cli md-cli environment command-alias alias string mount-point (keyword | string) | |
| Tree | mount-point | |
| String length | 1 to 255 | |
| Options | ||
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
command-completion
| Synopsis | Enter the command-completion context | |
| Context | configure system management-interface cli md-cli environment command-completion | |
| Tree | command-completion | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
enter boolean
| Synopsis | Complete the command when the Enter key is pressed | |
| Context | configure system management-interface cli md-cli environment command-completion enter boolean | |
| Tree | enter | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
space boolean
| Synopsis | Complete the command when the Space key is pressed | |
| Context | configure system management-interface cli md-cli environment command-completion space boolean | |
| Tree | space | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
tab boolean
| Synopsis | Complete the command when the Tab key is pressed | |
| Context | configure system management-interface cli md-cli environment command-completion tab boolean | |
| Tree | tab | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
commit-options
| Synopsis | Enter the commit-options context | |
| Context | configure system management-interface cli md-cli environment commit-options | |
| Tree | commit-options | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
comment boolean
| Synopsis | Require a commit comment when committing configuration | |
| Context | configure system management-interface cli md-cli environment commit-options comment boolean | |
| Tree | comment | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
confirm boolean
| Synopsis | Require confirmed commit when committing configuration | |
| Context | configure system management-interface cli md-cli environment commit-options confirm boolean | |
| Tree | confirm | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
console
| Synopsis | Enter the console context | |
| Context | configure system management-interface cli md-cli environment console | |
| Tree | console | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
length number
| Synopsis | Number of lines displayed on the console | |
| Context | configure system management-interface cli md-cli environment console length number | |
| Tree | length | |
| Range | 24 to 512 | |
| Default | 24 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
width number
| Synopsis | Number of columns displayed on the console | |
| Context | configure system management-interface cli md-cli environment console width number | |
| Tree | width | |
| Range | 80 to 512 | |
| Default | 80 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
history
| Synopsis | Enter the history context | |
| Context | configure system management-interface cli md-cli environment history | |
| Tree | history | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
recall boolean
| Synopsis | Allow command history recall and search execution | |
| Context | configure system management-interface cli md-cli environment history recall boolean | |
| Tree | recall | |
Description | When configured to true, the command history recall (!), substitution (!$), display (:p, Esc+.), and backward search (Ctrl-R) are enabled. When configured to false, the command history can be displayed using the history command, but commands in the history cannot be executed. | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
size number
| Synopsis | Command history size | |
| Context | configure system management-interface cli md-cli environment history size number | |
| Tree | size | |
Description | This command specifies the maximum size of the command history. A value of 0 disables the command history. | |
| Range | 0 to 1000 | |
| Default | 50 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
info-output
| Synopsis | Enter the info-output context | |
| Context | configure system management-interface cli md-cli environment info-output | |
| Tree | info-output | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
always-display
| Synopsis | Enter the always-display context | |
| Context | configure system management-interface cli md-cli environment info-output always-display | |
| Tree | always-display | |
Description | Commands in this context specify elements that are always displayed in the info output, regardless of whether the detail option is used. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state boolean
| Synopsis | Always display admin-state elements | |
| Context | configure system management-interface cli md-cli environment info-output always-display admin-state boolean | |
| Tree | admin-state | |
Description | When configured to true, the values of the admin-state elements in info output (without the detail option) are always displayed, even if they are the default values. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
message-severity-level
| Synopsis | Enter the message-severity-level context | |
| Context | configure system management-interface cli md-cli environment message-severity-level | |
| Tree | message-severity-level | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cli keyword
| Synopsis | Message severity threshold for CLI messages | |
| Context | configure system management-interface cli md-cli environment message-severity-level cli keyword | |
| Tree | cli | |
| Options | ||
| Default | info | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
more boolean
| Synopsis | Activate the pager when output is longer than a screen | |
| Context | configure system management-interface cli md-cli environment more boolean | |
| Tree | more | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
progress-indicator
| Synopsis | Enter the progress-indicator context | |
| Context | configure system management-interface cli md-cli environment progress-indicator | |
| Tree | progress-indicator | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of the progress indicator | |
| Context | configure system management-interface cli md-cli environment progress-indicator admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | enable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
delay number
| Synopsis | Delay before the progress indicator is displayed | |
| Context | configure system management-interface cli md-cli environment progress-indicator delay number | |
| Tree | delay | |
| Range | 0 to 10000 | |
| Units | milliseconds | |
| Default | 1000 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
type keyword
| Synopsis | Progress indicator output style | |
| Context | configure system management-interface cli md-cli environment progress-indicator type keyword | |
| Tree | type | |
| Options | ||
| Default | dots | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
prompt
| Synopsis | Enter the prompt context | |
| Context | configure system management-interface cli md-cli environment prompt | |
| Tree | prompt | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
context boolean
| Synopsis | Show the current command context in the prompt | |
| Context | configure system management-interface cli md-cli environment prompt context boolean | |
| Tree | context | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
newline boolean
| Synopsis | Add a new line before every prompt line | |
| Context | configure system management-interface cli md-cli environment prompt newline boolean | |
| Tree | newline | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
timestamp boolean
| Synopsis | Show the timestamp before the first prompt line | |
| Context | configure system management-interface cli md-cli environment prompt timestamp boolean | |
| Tree | timestamp | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
uncommitted-changes-indicator boolean
| Synopsis | Show an asterisk (*) when uncommitted changes exist | |
| Context | configure system management-interface cli md-cli environment prompt uncommitted-changes-indicator boolean | |
| Tree | uncommitted-changes-indicator | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
python
| Synopsis | Enter the python context | |
| Context | configure system management-interface cli md-cli environment python | |
| Tree | python | |
Description | Commands in this context customize Python settings used with the Python 3 interpreter in MD-CLI applications such as pyexec, command aliases, EHS, and CRON. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
memory-reservation number
| Synopsis | Memory reserved per Python interpreter | |
| Context | configure system management-interface cli md-cli environment python memory-reservation number | |
| Tree | memory-reservation | |
| Range | 1 to 500 | |
| Units | megabytes | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
minimum-available-memory number
| Synopsis | Minimum memory requirement to run a Python interpreter | |
| Context | configure system management-interface cli md-cli environment python minimum-available-memory number | |
| Tree | minimum-available-memory | |
| Range | 5 to 50 | |
| Units | percent | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
timeout number
| Synopsis | Maximum run time before a Python application is stopped | |
| Context | configure system management-interface cli md-cli environment python timeout number | |
| Tree | timeout | |
| Range | 30 to 86400 | |
| Units | seconds | |
| Default | 3600 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
time-display keyword
| Synopsis | Time zone to display time | |
| Context | configure system management-interface cli md-cli environment time-display keyword | |
| Tree | time-display | |
Description | This command configures the time zone for a timestamp displayed in outputs, such as event logs and show commands for the current CLI session. In event logs, the selected time is used to control the timestamps in the CLI output of show log log-id and in YANG state in the /state/log/log-id branch (for logs such as session, cli, memory, SNMP, and NETCONF). Also see the configure log log-id time-format command. | |
| Options | ||
| Default | local | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
time-format keyword
| Synopsis | Format to display the date and time | |
| Context | configure system management-interface cli md-cli environment time-format keyword | |
| Tree | time-format | |
Description | This command specifies the format of the time display in the prompt, configuration, state, and certain show command output in the current CLI session. | |
| Options | ||
| Default | rfc-3339 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
commit-history number
| Synopsis | Number of commit history IDs to store | |
| Context | configure system management-interface commit-history number | |
| Tree | commit-history | |
Description | This command sets the number of IDs to store in the commit history. Setting the value to 0 disables the commit history. | |
| Range | 0 to 200 | |
| Default | 50 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
configuration-mode keyword
| Synopsis | Management interfaces allowed to edit the configuration | |
| Context | configure system management-interface configuration-mode keyword | |
| Tree | configuration-mode | |
Description | This command controls which of the classic or model-driven management interfaces can modify the configuration of the router. Any management interface can be used in any configuration mode (to gather state information or perform operations, for example), but only specific management interfaces (CLI, NETCONF, and so on) are allowed to edit the configuration of the router in different modes. For example, only classic CLI and SNMP can be used to edit the configuration when in classic mode. | |
| Options | ||
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
configuration-save
| Synopsis | Enter the configuration-save context | |
| Context | configure system management-interface configuration-save | |
| Tree | configuration-save | |
Description | Commands in this context configure the attributes for saved configuration files. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
configuration-backups number
| Synopsis | Maximum number of configuration versions maintained | |
| Context | configure system management-interface configuration-save configuration-backups number | |
| Tree | configuration-backups | |
Description | This command configures the maximum number of saved configuration file versions the router maintains. When the configuration is saved, configuration file names are appended with a numeric extension. Each subsequent configuration save creates a new configuration file version with an incremented numeric extension until the maximum count is reached, after which the next configuration save overwrites the oldest file version. Each persistent index file is updated at the same time as the associated configuration file. The system synchronizes the active and standby CPM for all configurations and their associated persistent index files. | |
| Range | 1 to 200 | |
| Default | 50 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
incremental-saves boolean
| Synopsis | Use incremental saved configuration files | |
| Context | configure system management-interface configuration-save incremental-saves boolean | |
| Tree | incremental-saves | |
Description | When configured to true, the system saves each commit to the configure configuration region in a separate incremental saved configuration file, which allows for faster commits, instead of saving a complete saved configuration file each time. | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
netconf
| Synopsis | Enter the netconf context | |
| Context | configure system management-interface netconf | |
| Tree | netconf | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
auto-config-save boolean
| Synopsis | Automatically save configuration as part of commit | |
| Context | configure system management-interface netconf auto-config-save boolean | |
| Tree | auto-config-save | |
Description | When configured to true, the system automatically writes the running configuration to the saved configuration file as part of a successful commit operation. | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
call-home
| Synopsis | Enter the call-home context | |
| Context | configure system management-interface netconf call-home | |
| Tree | call-home | |
Description | Commands in this context configure NETCONF Call Home, which enables an SR OS node to trigger a NETCONF client to start a connection. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
device-labels
| Synopsis | Enter the device-labels context | |
| Context | configure system management-interface netconf call-home device-labels | |
| Tree | device-labels | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
advertise-operating-system boolean
| Synopsis | Advertise the network operating system | |
| Context | configure system management-interface netconf call-home device-labels advertise-operating-system boolean | |
| Tree | advertise-operating-system | |
Description | When configured to true, the network operating system is encoded as a NETCONF capability. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
advertise-software-version boolean
| Synopsis | Advertise the software version | |
| Context | configure system management-interface netconf call-home device-labels advertise-software-version boolean | |
| Tree | advertise-software-version | |
Description | When configured to true, the software version is encoded as a NETCONF capability. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
advertise-system-name boolean
| Synopsis | Advertise the system name | |
| Context | configure system management-interface netconf call-home device-labels advertise-system-name boolean | |
| Tree | advertise-system-name | |
Description | When configured to true, the system name is encoded as a NETCONF capability. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
device-label string
| Synopsis | Device label | |
| Context | configure system management-interface netconf call-home device-labels device-label string | |
| Tree | device-label | |
Description | This command encodes the device label as a NETCONF capability. | |
| String length | 1 to 16 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
netconf-client [name] named-item
| Synopsis | Enter the netconf-client list instance | |
| Context | configure system management-interface netconf call-home netconf-client named-item | |
| Tree | netconf-client | |
Description | Commands in this context configure the list of NETCONF clients with which the NETCONF server maintains simultaneous Call Home connections. | |
| Max. instances | 10 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[name] named-item
| Synopsis | Remote NETCONF client name | |
| Context | configure system management-interface netconf call-home netconf-client named-item | |
| Tree | netconf-client | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of the NETCONF Call Home endpoint | |
| Context | configure system management-interface netconf call-home netconf-client named-item admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
connection-type keyword
| Synopsis | Call Home connection type | |
| Context | configure system management-interface netconf call-home netconf-client named-item connection-type keyword | |
| Tree | connection-type | |
| Options | persistent – Enable persistent connection mode | |
| Default | persistent | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
delay-on-boot number
| Synopsis | Delay for Call Home connections after system boot | |
| Context | configure system management-interface netconf call-home netconf-client named-item delay-on-boot number | |
| Tree | delay-on-boot | |
| Range | 1 to 3600 | |
| Units | seconds | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system management-interface netconf call-home netconf-client named-item description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
remote-address (ipv4-address-no-zone | ipv6-address-no-zone)
| Synopsis | IP address of the NETCONF client | |
| Context | configure system management-interface netconf call-home netconf-client named-item remote-address (ipv4-address-no-zone | ipv6-address-no-zone) | |
| Tree | remote-address | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
remote-port number
| Synopsis | Port that the NETCONF client is listening on | |
| Context | configure system management-interface netconf call-home netconf-client named-item remote-port number | |
| Tree | remote-port | |
| Range | 1 to 65535 | |
| Default | 4334 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
router-instance string
| Synopsis | Router instance or VPRN service name | |
| Context | configure system management-interface netconf call-home netconf-client named-item router-instance string | |
| Tree | router-instance | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
transport keyword
| Synopsis | Transport type | |
| Context | configure system management-interface netconf call-home netconf-client named-item transport keyword | |
| Tree | transport | |
| Options | ssh – Transport type is SSH | |
| Default | ssh | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
capabilities
| Synopsis | Enter the capabilities context | |
| Context | configure system management-interface netconf capabilities | |
| Tree | capabilities | |
Description | Commands in this context configure explicit capabilities for the NETCONF server. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
candidate boolean
| Synopsis | Allow the NETCONF server to access candidate datastore | |
| Context | configure system management-interface netconf capabilities candidate boolean | |
| Tree | candidate | |
Description | When configured to true, this command allows the SR OS NETCONF server to access the candidate configuration datastore. Configuring this command to true also enables using commit and discard-changes. When configure system management-interface configuration-mode is set to classic, the candidate capability is disabled, even if this command is configured to true. When configured to false, this command disables the SR OS NETCONF server from accessing the candidate datastore. If the candidate is disabled, requests that reference the candidate datastore return an error, and when a NETCONF client establishes a new session, the candidate capability is not advertised in the SR OS NETCONF Hello message. | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
listen
| Synopsis | Enter the listen context | |
| Context | configure system management-interface netconf listen | |
| Tree | listen | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of NETCONF server in listen mode | |
| Context | configure system management-interface netconf listen admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
delay-on-boot number
| Synopsis | Delay before NETCONF server is operational after boot | |
| Context | configure system management-interface netconf listen delay-on-boot number | |
| Tree | delay-on-boot | |
Description | This command configures the delay timer for NETCONF connections. When the timer expires, NETCONF becomes operational and connections are accepted. This delay prevents automation from managing the system while it is still converging. When no delay is configured, connections are accepted after the system boots and NETCONF becomes operational. | |
| Range | 1 to 3600 | |
| Units | seconds | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
port number
| Synopsis | Port on which NETCONF server listens for connections | |
| Context | configure system management-interface netconf listen port number | |
| Tree | port | |
Description | This command specifies the port on which the SR OS NETCONF server listens for new connections. One port can be configured for NETCONF management. The configured port applies to both non-VPRN and VPRN management. New NETCONF connections are able to use the configured port. For NETCONF connections not using VPRN management, active NETCONF connections are not disconnected if the connection port changes. For NETCONF connections are not disconnected if the connection port changes. For NETCONF connections using VPRN management, active NETCONF connections are disconnected if the connection port changes. | |
| Range | 22 | 830 | |
| Default | 830 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
operations
| Synopsis | Enter the operations context | |
| Context | configure system management-interface operations | |
| Tree | operations | |
Description | Commands in this context configure parameters associated with operational commands in model-driven interfaces. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
global-timeouts
| Synopsis | Enter the global-timeouts context | |
| Context | configure system management-interface operations global-timeouts | |
| Tree | global-timeouts | |
Description | Commands in this context configure system timeout parameters for operational commands. Timeout parameters provide default system-level control for various types of operational commands in model-driven interfaces. The timeout values are used when specific execution and retention timeouts are not requested for a specific operation. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
asynchronous-execution (number | keyword)
| Synopsis | Timeout for asynchronous operation execution | |
| Context | configure system management-interface operations global-timeouts asynchronous-execution (number | keyword) | |
| Tree | asynchronous-execution | |
Description | This command configures the period of time that operations launched as “asynchronous” are allowed to execute before being automatically stopped by the SR OS. An asynchronous operation is not deleted from the system when it is stopped. See the asynchronous-retention command. If a specific execution timeout is not included in the request for a particular asynchronous operation, this system-level timeout applies. Note: This execution timeout is part of the general global operations infrastructure and is separate and independent from any operation-specific timeouts (for example, the ping operation also has its own timeout parameter). | |
| Range | 1 to 604800 | |
| Units | seconds | |
| Options | ||
| Default | 3600 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
asynchronous-retention (number | keyword)
| Synopsis | Timeout for asynchronous operation data retention | |
| Context | configure system management-interface operations global-timeouts asynchronous-retention (number | keyword) | |
| Tree | asynchronous-retention | |
Description | This command configures the period of time that data related to operations launched as “asynchronous” is retained in the system. After the retention timeout expires, all information related to the operation is deleted, including any status information and result data. If a specific retention timeout is not included in the request for a particular asynchronous operation, this system-level timeout applies. | |
| Range | 1 to 604800 | |
| Units | seconds | |
| Options | ||
| Default | 86400 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
synchronous-execution (number | keyword)
| Synopsis | Timeout for synchronous operation execution | |
| Context | configure system management-interface operations global-timeouts synchronous-execution (number | keyword) | |
| Tree | synchronous-execution | |
Description | This command configures the period of time that operations launched as “'synchronous” (the default method for all operations) are allowed to execute before they are automatically stopped, and their associated data is deleted. If a specific execution timeout is not included in the request for a particular synchronous operation, this system-level timeout applies. Note: This execution timeout is part of the general global operations infrastructure and is separate and independent from any operation-specific timeouts (for example, the ping operation also has its own timeout parameter). Caution: If this command is set with a specific time value, MD-CLI operations are subject to the timeout and are interrupted if they execute longer than the time value. This situation can arise because the timeout also applies to operations requested in the MD-CLI interface (for example, ping, file dir, and so on). | |
| Range | 1 to 604800 | |
| Units | seconds | |
| Options | ||
| Default | never | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
remote-management
| Synopsis | Enter the remote-management context | |
| Context | configure system management-interface remote-management | |
| Tree | remote-management | |
Description | Commands in this context configure the SR OS node to use the remote management service. Configuring remote management enables the SR OS node to report itself to a remote manager service running on a remote server, so that it is included in the dynamic list of available nodes. The manager service streamlines the management of multiple SR OS nodes running different SR OS versions using the same client application providing a similar shell to the MD-CLI. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of remote management registration | |
| Context | configure system management-interface remote-management admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
allow-unsecure-connection
| Synopsis | Allow connection without secured transport protocol | |
| Context | configure system management-interface remote-management allow-unsecure-connection | |
| Tree | allow-unsecure-connection | |
Description | When configured, this command allows an unsecured connection to remote managers; TCP connections are not encrypted, including username and password information. | |
Notes | The following elements are part of a choice: allow-unsecure-connection or client-tls-profile. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
client-tls-profile reference
| Synopsis | TLS client profile name | |
| Context | configure system management-interface remote-management client-tls-profile reference | |
| Tree | client-tls-profile | |
Description | This command specifies the client TLS profile to all remote managers. | |
Reference | configure system security tls client-tls-profile named-item | |
Notes | The following elements are part of a choice: allow-unsecure-connection or client-tls-profile. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
connection-timeout number
| Synopsis | Time without a response before manager declared down | |
| Context | configure system management-interface remote-management connection-timeout number | |
| Tree | connection-timeout | |
| Range | 1 to 3600 | |
| Units | seconds | |
| Default | 60 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
delay-on-boot number
| Synopsis | Delay for remote management after system boot | |
| Context | configure system management-interface remote-management delay-on-boot number | |
| Tree | delay-on-boot | |
Description | This command configures the delay timer for remote management connections over gRPC. When the timer expires, remote management becomes operational and connections are accepted. This delay prevents automation from managing the system while it is still converging. When no delay is configured, remote management connections are accepted after the system boots and gRPC becomes operational. | |
| Range | 1 to 3600 | |
| Units | seconds | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
device-label named-item-64
| Synopsis | Device label supplied to the remote manager | |
| Context | configure system management-interface remote-management device-label named-item-64 | |
| Tree | device-label | |
Description | This command specifies a metadata label that is supplied to the manager. This label is used to group devices or network nodes with a common purpose or goal. | |
| String length | 1 to 64 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
device-name named-item-64
| Synopsis | Device name supplied to the remote manager | |
| Context | configure system management-interface remote-management device-name named-item-64 | |
| Tree | device-name | |
Description | This command specifies a device name that is supplied to the manager. The name identifies a specific SR OS node in the network. When unconfigured, the default system name is used. | |
| String length | 1 to 64 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
hello-interval number
| Synopsis | Time between hello messages from SR OS node to manager | |
| Context | configure system management-interface remote-management hello-interval number | |
| Tree | hello-interval | |
| Range | 10 to 216000 | |
| Units | seconds | |
| Default | 600 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
manager [manager-name] named-item-64
| Synopsis | Enter the manager list instance | |
| Context | configure system management-interface remote-management manager named-item-64 | |
| Tree | manager | |
Description | Commands in this context configure options for a specific manager. Commands configured in this context take precedence over command values specified directly in the configure management-interface remote-management context. If a command is not configured in this context, the command setting is inherited from the higher level context. | |
| Max. instances | 2 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[manager-name] named-item-64
| Synopsis | Remote management manager name | |
| Context | configure system management-interface remote-management manager named-item-64 | |
| Tree | manager | |
| String length | 1 to 64 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of remote management registration | |
| Context | configure system management-interface remote-management manager named-item-64 admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
allow-unsecure-connection
| Synopsis | Allow connection without secured transport protocol | |
| Context | configure system management-interface remote-management manager named-item-64 allow-unsecure-connection | |
| Tree | allow-unsecure-connection | |
Description | When configured, the system allows an unsecured connection to the remote managers; the TCP connection is not encrypted. This includes username and password information. | |
Notes | The following elements are part of a choice: allow-unsecure-connection or client-tls-profile. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
client-tls-profile reference
| Synopsis | TLS client profile name assigned to the remote manager | |
| Context | configure system management-interface remote-management manager named-item-64 client-tls-profile reference | |
| Tree | client-tls-profile | |
Reference | configure system security tls client-tls-profile named-item | |
Notes | The following elements are part of a choice: allow-unsecure-connection or client-tls-profile. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
connection-timeout number
| Synopsis | Time without response before manager is declared down | |
| Context | configure system management-interface remote-management manager named-item-64 connection-timeout number | |
| Tree | connection-timeout | |
| Range | 1 to 3600 | |
| Units | seconds | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system management-interface remote-management manager named-item-64 description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
device-label named-item-64
| Synopsis | Device label supplied to the remote manager | |
| Context | configure system management-interface remote-management manager named-item-64 device-label named-item-64 | |
| Tree | device-label | |
Description | This command specifies a metadata label that is supplied to the manager. This label is used to group devices or network nodes with a common purpose or goal. | |
| String length | 1 to 64 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
device-name named-item-64
| Synopsis | Device name supplied to the remote manager | |
| Context | configure system management-interface remote-management manager named-item-64 device-name named-item-64 | |
| Tree | device-name | |
Description | This command specifies a device name that is supplied to the manager. The name identifies a specific SR OS node in the network. When unconfigured, the default system name is used. | |
| String length | 1 to 64 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
manager-address (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name)
| Synopsis | Destination IP address of the manager | |
| Context | configure system management-interface remote-management manager named-item-64 manager-address (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) | |
| Tree | manager-address | |
| String length | 1 to 255 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
manager-port number
| Synopsis | Destination TCP port for gRPC connections to manager | |
| Context | configure system management-interface remote-management manager named-item-64 manager-port number | |
| Tree | manager-port | |
| Range | 1 to 65535 | |
| Default | 57400 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
router-instance string
| Synopsis | Reference to a router or VPRN service name | |
| Context | configure system management-interface remote-management manager named-item-64 router-instance string | |
| Tree | router-instance | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
source-address (ipv4-address-no-zone | ipv6-address-no-zone)
| Synopsis | Source IP address for connection to the manager | |
| Context | configure system management-interface remote-management manager named-item-64 source-address (ipv4-address-no-zone | ipv6-address-no-zone) | |
| Tree | source-address | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
source-port (number | keyword)
| Synopsis | Source TCP destination port number | |
| Context | configure system management-interface remote-management manager named-item-64 source-port (number | keyword) | |
| Tree | source-port | |
| Range | 1 to 65535 | |
| Options | ||
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
router-instance string
| Synopsis | Router name or VPRN service name | |
| Context | configure system management-interface remote-management router-instance string | |
| Tree | router-instance | |
| Default | management | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
source-address (ipv4-address-no-zone | ipv6-address-no-zone)
| Synopsis | Source IP address for connection to the manager | |
| Context | configure system management-interface remote-management source-address (ipv4-address-no-zone | ipv6-address-no-zone) | |
| Tree | source-address | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
source-port (number | keyword)
| Synopsis | Source TCP port number to connection to the manager | |
| Context | configure system management-interface remote-management source-port (number | keyword) | |
| Tree | source-port | |
| Range | 1 to 65535 | |
| Options | ||
| Default | grpc-default | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
schema-path url
| Synopsis | Schema path URL | |
| Context | configure system management-interface schema-path url | |
| Tree | schema-path | |
Description | This command specifies the schema path where the SR OS YANG modules can be placed by the user before using a <get-schema> request. Nokia recommends that the URL string not exceed 135 characters for the <get-schema> request to work correctly with all schema files. If this command is not configured, the software upgrade process manages the YANG schema files to ensure the schema files are synchronized with the software image on both the primary and standby CPM. | |
| String length | 1 to 180 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
snmp
| Synopsis | Enter the snmp context | |
| Context | configure system management-interface snmp | |
| Tree | snmp | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of the SNMP agent | |
| Context | configure system management-interface snmp admin-state keyword | |
| Tree | admin-state | |
Description | This command administratively enables or disables SNMP agent operations. Disabling SNMP does not prevent the agent from sending SNMP notifications to configured SNMP trap destinations. In classic and mixed configuration mode, the agent is administratively disabled in the event of a reboot when the processing of the configuration file fails to complete or when an SNMP persistent index file fails while the bof system persistent-indices command is set to true. This prevents an SNMP-based management system from accessing and possibly synchronizing with a partially booted or incomplete network element. This auto-disable behavior is not applicable to model-driven configuration mode. | |
| Options | ||
| Default | enable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
engine-id engine-id-as-string
| Synopsis | SNMP engine ID that identifies the SNMPv3 node | |
| Context | configure system management-interface snmp engine-id engine-id-as-string | |
| Tree | engine-id | |
Description | This command sets the SNMP engine ID that uniquely identifies the SNMPv3 node. If unconfigured, the system uses an engine ID based on the information from the system backplane. If the SNMP engine ID is changed, the current configuration must be saved and a reboot must be executed. Otherwise, the previously configured SNMP communities and logger trap-target notify communities will not be valid for the new engine ID. Note: Changing the SNMP engine ID invalidates all SNMPv3 MD5 and SHA security digest keys, which may render the node unmanageable. When replacing a chassis, configure the new router to use the same engine ID as the previous router. This preserves SNMPv3 security keys and allows management stations to use their existing authentication keys for the new router. Ensure that the engine ID of each router is unique. A management domain can only maintain one instance of a specific engine ID. | |
| String length | 10 to 64 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
general-port number
| Synopsis | Port number used to send general SNMP messages | |
| Context | configure system management-interface snmp general-port number | |
| Tree | general-port | |
Description | This command configures the port number used to receive SNMP request messages and send replies. For the port used for SNMP notifications, configure the configure log snmp-trap-group trap-target port command. | |
| Range | 0 | 1 to 65535 | |
| Default | 161 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
max-bulk-duration number
| Synopsis | Maximum process duration before responses are returned | |
| Context | configure system management-interface snmp max-bulk-duration number | |
| Tree | max-bulk-duration | |
Description | This command sets the maximum duration to process an SNMP request before bulk responses are returned to avoid a timeout on the management system when a lot of information is returned in the response. | |
| Range | 100 to 5000 | |
| Units | milliseconds | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
packet-size number
| Synopsis | Maximum SNMP packet size generated by the node | |
| Context | configure system management-interface snmp packet-size number | |
| Tree | packet-size | |
| Range | 484 to 9216 | |
| Default | 1500 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
streaming
| Synopsis | Enter the streaming context | |
| Context | configure system management-interface snmp streaming | |
| Tree | streaming | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of SNMP streaming | |
| Context | configure system management-interface snmp streaming admin-state keyword | |
| Tree | admin-state | |
Description | This command enables or disables the proprietary SNMP request and response bundling as well as the TCP-based transport mechanism for optimizing network management of the router nodes. In higher latency networks, synchronizing router MIBs from network management using streaming takes less time than synchronizing using classic SNMP UDP requests. Streaming operates on TCP port 1491 and runs over IPv4 or IPv6. | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
transport keyword
| Synopsis | Transport protocol used by the SNMP agent | |
| Context | configure system management-interface snmp transport keyword | |
| Tree | transport | |
| Options | udp – UDP only tcp – TCP only both – TCP and UDP | |
| Default | udp | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
yang-modules
| Synopsis | Enter the yang-modules context | |
| Context | configure system management-interface yang-modules | |
| Tree | yang-modules | |
Description | Commands in this context determine the system support of the Nokia YANG models. The settings affect the data sent in a NETCONF <hello>, data populated in the RFC 6022 /netconf-state/schemas list, data returned in a <get-schema> request, and data populated in the RFC 8525 /yang-library. See "NETCONF monitoring" and "YANG library" in the 7705 SAR Gen 2 System Management Guide for more information. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
nmda
| Synopsis | Enter the nmda context | |
| Context | configure system management-interface yang-modules nmda | |
| Tree | nmda | |
Description | Commands in this context configure the attributes for the Network Management Datastores Architecture (NMDA). | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
nmda-support boolean
| Synopsis | Advertise NMDA support over NETCONF | |
| Context | configure system management-interface yang-modules nmda nmda-support boolean | |
| Tree | nmda-support | |
Description | When configured to true, this command enables the advertisement of NMDA support over NETCONF through the use of YANG library 1.1. When configured to false, this command disables NMDA advertisement over NETCONF and YANG library 1.0 is used. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
nokia-combined-modules boolean
| Synopsis | Support access to combined Nokia YANG models | |
| Context | configure system management-interface yang-modules nokia-combined-modules boolean | |
| Tree | nokia-combined-modules | |
Description | When configured to true, the system supports the combined Nokia YANG files for both configuration and state data in the NETCONF server. When the system is operating in classic configuration mode, attempts to access (read or write) the configuration using the Nokia configuration modules or namespace via NETCONF result in errors, even if this command is set to true. When configured to false, access to the combined Nokia YANG files is not supported. This command and the nokia-submodules command cannot both be set to true at the same time. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
nokia-submodules boolean
| Synopsis | Support submodule-based packaging of Nokia YANG models | |
| Context | configure system management-interface yang-modules nokia-submodules boolean | |
| Tree | nokia-submodules | |
Description | When configured to true, the system supports the alternative submodule-based packaging of the Nokia YANG files for both configuration and state data in the NETCONF server. When the system is operating in classic configuration mode, attempts to access (read or write) the configuration using the Nokia configuration modules or namespace via NETCONF result in errors, even if this command is set to true. When configured to false, access to the submodule-based packaging of the Nokia YANG files is not supported. This command and the nokia-combined-modules command cannot both be set to true at the same time. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
name named-item-64
network-element-discovery
| Synopsis | Enter the network-element-discovery context | |
| Context | configure system network-element-discovery | |
| Tree | network-element-discovery | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
generate-traps boolean
| Synopsis | Generate NE discovery traps | |
| Context | configure system network-element-discovery generate-traps boolean | |
| Tree | generate-traps | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
profile [name] named-item
| Synopsis | Enter the profile list instance | |
| Context | configure system network-element-discovery profile named-item | |
| Tree | profile | |
| Max. instances | 1 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[name] named-item
| Synopsis | Profile name | |
| Context | configure system network-element-discovery profile named-item | |
| Tree | profile | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
neid string
| Synopsis | Network element ID of the advertised node | |
| Context | configure system network-element-discovery profile named-item neid string | |
| Tree | neid | |
| String length | 7 to 8 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
neip
| Synopsis | Enter the neip context | |
| Context | configure system network-element-discovery profile named-item neip | |
| Tree | neip | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
auto-generate
| Synopsis | Enter the auto-generate context | |
| Context | configure system network-element-discovery profile named-item neip auto-generate | |
| Tree | auto-generate | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ipv4
| Synopsis | Enable the ipv4 context | |
| Context | configure system network-element-discovery profile named-item neip auto-generate ipv4 | |
| Tree | ipv4 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
vendor-id-value number
| Synopsis | Most significant byte if the NE IPv4 address | |
| Context | configure system network-element-discovery profile named-item neip auto-generate ipv4 vendor-id-value number | |
| Tree | vendor-id-value | |
| Range | 1 to 255 | |
| Default | 140 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
ipv6
| Synopsis | Enable the ipv6 context | |
| Context | configure system network-element-discovery profile named-item neip auto-generate ipv6 | |
| Tree | ipv6 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
vendor-id-value number
| Synopsis | Most significant byte of the NE IPv6 address | |
| Context | configure system network-element-discovery profile named-item neip auto-generate ipv6 vendor-id-value number | |
| Tree | vendor-id-value | |
| Range | 1 to 255 | |
| Default | 140 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
ipv4 ipv4-unicast-address
ipv6 ipv6-address
platform-type named-item-255
| Synopsis | Platform name and chassis type to be advertised | |
| Context | configure system network-element-discovery profile named-item platform-type named-item-255 | |
| Tree | platform-type | |
| String length | 1 to 255 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
system-mac mac-unicast-address-no-zero
| Synopsis | MAC address of the advertised node | |
| Context | configure system network-element-discovery profile named-item system-mac mac-unicast-address-no-zero | |
| Tree | system-mac | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
vendor-id named-item-255
| Synopsis | Vendor ID to be advertised | |
| Context | configure system network-element-discovery profile named-item vendor-id named-item-255 | |
| Tree | vendor-id | |
| String length | 1 to 255 | |
| Default | Nokia | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
ospf-dynamic-hostnames boolean
| Synopsis | Process received OSPF dynamic hostname information | |
| Context | configure system ospf-dynamic-hostnames boolean | |
| Tree | ospf-dynamic-hostnames | |
Description | When configured to true, OSPF dynamic hostnames are enabled. The router receiving the new dynamic hostname within the OSPF Router Information (RI) LSA is instructed to process the received dynamic hostname information. When configured to false, dynamic hostname information is not processed. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
persistence
| Synopsis | Enter the persistence context | |
| Context | configure system persistence | |
| Tree | persistence | |
Description | Commands in this context configure persistence on the system. The persistence feature enables the system to retain state information learned through DHCP snooping across reboots. This information includes data such as the IP address and MAC binding information, lease-length information, and ingress SAP information (required for VPLS snooping to identify the ingress interface). If persistence is enabled when there are no DHCP relay or snooping commands enabled, the system creates an empty file. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ancp
| Synopsis | Enter the ancp context | |
| Context | configure system persistence ancp | |
| Tree | ancp | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system persistence ancp description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
location keyword
| Synopsis | CPM flash card where the information is stored | |
| Context | configure system persistence ancp location keyword | |
| Tree | location | |
| Options | ||
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
dhcp-server
| Synopsis | Enter the dhcp-server context | |
| Context | configure system persistence dhcp-server | |
| Tree | dhcp-server | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system persistence dhcp-server description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
location keyword
| Synopsis | CPM flash card where the information is stored | |
| Context | configure system persistence dhcp-server location keyword | |
| Tree | location | |
| Options | ||
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
nat-port-forwarding
| Synopsis | Enter the nat-port-forwarding context | |
| Context | configure system persistence nat-port-forwarding | |
| Tree | nat-port-forwarding | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system persistence nat-port-forwarding description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
location keyword
| Synopsis | CPM flash card where the information is stored | |
| Context | configure system persistence nat-port-forwarding location keyword | |
| Tree | location | |
| Options | ||
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
script-control
| Synopsis | Enter the script-control context | |
| Context | configure system script-control | |
| Tree | script-control | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
script [script-name] named-item owner named-item
| Synopsis | Enter the script list instance | |
| Context | configure system script-control script named-item owner named-item | |
| Tree | script | |
| Max. instances | 1500 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[script-name] named-item
| Synopsis | Script name | |
| Context | configure system script-control script named-item owner named-item | |
| Tree | script | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
owner named-item
| Synopsis | Script owner | |
| Context | configure system script-control script named-item owner named-item | |
| Tree | script | |
Description | This command configures the owner to be associated with the script. The owner is optional and "TiMOS CLI" is used if an owner is not specified. The owner is an arbitrary name and not necessarily a user name. Commands in the scripts are not authorized against the owner. The configure system security cli-script authorization x cli-user command determines the user context against which commands in the scripts are authorized. | |
| String length | 1 to 32 | |
| MD-CLI default | TiMOS CLI | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of the script | |
| Context | configure system script-control script named-item owner named-item admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system script-control script named-item owner named-item description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
location string-not-all-spaces
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Script location | |
| Context | configure system script-control script named-item owner named-item location string-not-all-spaces | |
| Tree | location | |
| String length | 1 to 255 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
script-policy [policy-name] named-item owner named-item
| Synopsis | Enter the script-policy list instance | |
| Context | configure system script-control script-policy named-item owner named-item | |
| Tree | script-policy | |
| Max. instances | 1500 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[policy-name] named-item
| Synopsis | Script policy name | |
| Context | configure system script-control script-policy named-item owner named-item | |
| Tree | script-policy | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
owner named-item
| Synopsis | Script policy owner | |
| Context | configure system script-control script-policy named-item owner named-item | |
| Tree | script-policy | |
Description | This command configures the owner to be associated with the script policy. The owner is optional and "TiMOS CLI" is used if an owner is not specified. The owner is an arbitrary name and not necessarily a user name. Commands in the scripts are not authorized against the owner. The configure system security cli-script authorization x cli-user command determines the user context against which commands in the scripts are authorized. | |
| String length | 1 to 32 | |
| MD-CLI default | TiMOS CLI | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of the script policy | |
| Context | configure system script-control script-policy named-item owner named-item admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
expire-time (number | keyword)
| Synopsis | Maximum amount of time to keep a run history status | |
| Context | configure system script-control script-policy named-item owner named-item expire-time (number | keyword) | |
| Tree | expire-time | |
| Range | 0 to 21474836 | |
| Units | seconds | |
| Options | ||
| Default | 3600 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
lifetime (number | keyword)
| Synopsis | Maximum amount of time the script may run | |
| Context | configure system script-control script-policy named-item owner named-item lifetime (number | keyword) | |
| Tree | lifetime | |
| Range | 0 to 21474836 | |
| Units | seconds | |
| Options | ||
| Default | 3600 | |
Notes |
The following elements are part of a choice: (lifetime and script) or (python-lifetime and python-script). | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
lock-override boolean
| Synopsis | Allow EHS/CRON script to break database explicit lock | |
| Context | configure system script-control script-policy named-item owner named-item lock-override boolean | |
| Tree | lock-override | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
max-completed number
| Synopsis | Maximum number of script history status entries kept | |
| Context | configure system script-control script-policy named-item owner named-item max-completed number | |
| Tree | max-completed | |
| Range | 1 to 1500 | |
| Default | 1 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
python-lifetime number
| Synopsis | Maximum time the Python application can run | |
| Context | configure system script-control script-policy named-item owner named-item python-lifetime number | |
| Tree | python-lifetime | |
| Range | 30 to 86400 | |
| Units | seconds | |
Notes |
The following elements are part of a choice: (lifetime and script) or (python-lifetime and python-script). | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
python-script
| Synopsis | Enter the python-script context | |
| Context | configure system script-control script-policy named-item owner named-item python-script | |
| Tree | python-script | |
Notes | The following elements are part of a choice: (lifetime and script) or (python-lifetime and python-script). | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
results string-not-all-spaces
| Synopsis | Location to receive CLI output of a script run | |
| Context | configure system script-control script-policy named-item owner named-item results string-not-all-spaces | |
| Tree | results | |
| String length | 1 to 255 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
script
| Synopsis | Enter the script context | |
| Context | configure system script-control script-policy named-item owner named-item script | |
| Tree | script | |
Notes | The following elements are part of a choice: (lifetime and script) or (python-lifetime and python-script). | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
name named-item
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Script name | |
| Context | configure system script-control script-policy named-item owner named-item script name named-item | |
| Tree | name | |
| String length | 1 to 32 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
owner named-item
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Script owner | |
| Context | configure system script-control script-policy named-item owner named-item script owner named-item | |
| Tree | owner | |
| String length | 1 to 32 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
security
| Synopsis | Enter the security context | |
| Context | configure system security | |
| Tree | security | |
Description | Commands in this context configure central security settings such as DDoS protection, users, authorization profiles, and certificates. Access to these commands should be restricted to highly trusted users and device administrators. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
aaa
cli-session-group [cli-session-group-name] named-item
| Synopsis | Enter the cli-session-group list instance | |
| Context | configure system security aaa cli-session-group named-item | |
| Tree | cli-session-group | |
| Max. instances | 16 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[cli-session-group-name] named-item
| Synopsis | CLI session group name | |
| Context | configure system security aaa cli-session-group named-item | |
| Tree | cli-session-group | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
combined-max-sessions number
| Synopsis | Maximum number of concurrent SSH and Telnet sessions | |
| Context | configure system security aaa cli-session-group named-item combined-max-sessions number | |
| Tree | combined-max-sessions | |
| Range | 0 to 50 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system security aaa cli-session-group named-item description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ssh-max-sessions number
| Synopsis | Maximum number of concurrent SSH sessions | |
| Context | configure system security aaa cli-session-group named-item ssh-max-sessions number | |
| Tree | ssh-max-sessions | |
| Range | 0 to 50 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
telnet-max-sessions number
| Synopsis | Maximum number of concurrent Telnet sessions | |
| Context | configure system security aaa cli-session-group named-item telnet-max-sessions number | |
| Tree | telnet-max-sessions | |
| Range | 0 to 50 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
health-check (number | keyword)
| Synopsis | Polling interval of RADIUS, TACACS+, and LDAP servers | |
| Context | configure system security aaa health-check (number | keyword) | |
| Tree | health-check | |
| Range | 6 to 1500 | |
| Units | seconds | |
| Options | ||
| Default | 30 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
local-profiles
| Synopsis | Enter the local-profiles context | |
| Context | configure system security aaa local-profiles | |
| Tree | local-profiles | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
profile [user-profile-name] named-item
[user-profile-name] named-item
cli-session-group reference
| Synopsis | CLI session group to which the profile belongs | |
| Context | configure system security aaa local-profiles profile named-item cli-session-group reference | |
| Tree | cli-session-group | |
Reference | configure system security aaa cli-session-group named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
combined-max-sessions number
| Synopsis | Maximum number of concurrent SSH and Telnet sessions | |
| Context | configure system security aaa local-profiles profile named-item combined-max-sessions number | |
| Tree | combined-max-sessions | |
| Range | 0 to 50 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
default-action keyword
| Synopsis | Action for non-matching entry | |
| Context | configure system security aaa local-profiles profile named-item default-action keyword | |
| Tree | default-action | |
Description | This command specifies the default action to be applied when no match conditions are met in the list of profile entry match commands. It does not apply in any way to other ports of the profile such as grpc rpc-authorization or netconf base-op-authorization. | |
| Options | ||
| Default | none | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
entry [entry-id] number
[entry-id] number
action keyword
description description
| Synopsis | Text description | |
| Context | configure system security aaa local-profiles profile named-item entry number description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
match display-string
grpc
rpc-authorization
| Synopsis | Enter the rpc-authorization context | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization | |
| Tree | rpc-authorization | |
Description | Commands in this context control the authorization of each RPC in gRPC interfaces. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnmi-capabilities keyword
| Synopsis | gNMI Capabilities RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnmi-capabilities keyword | |
| Tree | gnmi-capabilities | |
| Options | ||
| Default | permit | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnmi-get keyword
| Synopsis | gNMI Get RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnmi-get keyword | |
| Tree | gnmi-get | |
| Options | ||
| Default | permit | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnmi-set keyword
| Synopsis | gNMI Set RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnmi-set keyword | |
| Tree | gnmi-set | |
| Options | ||
| Default | permit | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnmi-subscribe keyword
| Synopsis | gNMI Subscribe RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnmi-subscribe keyword | |
| Tree | gnmi-subscribe | |
| Options | ||
| Default | permit | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnoi-cert-mgmt-cangenerate keyword
| Synopsis | gNOI CanGenerateCSR RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnoi-cert-mgmt-cangenerate keyword | |
| Tree | gnoi-cert-mgmt-cangenerate | |
| Options | ||
| Default | deny | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnoi-cert-mgmt-getcert keyword
| Synopsis | gNOI GetCertificates RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnoi-cert-mgmt-getcert keyword | |
| Tree | gnoi-cert-mgmt-getcert | |
| Options | ||
| Default | deny | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnoi-cert-mgmt-install keyword
| Synopsis | gNOI Install RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnoi-cert-mgmt-install keyword | |
| Tree | gnoi-cert-mgmt-install | |
| Options | ||
| Default | deny | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnoi-cert-mgmt-revoke keyword
| Synopsis | gNOI RevokeCertificates RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnoi-cert-mgmt-revoke keyword | |
| Tree | gnoi-cert-mgmt-revoke | |
| Options | ||
| Default | deny | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnoi-cert-mgmt-rotate keyword
| Synopsis | gNOI Rotate RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnoi-cert-mgmt-rotate keyword | |
| Tree | gnoi-cert-mgmt-rotate | |
| Options | ||
| Default | deny | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnoi-file-get keyword
| Synopsis | gNOI File Get RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnoi-file-get keyword | |
| Tree | gnoi-file-get | |
| Options | ||
| Default | permit | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnoi-file-put keyword
| Synopsis | gNOI File Put RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnoi-file-put keyword | |
| Tree | gnoi-file-put | |
| Options | ||
| Default | permit | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnoi-file-remove keyword
| Synopsis | gNOI File Remove RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnoi-file-remove keyword | |
| Tree | gnoi-file-remove | |
| Options | ||
| Default | permit | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnoi-file-stat keyword
| Synopsis | gNOI File Stat RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnoi-file-stat keyword | |
| Tree | gnoi-file-stat | |
| Options | ||
| Default | permit | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnoi-file-transfertoremote keyword
| Synopsis | gNOI File TransferToRemote RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnoi-file-transfertoremote keyword | |
| Tree | gnoi-file-transfertoremote | |
| Options | ||
| Default | permit | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnoi-system-cancelreboot keyword
| Synopsis | gNOI System CancelReboot RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnoi-system-cancelreboot keyword | |
| Tree | gnoi-system-cancelreboot | |
| Options | ||
| Default | deny | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnoi-system-ping keyword
| Synopsis | gNOI System Ping RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnoi-system-ping keyword | |
| Tree | gnoi-system-ping | |
| Options | ||
| Default | permit | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnoi-system-reboot keyword
| Synopsis | gNOI System Reboot RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnoi-system-reboot keyword | |
| Tree | gnoi-system-reboot | |
| Options | ||
| Default | deny | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnoi-system-rebootstatus keyword
| Synopsis | gNOI System RebootStatus RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnoi-system-rebootstatus keyword | |
| Tree | gnoi-system-rebootstatus | |
| Options | ||
| Default | deny | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnoi-system-setpackage keyword
| Synopsis | gNOI System SetPackage RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnoi-system-setpackage keyword | |
| Tree | gnoi-system-setpackage | |
| Options | ||
| Default | deny | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnoi-system-switchcontrolprocessor keyword
| Synopsis | gNOI System SwitchControlProcessor RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnoi-system-switchcontrolprocessor keyword | |
| Tree | gnoi-system-switchcontrolprocessor | |
| Options | ||
| Default | deny | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnoi-system-time keyword
| Synopsis | gNOI System Time RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnoi-system-time keyword | |
| Tree | gnoi-system-time | |
| Options | ||
| Default | permit | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
gnoi-system-traceroute keyword
| Synopsis | gNOI System Traceroute RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization gnoi-system-traceroute keyword | |
| Tree | gnoi-system-traceroute | |
| Options | ||
| Default | permit | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
md-cli-session keyword
| Synopsis | gNOI MdCli Session RPC authorization | |
| Context | configure system security aaa local-profiles profile named-item grpc rpc-authorization md-cli-session keyword | |
| Tree | md-cli-session | |
| Options | ||
| Default | permit | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
netconf
base-op-authorization
| Synopsis | Enter the base-op-authorization context | |
| Context | configure system security aaa local-profiles profile named-item netconf base-op-authorization | |
| Tree | base-op-authorization | |
Description | Commands in this context configure the permission to use NETCONF operations at the base operation level for the specified profile. The NETCONF operations are authorized by default in the built-in system-generated administrative profile. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
action boolean
| Synopsis | Allow the NETCONF <action> RPC | |
| Context | configure system security aaa local-profiles profile named-item netconf base-op-authorization action boolean | |
| Tree | action | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
cancel-commit boolean
| Synopsis | Allow the NETCONF <cancel-commit> RPC | |
| Context | configure system security aaa local-profiles profile named-item netconf base-op-authorization cancel-commit boolean | |
| Tree | cancel-commit | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
close-session boolean
| Synopsis | Allow the NETCONF <close-session> RPC | |
| Context | configure system security aaa local-profiles profile named-item netconf base-op-authorization close-session boolean | |
| Tree | close-session | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
commit boolean
| Synopsis | Allow the NETCONF <commit> RPC | |
| Context | configure system security aaa local-profiles profile named-item netconf base-op-authorization commit boolean | |
| Tree | commit | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
copy-config boolean
| Synopsis | Allow the NETCONF <copy-config> RPC | |
| Context | configure system security aaa local-profiles profile named-item netconf base-op-authorization copy-config boolean | |
| Tree | copy-config | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
create-subscription boolean
| Synopsis | Allow the NETCONF <create-subscription> RPC | |
| Context | configure system security aaa local-profiles profile named-item netconf base-op-authorization create-subscription boolean | |
| Tree | create-subscription | |
Description | When configured to true, the system enables the NETCONF create-subscription operation in the default profile. The configuration of this command is checked only at the time of the initial subscription. Configuration changes to this command do not cancel any in-progress subscriptions, and users who successfully subscribed initially continue to receive messages. The operation is enabled by default in the built-in system-generated administrative profile. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
delete-config boolean
| Synopsis | Allow the NETCONF <delete-config> RPC | |
| Context | configure system security aaa local-profiles profile named-item netconf base-op-authorization delete-config boolean | |
| Tree | delete-config | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
discard-changes boolean
| Synopsis | Allow the NETCONF <discard-changes> RPC | |
| Context | configure system security aaa local-profiles profile named-item netconf base-op-authorization discard-changes boolean | |
| Tree | discard-changes | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
edit-config boolean
| Synopsis | Allow the NETCONF <edit-config> RPC | |
| Context | configure system security aaa local-profiles profile named-item netconf base-op-authorization edit-config boolean | |
| Tree | edit-config | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
get boolean
| Synopsis | Allow the NETCONF <get> RPC | |
| Context | configure system security aaa local-profiles profile named-item netconf base-op-authorization get boolean | |
| Tree | get | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
get-config boolean
| Synopsis | Allow the NETCONF <get-config> RPC | |
| Context | configure system security aaa local-profiles profile named-item netconf base-op-authorization get-config boolean | |
| Tree | get-config | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
get-data boolean
| Synopsis | Allow the NETCONF <get-data> RPC | |
| Context | configure system security aaa local-profiles profile named-item netconf base-op-authorization get-data boolean | |
| Tree | get-data | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
get-schema boolean
| Synopsis | Allow the NETCONF <get-schema> RPC | |
| Context | configure system security aaa local-profiles profile named-item netconf base-op-authorization get-schema boolean | |
| Tree | get-schema | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
kill-session boolean
| Synopsis | Allow the NETCONF <kill-session> RPC | |
| Context | configure system security aaa local-profiles profile named-item netconf base-op-authorization kill-session boolean | |
| Tree | kill-session | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
lock boolean
| Synopsis | Allow the NETCONF <lock> and <unlock> RPCs | |
| Context | configure system security aaa local-profiles profile named-item netconf base-op-authorization lock boolean | |
| Tree | lock | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
validate boolean
| Synopsis | Allow the NETCONF <validate> RPC | |
| Context | configure system security aaa local-profiles profile named-item netconf base-op-authorization validate boolean | |
| Tree | validate | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
ssh-max-sessions number
| Synopsis | Maximum number of concurrent SSH sessions | |
| Context | configure system security aaa local-profiles profile named-item ssh-max-sessions number | |
| Tree | ssh-max-sessions | |
| Range | 0 to 50 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
telnet-max-sessions number
| Synopsis | Maximum number of concurrent Telnet sessions | |
| Context | configure system security aaa local-profiles profile named-item telnet-max-sessions number | |
| Tree | telnet-max-sessions | |
| Range | 0 to 50 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
management-interface
| Synopsis | Enter the management-interface context | |
| Context | configure system security aaa management-interface | |
| Tree | management-interface | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
md-cli
command-accounting-during-load boolean
| Synopsis | Perform file command accounting for load or rollback | |
| Context | configure system security aaa management-interface md-cli command-accounting-during-load boolean | |
| Tree | command-accounting-during-load | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
output-authorization
| Synopsis | Enter the output-authorization context | |
| Context | configure system security aaa management-interface output-authorization | |
| Tree | output-authorization | |
Description | Commands in this context configure output authorization for model-driven interfaces and telemetry. When output authorization is performed, commands that display configuration or state output must authorize every element in the output. If a remote AAA server is configured, there may be delays in displaying output while the output is authorized. The remote AAA server may receive a large volume of authorization requests when substantial output displays are needed, such as for system configuration details. Input to edit the configuration is always authorized, and is not affected by commands in this context. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
md-interfaces boolean
| Synopsis | Authorize output in model-driven interfaces | |
| Context | configure system security aaa management-interface output-authorization md-interfaces boolean | |
| Tree | md-interfaces | |
Description | When configured to true, output is authorized for the following:
| |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
telemetry-data boolean
| Synopsis | Authorize dial-in telemetry output | |
| Context | configure system security aaa management-interface output-authorization telemetry-data boolean | |
| Tree | telemetry-data | |
Description | When configured to true, the system authorizes telemetry data in gNMI Subscriber RPC responses for dial-in telemetry. When configured to false, telemetry data is not authorized. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
telemetry-default-user reference
| Synopsis | Local user for dial-out telemetry output authorization | |
| Context | configure system security aaa management-interface output-authorization telemetry-default-user reference | |
| Tree | telemetry-default-user | |
Description | This command specifies the local user for telemetry data authorization in gNMI Publish RPCs for dial-out telemetry. The administrator must configure the local user to ensure the subscription is operational. | |
Reference | configure system security user-params local-user user named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
remote-servers
| Synopsis | Enter the remote-servers context | |
| Context | configure system security aaa remote-servers | |
| Tree | remote-servers | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ldap
admin-state keyword
| Synopsis | Administrative state of the LDAP operation protocol | |
| Context | configure system security aaa remote-servers ldap admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | enable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
public-key-authentication boolean
| Synopsis | Allow SSH public key authentication from LDAP server | |
| Context | configure system security aaa remote-servers ldap public-key-authentication boolean | |
| Tree | public-key-authentication | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
route-preference keyword
| Synopsis | Route preference to reach the AAA server | |
| Context | configure system security aaa remote-servers ldap route-preference keyword | |
| Tree | route-preference | |
Description | This command specifies the routing preference to reach the AAA server. If the configured option is to use both in-band and out-of-band routes, the out-of-band routes in the Base routing instance are used to reach the server before the in-band routes in the management routing instance. | |
| Options | ||
| Default | both | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
server [index] number
[index] number
address [ip-address] (ipv4-address-no-zone | ipv6-address-no-zone)
[ip-address] (ipv4-address-no-zone | ipv6-address-no-zone)
port number
admin-state keyword
| Synopsis | Administrative state of the LDAP server | |
| Context | configure system security aaa remote-servers ldap server number admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
bind-authentication
| Synopsis | Enter the bind-authentication context | |
| Context | configure system security aaa remote-servers ldap server number bind-authentication | |
| Tree | bind-authentication | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
password encrypted-leaf
| Synopsis | Password used for authentication with the LDAP server | |
| Context | configure system security aaa remote-servers ldap server number bind-authentication password encrypted-leaf | |
| Tree | password | |
| String length | 1 to 199 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
root-dn string-not-all-spaces
| Synopsis | Root domain used for authentication with LDAP server | |
| Context | configure system security aaa remote-servers ldap server number bind-authentication root-dn string-not-all-spaces | |
| Tree | root-dn | |
| String length | 1 to 512 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
search
base-dn string-not-all-spaces
server-name named-item
| Synopsis | LDAP server name | |
| Context | configure system security aaa remote-servers ldap server number server-name named-item | |
| Tree | server-name | |
| String length | 1 to 32 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
tls-profile reference
| Synopsis | TLS client profile used to encrypt the LDAP connection | |
| Context | configure system security aaa remote-servers ldap server number tls-profile reference | |
| Tree | tls-profile | |
Reference | configure system security tls client-tls-profile named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
server-retry number
| Synopsis | Number of attempts to retry contacting the LDAP server | |
| Context | configure system security aaa remote-servers ldap server-retry number | |
| Tree | server-retry | |
| Range | 1 to 10 | |
| Default | 3 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
server-timeout number
| Synopsis | Timeout for a response from the LDAP server | |
| Context | configure system security aaa remote-servers ldap server-timeout number | |
| Tree | server-timeout | |
| Range | 1 to 90 | |
| Units | seconds | |
| Default | 3 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
use-default-template boolean
| Synopsis | Apply the default template to LDAP | |
| Context | configure system security aaa remote-servers ldap use-default-template boolean | |
| Tree | use-default-template | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
radius
access-algorithm keyword
| Synopsis | Algorithm used to access the set of RADIUS servers | |
| Context | configure system security aaa remote-servers radius access-algorithm keyword | |
| Tree | access-algorithm | |
| Options | ||
| Default | direct | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
accounting boolean
| Synopsis | Enable RADIUS command accounting | |
| Context | configure system security aaa remote-servers radius accounting boolean | |
| Tree | accounting | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
accounting-port number
| Synopsis | Port number on RADIUS server for accounting requests | |
| Context | configure system security aaa remote-servers radius accounting-port number | |
| Tree | accounting-port | |
| Range | 1 to 65535 | |
| Default | 1813 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of the authentication server | |
| Context | configure system security aaa remote-servers radius admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | enable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
authorization boolean
| Synopsis | Enable RADIUS authorization | |
| Context | configure system security aaa remote-servers radius authorization boolean | |
| Tree | authorization | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
interactive-authentication boolean
| Synopsis | Enable RADIUS interactive authentication | |
| Context | configure system security aaa remote-servers radius interactive-authentication boolean | |
| Tree | interactive-authentication | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
port number
route-preference keyword
| Synopsis | Route preference to reach the AAA server | |
| Context | configure system security aaa remote-servers radius route-preference keyword | |
| Tree | route-preference | |
Description | This command specifies the routing preference to reach the AAA server. If the configured option is to use both in-band and out-of-band routes, the out-of-band routes in the Base routing instance are used to reach the server before the in-band routes in the management routing instance. | |
| Options | ||
| Default | both | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
server [index] number
[index] number
address (ipv4-address-no-zone | ipv6-address-no-zone)
authenticator keyword
| Synopsis | Authenticator hash algorithm for the RADIUS server | |
| Context | configure system security aaa remote-servers radius server number authenticator keyword | |
| Tree | authenticator | |
Description | This command specifies the hash algorithm used to authenticate RADIUS Access-Request, Access-Accept, Access-Reject, Access-Challenge, Accounting-Request, and Accounting-Response packets. | |
| Options | ||
| Default | md5 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
secret encrypted-leaf
tls-client-profile reference
| Synopsis | TLS client profile for the RADIUS server | |
| Context | configure system security aaa remote-servers radius server number tls-client-profile reference | |
| Tree | tls-client-profile | |
Description | This command specifies the TLS client profile used to encrypt RADIUS communication. When configured, RADIUS messages are sent using TLS. | |
Reference | configure system security tls client-tls-profile named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
server-retry number
| Synopsis | Number of attempts to retry contacting RADIUS server | |
| Context | configure system security aaa remote-servers radius server-retry number | |
| Tree | server-retry | |
| Range | 1 to 10 | |
| Default | 3 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
server-timeout number
| Synopsis | Time to wait for a response from the RADIUS server | |
| Context | configure system security aaa remote-servers radius server-timeout number | |
| Tree | server-timeout | |
| Range | 1 to 90 | |
| Units | seconds | |
| Default | 3 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
use-default-template boolean
| Synopsis | Apply the RADIUS default user template to RADIUS user | |
| Context | configure system security aaa remote-servers radius use-default-template boolean | |
| Tree | use-default-template | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
tacplus
accounting
| Synopsis | Enable the accounting context | |
| Context | configure system security aaa remote-servers tacplus accounting | |
| Tree | accounting | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
record-type keyword
| Synopsis | Type of accounting record packet sent to TACACS+ server | |
| Context | configure system security aaa remote-servers tacplus accounting record-type keyword | |
| Tree | record-type | |
| Options | ||
| Default | stop-only | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-control
| Synopsis | Enter the admin-control context | |
| Context | configure system security aaa remote-servers tacplus admin-control | |
| Tree | admin-control | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
tacplus-map-to-priv-lvl number
| Synopsis | Interactive authentication from node to TACACS+ server | |
| Context | configure system security aaa remote-servers tacplus admin-control tacplus-map-to-priv-lvl number | |
| Tree | tacplus-map-to-priv-lvl | |
| Range | 0 to 15 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of the TACACS+ protocol | |
| Context | configure system security aaa remote-servers tacplus admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | enable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
authorization
| Synopsis | Enable the authorization context | |
| Context | configure system security aaa remote-servers tacplus authorization | |
| Tree | authorization | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
request-format
| Synopsis | Enter the request-format context | |
| Context | configure system security aaa remote-servers tacplus authorization request-format | |
| Tree | request-format | |
Description | Commands in this context configure access operations that are sent to the TACACS+ server during authorization. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
access-operation-cmd keyword
| Synopsis | Access operations sent in authorization requests | |
| Context | configure system security aaa remote-servers tacplus authorization request-format access-operation-cmd keyword | |
| Tree | access-operation-cmd | |
Description | This command sends an operation argument in authorization requests. In model-driven interfaces, this command configures the system to send the operation in the cmd argument, and the path in the cmd-args argument, in TACACS+ authorization requests. This command does not apply to authorization requests in classic interfaces. | |
| Options | ||
| Max. instances | 1 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
use-priv-lvl boolean
| Synopsis | Allow privilege level mapping | |
| Context | configure system security aaa remote-servers tacplus authorization use-priv-lvl boolean | |
| Tree | use-priv-lvl | |
Description | When configured to true, this command automatically performs a single authorization request to the TACACS+ server for cmd* (all commands) immediately after login, and then uses the local profile associated (via the priv-lvl-map) with the priv-lvl returned by the TACACS+ server for all subsequent authorization (except enable-admin). After the initial authorization for cmd*, no further authorization requests are sent to the TACACS+ server (except enable-admin). When configured to false, each command is sent to the TACACS+ server for authorization (this is true regardless of whether the tacplus use-default-template setting is enabled). | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
ignore-unknown-mandatory-vsas boolean
| Synopsis | Ignore unknown mandatory VSAs and fail authentication | |
| Context | configure system security aaa remote-servers tacplus ignore-unknown-mandatory-vsas boolean | |
| Tree | ignore-unknown-mandatory-vsas | |
Description | When configured to true, the system ignores unknown mandatory VSAs and authentication succeeds. When configured to false, the system ignores unknown mandatory VSAs received in a reply from the TACACS+ server. Authentication fails and the user is disconnected because the system cannot process a mandatory VSA that is unknown. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
interactive-authentication boolean
| Synopsis | Allows TACACS+ interactive authentication | |
| Context | configure system security aaa remote-servers tacplus interactive-authentication boolean | |
| Tree | interactive-authentication | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
priv-lvl-map
| Synopsis | Enter the priv-lvl-map context | |
| Context | configure system security aaa remote-servers tacplus priv-lvl-map | |
| Tree | priv-lvl-map | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
priv-lvl [level] number
| Synopsis | Enter the priv-lvl list instance | |
| Context | configure system security aaa remote-servers tacplus priv-lvl-map priv-lvl number | |
| Tree | priv-lvl | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[level] number
| Synopsis | Privilege level for the mapping | |
| Context | configure system security aaa remote-servers tacplus priv-lvl-map priv-lvl number | |
| Tree | priv-lvl | |
| Range | 0 to 15 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
user-profile-name reference
| Synopsis | User profile for the mapping | |
| Context | configure system security aaa remote-servers tacplus priv-lvl-map priv-lvl number user-profile-name reference | |
| Tree | user-profile-name | |
Reference | configure system security aaa local-profiles profile named-item | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
route-preference keyword
| Synopsis | Route preference to reach the AAA server | |
| Context | configure system security aaa remote-servers tacplus route-preference keyword | |
| Tree | route-preference | |
Description | This command specifies the routing preference to reach the AAA server. If the configured option is to use both in-band and out-of-band routes, the out-of-band routes in the Base routing instance are used to reach the server before the in-band routes in the management routing instance. | |
| Options | ||
| Default | both | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
server [index] number
[index] number
address (ipv4-address-no-zone | ipv6-address-no-zone)
port number
secret encrypted-leaf
server-retry-timeout (number | keyword)
| Synopsis | Time before retrying requests when health checks are disabled | |
| Context | configure system security aaa remote-servers tacplus server-retry-timeout (number | keyword) | |
| Tree | server-retry-timeout | |
Description | This command configures the maximum timeout before retrying requests when health checks are disabled and all TACACS+ servers are operationally down. Set the value of this timer to a lower value or disable it to increase the interactive responsiveness of AAA requests after the servers become unreachable. | |
| Range | 1 to 300 | |
| Units | seconds | |
| Options | none – Disable retry timeout and send requests immediately | |
| Default | 300 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
server-timeout number
| Synopsis | Time to wait for a response from the TACACS+ server | |
| Context | configure system security aaa remote-servers tacplus server-timeout number | |
| Tree | server-timeout | |
| Range | 1 to 90 | |
| Units | seconds | |
| Default | 3 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
service-request
| Synopsis | Enter the service-request context | |
| Context | configure system security aaa remote-servers tacplus service-request | |
| Tree | service-request | |
Description | Commands in this context enable Nokia services to be requested from the TACACS+ server when a user authenticates. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
nokia-grpc-rpc-authorization boolean
| Synopsis | Request nokia-grpc-rpc-authorization service VSAs | |
| Context | configure system security aaa remote-servers tacplus service-request nokia-grpc-rpc-authorization boolean | |
| Tree | nokia-grpc-rpc-authorization | |
Description | When configured to true, the nokia-grpc-rpc-authorization service is requested from the TACACS+ server after successful authentication. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
nokia-netconf-base-op-authorization boolean
| Synopsis | Request nokia-netconf-base-op-authorization service VSAs | |
| Context | configure system security aaa remote-servers tacplus service-request nokia-netconf-base-op-authorization boolean | |
| Tree | nokia-netconf-base-op-authorization | |
Description | When configured to true, the nokia-netconf-base-op-authorization service is requested from the TACACS+ server after successful authentication. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
nokia-user boolean
| Synopsis | Request nokia-user service VSAs | |
| Context | configure system security aaa remote-servers tacplus service-request nokia-user boolean | |
| Tree | nokia-user | |
Description | When configured to true, the nokia-user service is requested from the TACACS+ server after successful authentication. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
nokia-user-profile boolean
| Synopsis | Request nokia-user-profile service VSAs | |
| Context | configure system security aaa remote-servers tacplus service-request nokia-user-profile boolean | |
| Tree | nokia-user-profile | |
Description | When configured to true, the nokia-user-profile service is requested from the TACACS+ server after successful authentication. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
use-default-template boolean
| Synopsis | Apply TACACS+ default user-template to TACACS+ user | |
| Context | configure system security aaa remote-servers tacplus use-default-template boolean | |
| Tree | use-default-template | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
vprn-server
| Synopsis | Enter the vprn-server context | |
| Context | configure system security aaa remote-servers vprn-server | |
| Tree | vprn-server | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
inband reference
| Synopsis | VPRN service used for AAA by in-band sessions | |
| Context | configure system security aaa remote-servers vprn-server inband reference | |
| Tree | inband | |
Description | This command configures TACACS+ or RADIUS servers in a VPRN to be used for AAA by that VPRN and by sessions in the Base routing instance. | |
Reference | ||
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
outband reference
| Synopsis | VPRN service used for AAA by out-of-band sessions | |
| Context | configure system security aaa remote-servers vprn-server outband reference | |
| Tree | outband | |
Description | This command configures TACACS+ and RADIUS servers in a VPRN to be used for AAA by that VPRN and by sessions on the console or out-of-band (OOB) Ethernet ports. | |
Reference | ||
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
vprn reference
| Synopsis | VPRN used for AAA in VPRNs without a AAA server | |
| Context | configure system security aaa remote-servers vprn-server vprn reference | |
| Tree | vprn | |
Description | This command configures TACACS+ or RADIUS servers in a VPRN to be used for AAA by that VPRN and by sessions in VPRNs without a AAA server configured. | |
Reference | ||
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
user-template [user-template-name] keyword
| Synopsis | Enter the user-template list instance | |
| Context | configure system security aaa user-template keyword | |
| Tree | user-template | |
Description | Commands in this context configure templates for remote users. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[user-template-name] keyword
| Synopsis | Default user template applied to the remote user | |
| Context | configure system security aaa user-template keyword | |
| Tree | user-template | |
| Options | ldap-default – Default LDAP user template radius-default – Default RADIUS user template tacplus-default – Default TACACS+ user template | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
access
| Synopsis | Enter the access context | |
| Context | configure system security aaa user-template keyword access | |
| Tree | access | |
Description | Commands in this context grant a user access to the router management access methods. If a user requires access to more than one method, multiple methods can be specified. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
bluetooth boolean
console boolean
| Synopsis | Allow Bluetooth, console port CLI, SCP/SFTP, SSH CLI, and Telnet CLI access | |
| Context | configure system security aaa user-template keyword access console boolean | |
| Tree | console | |
Description | When configured to true, the system allows this access method to take precedence over other access methods in all cases. | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
console-port-cli boolean
| Synopsis | Allow console port CLI access | |
| Context | configure system security aaa user-template keyword access console-port-cli boolean | |
| Tree | console-port-cli | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
ftp boolean
grpc boolean
netconf boolean
scp-sftp boolean
ssh-cli boolean
telnet-cli boolean
| Synopsis | Allow Telnet CLI access | |
| Context | configure system security aaa user-template keyword access telnet-cli boolean | |
| Tree | telnet-cli | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
console
login-exec string-not-all-spaces
| Synopsis | File to execute when the user logs in | |
| Context | configure system security aaa user-template keyword console login-exec string-not-all-spaces | |
| Tree | login-exec | |
| String length | 1 to 200 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
home-directory cflash-without-slot-url
| Synopsis | User local home directory based on the template | |
| Context | configure system security aaa user-template keyword home-directory cflash-without-slot-url | |
| Tree | home-directory | |
Description | This command configures the home directory of the user for file access. Files can be accessed locally by CLI file commands and output modifiers such as > (file redirect), or remotely via FTP and SCP. If the home directory does not exist, a warning message is displayed when the user logs in. When restricted-to-home is configured, file access is denied unless the home-directory is configured and the directory is created by an administrator. | |
| String length | 1 to 200 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
profile named-item
restricted-to-home boolean
| Synopsis | Restrict file access to the home directory of the user | |
| Context | configure system security aaa user-template keyword restricted-to-home boolean | |
| Tree | restricted-to-home | |
Description | When configured to true, the router denies the user from accessing files outside of their home directory. Files can be accessed locally by CLI file commands and output modifiers such as > (file redirect), or remotely via FTP and SCP. The system denies all configuration save operations (such as admin save) via any management interface (such as CLI and NETCONF) unless save-when-restricted is enabled. File access is denied unless a home directory is configured and the directory is created by an administrator. When configured to false, the router permits the user to access all files on the system. | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
save-when-restricted boolean
| Synopsis | Save configurations when the user is restricted to home | |
| Context | configure system security aaa user-template keyword save-when-restricted boolean | |
| Tree | save-when-restricted | |
Description | When configured to true, the system permits configuration save operations for all configuration regions (such as bof and configure) via any management interface (such as CLI and NETCONF) even if restricted-to-home is enabled. The configuration for each region can be saved with admin save CLI commands or when committed over NETCONF and gRPC. When configured to false, the system denies saving the configuration when restricted-to-home is enabled, unless the home directory of the user includes the location of the saved configuration file. | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
cli-script
| Synopsis | Enter the cli-script context | |
| Context | configure system security cli-script | |
| Tree | cli-script | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
authorization
| Synopsis | Enter the authorization context | |
| Context | configure system security cli-script authorization | |
| Tree | authorization | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cron
| Synopsis | Enter the cron context | |
| Context | configure system security cli-script authorization cron | |
| Tree | cron | |
Description | Commands in this context configure authorization for the cron job scheduler. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cli-user reference
| Synopsis | User profile name for CLI command script authorization | |
| Context | configure system security cli-script authorization cron cli-user reference | |
| Tree | cli-user | |
Reference | configure system security user-params local-user user named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
event-handler
| Synopsis | Enter the event-handler context | |
| Context | configure system security cli-script authorization event-handler | |
| Tree | event-handler | |
Description | Commands in this context configure authorization for the Event Handling System (EHS). EHS allows user-controlled programmatic exception handling by allowing a CLI script to be executed upon the detection of a log event. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cli-user reference
| Synopsis | User profile name for CLI command script authorization | |
| Context | configure system security cli-script authorization event-handler cli-user reference | |
| Tree | cli-user | |
Reference | configure system security user-params local-user user named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
dist-cpu-protection
| Synopsis | Enter the dist-cpu-protection context | |
| Context | configure system security dist-cpu-protection | |
| Tree | dist-cpu-protection | |
Description | Commands in this context configure distributed CPU protection (DCP) attributes. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
policy [policy-name] named-item
| Synopsis | Enter the policy list instance | |
| Context | configure system security dist-cpu-protection policy named-item | |
| Tree | policy | |
Description | Commands in this context configure the attributes of DCP policies. These policies can be applied to objects such as SAPs, network interfaces or ports | |
| Max. instances | 130 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[policy-name] named-item
| Synopsis | Policy name | |
| Context | configure system security dist-cpu-protection policy named-item | |
| Tree | policy | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system security dist-cpu-protection policy named-item description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
local-monitoring-policer [policer-name] named-item
| Synopsis | Enter the local-monitoring-policer list instance | |
| Context | configure system security dist-cpu-protection policy named-item local-monitoring-policer named-item | |
| Tree | local-monitoring-policer | |
| Max. instances | 1 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[policer-name] named-item
| Synopsis | Local monitoring policer name | |
| Context | configure system security dist-cpu-protection policy named-item local-monitoring-policer named-item | |
| Tree | local-monitoring-policer | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system security dist-cpu-protection policy named-item local-monitoring-policer named-item description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
exceed-action keyword
| Synopsis | Action taken when policer rates are exceeded | |
| Context | configure system security dist-cpu-protection policy named-item local-monitoring-policer named-item exceed-action keyword | |
| Tree | exceed-action | |
Description | This command specifies the action taken on the extracted control packets when the configured policer rates are exceeded. | |
| Options | ||
| Default | none | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
log-events keyword
| Synopsis | Control of log events creation for status and activity | |
| Context | configure system security dist-cpu-protection policy named-item local-monitoring-policer named-item log-events keyword | |
| Tree | log-events | |
Description | This command controls the creation of log events related to the status and activity of the local monitoring policer. | |
| Options | ||
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
rate
| Synopsis | Enter the rate context | |
| Context | configure system security dist-cpu-protection policy named-item local-monitoring-policer named-item rate | |
| Tree | rate | |
Description | Commands in this context specify the rate and burst tolerance for the policer. The actual hardware may not be able to perfectly rate limit to the exact configured parameters. In this case, the configured parameters will be adapted to the closest supported rate. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
kbps
| Synopsis | Enter the kbps context | |
| Context | configure system security dist-cpu-protection policy named-item local-monitoring-policer named-item rate kbps | |
| Tree | kbps | |
Notes | The following elements are part of a choice: kbps or packets. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
limit (keyword | number)
| Synopsis | Rate limit | |
| Context | configure system security dist-cpu-protection policy named-item local-monitoring-policer named-item rate kbps limit (keyword | number) | |
| Tree | limit | |
| Range | 1 to 20000000 | |
| Units | kilobps | |
| Options | ||
| Default | max | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mbs number
| Synopsis | Tolerance for the rate | |
| Context | configure system security dist-cpu-protection policy named-item local-monitoring-policer named-item rate kbps mbs number | |
| Tree | mbs | |
| Range | 0 to 4194304 | |
| Units | bytes | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
packets
| Synopsis | Enter the packets context | |
| Context | configure system security dist-cpu-protection policy named-item local-monitoring-policer named-item rate packets | |
| Tree | packets | |
Notes | The following elements are part of a choice: kbps or packets. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
initial-delay number
| Synopsis | Additional packets allowed in an initial burst | |
| Context | configure system security dist-cpu-protection policy named-item local-monitoring-policer named-item rate packets initial-delay number | |
| Tree | initial-delay | |
Description | This command specifies the number of packets allowed in an initial burst (or a burst after the policer bucket has drained to zero) in addition to the packets per interval limit. The typical setting would be a value equal to the number of received packets in several full handshakes or negotiations of the protocol. | |
| Range | 0 to 255 | |
| Units | packets | |
| Default | 0 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
limit (keyword | number)
| Synopsis | Packets per interval limit | |
| Context | configure system security dist-cpu-protection policy named-item local-monitoring-policer named-item rate packets limit (keyword | number) | |
| Tree | limit | |
| Range | 0 to 8000 | |
| Units | packets per interval | |
| Options | ||
| Default | max | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
within number
| Synopsis | Measurement interval for packets rate | |
| Context | configure system security dist-cpu-protection policy named-item local-monitoring-policer named-item rate packets within number | |
| Tree | within | |
| Range | 1 to 32767 | |
| Units | seconds | |
| Default | 1 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
protocol [protocol-name] keyword
[protocol-name] keyword
dynamic-parameters
| Synopsis | Enter the dynamic-parameters context | |
| Context | configure system security dist-cpu-protection policy named-item protocol keyword dynamic-parameters | |
| Tree | dynamic-parameters | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
detection-time number
| Synopsis | Minimum time the dynamic policer remains allocated | |
| Context | configure system security dist-cpu-protection policy named-item protocol keyword dynamic-parameters detection-time number | |
| Tree | detection-time | |
| Range | 1 to 128000 | |
| Units | seconds | |
| Default | 30 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
exceed-action
| Synopsis | Enter the exceed-action context | |
| Context | configure system security dist-cpu-protection policy named-item protocol keyword dynamic-parameters exceed-action | |
| Tree | exceed-action | |
Description | Commands in this context specify the settings for the scenario when the configured policer rates are exceeded. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
action keyword
| Synopsis | Action taken on control packets when rates are exceeded | |
| Context | configure system security dist-cpu-protection policy named-item protocol keyword dynamic-parameters exceed-action action keyword | |
| Tree | action | |
| Options | ||
| Default | none | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
hold-down (keyword | number)
| Synopsis | Hold down behavior | |
| Context | configure system security dist-cpu-protection policy named-item protocol keyword dynamic-parameters exceed-action hold-down (keyword | number) | |
| Tree | hold-down | |
Description | This command specifies the behavior when the system detects that an enforcement policer has marked or discarded one or more packets and there is no action specified for the scenario when the rates are exceeded. The hold time condition is cleared after the specified time has expired. The detection time (the minimum time that the policer remains allocated) begins after the hold down is complete. The hold down behavior is not applicable to a local monitoring policer. An indefinite hold down behavior must be cleared using the tools perform security dist-cpu-protection release-hold-down command. | |
| Range | 1 to 10080 | |
| Units | seconds | |
| Options | ||
| Default | none | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
log-events keyword
| Synopsis | Control of log events creation for status and activity | |
| Context | configure system security dist-cpu-protection policy named-item protocol keyword dynamic-parameters log-events keyword | |
| Tree | log-events | |
Description | This command controls the creation of log events related to the status and activity of the local monitoring policer. | |
| Options | ||
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
rate
| Synopsis | Enter the rate context | |
| Context | configure system security dist-cpu-protection policy named-item protocol keyword dynamic-parameters rate | |
| Tree | rate | |
Description | Commands in this context specify the rate and burst tolerance for the policer. The actual hardware may not be able to perfectly rate limit to the exact configured parameters. In this case, the configured parameters will be adapted to the closest supported rate. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
kbps
| Synopsis | Enter the kbps context | |
| Context | configure system security dist-cpu-protection policy named-item protocol keyword dynamic-parameters rate kbps | |
| Tree | kbps | |
Notes | The following elements are part of a choice: kbps or packets. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
limit (keyword | number)
| Synopsis | Rate limit | |
| Context | configure system security dist-cpu-protection policy named-item protocol keyword dynamic-parameters rate kbps limit (keyword | number) | |
| Tree | limit | |
| Range | 1 to 20000000 | |
| Units | kilobps | |
| Options | ||
| Default | max | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mbs number
| Synopsis | Tolerance for the rate | |
| Context | configure system security dist-cpu-protection policy named-item protocol keyword dynamic-parameters rate kbps mbs number | |
| Tree | mbs | |
| Range | 0 to 4194304 | |
| Units | bytes | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
packets
| Synopsis | Enter the packets context | |
| Context | configure system security dist-cpu-protection policy named-item protocol keyword dynamic-parameters rate packets | |
| Tree | packets | |
Notes | The following elements are part of a choice: kbps or packets. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
initial-delay number
| Synopsis | Additional packets allowed in an initial burst | |
| Context | configure system security dist-cpu-protection policy named-item protocol keyword dynamic-parameters rate packets initial-delay number | |
| Tree | initial-delay | |
Description | This command specifies the number of packets allowed in an initial burst (or a burst after the policer bucket has drained to zero) in addition to the packets per interval limit. The typical setting would be a value equal to the number of received packets in several full handshakes or negotiations of the protocol. | |
| Range | 0 to 255 | |
| Units | packets | |
| Default | 0 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
limit (keyword | number)
| Synopsis | Packets per interval limit | |
| Context | configure system security dist-cpu-protection policy named-item protocol keyword dynamic-parameters rate packets limit (keyword | number) | |
| Tree | limit | |
| Range | 0 to 8000 | |
| Units | packets per interval | |
| Options | ||
| Default | max | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
within number
| Synopsis | Measurement interval for packets rate | |
| Context | configure system security dist-cpu-protection policy named-item protocol keyword dynamic-parameters rate packets within number | |
| Tree | within | |
| Range | 1 to 32767 | |
| Units | seconds | |
| Default | 1 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
enforcement
| Synopsis | Enter the enforcement context | |
| Context | configure system security dist-cpu-protection policy named-item protocol keyword enforcement | |
| Tree | enforcement | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
dynamic
| Synopsis | Enter the dynamic context | |
| Context | configure system security dist-cpu-protection policy named-item protocol keyword enforcement dynamic | |
| Tree | dynamic | |
Notes | The following elements are part of a choice: dynamic, dynamic-local-mon-bypass, shared, or static. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mon-policer-name reference
| Synopsis | Dynamic enforcement policer for the protocol | |
| Context | configure system security dist-cpu-protection policy named-item protocol keyword enforcement dynamic mon-policer-name reference | |
| Tree | mon-policer-name | |
Description | This command specifies the dynamic enforcement policer that is instantiated when the associated local monitoring policer is determined to be in a nonconforming state (at the end of a minimum monitoring time of 60 seconds to reduce thrashing). | |
Reference | configure system security dist-cpu-protection policy named-item local-monitoring-policer named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
dynamic-local-mon-bypass
| Synopsis | Do not include packets in the local monitoring function | |
| Context | configure system security dist-cpu-protection policy named-item protocol keyword enforcement dynamic-local-mon-bypass | |
| Tree | dynamic-local-mon-bypass | |
Description | When configured, packets from the protocol are not included in the local monitoring function and the dynamic enforcement policer is not instantiated for the protocol. | |
Notes | The following elements are part of a choice: dynamic, dynamic-local-mon-bypass, shared, or static. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
static
| Synopsis | Enter the static context | |
| Context | configure system security dist-cpu-protection policy named-item protocol keyword enforcement static | |
| Tree | static | |
Notes | The following elements are part of a choice: dynamic, dynamic-local-mon-bypass, shared, or static. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
policer-name reference
| Synopsis | Static policer enforced by the protocol | |
| Context | configure system security dist-cpu-protection policy named-item protocol keyword enforcement static policer-name reference | |
| Tree | policer-name | |
Reference | configure system security dist-cpu-protection policy named-item static-policer named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
static-policer [policer-name] named-item
| Synopsis | Enter the static-policer list instance | |
| Context | configure system security dist-cpu-protection policy named-item static-policer named-item | |
| Tree | static-policer | |
Description | Commands in this context configure a static enforcement policer that can be referenced by one or more protocols in the policy. When a policer is referenced by a protocol, the policer is instantiated for each object (for example, a SAP or network interface) that is created and references the policer. If no policer resources are available on the associated card or FP, the object is not created. | |
| Max. instances | 26 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[policer-name] named-item
| Synopsis | Static policer name | |
| Context | configure system security dist-cpu-protection policy named-item static-policer named-item | |
| Tree | static-policer | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system security dist-cpu-protection policy named-item static-policer named-item description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
detection-time number
| Synopsis | Minimum time the dynamic policer remains allocated | |
| Context | configure system security dist-cpu-protection policy named-item static-policer named-item detection-time number | |
| Tree | detection-time | |
| Range | 1 to 128000 | |
| Units | seconds | |
| Default | 30 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
exceed-action
| Synopsis | Enter the exceed-action context | |
| Context | configure system security dist-cpu-protection policy named-item static-policer named-item exceed-action | |
| Tree | exceed-action | |
Description | Commands in this context specify the settings for the scenario when the configured policer rates are exceeded. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
action keyword
| Synopsis | Action taken on control packets when rates are exceeded | |
| Context | configure system security dist-cpu-protection policy named-item static-policer named-item exceed-action action keyword | |
| Tree | action | |
| Options | ||
| Default | none | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
hold-down (keyword | number)
| Synopsis | Hold down behavior | |
| Context | configure system security dist-cpu-protection policy named-item static-policer named-item exceed-action hold-down (keyword | number) | |
| Tree | hold-down | |
Description | This command specifies the behavior when the system detects that an enforcement policer has marked or discarded one or more packets and there is no action specified for the scenario when the rates are exceeded. The hold time condition is cleared after the specified time has expired. The detection time (the minimum time that the policer remains allocated) begins after the hold down is complete. The hold down behavior is not applicable to a local monitoring policer. An indefinite hold down behavior must be cleared using the tools perform security dist-cpu-protection release-hold-down command. | |
| Range | 1 to 10080 | |
| Units | seconds | |
| Options | ||
| Default | none | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
log-events keyword
| Synopsis | Control of log events creation for status and activity | |
| Context | configure system security dist-cpu-protection policy named-item static-policer named-item log-events keyword | |
| Tree | log-events | |
Description | This command controls the creation of log events related to the status and activity of the local monitoring policer. | |
| Options | ||
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
rate
| Synopsis | Enter the rate context | |
| Context | configure system security dist-cpu-protection policy named-item static-policer named-item rate | |
| Tree | rate | |
Description | Commands in this context specify the rate and burst tolerance for the policer. The actual hardware may not be able to perfectly rate limit to the exact configured parameters. In this case, the configured parameters will be adapted to the closest supported rate. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
kbps
| Synopsis | Enter the kbps context | |
| Context | configure system security dist-cpu-protection policy named-item static-policer named-item rate kbps | |
| Tree | kbps | |
Notes | The following elements are part of a choice: kbps or packets. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
limit (keyword | number)
| Synopsis | Rate limit | |
| Context | configure system security dist-cpu-protection policy named-item static-policer named-item rate kbps limit (keyword | number) | |
| Tree | limit | |
| Range | 1 to 20000000 | |
| Units | kilobps | |
| Options | ||
| Default | max | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mbs number
| Synopsis | Tolerance for the rate | |
| Context | configure system security dist-cpu-protection policy named-item static-policer named-item rate kbps mbs number | |
| Tree | mbs | |
| Range | 0 to 4194304 | |
| Units | bytes | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
packets
| Synopsis | Enter the packets context | |
| Context | configure system security dist-cpu-protection policy named-item static-policer named-item rate packets | |
| Tree | packets | |
Notes | The following elements are part of a choice: kbps or packets. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
initial-delay number
| Synopsis | Additional packets allowed in an initial burst | |
| Context | configure system security dist-cpu-protection policy named-item static-policer named-item rate packets initial-delay number | |
| Tree | initial-delay | |
Description | This command specifies the number of packets allowed in an initial burst (or a burst after the policer bucket has drained to zero) in addition to the packets per interval limit. The typical setting would be a value equal to the number of received packets in several full handshakes or negotiations of the protocol. | |
| Range | 0 to 255 | |
| Units | packets | |
| Default | 0 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
limit (keyword | number)
| Synopsis | Packets per interval limit | |
| Context | configure system security dist-cpu-protection policy named-item static-policer named-item rate packets limit (keyword | number) | |
| Tree | limit | |
| Range | 0 to 8000 | |
| Units | packets per interval | |
| Options | ||
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
within number
| Synopsis | Measurement interval for packets rate | |
| Context | configure system security dist-cpu-protection policy named-item static-policer named-item rate packets within number | |
| Tree | within | |
| Range | 1 to 32767 | |
| Units | seconds | |
| Default | 1 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
type keyword
ftp-server boolean
| Synopsis | Enable FTP servers running on the system | |
| Context | configure system security ftp-server boolean | |
| Tree | ftp-server | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
hash-control
| Synopsis | Enter the hash-control context | |
| Context | configure system security hash-control | |
| Tree | hash-control | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
management-interface
| Synopsis | Enter the management-interface context | |
| Context | configure system security hash-control management-interface | |
| Tree | management-interface | |
Description | Commands in this context configure encryption parameters for different management interfaces. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
classic-cli
| Synopsis | Enter the classic-cli context | |
| Context | configure system security hash-control management-interface classic-cli | |
| Tree | classic-cli | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
read-algorithm keyword
| Synopsis | Input encryption algorithm for configuration secrets | |
| Context | configure system security hash-control management-interface classic-cli read-algorithm keyword | |
| Tree | read-algorithm | |
Description | This command specifies how encrypted configuration secrets are interpreted and which encryption types are accepted when secrets are input into the system or read from a configuration file (for example, at system bootup time). | |
| Options | ||
| Default | all-hash | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
write-algorithm keyword
| Synopsis | Output encryption algorithm for configuration secrets | |
| Context | configure system security hash-control management-interface classic-cli write-algorithm keyword | |
| Tree | write-algorithm | |
Description | This command specifies the format of the output for encrypted configuration secrets (for example, in the saved configuration file, or in the output of the info or show commands). | |
| Options | ||
| Default | hash2 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
grpc
| Synopsis | Enter the grpc context | |
| Context | configure system security hash-control management-interface grpc | |
| Tree | grpc | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
hash-algorithm keyword
| Synopsis | Encryption algorithm for configuration secrets | |
| Context | configure system security hash-control management-interface grpc hash-algorithm keyword | |
| Tree | hash-algorithm | |
Description | This command specifies the format of the input and output for encrypted configuration secrets. | |
| Options | ||
| Default | hash2 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
md-cli
| Synopsis | Enter the md-cli context | |
| Context | configure system security hash-control management-interface md-cli | |
| Tree | md-cli | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
hash-algorithm keyword
| Synopsis | Encryption algorithm for configuration secrets | |
| Context | configure system security hash-control management-interface md-cli hash-algorithm keyword | |
| Tree | hash-algorithm | |
Description | This command specifies the format of the input and output for encrypted configuration secrets. | |
| Options | ||
| Default | hash2 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
netconf
| Synopsis | Enter the netconf context | |
| Context | configure system security hash-control management-interface netconf | |
| Tree | netconf | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
hash-algorithm keyword
| Synopsis | Encryption algorithm for configuration secrets | |
| Context | configure system security hash-control management-interface netconf hash-algorithm keyword | |
| Tree | hash-algorithm | |
Description | This command specifies the format of the input and output for encrypted configuration secrets. | |
| Options | ||
| Default | hash2 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
keychains
keychain [keychain-name] named-item
[keychain-name] named-item
admin-state keyword
| Synopsis | Administrative state of the keychain | |
| Context | configure system security keychains keychain named-item admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | enable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
bidirectional
| Synopsis | Enter the bidirectional context | |
| Context | configure system security keychains keychain named-item bidirectional | |
| Tree | bidirectional | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
entry [keychain-entry-index] number
[keychain-entry-index] number
admin-state keyword
| Synopsis | Administrative state of the keychain entry | |
| Context | configure system security keychains keychain named-item bidirectional entry number admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | enable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
algorithm keyword
|
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
| Synopsis | Encryption algorithm used by the keychain key | |
| Context | configure system security keychains keychain named-item bidirectional entry number algorithm keyword | |
| Tree | algorithm | |
| Options | ||
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
authentication-key encrypted-leaf
|
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
| Synopsis | Authentication key used by the encryption algorithm | |
| Context | configure system security keychains keychain named-item bidirectional entry number authentication-key encrypted-leaf | |
| Tree | authentication-key | |
| String length | 1 to 54 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
begin-time date-and-time
| Synopsis | Calendar date and time to start using the key | |
| Context | configure system security keychains keychain named-item bidirectional entry number begin-time date-and-time | |
| Tree | begin-time | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
option keyword
tolerance (number | keyword)
description description
| Synopsis | Text description | |
| Context | configure system security keychains keychain named-item description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
receive
entry [keychain-entry-index] number
[keychain-entry-index] number
admin-state keyword
| Synopsis | Administrative state of the keychain entry | |
| Context | configure system security keychains keychain named-item receive entry number admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | enable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
algorithm keyword
|
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
| Synopsis | Encryption algorithm used by the keychain key | |
| Context | configure system security keychains keychain named-item receive entry number algorithm keyword | |
| Tree | algorithm | |
| Options | ||
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
authentication-key encrypted-leaf
|
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
| Synopsis | Authentication key used by the encryption algorithm | |
| Context | configure system security keychains keychain named-item receive entry number authentication-key encrypted-leaf | |
| Tree | authentication-key | |
| String length | 1 to 54 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
begin-time date-and-time
| Synopsis | Calendar date and time to start using the key | |
| Context | configure system security keychains keychain named-item receive entry number begin-time date-and-time | |
| Tree | begin-time | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
end-time date-and-time
tolerance (number | keyword)
send
entry [keychain-entry-index] number
[keychain-entry-index] number
admin-state keyword
| Synopsis | Administrative state of the keychain entry | |
| Context | configure system security keychains keychain named-item send entry number admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | enable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
algorithm keyword
|
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
| Synopsis | Encryption algorithm used by the keychain key | |
| Context | configure system security keychains keychain named-item send entry number algorithm keyword | |
| Tree | algorithm | |
| Options | ||
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
authentication-key encrypted-leaf
|
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
| Synopsis | Authentication key used by the encryption algorithm | |
| Context | configure system security keychains keychain named-item send entry number authentication-key encrypted-leaf | |
| Tree | authentication-key | |
| String length | 1 to 54 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
begin-time date-and-time
| Synopsis | Calendar date and time to start using the key | |
| Context | configure system security keychains keychain named-item send entry number begin-time date-and-time | |
| Tree | begin-time | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
tcp-option-number
| Synopsis | Enter the tcp-option-number context | |
| Context | configure system security keychains keychain named-item tcp-option-number | |
| Tree | tcp-option-number | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
receive keyword
send keyword
management
| Synopsis | Enter the management context | |
| Context | configure system security management | |
| Tree | management | |
Description | Commands in this context control which management protocols can be used to access the SR OS router via the 'Base' and 'management' router instances. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
allow-ftp boolean
| Synopsis | Allow access to the FTP server | |
| Context | configure system security management allow-ftp boolean | |
| Tree | allow-ftp | |
Description | When configured to true, this command allows FTP access to the SR OS router via the 'Base' and 'management' router instances. When configured to false, this command disallows access to the SR OS FTP server. | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
allow-grpc boolean
| Synopsis | Allow access to the gRPC server | |
| Context | configure system security management allow-grpc boolean | |
| Tree | allow-grpc | |
Description | When configured to true, the system allows access to the gRPC server via the 'Base' and 'management' router instances. | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
allow-netconf boolean
| Synopsis | Allow access to the NETCONF server | |
| Context | configure system security management allow-netconf boolean | |
| Tree | allow-netconf | |
Description | When configured to true, the system allows NETCONF server access to the SR OS router via the 'Base' and 'management' router instances. | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
allow-ssh boolean
| Synopsis | Allow access to the SSH server | |
| Context | configure system security management allow-ssh boolean | |
| Tree | allow-ssh | |
Description | When configured to true, this command allows SSH server access to the SR OS router via the 'Base' and 'management' router instances. When configured to false, this command disallows SSH server access. | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
allow-telnet boolean
| Synopsis | Allow access to the IPv4 Telnet server | |
| Context | configure system security management allow-telnet boolean | |
| Tree | allow-telnet | |
Description | When configured to true, the system allows IPv4 Telnet server access to the SR OS router via the 'Base' and 'management' router instances. When configured to false, access to the IPv4 Telnet server is not allowed. | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
allow-telnet6 boolean
| Synopsis | Allow access to the Telnet IPv6 server | |
| Context | configure system security management allow-telnet6 boolean | |
| Tree | allow-telnet6 | |
Description | When configured to true, the system allows IPv6 Telnet server access to the SR OS router via the 'Base' and 'management' router instances. When configured to false, the system prevents access to the IPv6 Telnet server. | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
management-access-filter
| Synopsis | Enter the management-access-filter context | |
| Context | configure system security management-access-filter | |
| Tree | management-access-filter | |
Description | Commands in this context configure the attributes for management access filters. Management access filters control all traffic in and out of the CPM. The filters can be used to restrict management of the router by other nodes outside of specific networks (or sub-networks) or through designated ports. Management filters are enforced by the system software. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ip-filter
| Synopsis | Enter the ip-filter context | |
| Context | configure system security management-access-filter ip-filter | |
| Tree | ip-filter | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of management-access filters | |
| Context | configure system security management-access-filter ip-filter admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | enable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
default-action keyword
| Synopsis | Default action for the management access filter | |
| Context | configure system security management-access-filter ip-filter default-action keyword | |
| Tree | default-action | |
Description | This command specifies the default action for management access in the absence of a specific management access filter match. | |
| Options | ||
| Default | ignore-match | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
entry [entry-id] number
[entry-id] number
| Synopsis | Entry ID to identify the match criteria and the action | |
| Context | configure system security management-access-filter ip-filter entry number | |
| Tree | entry | |
Description | This command specifies the entry ID to identify the match criteria and the corresponding action. It is recommended that entries are numbered in staggered increments. This allows users to insert a new entry in an existing policy without having to renumber the existing entries. | |
| Range | 1 to 9999 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
action keyword
| Synopsis | Action associated with the management access filter | |
| Context | configure system security management-access-filter ip-filter entry number action keyword | |
| Tree | action | |
Description | This command specifies the action associated with the management access filter match criteria entry. If the packet does not meet any of the match criteria, the configured default action is applied. | |
| Options | ||
| Default | ignore-match | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system security management-access-filter ip-filter entry number description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
log-events boolean
| Synopsis | Enable match logging | |
| Context | configure system security management-access-filter ip-filter entry number log-events boolean | |
| Tree | log-events | |
Description | When configured to true, this command enables match logging. When enabled, matches on the entry cause the Security event mafEntryMatch to be raised. When configured to false, match logging is disabled. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
match
dst-port
mask number
port number
mgmt-port
cpm
lag lag-interface
| Synopsis | LAG ID as the match criterion | |
| Context | configure system security management-access-filter ip-filter entry number match mgmt-port lag lag-interface | |
| Tree | lag | |
| String length | 1 to 27 | |
Notes | The following elements are part of a choice: cpm, (lag and lag-id), or port-id. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
port-id port
protocol (number | keyword)
router-instance string
| Synopsis | Router instance as the match criterion | |
| Context | configure system security management-access-filter ip-filter entry number match router-instance string | |
| Tree | router-instance | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
src-ip
address (ipv4-prefix | ipv4-address)
| Synopsis | IP address or IP prefix as the match criterion | |
| Context | configure system security management-access-filter ip-filter entry number match src-ip address (ipv4-prefix | ipv4-address) | |
| Tree | address | |
Notes | The following elements are part of a choice: (address and mask) or ip-prefix-list. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ip-prefix-list reference
| Synopsis | IP prefix list as the match criterion | |
| Context | configure system security management-access-filter ip-filter entry number match src-ip ip-prefix-list reference | |
| Tree | ip-prefix-list | |
Reference | configure filter match-list ip-prefix-list named-item | |
Notes | The following elements are part of a choice: (address and mask) or ip-prefix-list. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mask ipv4-address
src-port
mask number
port number
ipv6-filter
| Synopsis | Enter the ipv6-filter context | |
| Context | configure system security management-access-filter ipv6-filter | |
| Tree | ipv6-filter | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of management-access filters | |
| Context | configure system security management-access-filter ipv6-filter admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | enable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
default-action keyword
| Synopsis | Default action for the management access filter | |
| Context | configure system security management-access-filter ipv6-filter default-action keyword | |
| Tree | default-action | |
Description | This command specifies the default action for management access in the absence of a specific management access filter match. | |
| Options | ||
| Default | ignore-match | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
entry [entry-id] number
| Synopsis | Enter the entry list instance | |
| Context | configure system security management-access-filter ipv6-filter entry number | |
| Tree | entry | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[entry-id] number
| Synopsis | Entry ID to identify the match criteria and the action | |
| Context | configure system security management-access-filter ipv6-filter entry number | |
| Tree | entry | |
Description | This command specifies the entry ID to identify the match criteria and the corresponding action. It is recommended that entries are numbered in staggered increments. This allows users to insert a new entry in an existing policy without having to renumber the existing entries. | |
| Range | 1 to 9999 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
action keyword
| Synopsis | Action associated with the management access filter | |
| Context | configure system security management-access-filter ipv6-filter entry number action keyword | |
| Tree | action | |
Description | This command specifies the action associated with the management access filter match criteria entry. If the packet does not meet any of the match criteria, the configured default action is applied. | |
| Options | ||
| Default | ignore-match | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system security management-access-filter ipv6-filter entry number description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
log-events boolean
| Synopsis | Enable match logging | |
| Context | configure system security management-access-filter ipv6-filter entry number log-events boolean | |
| Tree | log-events | |
Description | When configured to true, this command enables match logging. When enabled, matches on the entry cause the Security event mafEntryMatch to be raised. When configured to false, match logging is disabled. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
match
| Synopsis | Enter the match context | |
| Context | configure system security management-access-filter ipv6-filter entry number match | |
| Tree | match | |
Description | Commands in this context specify match criteria for the entry. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
dst-port
| Synopsis | Enable the dst-port context | |
| Context | configure system security management-access-filter ipv6-filter entry number match dst-port | |
| Tree | dst-port | |
Description | Commands in this context specify match criteria based on the destination port. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mask number
| Synopsis | IP address mask as the match criterion | |
| Context | configure system security management-access-filter ipv6-filter entry number match dst-port mask number | |
| Tree | mask | |
| Range | 1 to 65535 | |
| Default | 65535 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
port number
| Synopsis | TCP or UDP port number as the match criterion | |
| Context | configure system security management-access-filter ipv6-filter entry number match dst-port port number | |
| Tree | port | |
| Range | 1 to 65535 | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
flow-label number
| Synopsis | Flow identifier used to discriminate traffic flows | |
| Context | configure system security management-access-filter ipv6-filter entry number match flow-label number | |
| Tree | flow-label | |
| Range | 0 to 1048575 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mgmt-port
| Synopsis | Enter the mgmt-port context | |
| Context | configure system security management-access-filter ipv6-filter entry number match mgmt-port | |
| Tree | mgmt-port | |
Description | Commands in this context specify match criteria based on the Ethernet port. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cpm
| Synopsis | Match any traffic received on any Ethernet port | |
| Context | configure system security management-access-filter ipv6-filter entry number match mgmt-port cpm | |
| Tree | cpm | |
Notes | The following elements are part of a choice: cpm, (lag and lag-id), or port-id. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
lag lag-interface
| Synopsis | LAG ID as the match criterion | |
| Context | configure system security management-access-filter ipv6-filter entry number match mgmt-port lag lag-interface | |
| Tree | lag | |
| String length | 1 to 27 | |
Notes | The following elements are part of a choice: cpm, (lag and lag-id), or port-id. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
port-id port
| Synopsis | Port ID as the match criterion | |
| Context | configure system security management-access-filter ipv6-filter entry number match mgmt-port port-id port | |
| Tree | port-id | |
Notes | The following elements are part of a choice: cpm, (lag and lag-id), or port-id. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
next-header (number | keyword)
| Synopsis | IP protocol to match | |
| Context | configure system security management-access-filter ipv6-filter entry number match next-header (number | keyword) | |
| Tree | next-header | |
| Range | 0 to 255 | |
| Options | ||
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
router-instance string
| Synopsis | Router instance as the match criterion | |
| Context | configure system security management-access-filter ipv6-filter entry number match router-instance string | |
| Tree | router-instance | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
src-ip
| Synopsis | Enter the src-ip context | |
| Context | configure system security management-access-filter ipv6-filter entry number match src-ip | |
| Tree | src-ip | |
Description | Commands in this context specify match criteria based on the source port. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
address (ipv6-prefix | ipv6-address)
| Synopsis | IPv6 address or IPv6 prefix to match | |
| Context | configure system security management-access-filter ipv6-filter entry number match src-ip address (ipv6-prefix | ipv6-address) | |
| Tree | address | |
Notes | The following elements are part of a choice: (address and mask) or ipv6-prefix-list. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ipv6-prefix-list reference
| Synopsis | IPv6 prefix list as the match criterion | |
| Context | configure system security management-access-filter ipv6-filter entry number match src-ip ipv6-prefix-list reference | |
| Tree | ipv6-prefix-list | |
Reference | configure filter match-list ipv6-prefix-list named-item | |
Notes | The following elements are part of a choice: (address and mask) or ipv6-prefix-list. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mask ipv6-address
| Synopsis | IP address mask as the match criterion | |
| Context | configure system security management-access-filter ipv6-filter entry number match src-ip mask ipv6-address | |
| Tree | mask | |
Notes | The following elements are part of a choice: (address and mask) or ipv6-prefix-list. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
src-port
| Synopsis | Enable the src-port context | |
| Context | configure system security management-access-filter ipv6-filter entry number match src-port | |
| Tree | src-port | |
Description | Commands in this context specify match criteria based on the source port. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mask number
| Synopsis | IP address mask as the match criterion | |
| Context | configure system security management-access-filter ipv6-filter entry number match src-port mask number | |
| Tree | mask | |
| Range | 1 to 65535 | |
| Default | 65535 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
port number
| Synopsis | TCP or UDP port number as the match criterion | |
| Context | configure system security management-access-filter ipv6-filter entry number match src-port port number | |
| Tree | port | |
| Range | 1 to 65535 | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mac-filter
| Synopsis | Enter the mac-filter context | |
| Context | configure system security management-access-filter mac-filter | |
| Tree | mac-filter | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of management access MAC filter | |
| Context | configure system security management-access-filter mac-filter admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | enable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
default-action keyword
| Synopsis | Default action for the management access filter | |
| Context | configure system security management-access-filter mac-filter default-action keyword | |
| Tree | default-action | |
Description | This command specifies the default action for management access in the absence of a specific management access filter match. | |
| Options | ||
| Default | ignore-match | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
entry [entry-id] number
| Synopsis | Enter the entry list instance | |
| Context | configure system security management-access-filter mac-filter entry number | |
| Tree | entry | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[entry-id] number
| Synopsis | Entry ID to identify the match criteria and the action | |
| Context | configure system security management-access-filter mac-filter entry number | |
| Tree | entry | |
Description | This command specifies the entry ID to identify the match criteria and the corresponding action. It is recommended that entries are numbered in staggered increments. This allows users to insert a new entry in an existing policy without having to renumber the existing entries. | |
| Range | 1 to 9999 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
action keyword
| Synopsis | Action associated with the management access filter | |
| Context | configure system security management-access-filter mac-filter entry number action keyword | |
| Tree | action | |
Description | This command specifies the action associated with the management access filter match criteria entry. If the packet does not meet any of the match criteria, the configured default action is applied. | |
| Options | ||
| Default | ignore-match | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system security management-access-filter mac-filter entry number description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
log-events boolean
| Synopsis | Enable match logging | |
| Context | configure system security management-access-filter mac-filter entry number log-events boolean | |
| Tree | log-events | |
Description | When configured to true, this command enables match logging. When enabled, matches on the entry cause the Security event mafEntryMatch to be raised. When configured to false, match logging is disabled. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
match
| Synopsis | Enter the match context | |
| Context | configure system security management-access-filter mac-filter entry number match | |
| Tree | match | |
Description | Commands in this context specify match criteria for the entry. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
dot1p
| Synopsis | Enable the dot1p context | |
| Context | configure system security management-access-filter mac-filter entry number match dot1p | |
| Tree | dot1p | |
Description | Commands in this context specify match criteria based on the IEEE 802.1p value. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mask number
| Synopsis | 3-bit mask as the match criterion | |
| Context | configure system security management-access-filter mac-filter entry number match dot1p mask number | |
| Tree | mask | |
| Range | 1 to 7 | |
| Default | 7 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
priority number
| Synopsis | IEEE 802.1p value as the match criterion | |
| Context | configure system security management-access-filter mac-filter entry number match dot1p priority number | |
| Tree | priority | |
| Range | 0 to 7 | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
dst-mac
| Synopsis | Enable the dst-mac context | |
| Context | configure system security management-access-filter mac-filter entry number match dst-mac | |
| Tree | dst-mac | |
Description | Commands in this context specify match criteria based on the destination MAC. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
address mac-address
| Synopsis | MAC address used as the match criterion | |
| Context | configure system security management-access-filter mac-filter entry number match dst-mac address mac-address | |
| Tree | address | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mask mac-address
| Synopsis | MAC address mask as the match criterion | |
| Context | configure system security management-access-filter mac-filter entry number match dst-mac mask mac-address | |
| Tree | mask | |
| Default | ff:ff:ff:ff:ff:ff | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
etype etype-value
| Synopsis | Ethernet type II Ethertype value as the match criterion | |
| Context | configure system security management-access-filter mac-filter entry number match etype etype-value | |
| Tree | etype | |
Description | This command specifies an Ethernet type II Ethertype value to be used as a MAC filter match criterion. The Ethernet type field is used by the Ethernet version-II frames and does not apply to IEEE 802.3 Ethernet frames. | |
| String length | 5 to 6 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
frame-type keyword
| Synopsis | MAC frame type as the match criterion | |
| Context | configure system security management-access-filter mac-filter entry number match frame-type keyword | |
| Tree | frame-type | |
| Options | ||
| Default | 802dot3 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
llc-dsap
| Synopsis | Enable the llc-dsap context | |
| Context | configure system security management-access-filter mac-filter entry number match llc-dsap | |
| Tree | llc-dsap | |
Description | Commands in this context specify match criteria based on the Destination Service Access Point (DSAP). | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
dsap number
| Synopsis | 8-bit DSAP as the match criterion | |
| Context | configure system security management-access-filter mac-filter entry number match llc-dsap dsap number | |
| Tree | dsap | |
| Range | 0 to 255 | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mask number
| Synopsis | Mask for DSAP value as the match criterion | |
| Context | configure system security management-access-filter mac-filter entry number match llc-dsap mask number | |
| Tree | mask | |
| Range | 1 to 255 | |
| Default | 255 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
llc-ssap
| Synopsis | Enable the llc-ssap context | |
| Context | configure system security management-access-filter mac-filter entry number match llc-ssap | |
| Tree | llc-ssap | |
Description | Commands in this context specify match criteria based on the Source Service Access Point (SSAP). | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mask number
| Synopsis | Mask for SSAP value as the match criterion | |
| Context | configure system security management-access-filter mac-filter entry number match llc-ssap mask number | |
| Tree | mask | |
| Range | 1 to 255 | |
| Default | 255 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
ssap number
| Synopsis | 8-bit SSAP as the match criterion | |
| Context | configure system security management-access-filter mac-filter entry number match llc-ssap ssap number | |
| Tree | ssap | |
| Range | 0 to 255 | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
service service-name
| Synopsis | Service ID used as the match condition | |
| Context | configure system security management-access-filter mac-filter entry number match service service-name | |
| Tree | service | |
| String length | 1 to 64 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
snap-oui keyword
| Synopsis | IEEE 802.3 LLC SNAP Ethernet Frame OUI value for match | |
| Context | configure system security management-access-filter mac-filter entry number match snap-oui keyword | |
| Tree | snap-oui | |
Description | This command specifies the IEEE 802.3 LLC SNAP Ethernet Frame OUI value as the MAC filter match criterion. | |
| Options | ||
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
snap-pid number
| Synopsis | IEEE 802.3 LLC SNAP Ethernet Frame PID as the match | |
| Context | configure system security management-access-filter mac-filter entry number match snap-pid number | |
| Tree | snap-pid | |
Description | This command specifies an IEEE 802.3 LLC SNAP Ethernet Frame PID value used as the MAC filter match criterion. The SNAP PID match criterion is independent of the OUI field within the SNAP header. Two packets with different 3-byte OUI fields but the same PID field match the same filter entry based on a SNAP PID match criterion. | |
| Range | 0 to 65535 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
src-mac
| Synopsis | Enable the src-mac context | |
| Context | configure system security management-access-filter mac-filter entry number match src-mac | |
| Tree | src-mac | |
Description | Commands in this context specify match criteria based on the source MAC. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
address mac-address
| Synopsis | MAC address used as the match criterion | |
| Context | configure system security management-access-filter mac-filter entry number match src-mac address mac-address | |
| Tree | address | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mask mac-address
| Synopsis | MAC address mask as the match criterion | |
| Context | configure system security management-access-filter mac-filter entry number match src-mac mask mac-address | |
| Tree | mask | |
| Default | ff:ff:ff:ff:ff:ff | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
pki
ca-profile [ca-profile-name] named-item
| Synopsis | Enter the ca-profile list instance | |
| Context | configure system security pki ca-profile named-item | |
| Tree | ca-profile | |
| Max. instances | 128 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[ca-profile-name] named-item
| Synopsis | CA profile name | |
| Context | configure system security pki ca-profile named-item | |
| Tree | ca-profile | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of the CA profile | |
| Context | configure system security pki ca-profile named-item admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
auto-crl-update
| Synopsis | Enable the auto-crl-update context | |
| Context | configure system security pki ca-profile named-item auto-crl-update | |
| Tree | auto-crl-update | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of the automatic CRL update | |
| Context | configure system security pki ca-profile named-item auto-crl-update admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
crl-urls
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Enter the crl-urls context | |
| Context | configure system security pki ca-profile named-item auto-crl-update crl-urls | |
| Tree | crl-urls | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
url-entry [entry-id] number
| Synopsis | Enter the url-entry list instance | |
| Context | configure system security pki ca-profile named-item auto-crl-update crl-urls url-entry number | |
| Tree | url-entry | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[entry-id] number
| Synopsis | URL on this system | |
| Context | configure system security pki ca-profile named-item auto-crl-update crl-urls url-entry number | |
| Tree | url-entry | |
| Range | 1 to 8 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
transmission-profile reference
| Synopsis | File transmission profile to update CRL | |
| Context | configure system security pki ca-profile named-item auto-crl-update crl-urls url-entry number transmission-profile reference | |
| Tree | transmission-profile | |
Reference | configure system transmission-profile named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
url http-url-path-loose
| Synopsis | Location of updated CRL | |
| Context | configure system security pki ca-profile named-item auto-crl-update crl-urls url-entry number url http-url-path-loose | |
| Tree | url | |
| String length | 1 to 180 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
periodic-update-interval number
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Interval between two consecutive CRL updates | |
| Context | configure system security pki ca-profile named-item auto-crl-update periodic-update-interval number | |
| Tree | periodic-update-interval | |
| Range | 3600 to 31622400 | |
| Units | seconds | |
| Default | 86400 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
pre-update-time number
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Time prior to the next update time of the current CRL | |
| Context | configure system security pki ca-profile named-item auto-crl-update pre-update-time number | |
| Tree | pre-update-time | |
| Range | 0 to 31622400 | |
| Units | seconds | |
| Default | 3600 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
retry-interval number
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Interval before retrying to update CRL | |
| Context | configure system security pki ca-profile named-item auto-crl-update retry-interval number | |
| Tree | retry-interval | |
| Range | 0 to 31622400 | |
| Units | seconds | |
| Default | 3600 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
schedule-type keyword
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Time scheduler type for an automated CRL update | |
| Context | configure system security pki ca-profile named-item auto-crl-update schedule-type keyword | |
| Tree | schedule-type | |
| Options | ||
| Default | next-update-based | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 | |
cert-file pki-file-name
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Certificate file name | |
| Context | configure system security pki ca-profile named-item cert-file pki-file-name | |
| Tree | cert-file | |
| String length | 1 to 95 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
cmpv2
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Enter the cmpv2 context | |
| Context | configure system security pki ca-profile named-item cmpv2 | |
| Tree | cmpv2 | |
Description | Commands in this context configure CMPv2 options. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
accept-unprotected-message
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Enter the accept-unprotected-message context | |
| Context | configure system security pki ca-profile named-item cmpv2 accept-unprotected-message | |
| Tree | accept-unprotected-message | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
error-message boolean
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Accept unprotected error messages | |
| Context | configure system security pki ca-profile named-item cmpv2 accept-unprotected-message error-message boolean | |
| Tree | error-message | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 | |
pkiconf-message boolean
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Accept unprotected PKI confirmation messages | |
| Context | configure system security pki ca-profile named-item cmpv2 accept-unprotected-message pkiconf-message boolean | |
| Tree | pkiconf-message | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 | |
always-set-sender-for-ir boolean
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Set subject name in CMPv2 header for all IR messages | |
| Context | configure system security pki ca-profile named-item cmpv2 always-set-sender-for-ir boolean | |
| Tree | always-set-sender-for-ir | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 | |
http
response-timeout number
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | HTTP response timeout | |
| Context | configure system security pki ca-profile named-item cmpv2 http response-timeout number | |
| Tree | response-timeout | |
| Range | 1 to 3600 | |
| Units | seconds | |
| Default | 30 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
version keyword
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | HTTP version for CMPv2 messages | |
| Context | configure system security pki ca-profile named-item cmpv2 http version keyword | |
| Tree | version | |
| Options | ||
| Default | 1.1 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
key-list
key [reference-number] display-string
[reference-number] display-string
password encrypted-leaf
recipient-subject string
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | DN attributes for recipient subject of CMPv2 requests | |
| Context | configure system security pki ca-profile named-item cmpv2 recipient-subject string | |
| Tree | recipient-subject | |
| String length | 1 to 256 | |
Notes | The following elements are part of a choice: recipient-subject or use-ca-subject. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
response-signing-cert pki-file-name
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | File name of the certificate to verify CMPv2 responses | |
| Context | configure system security pki ca-profile named-item cmpv2 response-signing-cert pki-file-name | |
| Tree | response-signing-cert | |
Description | This command specifies an imported certificate used to verify the CMP response message that they are protected by signature. When unconfigured, CA's certificate is used. | |
| String length | 1 to 95 | |
|
Notes | The following elements are part of a choice: response-signing-cert or response-signing-use-extracert. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
response-signing-use-extracert
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Use extraCerts certificate to verify response signature | |
| Context | configure system security pki ca-profile named-item cmpv2 response-signing-use-extracert | |
| Tree | response-signing-use-extracert | |
Notes | The following elements are part of a choice: response-signing-cert or response-signing-use-extracert. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
same-recipient-nonce-for-poll-request boolean
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Use same recipNonce as last CMPv2 response | |
| Context | configure system security pki ca-profile named-item cmpv2 same-recipient-nonce-for-poll-request boolean | |
| Tree | same-recipient-nonce-for-poll-request | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 | |
signing-cert-subject string
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Subject DN attributes to identify signing certificate | |
| Context | configure system security pki ca-profile named-item cmpv2 signing-cert-subject string | |
| Tree | signing-cert-subject | |
| String length | 1 to 256 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
url
service-name service-name
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Administrative service name | |
| Context | configure system security pki ca-profile named-item cmpv2 url service-name service-name | |
| Tree | service-name | |
| String length | 1 to 64 | |
Notes | The following elements are part of a choice: service-name or transmission-profile. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
transmission-profile reference
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Transmission profile for CMPv2 | |
| Context | configure system security pki ca-profile named-item cmpv2 url transmission-profile reference | |
| Tree | transmission-profile | |
Reference | configure system transmission-profile named-item | |
Notes | The following elements are part of a choice: service-name or transmission-profile. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
url-string http-optional-url-loose
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | URL for CMPv2 | |
| Context | configure system security pki ca-profile named-item cmpv2 url url-string http-optional-url-loose | |
| Tree | url-string | |
| String length | 1 to 180 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
use-ca-subject
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Use subject DN in CA certificate as CMPv2 request recipient | |
| Context | configure system security pki ca-profile named-item cmpv2 use-ca-subject | |
| Tree | use-ca-subject | |
Notes | The following elements are part of a choice: recipient-subject or use-ca-subject. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
crl-file pki-file-name
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Certificate Revocation List (CRL) file name | |
| Context | configure system security pki ca-profile named-item crl-file pki-file-name | |
| Tree | crl-file | |
| String length | 1 to 95 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
description description
| Synopsis | Text description | |
| Context | configure system security pki ca-profile named-item description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ocsp
responder-url http-optional-url-loose
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | HTTP URL of the OCSP responder for the CA | |
| Context | configure system security pki ca-profile named-item ocsp responder-url http-optional-url-loose | |
| Tree | responder-url | |
| String length | 1 to 180 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
service-name service-name
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Administrative service name | |
| Context | configure system security pki ca-profile named-item ocsp service-name service-name | |
| Tree | service-name | |
| String length | 1 to 64 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
transmission-profile reference
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Transmission profile for the OCSP | |
| Context | configure system security pki ca-profile named-item ocsp transmission-profile reference | |
| Tree | transmission-profile | |
Reference | configure system transmission-profile named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
revocation-check keyword
|
WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect. | ||
| Synopsis | Revocation method to check status of CA certificates | |
| Context | configure system security pki ca-profile named-item revocation-check keyword | |
| Tree | revocation-check | |
Description | This command specifies the revocation method the system uses to check the revocation status of certificate issued by the CA. Note: The crl-optional command option makes configuration of a valid CRL in a ca-profile optional. However, from a security point of view, it is important to always verify the revocation status of a certificate. | |
| Options | ||
| Default | crl | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
certificate-auto-update [certificate-file-name] pki-file-name
| Synopsis | Enter the certificate-auto-update list instance | |
| Context | configure system security pki certificate-auto-update pki-file-name | |
| Tree | certificate-auto-update | |
Description | Commands in this context configure automatic certificate update associations. | |
| Max. instances | 256 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[certificate-file-name] pki-file-name
| Synopsis | Certificate file name | |
| Context | configure system security pki certificate-auto-update pki-file-name | |
| Tree | certificate-auto-update | |
| String length | 1 to 95 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
key-file-name pki-file-name
| Synopsis | Imported key filename | |
| Context | configure system security pki certificate-auto-update pki-file-name key-file-name pki-file-name | |
| Tree | key-file-name | |
| String length | 1 to 95 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
profile reference
| Synopsis | Certificate update profile name | |
| Context | configure system security pki certificate-auto-update pki-file-name profile reference | |
| Tree | profile | |
Reference | configure system security pki certificate-update-profile named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
certificate-display-format keyword
| Synopsis | Display format for Certificates and CRLs | |
| Context | configure system security pki certificate-display-format keyword | |
| Tree | certificate-display-format | |
| Options | ||
| Default | ascii | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
certificate-expiration-warning
| Synopsis | Enter the certificate-expiration-warning context | |
| Context | configure system security pki certificate-expiration-warning | |
| Tree | certificate-expiration-warning | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
hours number
repeat-hours number
| Synopsis | Time system repeats certificate expiration warning trap | |
| Context | configure system security pki certificate-expiration-warning repeat-hours number | |
| Tree | repeat-hours | |
| Range | 0 to 8760 | |
| Units | hours | |
| Default | 0 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
certificate-update-profile [name] named-item
| Synopsis | Enter the certificate-update-profile list instance | |
| Context | configure system security pki certificate-update-profile named-item | |
| Tree | certificate-update-profile | |
Description | Commands in this context configure a certificate update profile that specifies the behavior of the automatic update certificate. | |
| Max. instances | 256 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[name] named-item
| Synopsis | Certificate update profile name | |
| Context | configure system security pki certificate-update-profile named-item | |
| Tree | certificate-update-profile | |
Description | This command configures the certificate update profile name. | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
after-issue number
| Synopsis | Time for scheduler updates after certificate issuance | |
| Context | configure system security pki certificate-update-profile named-item after-issue number | |
| Tree | after-issue | |
Description | This command configures the time for scheduler updates after the certificate issue time. | |
| Range | 864000 to 157680000 | |
| Units | seconds | |
Notes | The following elements are part of a choice: after-issue or before-expiry. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
before-expiry number
| Synopsis | Time scheduler updates before certificate expiry | |
| Context | configure system security pki certificate-update-profile named-item before-expiry number | |
| Tree | before-expiry | |
Description | This command configures the time that the scheduler updates before the certificate expiration time. | |
| Range | 3600 to 157680000 | |
| Units | seconds | |
| Default | 86400 | |
Notes |
The following elements are part of a choice: after-issue or before-expiry. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cmpv2
ca-profile reference
| Synopsis | CA profile name | |
| Context | configure system security pki certificate-update-profile named-item cmpv2 ca-profile reference | |
| Tree | ca-profile | |
Description | This command specifies the use of CMPv2 as the protocol to update the certificate. The CMPv2 configuration is derived from the referenced CA profile. | |
Reference | configure system security pki ca-profile named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
dsa
key-size number
| Synopsis | Length of the generated DSA key | |
| Context | configure system security pki certificate-update-profile named-item dsa key-size number | |
| Tree | key-size | |
Description | This command specifies that the newly generated key is an DSA key with the specified key length in bits. | |
| Range | 512 to 8192 | |
| Default | 2048 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
ecdsa
curve keyword
| Synopsis | Elliptic curve to be used in ECDSA key generation | |
| Context | configure system security pki certificate-update-profile named-item ecdsa curve keyword | |
| Tree | curve | |
Description | This command specifies that the newly generated key is an ECDSA key with the specified curve. | |
| Options | ||
| Default | secp256r1 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
est
est-profile reference
| Synopsis | EST profile name | |
| Context | configure system security pki certificate-update-profile named-item est est-profile reference | |
| Tree | est-profile | |
Description | This command specifies the use of EST as the protocol to update the certificate. The EST configuration is derived from the referenced EST profile. | |
Reference | configure system security pki est-profile named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
hash-algorithm keyword
| Synopsis | Hash algorithm for a certificate request | |
| Context | configure system security pki certificate-update-profile named-item hash-algorithm keyword | |
| Tree | hash-algorithm | |
Description | This command specifies the hash algorithm used to generate a certificate request. | |
| Options | ||
| Default | sha256 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
retry-interval number
| Synopsis | Retry interval after a failed update | |
| Context | configure system security pki certificate-update-profile named-item retry-interval number | |
| Tree | retry-interval | |
Description | This command configures the retry interval after the update fails. | |
| Range | 60 to 36000 | |
| Units | seconds | |
| Default | 3600 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
rsa
key-size number
| Synopsis | Length of the generated RSA key | |
| Context | configure system security pki certificate-update-profile named-item rsa key-size number | |
| Tree | key-size | |
Description | This command specifies that the newly generated key is a RSA key with the specified key length in bits. | |
| Range | 512 to 8192 | |
| Default | 2048 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
same-as-existing-key
| Synopsis | Generate the new key to same type and key length | |
| Context | configure system security pki certificate-update-profile named-item same-as-existing-key | |
| Tree | same-as-existing-key | |
Description | When configured, this command specifies that the newly generated key is the same type and key length as the existing key. | |
Notes | The following elements are part of a choice: dsa, ecdsa, rsa, or same-as-existing-key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
common-name-list [cn-list-name] named-item
| Synopsis | Enter the common-name-list list instance | |
| Context | configure system security pki common-name-list named-item | |
| Tree | common-name-list | |
| Max. instances | 64 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[cn-list-name] named-item
| Synopsis | CN list name | |
| Context | configure system security pki common-name-list named-item | |
| Tree | common-name-list | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
common-name [cn-index] number
| Synopsis | Enter the common-name list instance | |
| Context | configure system security pki common-name-list named-item common-name number | |
| Tree | common-name | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[cn-index] number
| Synopsis | Common name index | |
| Context | configure system security pki common-name-list named-item common-name number | |
| Tree | common-name | |
| Range | 1 to 128 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cn-type keyword
| Synopsis | Common name type | |
| Context | configure system security pki common-name-list named-item common-name number cn-type keyword | |
| Tree | cn-type | |
| Options | ||
|
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cn-value regular-expression-not-all-spaces
| Synopsis | Common name value | |
| Context | configure system security pki common-name-list named-item common-name number cn-value regular-expression-not-all-spaces | |
| Tree | cn-value | |
| String length | 1 to 255 | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
crl-expiration-warning
| Synopsis | Enter the crl-expiration-warning context | |
| Context | configure system security pki crl-expiration-warning | |
| Tree | crl-expiration-warning | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
hours number
repeat-hours number
| Synopsis | Time system repeats CRL expiration warning trap | |
| Context | configure system security pki crl-expiration-warning repeat-hours number | |
| Tree | repeat-hours | |
| Range | 0 to 8760 | |
| Units | hours | |
| Default | 0 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
dynamic-ca boolean
| Synopsis | Enable the dynamic sub-CA support for IPsec | |
| Context | configure system security pki dynamic-ca boolean | |
| Tree | dynamic-ca | |
Description | When configured to true, the system may authenticate the IPsec peer using a certificate without provisioning the peer's sub-CAs locally, if the peer sends sub-CA certificates during IKEv2 exchanges. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
est-profile [name] named-item
| Synopsis | Enter the est-profile list instance | |
| Context | configure system security pki est-profile named-item | |
| Tree | est-profile | |
Description | Commands in this context configure an Enrollment over Secure Transport (EST) profile. | |
| Max. instances | 128 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[name] named-item
| Synopsis | Enrollment over Secured Transport profile name | |
| Context | configure system security pki est-profile named-item | |
| Tree | est-profile | |
Description | This command configures the EST profile name. | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
check-id-kp-cmcra-only boolean
| Synopsis | Check id-kp-cmcra in the EST certificate | |
| Context | configure system security pki est-profile named-item check-id-kp-cmcra-only boolean | |
| Tree | check-id-kp-cmcra-only | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
client-tls-profile named-item
| Synopsis | TLS client profile assigned to applications | |
| Context | configure system security pki est-profile named-item client-tls-profile named-item | |
| Tree | client-tls-profile | |
Description | This command specifies the TLS client profile to be assigned to applications for encryption. The profile creates the TLS connection to the EST server. | |
| String length | 1 to 32 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
http-authentication
| Synopsis | Enter the http-authentication context | |
| Context | configure system security pki est-profile named-item http-authentication | |
| Tree | http-authentication | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
password encrypted-leaf
| Synopsis | Password for EST authentication | |
| Context | configure system security pki est-profile named-item http-authentication password encrypted-leaf | |
| Tree | password | |
| String length | 1 to 115 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
username string
| Synopsis | Username for the EST authentication | |
| Context | configure system security pki est-profile named-item http-authentication username string | |
| Tree | username | |
| String length | 1 to 32 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
server
fqdn fully-qualified-domain-name
| Synopsis | Fully Qualified Domain Name (FQDN) of the EST server | |
| Context | configure system security pki est-profile named-item server fqdn fully-qualified-domain-name | |
| Tree | fqdn | |
Description | This command specifies to use the FQDN of the EST server. | |
| String length | 1 to 255 | |
Notes | The following elements are part of a choice: fqdn, ipv4, or ipv6. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ipv4 ipv4-unicast-address
ipv6 (ipv4-address-no-zone | ipv6-address-no-zone)
port number
transmission-profile named-item
| Synopsis | Transmission profile name for EST | |
| Context | configure system security pki est-profile named-item transmission-profile named-item | |
| Tree | transmission-profile | |
Description | This command associates a file transmission profile to the EST profile. The transmission profile defines transport parameters for protocol such as HTTP, include routing instance, source address, timeout value, and so on. | |
| String length | 1 to 32 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
imported-format keyword
| Synopsis | The supported encrypted file formats | |
| Context | configure system security pki imported-format keyword | |
| Tree | imported-format | |
| Options | ||
| Default | any | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
maximum-cert-chain-depth number
| Synopsis | Maximum depth of certificate chain verification | |
| Context | configure system security pki maximum-cert-chain-depth number | |
| Tree | maximum-cert-chain-depth | |
| Range | 1 to 7 | |
| Default | 7 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
python-script
| Synopsis | Enter the python-script context | |
| Context | configure system security python-script | |
| Tree | python-script | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
authorization
| Synopsis | Enter the authorization context | |
| Context | configure system security python-script authorization | |
| Tree | authorization | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cron
| Synopsis | Enter the cron context | |
| Context | configure system security python-script authorization cron | |
| Tree | cron | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cli-user reference
| Synopsis | User profile name when executing a Python application | |
| Context | configure system security python-script authorization cron cli-user reference | |
| Tree | cli-user | |
Reference | configure system security user-params local-user user named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
event-handler
| Synopsis | Enter the event-handler context | |
| Context | configure system security python-script authorization event-handler | |
| Tree | event-handler | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cli-user reference
| Synopsis | User profile name when executing a Python application | |
| Context | configure system security python-script authorization event-handler cli-user reference | |
| Tree | cli-user | |
Reference | configure system security user-params local-user user named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
subscriber-mgmt
| Synopsis | Enter the subscriber-mgmt context | |
| Context | configure system security python-script authorization subscriber-mgmt | |
| Tree | subscriber-mgmt | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cli-user reference
| Synopsis | User profile name when executing a Python application | |
| Context | configure system security python-script authorization subscriber-mgmt cli-user reference | |
| Tree | cli-user | |
Reference | configure system security user-params local-user user named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
snmp
access [group] named-item context named-item-or-empty security-model keyword security-level keyword
| Synopsis | Enter the access list instance | |
| Context | configure system security snmp access named-item context named-item-or-empty security-model keyword security-level keyword | |
| Tree | access | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[group] named-item
| Synopsis | Group name | |
| Context | configure system security snmp access named-item context named-item-or-empty security-model keyword security-level keyword | |
| Tree | access | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
context named-item-or-empty
| Synopsis | String to match context name for access rights | |
| Context | configure system security snmp access named-item context named-item-or-empty security-model keyword security-level keyword | |
| Tree | access | |
| String length | 0 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
security-model keyword
| Synopsis | Security model | |
| Context | configure system security snmp access named-item context named-item-or-empty security-model keyword security-level keyword | |
| Tree | access | |
| Options | ||
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
security-level keyword
| Synopsis | Minimum security level required to gain access rights | |
| Context | configure system security snmp access named-item context named-item-or-empty security-model keyword security-level keyword | |
| Tree | access | |
| Options | ||
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
notify named-item
| Synopsis | SNMP view for notification access | |
| Context | configure system security snmp access named-item context named-item-or-empty security-model keyword security-level keyword notify named-item | |
| Tree | notify | |
Description | This command specifies the SNMP view used to control which MIB objects can be accessed for notifications. | |
| String length | 1 to 32 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
prefix-match keyword
| Synopsis | Match type for the context | |
| Context | configure system security snmp access named-item context named-item-or-empty security-model keyword security-level keyword prefix-match keyword | |
| Tree | prefix-match | |
| Options | ||
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
read named-item
| Synopsis | SNMP view for read access | |
| Context | configure system security snmp access named-item context named-item-or-empty security-model keyword security-level keyword read named-item | |
| Tree | read | |
Description | This command specifies the SNMP view used to control which MIB objects can be accessed using a read (get) operation. | |
| String length | 1 to 32 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
write named-item
| Synopsis | SNMP view for write access | |
| Context | configure system security snmp access named-item context named-item-or-empty security-model keyword security-level keyword write named-item | |
| Tree | write | |
Description | This command specifies the SNMP view used to control which MIB objects can be accessed using a write (set) operation. | |
| String length | 1 to 32 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
attempts
| Synopsis | Enter the attempts context | |
| Context | configure system security snmp attempts | |
| Tree | attempts | |
Description | Commands in this context configure settings for SNMPv2 or SNMPv3 connection attempts. The command settings are used to counter Denial of Service (DOS) attacks through SNMP. If the threshold is exceeded, the host is locked out for the lockout time period. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
count number
lockout number
| Synopsis | Lockout period during which the host cannot log in | |
| Context | configure system security snmp attempts lockout number | |
| Tree | lockout | |
Description | This command configures the time period during which the host cannot log in. When the host exceeds the attempted counts setting, the host is locked out from further login attempts for the configured time period. | |
| Range | 0 to 1440 | |
| Units | minutes | |
| Default | 10 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
time number
community [community-string] encrypted-leaf
[community-string] encrypted-leaf
access-permissions keyword
| Synopsis | Access permissions for objects in the MIB | |
| Context | configure system security snmp community encrypted-leaf access-permissions keyword | |
| Tree | access-permissions | |
| Options | ||
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
source-access-list reference
| Synopsis | Source access list to validate received SNMP requests | |
| Context | configure system security snmp community encrypted-leaf source-access-list reference | |
| Tree | source-access-list | |
Reference | configure system security snmp source-access-list string-not-all-spaces | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
version keyword
source-access-list [list-name] string-not-all-spaces
| Synopsis | Enter the source-access-list list instance | |
| Context | configure system security snmp source-access-list string-not-all-spaces | |
| Tree | source-access-list | |
Description | Commands in this context configure SNMP source access lists. SNMP source access lists are used to validate the source IP address of received SNMP requests. Multiple community (VPRN or Base router) and USM community instances can reference the same SNMP source access list. | |
| Max. instances | 16 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[list-name] string-not-all-spaces
| Synopsis | Source access list name | |
| Context | configure system security snmp source-access-list string-not-all-spaces | |
| Tree | source-access-list | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
source-host [host-name] named-item
| Synopsis | Enter the source-host list instance | |
| Context | configure system security snmp source-access-list string-not-all-spaces source-host named-item | |
| Tree | source-host | |
| Max. instances | 16 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[host-name] named-item
| Synopsis | Source host entry name | |
| Context | configure system security snmp source-access-list string-not-all-spaces source-host named-item | |
| Tree | source-host | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
address (ipv4-address-no-zone | ipv6-address-no-zone)
| Synopsis | Source IP address entry used to validate SNMP requests | |
| Context | configure system security snmp source-access-list string-not-all-spaces source-host named-item address (ipv4-address-no-zone | ipv6-address-no-zone) | |
| Tree | address | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
usm-community [community-string] encrypted-leaf
| Synopsis | Enter the usm-community list instance | |
| Context | configure system security snmp usm-community encrypted-leaf | |
| Tree | usm-community | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[community-string] encrypted-leaf
| Synopsis | Community string associated with SNMPv3 access group | |
| Context | configure system security snmp usm-community encrypted-leaf | |
| Tree | usm-community | |
| String length | 1 to 114 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
group named-item
source-access-list reference
| Synopsis | Source access list to validate received SNMP requests | |
| Context | configure system security snmp usm-community encrypted-leaf source-access-list reference | |
| Tree | source-access-list | |
Reference | configure system security snmp source-access-list string-not-all-spaces | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
view [view-name] named-item subtree string
[view-name] named-item
subtree string
mask string
type keyword
source-address
| Synopsis | Enter the source-address context | |
| Context | configure system security source-address | |
| Tree | source-address | |
Description | Commands in this context configure the IP source address that is used in all unsolicited packets sent by the specified applications. This configuration applies to packets transmitted in-band (for example, a network port on an IOM) and does not apply to packets transmitted out-of-band on the management interface on the CPM Ethernet port. Packets transmitted using the CPM Ethernet port use the address of the CPM Ethernet port as the IP source address in the packet. When a source address is specified for the PTP application, the port-based 1588 hardware timestamping assist function is applied to PTP packets matching the IPv4 address of the router interface used to ingress the SR/ESS or IP address specified in this command. If the IP address is removed, the port-based 1588 hardware timestamping assist function is only applied to PTP packets matching the IPv4 address of the router interface. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ipv4 [application] keyword
| Synopsis | Enter the ipv4 list instance | |
| Context | configure system security source-address ipv4 keyword | |
| Tree | ipv4 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[application] keyword
| Synopsis | Application that uses the source IP address | |
| Context | configure system security source-address ipv4 keyword | |
| Tree | ipv4 | |
| Options | ||
Notes |
This element is part of a list key. | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
address ipv4-address
|
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
| Synopsis | Source IPv4 address | |
| Context | configure system security source-address ipv4 keyword address ipv4-address | |
| Tree | address | |
Notes | The following elements are part of a mandatory choice: address or interface-name. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
interface-name interface-name
|
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
| Synopsis | IP interface name | |
| Context | configure system security source-address ipv4 keyword interface-name interface-name | |
| Tree | interface-name | |
| String length | 1 to 32 | |
Notes | The following elements are part of a mandatory choice: address or interface-name. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
ipv6 [application] keyword
| Synopsis | Enter the ipv6 list instance | |
| Context | configure system security source-address ipv6 keyword | |
| Tree | ipv6 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[application] keyword
| Synopsis | Application which uses the source IPv6 address | |
| Context | configure system security source-address ipv6 keyword | |
| Tree | ipv6 | |
| Options | ||
Notes |
This element is part of a list key. | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
address ipv6-address
|
WARNING: Modifying this element recreates the parent element automatically for the new value to take effect. | ||
| Synopsis | Source IPv6 address | |
| Context | configure system security source-address ipv6 keyword address ipv6-address | |
| Tree | address | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 | |
ssh
authentication-method
| Synopsis | Enter the authentication-method context | |
| Context | configure system security ssh authentication-method | |
| Tree | authentication-method | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
client
public-key-only boolean
| Synopsis | Accept only public-key authentication for SSH session | |
| Context | configure system security ssh authentication-method client public-key-only boolean | |
| Tree | public-key-only | |
Description | When configured to true, the system accepts only public key client authentication for the SSH server. This command defines the authentication method at the system level. When configured to false, the system accepts public key or password client authentication. If interactive-authentication is configured to true in the configure system security aaa remote-servers radius or configure system security aaa remote-servers tacplus context, the system also accepts interactive keyboard authentication. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
server
public-key-only boolean
| Synopsis | Accept only public-key authentication for SSH session | |
| Context | configure system security ssh authentication-method server public-key-only boolean | |
| Tree | public-key-only | |
Description | When configured to true, the system accepts only public key client authentication for the SSH server. This command defines the authentication method at the system level. When configured to false, the system accepts public key or password client authentication. If interactive-authentication is configured to true in the configure system security aaa remote-servers radius or configure system security aaa remote-servers tacplus context, the system also accepts interactive keyboard authentication. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
client-cipher-list-v2
| Synopsis | Enter the client-cipher-list-v2 context | |
| Context | configure system security ssh client-cipher-list-v2 | |
| Tree | client-cipher-list-v2 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cipher [index] number
| Synopsis | Enter the cipher list instance | |
| Context | configure system security ssh client-cipher-list-v2 cipher number | |
| Tree | cipher | |
Description | Commands in this context configure a client-cipher instance. Client-ciphers are used when the SR OS is acting as an SSH client. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[index] number
name keyword
client-host-key-list-v2
| Synopsis | Enter the client-host-key-list-v2 context | |
| Context | configure system security ssh client-host-key-list-v2 | |
| Tree | client-host-key-list-v2 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
host-key [index] number
[index] number
name keyword
client-kex-list-v2
| Synopsis | Enter the client-kex-list-v2 context | |
| Context | configure system security ssh client-kex-list-v2 | |
| Tree | client-kex-list-v2 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
kex [index] number
| Synopsis | Enter the kex list instance | |
| Context | configure system security ssh client-kex-list-v2 kex number | |
| Tree | kex | |
Description | Commands in this context configure SSH Key Exchange (KEX) algorithms for SR OS as a client. If a list is configured, SSH uses the list with the first-listed algorithm having the highest priority. By default, the client list is empty. The default list contains the following:
| |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[index] number
| Synopsis | SSHv2 KEX algorithm index | |
| Context | configure system security ssh client-kex-list-v2 kex number | |
| Tree | kex | |
Description | This command configures the index of the KEX algorithm in the list. The lowest index in the list is negotiated first on the SSH negotiation list, while the highest index is at the bottom of the SSH negotiation list. | |
| Range | 1 to 255 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
name keyword
client-mac-list-v2
| Synopsis | Enter the client-mac-list-v2 context | |
| Context | configure system security ssh client-mac-list-v2 | |
| Tree | client-mac-list-v2 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mac [index] number
[index] number
name keyword
key-re-exchange
| Synopsis | Enter the key-re-exchange context | |
| Context | configure system security ssh key-re-exchange | |
| Tree | key-re-exchange | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
client
admin-state keyword
| Synopsis | Administrative state of the key re-exchange | |
| Context | configure system security ssh key-re-exchange client admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | enable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mbytes (number | keyword)
minutes (number | keyword)
server
admin-state keyword
| Synopsis | Administrative state of the key re-exchange | |
| Context | configure system security ssh key-re-exchange server admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | enable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mbytes (number | keyword)
minutes (number | keyword)
listening-port number
| Synopsis | TCP port for SSH connections for VPRN or base routing | |
| Context | configure system security ssh listening-port number | |
| Tree | listening-port | |
| Range | 22 | 1024 to 49151 | |
| Default | 22 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
permit-empty-passwords boolean
| Synopsis | Permit users with empty password strings to log in | |
| Context | configure system security ssh permit-empty-passwords boolean | |
| Tree | permit-empty-passwords | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
preserve-key boolean
| Synopsis | Preserve keys and restore on system or server restart | |
| Context | configure system security ssh preserve-key boolean | |
| Tree | preserve-key | |
Description | When configured to true, private, public, and host keys are saved by the server. The keys are restored following a system reboot or a restart of an SSH server. When configured to false, the keys are held in memory by an SSH server but are not restored following a system reboot. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
server-admin-state keyword
| Synopsis | Administrative state of the SSH server | |
| Context | configure system security ssh server-admin-state keyword | |
| Tree | server-admin-state | |
| Options | ||
| Default | enable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
server-cipher-list-v2
| Synopsis | Enter the server-cipher-list-v2 context | |
| Context | configure system security ssh server-cipher-list-v2 | |
| Tree | server-cipher-list-v2 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cipher [index] number
| Synopsis | Enter the cipher list instance | |
| Context | configure system security ssh server-cipher-list-v2 cipher number | |
| Tree | cipher | |
Description | Commands in this context configure a server-cipher instance. Server-ciphers are used when SR OS is acting as an SSH server. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[index] number
name keyword
server-host-key-list-v2
| Synopsis | Enter the server-host-key-list-v2 context | |
| Context | configure system security ssh server-host-key-list-v2 | |
| Tree | server-host-key-list-v2 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
host-key [index] number
[index] number
name keyword
server-kex-list-v2
| Synopsis | Enter the server-kex-list-v2 context | |
| Context | configure system security ssh server-kex-list-v2 | |
| Tree | server-kex-list-v2 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
kex [index] number
[index] number
| Synopsis | SSHv2 KEX algorithm index | |
| Context | configure system security ssh server-kex-list-v2 kex number | |
| Tree | kex | |
Description | This command configures the index of the KEX algorithm in the list. The lowest index in the list is negotiated first on the SSH negotiation list, while the highest index is at the bottom of the SSH negotiation list. | |
| Range | 1 to 255 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
name keyword
server-mac-list-v2
| Synopsis | Enter the server-mac-list-v2 context | |
| Context | configure system security ssh server-mac-list-v2 | |
| Tree | server-mac-list-v2 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mac [index] number
[index] number
name keyword
system-passwords
| Synopsis | Enter the system-passwords context | |
| Context | configure system security system-passwords | |
| Tree | system-passwords | |
Description | This command enters the context to configure system passwords. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-password hashed-leaf
| Synopsis | Administrative password for the enable command | |
| Context | configure system security system-passwords admin-password hashed-leaf | |
| Tree | admin-password | |
Description | This command allows a user with administrative permissions to configure a password that enables a user to become an administrator. This password is valid only for one session. When enabled, no authorization to TACACS+ or RADIUS is performed and the user is locally regarded as an administrative user. If the admin-password is configured in the configure system security system-passwords admin-password context, any user can enter the special mode by entering the enable command. enable is in the default profile. By default, all users are given access to this command. After the enable command is entered, the user is prompted for a password. If the password matches, user is given unrestricted access to all commands. The minimum length of the password is determined by the minimum-length command. The complexity requirements for the password are determined by the complexity command. Note: This command applies to a local user, in addition to users on RADIUS, TACACS, and LDAP. | |
| String length | 3 to 136 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
tech-support
| Synopsis | Enter the tech-support context | |
| Context | configure system security tech-support | |
| Tree | tech-support | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ts-location (ts-sat-url | cflash-url | string)
| Synopsis | Default file path for generated tech-support files | |
| Context | configure system security tech-support ts-location (ts-sat-url | cflash-url | string) | |
| Tree | ts-location | |
| String length | 1 to 180 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
telnet
listening-port number
| Synopsis | TCP port for Telnet connections for VPRN or base routing | |
| Context | configure system security telnet listening-port number | |
| Tree | listening-port | |
| Range | 23 | 1024 to 49151 | |
| Default | 23 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
telnet-server boolean
| Synopsis | Enable Telnet servers running on the system | |
| Context | configure system security telnet-server boolean | |
| Tree | telnet-server | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
telnet6-server boolean
| Synopsis | Enable Telnet IPv6 servers running on the system | |
| Context | configure system security telnet6-server boolean | |
| Tree | telnet6-server | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
tls
cert-profile [cert-profile-name] named-item
| Synopsis | Enter the cert-profile list instance | |
| Context | configure system security tls cert-profile named-item | |
| Tree | cert-profile | |
| Max. instances | 16 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[cert-profile-name] named-item
| Synopsis | TLS certificate profile name | |
| Context | configure system security tls cert-profile named-item | |
| Tree | cert-profile | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of the certificate profile | |
| Context | configure system security tls cert-profile named-item admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
entry [entry-id] number
[entry-id] number
certificate-file string-not-all-spaces
| Synopsis | Certificate file name | |
| Context | configure system security tls cert-profile named-item entry number certificate-file string-not-all-spaces | |
| Tree | certificate-file | |
| String length | 1 to 95 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
key-file string-not-all-spaces
send-chain
| Synopsis | Enter the send-chain context | |
| Context | configure system security tls cert-profile named-item entry number send-chain | |
| Tree | send-chain | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ca-profile [ca-profile-name] reference
| Synopsis | Add a list entry for ca-profile | |
| Context | configure system security tls cert-profile named-item entry number send-chain ca-profile reference | |
| Tree | ca-profile | |
| Max. instances | 7 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[ca-profile-name] reference
| Synopsis | CA profile name | |
| Context | configure system security tls cert-profile named-item entry number send-chain ca-profile reference | |
| Tree | ca-profile | |
Reference | configure system security pki ca-profile named-item | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
client-cipher-list [client-cipher-list-name] named-item
| Synopsis | Enter the client-cipher-list list instance | |
| Context | configure system security tls client-cipher-list named-item | |
| Tree | client-cipher-list | |
| Max. instances | 16 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[client-cipher-list-name] named-item
| Synopsis | Client cipher list name | |
| Context | configure system security tls client-cipher-list named-item | |
| Tree | client-cipher-list | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
tls12-cipher [index] number
| Synopsis | Enter the tls12-cipher list instance | |
| Context | configure system security tls client-cipher-list named-item tls12-cipher number | |
| Tree | tls12-cipher | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[index] number
| Synopsis | Index of the cipher | |
| Context | configure system security tls client-cipher-list named-item tls12-cipher number | |
| Tree | tls12-cipher | |
| Range | 1 to 255 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
name keyword
| Synopsis | Cipher suite code | |
| Context | configure system security tls client-cipher-list named-item tls12-cipher number name keyword | |
| Tree | name | |
| Options | ||
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
tls13-cipher [index] number
| Synopsis | Enter the tls13-cipher list instance | |
| Context | configure system security tls client-cipher-list named-item tls13-cipher number | |
| Tree | tls13-cipher | |
Description | Commands in this context configure the TLS 1.3-supported ciphers used by the client. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[index] number
| Synopsis | Index number of the TLS 1.3 cipher | |
| Context | configure system security tls client-cipher-list named-item tls13-cipher number | |
| Tree | tls13-cipher | |
| Range | 1 to 255 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
name keyword
| Synopsis | Name of the TLS 1.3 cipher suite code | |
| Context | configure system security tls client-cipher-list named-item tls13-cipher number name keyword | |
| Tree | name | |
| Options | ||
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
client-group-list [client-group-list-name] named-item
| Synopsis | Enter the client-group-list list instance | |
| Context | configure system security tls client-group-list named-item | |
| Tree | client-group-list | |
Description | Commands in this context configure the list of TLS 1.3-supported group suite codes that the client sends in a client Hello message. | |
| Max. instances | 16 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[client-group-list-name] named-item
| Synopsis | Name of the TLS client group list | |
| Context | configure system security tls client-group-list named-item | |
| Tree | client-group-list | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
tls13-group [index] number
| Synopsis | Enter the tls13-group list instance | |
| Context | configure system security tls client-group-list named-item tls13-group number | |
| Tree | tls13-group | |
Description | Commands in this context configure the TLS 1.3-supported group suite codes sent by the client in its Hello messages. SR OS supports the use of Elliptic-Curve Diffie-Hellman Ephemeral (ECDHE) groups. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[index] number
| Synopsis | Index number of the TLS 1.3 group | |
| Context | configure system security tls client-group-list named-item tls13-group number | |
| Tree | tls13-group | |
| Range | 1 to 255 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
name keyword
| Synopsis | Name of the TLS 1.3 group suite code | |
| Context | configure system security tls client-group-list named-item tls13-group number name keyword | |
| Tree | name | |
| Options | ||
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
client-signature-list [client-signature-list-name] named-item
| Synopsis | Enter the client-signature-list list instance | |
| Context | configure system security tls client-signature-list named-item | |
| Tree | client-signature-list | |
Description | Commands in this context configure the list of TLS 1.3-supported signature suite codes that the client sends in a client Hello message. | |
| Max. instances | 16 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[client-signature-list-name] named-item
| Synopsis | Name of the TLS 1.3 client signature list | |
| Context | configure system security tls client-signature-list named-item | |
| Tree | client-signature-list | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
tls13-signature [index] number
| Synopsis | Enter the tls13-signature list instance | |
| Context | configure system security tls client-signature-list named-item tls13-signature number | |
| Tree | tls13-signature | |
Description | Commands in this context configure the TLS 1.3-supported signature suite codes sent by the client in its Hello messages. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[index] number
| Synopsis | Index number of the TLS 1.3 signature | |
| Context | configure system security tls client-signature-list named-item tls13-signature number | |
| Tree | tls13-signature | |
| Range | 1 to 255 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
name keyword
| Synopsis | Name of the TLS 1.3 signature suite code | |
| Context | configure system security tls client-signature-list named-item tls13-signature number name keyword | |
| Tree | name | |
| Options | ||
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
client-tls-profile [client-profile-name] named-item
| Synopsis | Enter the client-tls-profile list instance | |
| Context | configure system security tls client-tls-profile named-item | |
| Tree | client-tls-profile | |
| Max. instances | 16 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[client-profile-name] named-item
| Synopsis | Client TLS profile name | |
| Context | configure system security tls client-tls-profile named-item | |
| Tree | client-tls-profile | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of the client TLS profile | |
| Context | configure system security tls client-tls-profile named-item admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cert-profile reference
| Synopsis | Certificate profile ID | |
| Context | configure system security tls client-tls-profile named-item cert-profile reference | |
| Tree | cert-profile | |
Reference | configure system security tls cert-profile named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cipher-list reference
| Synopsis | Cipher list for negotiation in the client Hello message | |
| Context | configure system security tls client-tls-profile named-item cipher-list reference | |
| Tree | cipher-list | |
Reference | configure system security tls client-cipher-list named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
group-list reference
| Synopsis | Name of the list of supported group suite codes | |
| Context | configure system security tls client-tls-profile named-item group-list reference | |
| Tree | group-list | |
Description | This command assigns an existing TLS 1.3 group list to the TLS client profile. | |
Reference | configure system security tls client-group-list named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
protocol-version keyword
| Synopsis | TLS protocol version used by the TLS client profile | |
| Context | configure system security tls client-tls-profile named-item protocol-version keyword | |
| Tree | protocol-version | |
Description | This command configures the TLS version to be negotiated between the client and the server. The client adds the specified version as a supported version in its Hello message to the server. | |
| Options | ||
| Default | tls-version-12 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
signature-list reference
| Synopsis | Name of the list of supported signature suite codes | |
| Context | configure system security tls client-tls-profile named-item signature-list reference | |
| Tree | signature-list | |
Description | This command assigns an existing TLS 1.3 signature list to the TLS client profile. | |
Reference | configure system security tls client-signature-list named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
status-verify
| Synopsis | Enter the status-verify context | |
| Context | configure system security tls client-tls-profile named-item status-verify | |
| Tree | status-verify | |
Description | Commands in this context configure certificate revocation status verification options for the end-entity certificate in a TLS client. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
default-result keyword
| Synopsis | Default result of certificate status verification | |
| Context | configure system security tls client-tls-profile named-item status-verify default-result keyword | |
| Tree | default-result | |
Description | This command configures the default result of the entity certificate verification in the TLS client profile. This command overwrites the EE certificate revocation verification for the TLS client profile. By default the router checks the certification revocation status, but if this command is set to good, the end-entity certificate revocation status is overwritten and a good revocation status is returned for the EE certificate. If this command is set to revoked, the router returns the actual revocation status of the end-entity certificate. | |
| Options | ||
| Default | revoked | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ee-revocation
| Synopsis | Enter the ee-revocation context | |
| Context | configure system security tls client-tls-profile named-item status-verify ee-revocation | |
| Tree | ee-revocation | |
Description | Commands in this context configure the methods used to verify the end entity certificate revocation status for the TLS client profile. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
primary keyword
| Synopsis | Primary method used to verify certificate revocation | |
| Context | configure system security tls client-tls-profile named-item status-verify ee-revocation primary keyword | |
| Tree | primary | |
| Options | ||
| Default | crl | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
secondary keyword
| Synopsis | Secondary method used to verify certificate revocation | |
| Context | configure system security tls client-tls-profile named-item status-verify ee-revocation secondary keyword | |
| Tree | secondary | |
| Options | ||
| Default | none | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
trust-anchor-profile reference
| Synopsis | Trust anchor profile | |
| Context | configure system security tls client-tls-profile named-item trust-anchor-profile reference | |
| Tree | trust-anchor-profile | |
Reference | configure system security tls trust-anchor-profile named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
server-cipher-list [server-cipher-list-name] named-item
| Synopsis | Enter the server-cipher-list list instance | |
| Context | configure system security tls server-cipher-list named-item | |
| Tree | server-cipher-list | |
| Max. instances | 16 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[server-cipher-list-name] named-item
| Synopsis | Server cipher list name | |
| Context | configure system security tls server-cipher-list named-item | |
| Tree | server-cipher-list | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
tls12-cipher [index] number
| Synopsis | Enter the tls12-cipher list instance | |
| Context | configure system security tls server-cipher-list named-item tls12-cipher number | |
| Tree | tls12-cipher | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[index] number
| Synopsis | Index of the cipher | |
| Context | configure system security tls server-cipher-list named-item tls12-cipher number | |
| Tree | tls12-cipher | |
| Range | 1 to 255 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
name keyword
| Synopsis | Cipher suite code | |
| Context | configure system security tls server-cipher-list named-item tls12-cipher number name keyword | |
| Tree | name | |
| Options | ||
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
tls13-cipher [index] number
| Synopsis | Enter the tls13-cipher list instance | |
| Context | configure system security tls server-cipher-list named-item tls13-cipher number | |
| Tree | tls13-cipher | |
Description | Commands in this context configure the TLS 1.3-supported ciphers used by the server. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[index] number
| Synopsis | Index number of the TLS 1.3 cipher | |
| Context | configure system security tls server-cipher-list named-item tls13-cipher number | |
| Tree | tls13-cipher | |
| Range | 1 to 255 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
name keyword
| Synopsis | Name of the TLS 1.3 cipher suite code | |
| Context | configure system security tls server-cipher-list named-item tls13-cipher number name keyword | |
| Tree | name | |
| Options | ||
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
server-group-list [server-group-list-name] named-item
| Synopsis | Enter the server-group-list list instance | |
| Context | configure system security tls server-group-list named-item | |
| Tree | server-group-list | |
Description | Commands in this context configure the list of TLS 1.3-supported group suite codes that the server sends in a server Hello message. | |
| Max. instances | 16 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[server-group-list-name] named-item
| Synopsis | Name of the TLS server group list | |
| Context | configure system security tls server-group-list named-item | |
| Tree | server-group-list | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
tls13-group [index] number
| Synopsis | Enter the tls13-group list instance | |
| Context | configure system security tls server-group-list named-item tls13-group number | |
| Tree | tls13-group | |
Description | Commands in this context configure the TLS 1.3-supported group suite codes sent by the server in its Hello messages. SR OS supports the use of Elliptic-Curve Diffie-Hellman Ephemeral (ECDHE) groups. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[index] number
| Synopsis | Index number of the TLS 1.3 group | |
| Context | configure system security tls server-group-list named-item tls13-group number | |
| Tree | tls13-group | |
| Range | 1 to 255 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
name keyword
| Synopsis | Name of the TLS 1.3 group suite code | |
| Context | configure system security tls server-group-list named-item tls13-group number name keyword | |
| Tree | name | |
| Options | ||
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
server-signature-list [server-signature-list-name] named-item
| Synopsis | Enter the server-signature-list list instance | |
| Context | configure system security tls server-signature-list named-item | |
| Tree | server-signature-list | |
Description | Commands in this context configure the list of TLS 1.3-supported signature suite codes for the digital signature that the server sends in a server Hello message. | |
| Max. instances | 16 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[server-signature-list-name] named-item
| Synopsis | Name of the TLS 1.3 server signature list | |
| Context | configure system security tls server-signature-list named-item | |
| Tree | server-signature-list | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
tls13-signature [index] number
| Synopsis | Enter the tls13-signature list instance | |
| Context | configure system security tls server-signature-list named-item tls13-signature number | |
| Tree | tls13-signature | |
Description | Commands in this context configure the TLS 1.3-supported signature suite codes sent by the server in its Hello messages. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[index] number
| Synopsis | Index number of the TLS 1.3 signature | |
| Context | configure system security tls server-signature-list named-item tls13-signature number | |
| Tree | tls13-signature | |
| Range | 1 to 255 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
name keyword
| Synopsis | Name of the TLS 1.3 signature suite code | |
| Context | configure system security tls server-signature-list named-item tls13-signature number name keyword | |
| Tree | name | |
| Options | ||
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
server-tls-profile [server-profile-name] named-item
| Synopsis | Enter the server-tls-profile list instance | |
| Context | configure system security tls server-tls-profile named-item | |
| Tree | server-tls-profile | |
| Max. instances | 16 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[server-profile-name] named-item
| Synopsis | TLS server profile name | |
| Context | configure system security tls server-tls-profile named-item | |
| Tree | server-tls-profile | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of the server TLS profile | |
| Context | configure system security tls server-tls-profile named-item admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
authenticate-client
| Synopsis | Enter the authenticate-client context | |
| Context | configure system security tls server-tls-profile named-item authenticate-client | |
| Tree | authenticate-client | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
common-name-list reference
| Synopsis | Common name list for client certificate authentication | |
| Context | configure system security tls server-tls-profile named-item authenticate-client common-name-list reference | |
| Tree | common-name-list | |
Reference | configure system security pki common-name-list named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
trust-anchor-profile reference
| Synopsis | Trust anchor profile for client authentication | |
| Context | configure system security tls server-tls-profile named-item authenticate-client trust-anchor-profile reference | |
| Tree | trust-anchor-profile | |
Reference | configure system security tls trust-anchor-profile named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cert-profile reference
| Synopsis | Certificate profile ID | |
| Context | configure system security tls server-tls-profile named-item cert-profile reference | |
| Tree | cert-profile | |
Reference | configure system security tls cert-profile named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cipher-list reference
| Synopsis | Cipher list used by the TLS server profile | |
| Context | configure system security tls server-tls-profile named-item cipher-list reference | |
| Tree | cipher-list | |
Reference | configure system security tls server-cipher-list named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
group-list reference
| Synopsis | Name of the list of supported group suite codes | |
| Context | configure system security tls server-tls-profile named-item group-list reference | |
| Tree | group-list | |
Description | This command assigns an existing TLS 1.3 group list to the TLS server profile. | |
Reference | configure system security tls server-group-list named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
protocol-version keyword
| Synopsis | TLS protocol version used by the TLS server profile | |
| Context | configure system security tls server-tls-profile named-item protocol-version keyword | |
| Tree | protocol-version | |
Description | This command configures the TLS version to be negotiated between the server and the client. The server adds the specified version as a supported version in its Hello message to the client. | |
| Options | ||
| Default | tls-version-12 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
signature-list reference
| Synopsis | Name of the list of supported signature suite codes | |
| Context | configure system security tls server-tls-profile named-item signature-list reference | |
| Tree | signature-list | |
Description | This command assigns an existing TLS 1.3 signature list to the TLS server profile. | |
Reference | configure system security tls server-signature-list named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
status-verify
| Synopsis | Enter the status-verify context | |
| Context | configure system security tls server-tls-profile named-item status-verify | |
| Tree | status-verify | |
Description | Commands in this context configure certificate revocation status verification options for the end-entity certificate in a TLS server. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
default-result keyword
| Synopsis | Default result of certificate status verification | |
| Context | configure system security tls server-tls-profile named-item status-verify default-result keyword | |
| Tree | default-result | |
Description | This command configures the default result of the entity certificate verification in the TLS server profile. This command overwrites the EE certificate revocation verification for the TLS server profile. By default the router checks the certification revocation status, but if this command is set to good, the end-entity certificate revocation status is overwritten and a good revocation status is returned for the EE certificate. If this command is set to revoked, the router returns the actual revocation status of the end-entity certificate. | |
| Options | ||
| Default | revoked | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ee-revocation
| Synopsis | Enter the ee-revocation context | |
| Context | configure system security tls server-tls-profile named-item status-verify ee-revocation | |
| Tree | ee-revocation | |
Description | Commands in this context configure the methods used to verify the end entity certificate revocation status for the TLS server profile. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
primary keyword
| Synopsis | Primary method used to verify certificate revocation | |
| Context | configure system security tls server-tls-profile named-item status-verify ee-revocation primary keyword | |
| Tree | primary | |
| Options | ||
| Default | crl | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
secondary keyword
| Synopsis | Secondary method used to verify certificate revocation | |
| Context | configure system security tls server-tls-profile named-item status-verify ee-revocation secondary keyword | |
| Tree | secondary | |
| Options | ||
| Default | none | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
tls-re-negotiate-timer number
| Synopsis | TLS HELLO request timer | |
| Context | configure system security tls server-tls-profile named-item tls-re-negotiate-timer number | |
| Tree | tls-re-negotiate-timer | |
| Range | 0 to 65000 | |
| Units | minutes | |
| Default | 0 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
trust-anchor-profile [trust-anchor-profile-name] named-item
| Synopsis | Enter the trust-anchor-profile list instance | |
| Context | configure system security tls trust-anchor-profile named-item | |
| Tree | trust-anchor-profile | |
| Max. instances | 16 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[trust-anchor-profile-name] named-item
| Synopsis | Trust anchor profile name | |
| Context | configure system security tls trust-anchor-profile named-item | |
| Tree | trust-anchor-profile | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
trust-anchor [ca-profile-name] reference
| Synopsis | Add a list entry for trust-anchor | |
| Context | configure system security tls trust-anchor-profile named-item trust-anchor reference | |
| Tree | trust-anchor | |
| Max. instances | 8 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
[ca-profile-name] reference
| Synopsis | Trusted CA profile name | |
| Context | configure system security tls trust-anchor-profile named-item trust-anchor reference | |
| Tree | trust-anchor | |
Reference | configure system security pki ca-profile named-item | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
user-params
| Synopsis | Enter the user-params context | |
| Context | configure system security user-params | |
| Tree | user-params | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
attempts
| Synopsis | Enter the attempts context | |
| Context | configure system security user-params attempts | |
| Tree | attempts | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
count number
lockout number
time number
authentication-order
| Synopsis | Enter the authentication-order context | |
| Context | configure system security user-params authentication-order | |
| Tree | authentication-order | |
Description | Commands in this context configure the sequence in which the system attempts authentication and authorization among the local user database, RADIUS servers, TACACS+ servers, and LDAP servers. Configure the order from the most preferred method to the least preferred. The presence of all methods in the command line does not guarantee they are all operational. Specifying options that are not available delays user authentication. If all operational methods are attempted and no authentication for a particular login has been granted, an entry in the security log records the failed attempt. Both the attempted login identification and originating IP address are logged with a timestamp. The default order is [radius tacplus ldap local]. The order is not applicable to SNMPv3. SNMPv3 messages ignore the configured order and are authorized using the locally configured users only. TACACS+, RADIUS, and LDAP are not supported for SNMPv3 authentication. Note: This command applies to a local user, in addition to users on RADIUS, TACACS+, and LDAP. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
exit-on-reject boolean
| Synopsis | Ignore subsequent AAA methods after a reject | |
| Context | configure system security user-params authentication-order exit-on-reject boolean | |
| Tree | exit-on-reject | |
Description | When configured to true, the router stops authentication if one of the AAA methods configured in the authentication order sends a rejection. When configured to false, the router attempts the next AAA method if a AAA method sends a rejection. If all AAA methods are exhausted, authentication and authorization is rejected. If the order specifies local as the first method, the following actions apply:
| |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
order keyword
| Synopsis | Authentication and authorization order | |
| Context | configure system security user-params authentication-order order keyword | |
| Tree | order | |
Description | This command specifies the order of authentication and authorization. The default order is [radius tacplus ldap local] | |
| Options | ||
| Max. instances | 4 | |
Notes | This element is ordered by the user. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
local-user
| Synopsis | Enter the local-user context | |
| Context | configure system security user-params local-user | |
| Tree | local-user | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
password
| Synopsis | Enter the password context | |
| Context | configure system security user-params local-user password | |
| Tree | password | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
aging number
| Synopsis | Maximum time during which a user password is valid | |
| Context | configure system security user-params local-user password aging number | |
| Tree | aging | |
| Range | 1 to 500 | |
| Units | days | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
complexity-rules
| Synopsis | Enter the complexity-rules context | |
| Context | configure system security user-params local-user password complexity-rules | |
| Tree | complexity-rules | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
allow-user-name boolean
| Synopsis | Allow the username to be used as part of the password | |
| Context | configure system security user-params local-user password complexity-rules allow-user-name boolean | |
| Tree | allow-user-name | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
credits
| Synopsis | Enter the credits context | |
| Context | configure system security user-params local-user password complexity-rules credits | |
| Tree | credits | |
Notes | The following elements are part of a choice: credits or required. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
lowercase number
| Synopsis | Maximum credits for the use of lowercase letters | |
| Context | configure system security user-params local-user password complexity-rules credits lowercase number | |
| Tree | lowercase | |
| Range | 1 to 10 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
numeric number
| Synopsis | Maximum credits for the use of numeric characters | |
| Context | configure system security user-params local-user password complexity-rules credits numeric number | |
| Tree | numeric | |
| Range | 1 to 10 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
special-character number
| Synopsis | Maximum credits for the use of special characters | |
| Context | configure system security user-params local-user password complexity-rules credits special-character number | |
| Tree | special-character | |
| Range | 1 to 10 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
uppercase number
| Synopsis | Maximum credits for the use of uppercase letters | |
| Context | configure system security user-params local-user password complexity-rules credits uppercase number | |
| Tree | uppercase | |
| Range | 1 to 10 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
disallow-sequence-keys number
| Synopsis | Minimum length of disallowed sequential characters | |
| Context | configure system security user-params local-user password complexity-rules disallow-sequence-keys number | |
| Tree | disallow-sequence-keys | |
Description | This command configures the number of consecutive characters that are not allowed to be entered as part of the password on a U.S. English or Korean keyboard. These characters can be lowercase or uppercase letters, or numbers. Special characters are not taken into account. These consecutive characters can be horizontal (left to right) or (right to left) or diagonal (up to bottom or bottom to top). If the number of consecutive characters is equal to or larger than the configured value, the password is disallowed. For example, if the user attempts to use the password "dsalkjhgfdsa", with this command configured to 8, the system rejects the password because the first consecutive sequence "dsa" is 3 lowercase letters, which passes the check, but the second consecutive sequence is "lkjhgfdsa", which consists of 9 consecutive lowercase letters and this does not pass the check. | |
| Range | 2 to 8 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
minimum-classes number
| Synopsis | Minimum number of different character classes to use | |
| Context | configure system security user-params local-user password complexity-rules minimum-classes number | |
| Tree | minimum-classes | |
| Range | 2 to 4 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
minimum-length number
| Synopsis | Minimum length required for local passwords | |
| Context | configure system security user-params local-user password complexity-rules minimum-length number | |
| Tree | minimum-length | |
| Range | 6 to 50 | |
| Default | 6 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
repeated-characters number
| Synopsis | Number of times same character can repeat consecutively | |
| Context | configure system security user-params local-user password complexity-rules repeated-characters number | |
| Tree | repeated-characters | |
| Range | 2 to 8 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
required
| Synopsis | Enter the required context | |
| Context | configure system security user-params local-user password complexity-rules required | |
| Tree | required | |
Notes | The following elements are part of a choice: credits or required. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
lowercase number
| Synopsis | Number of lowercase letters required | |
| Context | configure system security user-params local-user password complexity-rules required lowercase number | |
| Tree | lowercase | |
| Range | 1 to 10 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
numeric number
| Synopsis | Number of numeric characters required | |
| Context | configure system security user-params local-user password complexity-rules required numeric number | |
| Tree | numeric | |
| Range | 1 to 10 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
special-character number
| Synopsis | Number of special characters required | |
| Context | configure system security user-params local-user password complexity-rules required special-character number | |
| Tree | special-character | |
| Range | 1 to 10 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
uppercase number
| Synopsis | Number of uppercase letters required | |
| Context | configure system security user-params local-user password complexity-rules required uppercase number | |
| Tree | uppercase | |
| Range | 1 to 10 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
hashing keyword
| Synopsis | Hashing algorithm for user passwords | |
| Context | configure system security user-params local-user password hashing keyword | |
| Tree | hashing | |
| Options | ||
| Default | bcrypt | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
history-size number
| Synopsis | Number of previous passwords to compare against | |
| Context | configure system security user-params local-user password history-size number | |
| Tree | history-size | |
| Range | 0 to 20 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
minimum-age number
| Synopsis | Minimum age required for a password before changing it | |
| Context | configure system security user-params local-user password minimum-age number | |
| Tree | minimum-age | |
| Range | 0 to 86400 | |
| Units | seconds | |
| Default | 600 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
minimum-change number
| Synopsis | Minimum character differences between passwords | |
| Context | configure system security user-params local-user password minimum-change number | |
| Tree | minimum-change | |
| Range | 1 to 20 | |
| Default | 5 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
user [user-name] named-item
| Synopsis | Enter the user list instance | |
| Context | configure system security user-params local-user user named-item | |
| Tree | user | |
Description | Commands in this context configure local users. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[user-name] named-item
| Synopsis | Local user name | |
| Context | configure system security user-params local-user user named-item | |
| Tree | user | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
access
| Synopsis | Enter the access context | |
| Context | configure system security user-params local-user user named-item access | |
| Tree | access | |
Description | Commands in this context grant a user access to the router management access methods. If a user requires access to more than one method, multiple methods can be specified. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
bluetooth boolean
| Synopsis | Allow Bluetooth access | |
| Context | configure system security user-params local-user user named-item access bluetooth boolean | |
| Tree | bluetooth | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
console boolean
| Synopsis | Allow Bluetooth, console port CLI, SCP/SFTP, SSH CLI, and Telnet CLI access | |
| Context | configure system security user-params local-user user named-item access console boolean | |
| Tree | console | |
Description | When configured to true, the system allows this access method to take precedence over other access methods in all cases. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
console-port-cli boolean
| Synopsis | Allow console port CLI access | |
| Context | configure system security user-params local-user user named-item access console-port-cli boolean | |
| Tree | console-port-cli | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
ftp boolean
| Synopsis | Allow FTP access | |
| Context | configure system security user-params local-user user named-item access ftp boolean | |
| Tree | ftp | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
grpc boolean
| Synopsis | Allow gRPC access | |
| Context | configure system security user-params local-user user named-item access grpc boolean | |
| Tree | grpc | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
netconf boolean
| Synopsis | Allow NETCONF access | |
| Context | configure system security user-params local-user user named-item access netconf boolean | |
| Tree | netconf | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
scp-sftp boolean
| Synopsis | Allow SCP/SFTP access | |
| Context | configure system security user-params local-user user named-item access scp-sftp boolean | |
| Tree | scp-sftp | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
snmp boolean
| Synopsis | Allow SNMP access | |
| Context | configure system security user-params local-user user named-item access snmp boolean | |
| Tree | snmp | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
ssh-cli boolean
| Synopsis | Allow SSH CLI access | |
| Context | configure system security user-params local-user user named-item access ssh-cli boolean | |
| Tree | ssh-cli | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
telnet-cli boolean
| Synopsis | Allow Telnet CLI access | |
| Context | configure system security user-params local-user user named-item access telnet-cli boolean | |
| Tree | telnet-cli | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
cli-engine keyword
| Synopsis | User level override for CLI engine access | |
| Context | configure system security user-params local-user user named-item cli-engine keyword | |
| Tree | cli-engine | |
| Options | ||
| Max. instances | 2 | |
Notes | This element is ordered by the user. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
console
| Synopsis | Enter the console context | |
| Context | configure system security user-params local-user user named-item console | |
| Tree | console | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cannot-change-password boolean
| Synopsis | Change password privileges | |
| Context | configure system security user-params local-user user named-item console cannot-change-password boolean | |
| Tree | cannot-change-password | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
login-exec (sat-url | cflash-url | ftp-tftp-url | filename)
| Synopsis | File to execute when the user logs in | |
| Context | configure system security user-params local-user user named-item console login-exec (sat-url | cflash-url | ftp-tftp-url | filename) | |
| Tree | login-exec | |
String length |
1 to 200 (sat-url, cflash-url) 1 to 180 (ftp-tftp-url, filename) | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
member reference
| Synopsis | User profiles for this user | |
| Context | configure system security user-params local-user user named-item console member reference | |
| Tree | member | |
Reference | configure system security aaa local-profiles profile named-item | |
| Max. instances | 8 | |
Notes | This element is ordered by the user. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
new-password-at-login boolean
| Synopsis | Prompt a user to change password at next console login | |
| Context | configure system security user-params local-user user named-item console new-password-at-login boolean | |
| Tree | new-password-at-login | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
home-directory cflash-without-slot-url
| Synopsis | Home directory for the user | |
| Context | configure system security user-params local-user user named-item home-directory cflash-without-slot-url | |
| Tree | home-directory | |
Description | This command configures the home directory of the user for file access. Files can be accessed locally by CLI file commands and output modifiers such as > (file redirect), or remotely via FTP and SCP. If the home directory does not exist, a warning message is displayed when the user logs in. When restricted-to-home is configured, file access is denied unless the home-directory is configured and the directory is created by an administrator. | |
| String length | 1 to 200 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
password hashed-leaf
| Synopsis | User password | |
| Context | configure system security user-params local-user user named-item password hashed-leaf | |
| Tree | password | |
| String length | 3 to 136 | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
public-keys
| Synopsis | Enter the public-keys context | |
| Context | configure system security user-params local-user user named-item public-keys | |
| Tree | public-keys | |
Description | Commands in this context configure public keys for SSH. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ecdsa
| Synopsis | Enter the ecdsa context | |
| Context | configure system security user-params local-user user named-item public-keys ecdsa | |
| Tree | ecdsa | |
Description | Commands in this context configure Elliptic Curve Digital Signature Algorithm (ECDSA) public keys. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ecdsa-key [ecdsa-public-key-id] number
| Synopsis | Enter the ecdsa-key list instance | |
| Context | configure system security user-params local-user user named-item public-keys ecdsa ecdsa-key number | |
| Tree | ecdsa-key | |
Description | Commands in this context configure an ECDSA public key and associate the key with a username. A user can associate multiple public keys with a username. The key ID identifies these keys for the user. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[ecdsa-public-key-id] number
| Synopsis | ECDSA public key identifier | |
| Context | configure system security user-params local-user user named-item public-keys ecdsa ecdsa-key number | |
| Tree | ecdsa-key | |
| Range | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system security user-params local-user user named-item public-keys ecdsa ecdsa-key number description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
key-value string-not-all-spaces
| Synopsis | ECDSA public key value | |
| Context | configure system security user-params local-user user named-item public-keys ecdsa ecdsa-key number key-value string-not-all-spaces | |
| Tree | key-value | |
Description | This command configures a value for the ECDSA public key. The public key must be enclosed in quotation marks. For ECDSA, the key is between 1 and 1024 bits. | |
| String length | 1 to 255 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
rsa
| Synopsis | Enter the rsa context | |
| Context | configure system security user-params local-user user named-item public-keys rsa | |
| Tree | rsa | |
Description | Commands in this context configure RSA public keys. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
rsa-key [rsa-public-key-id] number
| Synopsis | Enter the rsa-key list instance | |
| Context | configure system security user-params local-user user named-item public-keys rsa rsa-key number | |
| Tree | rsa-key | |
Description | Commands in this context configure an RSA public key and associate the key with a username. A user can associate multiple public keys with a username. The key ID identifies these keys for the user. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[rsa-public-key-id] number
| Synopsis | RSA public key identifier | |
| Context | configure system security user-params local-user user named-item public-keys rsa rsa-key number | |
| Tree | rsa-key | |
| Range | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system security user-params local-user user named-item public-keys rsa rsa-key number description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
key-value string-not-all-spaces
| Synopsis | RSA public key value | |
| Context | configure system security user-params local-user user named-item public-keys rsa rsa-key number key-value string-not-all-spaces | |
| Tree | key-value | |
Description | This command configures a value for the RSA public key. The public key must be enclosed in quotation marks. For RSA, the key is between 768 and 4096 bits. | |
| String length | 1 to 800 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
restricted-to-home boolean
| Synopsis | Restrict file access to the home directory of the user | |
| Context | configure system security user-params local-user user named-item restricted-to-home boolean | |
| Tree | restricted-to-home | |
Description | When configured to true, the router denies the user from accessing files outside of their home directory. Files can be accessed locally by CLI file commands and output modifiers such as > (file redirect), or remotely via FTP and SCP. The system denies all configuration save operations (such as admin save) via any management interface (such as CLI and NETCONF) unless save-when-restricted is enabled. File access is denied unless a home directory is configured and the directory is created by an administrator. When configured to false, the router permits the user to access all files on the system. | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
save-when-restricted boolean
| Synopsis | Save configurations when the user is restricted to home | |
| Context | configure system security user-params local-user user named-item save-when-restricted boolean | |
| Tree | save-when-restricted | |
Description | When configured to true, the system permits configuration save operations for all configuration regions (such as bof and configure) via any management interface (such as CLI and NETCONF) even if restricted-to-home is enabled. The configuration for each region can be saved with admin save CLI commands or when committed over NETCONF and gRPC. When configured to false, the system denies saving the configuration when restricted-to-home is enabled, unless the home directory of the user includes the location of the saved configuration file. | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
snmp
| Synopsis | Enter the snmp context | |
| Context | configure system security user-params local-user user named-item snmp | |
| Tree | snmp | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
authentication
| Synopsis | Enable the authentication context | |
| Context | configure system security user-params local-user user named-item snmp authentication | |
| Tree | authentication | |
Description | Commands in this context configure the SNMPv3 authentication and privacy protocols for the user to communicate with the router. The keys are stored in an encrypted format in the configuration. The keys configured with these commands must be localized keys, which are a hash of the SNMP engine ID and a password. The password is not entered directly in this command. Use the tools perform system management-interface snmp generate-key command to generate localized authentication and privacy keys. If authentication is not configured, only the username is required to allow and authenticate SNMPv3 operations. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
authentication-key encrypted-leaf-hex-without-prefix
| Synopsis | Localized authentication key | |
| Context | configure system security user-params local-user user named-item snmp authentication authentication-key encrypted-leaf-hex-without-prefix | |
| Tree | authentication-key | |
Description | This command specifies the authentication key for the authentication protocol. The key must be a localized key, which is a hash of the SNMP engine ID and a password. The password is not entered directly in this command. Use the tools perform system management-interface snmp generate-key command to generate a localized authentication key. | |
| String length | 1 to 115 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
authentication-protocol keyword
| Synopsis | Authentication protocol | |
| Context | configure system security user-params local-user user named-item snmp authentication authentication-protocol keyword | |
| Tree | authentication-protocol | |
| Options | ||
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
privacy
| Synopsis | Enable the privacy context | |
| Context | configure system security user-params local-user user named-item snmp authentication privacy | |
| Tree | privacy | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
privacy-key encrypted-leaf-hex-without-prefix
| Synopsis | Localized privacy key | |
| Context | configure system security user-params local-user user named-item snmp authentication privacy privacy-key encrypted-leaf-hex-without-prefix | |
| Tree | privacy-key | |
Description | This command specifies the privacy key for the privacy protocol. The key must be a localized key, which is a hash of the SNMP engine ID and a password. The password is not entered directly in this command. Use the tools perform system management-interface snmp generate-key command to generate a localized privacy key. | |
| String length | 1 to 71 | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
privacy-protocol keyword
| Synopsis | Privacy protocol | |
| Context | configure system security user-params local-user user named-item snmp authentication privacy privacy-protocol keyword | |
| Tree | privacy-protocol | |
| Options | ||
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
group named-item
| Synopsis | User to associate with a group name | |
| Context | configure system security user-params local-user user named-item snmp group named-item | |
| Tree | group | |
| String length | 1 to 32 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ssh-authentication-method
| Synopsis | Enter the ssh-authentication-method context | |
| Context | configure system security user-params local-user user named-item ssh-authentication-method | |
| Tree | ssh-authentication-method | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
client
| Synopsis | Enter the client context | |
| Context | configure system security user-params local-user user named-item ssh-authentication-method client | |
| Tree | client | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
public-key-only keyword
| Synopsis | Public key only SSH authentication for this user | |
| Context | configure system security user-params local-user user named-item ssh-authentication-method client public-key-only keyword | |
| Tree | public-key-only | |
Description | This command configures the authentication method accepted for the SSH session for the specified user. This user-level configuration overrides the system-level configuration defined in the configure system security ssh authentication-method public-key-only command. When unconfigured, the command inherits the setting from the system level command. The command options are:
| |
| Options | ||
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
server
| Synopsis | Enter the server context | |
| Context | configure system security user-params local-user user named-item ssh-authentication-method server | |
| Tree | server | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
public-key-only keyword
| Synopsis | Public key only SSH authentication for this user | |
| Context | configure system security user-params local-user user named-item ssh-authentication-method server public-key-only keyword | |
| Tree | public-key-only | |
Description | This command configures the authentication method accepted for the SSH session for the specified user. This user-level configuration overrides the system-level configuration defined in the configure system security ssh authentication-method public-key-only command. When unconfigured, the command inherits the setting from the system level command. The command options are:
| |
| Options | ||
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
vprn-network-exceptions
| Synopsis | Enable the vprn-network-exceptions context | |
| Context | configure system security vprn-network-exceptions | |
| Tree | vprn-network-exceptions | |
Description | Commands in this context configure the rate limiting attributes for processing packets with label TTL expiry received within an LSP shortcut or VPRN instances in the system and from all network IP interfaces. This includes labeled user and control plan packets, ping, and traceroute packets within GRT and VPRN, and ICMP replies. These commands do not rate limit MPLS or service OAM packets. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
count number
| Synopsis | Limit of exception messages received | |
| Context | configure system security vprn-network-exceptions count number | |
| Tree | count | |
Description | This command specifies the threshold limit of exception messages. If the threshold value is exceeded within the configured time interval, packets are dropped. | |
| Range | 10 to 1000 | |
| Default | 100 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
window number
| Synopsis | Time interval to measure exception messages | |
| Context | configure system security vprn-network-exceptions window number | |
| Tree | window | |
Description | This command configures the time interval within which exception messages are counted. If the threshold value is exceeded within the configured time interval, packets are dropped. | |
| Range | 1 to 60 | |
| Units | seconds | |
| Default | 10 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
telemetry
destination-group [name] named-item
| Synopsis | Enter the destination-group list instance | |
| Context | configure system telemetry destination-group named-item | |
| Tree | destination-group | |
Description | Commands in this context configure parameters for destination groups. | |
| Max. instances | 225 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[name] named-item
| Synopsis | Destination group name | |
| Context | configure system telemetry destination-group named-item | |
| Tree | destination-group | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
allow-unsecure-connection
| Synopsis | Allow connection without secured transport protocol | |
| Context | configure system telemetry destination-group named-item allow-unsecure-connection | |
| Tree | allow-unsecure-connection | |
Description | When configured, this command allows an unsecured connection to remote managers; TCP connections are not encrypted, including username and password information. | |
Notes | The following elements are part of a choice: allow-unsecure-connection or tls-client-profile. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system telemetry destination-group named-item description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
destination [address] (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number
| Synopsis | Enter the destination list instance | |
| Context | configure system telemetry destination-group named-item destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number | |
| Tree | destination | |
| Max. instances | 4 | |
Notes | This element is ordered by the user. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[address] (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name)
| Synopsis | Address of the destination within the destination group | |
| Context | configure system telemetry destination-group named-item destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number | |
| Tree | destination | |
| String length | 1 to 255 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
port number
| Synopsis | TCP port number for the destination | |
| Context | configure system telemetry destination-group named-item destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number | |
| Tree | destination | |
| Range | 0 | 1 to 65535 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
router-instance string
| Synopsis | Router name or VPRN service name | |
| Context | configure system telemetry destination-group named-item destination (ipv4-address-no-zone | ipv6-address-no-zone | fully-qualified-domain-name) port number router-instance string | |
| Tree | router-instance | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
tcp-keepalive
| Synopsis | Enter the tcp-keepalive context | |
| Context | configure system telemetry destination-group named-item tcp-keepalive | |
| Tree | tcp-keepalive | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of the TCP keep-alive algorithm | |
| Context | configure system telemetry destination-group named-item tcp-keepalive admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
idle-time number
| Synopsis | Time until the first TCP keepalive probe is sent | |
| Context | configure system telemetry destination-group named-item tcp-keepalive idle-time number | |
| Tree | idle-time | |
| Range | 1 to 100000 | |
| Units | seconds | |
| Default | 600 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
interval number
| Synopsis | Time between TCP keepalive probes | |
| Context | configure system telemetry destination-group named-item tcp-keepalive interval number | |
| Tree | interval | |
| Range | 1 to 100000 | |
| Units | seconds | |
| Default | 15 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
retries number
| Synopsis | Number of probe retries before closing the connection | |
| Context | configure system telemetry destination-group named-item tcp-keepalive retries number | |
| Tree | retries | |
Description | This command configures the number of missed TCP keepalive probes before closing the TCP connection and attempting to reach the other destinations within the same destination group. | |
| Range | 3 to 100 | |
| Default | 4 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
tls-client-profile reference
| Synopsis | TLS client profile assigned to the destination group | |
| Context | configure system telemetry destination-group named-item tls-client-profile reference | |
| Tree | tls-client-profile | |
Reference | configure system security tls client-tls-profile named-item | |
Notes | The following elements are part of a choice: allow-unsecure-connection or tls-client-profile. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
notification-bundling
| Synopsis | Enter the notification-bundling context | |
| Context | configure system telemetry notification-bundling | |
| Tree | notification-bundling | |
Description | Commands in this context configure the bundling of multiple notifications into one telemetry message. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of notification bundling | |
| Context | configure system telemetry notification-bundling admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
max-msg-count number
| Synopsis | Maximum notifications count in telemetry message bundle | |
| Context | configure system telemetry notification-bundling max-msg-count number | |
| Tree | max-msg-count | |
| Range | 2 to 1000 | |
| Default | 100 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
max-time-granularity number
| Synopsis | Maximum interval when bundling of notifications occurs | |
| Context | configure system telemetry notification-bundling max-time-granularity number | |
| Tree | max-time-granularity | |
Description | This command sets the maximum time interval during which telemetry notifications are bundled. All bundled notifications have the same timestamp, which is the timestamp of the bundle. | |
| Range | 1 to 1000 | |
| Units | milliseconds | |
| Default | 100 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
persistent-subscriptions
| Synopsis | Enter the persistent-subscriptions context | |
| Context | configure system telemetry persistent-subscriptions | |
| Tree | persistent-subscriptions | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
delay-on-boot number
| Synopsis | Delay for persistent subscriptions after system boot | |
| Context | configure system telemetry persistent-subscriptions delay-on-boot number | |
| Tree | delay-on-boot | |
Description | This command configures the delay timer for gRPC telemetry persistent subscriptions. When the timer expires, gRPC telemetry persistent subscriptions become operational and connections are initiated. This delay prevents the system from trying to establish gRPC persistent subscriptions while it is still converging. When no delay is configured, gRPC telemetry persistent subscriptions are initiated after the system boots and gRPC becomes operational. | |
| Range | 1 to 3600 | |
| Units | seconds | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
subscription [name] named-item
| Synopsis | Enter the subscription list instance | |
| Context | configure system telemetry persistent-subscriptions subscription named-item | |
| Tree | subscription | |
| Max. instances | 225 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[name] named-item
| Synopsis | Persistent subscription name | |
| Context | configure system telemetry persistent-subscriptions subscription named-item | |
| Tree | subscription | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
admin-state keyword
| Synopsis | Administrative state of the persistent subscription | |
| Context | configure system telemetry persistent-subscriptions subscription named-item admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system telemetry persistent-subscriptions subscription named-item description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
destination-group reference
| Synopsis | Name of the destination group used in the subscription | |
| Context | configure system telemetry persistent-subscriptions subscription named-item destination-group reference | |
| Tree | destination-group | |
Reference | configure system telemetry destination-group named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
encoding keyword
| Synopsis | Encoding used for telemetry notifications | |
| Context | configure system telemetry persistent-subscriptions subscription named-item encoding keyword | |
| Tree | encoding | |
Description | This command specifies the encoding used for telemetry notifications as defined by the gNMI OpenConfig standard. | |
| Options | json – JSON encoded text bytes – Encoded according to gnmi.schemas proto – Encoded with scalar TypedValue values json-ietf – JSON encoded text as per RFC 7951 | |
| Default | json | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
local-source-address (ipv4-address-no-zone | ipv6-address-no-zone)
| Synopsis | Local IP address of packets sent from the source | |
| Context | configure system telemetry persistent-subscriptions subscription named-item local-source-address (ipv4-address-no-zone | ipv6-address-no-zone) | |
| Tree | local-source-address | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
mode keyword
| Synopsis | Mode for telemetry notifications | |
| Context | configure system telemetry persistent-subscriptions subscription named-item mode keyword | |
| Tree | mode | |
Description | This command specifies the subscription path mode for telemetry notifications sent out for the persistent subscription. | |
| Options | ||
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
originated-qos-marking keyword
| Synopsis | QoS marking used for telemetry notification packets | |
| Context | configure system telemetry persistent-subscriptions subscription named-item originated-qos-marking keyword | |
| Tree | originated-qos-marking | |
| Options | ||
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
sample-interval number
| Synopsis | Sampling interval for the persistent subscription | |
| Context | configure system telemetry persistent-subscriptions subscription named-item sample-interval number | |
| Tree | sample-interval | |
Description | This command configures the sampling interval for the persistent subscription. The interval applies only in sampling or target-defined modes. | |
| Range | 1000 to 18446744073709551615 | |
| Units | milliseconds | |
| Default | 10000 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
sensor-group reference
| Synopsis | Sensor group used in the persistent subscription | |
| Context | configure system telemetry persistent-subscriptions subscription named-item sensor-group reference | |
| Tree | sensor-group | |
Description | This command specifies the sensor group to be used in the persistent subscription. If no valid paths exist in the sensor group, the configuration is accepted, however, no gRPC connection is established when persistent subscription is activated. | |
Reference | configure system telemetry sensor-groups sensor-group named-item | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
sensor-groups
| Synopsis | Enter the sensor-groups context | |
| Context | configure system telemetry sensor-groups | |
| Tree | sensor-groups | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
sensor-group [name] named-item
| Synopsis | Enter the sensor-group list instance | |
| Context | configure system telemetry sensor-groups sensor-group named-item | |
| Tree | sensor-group | |
| Max. instances | 225 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[name] named-item
| Synopsis | Sensor group name | |
| Context | configure system telemetry sensor-groups sensor-group named-item | |
| Tree | sensor-group | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system telemetry sensor-groups sensor-group named-item description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
path [xpath] string
| Synopsis | Add a list entry for path | |
| Context | configure system telemetry sensor-groups sensor-group named-item path string | |
| Tree | path | |
| Max. instances | 4500 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[xpath] string
| Synopsis | gNMI path to be streamed | |
| Context | configure system telemetry sensor-groups sensor-group named-item path string | |
| Tree | path | |
Description | This command configures a path for the specified sensor group. Multiple paths can be defined for a single sensor group. Streamed data includes all descendants of the tree indicated by the path. The path is defined in the form of an XML Path (XPath) syntax that refers to single or multiple objects within the YANG model. The path must be enclosed in quotation marks (") when it includes a list key, for example, "/state/router[router-name=Base]". | |
| String length | 1 to 512 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
thresholds
| Synopsis | Enter the thresholds context | |
| Context | configure system thresholds | |
| Tree | thresholds | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
cflash-cap-alarm-percent [cflash-id] thresholds-cflash-url
| Synopsis | Enter the cflash-cap-alarm-percent list instance | |
| Context | configure system thresholds cflash-cap-alarm-percent thresholds-cflash-url | |
| Tree | cflash-cap-alarm-percent | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[cflash-id] thresholds-cflash-url
| Synopsis | cflash device name monitored for capacity | |
| Context | configure system thresholds cflash-cap-alarm-percent thresholds-cflash-url | |
| Tree | cflash-cap-alarm-percent | |
| String length | 1 to 200 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
falling-threshold number
| Synopsis | Falling threshold for the sampled statistic | |
| Context | configure system thresholds cflash-cap-alarm-percent thresholds-cflash-url falling-threshold number | |
| Tree | falling-threshold | |
Description | This command specifies a falling threshold for the sampled statistic. When the current sampled value is less than or equal to this threshold, and the value at the last sampling interval was greater than this threshold, a single threshold-crossing event is generated. A single threshold-crossing event is also generated if the first sample taken is less than or equal to this threshold and the associated startup-alarm command is equal to the falling or either values. After a falling threshold-crossing event is generated, another such event is not generated until the sampled value rises above this threshold and reaches greater than or equal to the rising-threshold command. | |
| Range | 0 to 100 | |
| Units | percent | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
interval number
| Synopsis | Polling period over which data is sampled and compared | |
| Context | configure system thresholds cflash-cap-alarm-percent thresholds-cflash-url interval number | |
| Tree | interval | |
Description | This command specifies the polling interval over which the data is sampled and compared with the rising and falling thresholds. | |
| Range | 1 to 2147483647 | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
rising-threshold number
| Synopsis | Rising threshold for the sampled statistic | |
| Context | configure system thresholds cflash-cap-alarm-percent thresholds-cflash-url rising-threshold number | |
| Tree | rising-threshold | |
Description | This command specifies a rising threshold for the sampled statistic. When the current sampled value is greater than or equal to this threshold, and the value at the last sampling interval was less than this threshold, a single threshold-crossing event is generated. A single threshold crossing event is also generated if the first sample taken is greater than or equal to this threshold and the associated startup-alarm command is equal to the rising or either values. After a rising threshold-crossing event is generated, another such event is not generated until the sampled value falls below this threshold and reaches less than or equal the falling-threshold command. | |
| Range | 0 to 100 | |
| Units | percent | |
Notes |
This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
rmon-event-type keyword
| Synopsis | Notification type specifying action when event occurs | |
| Context | configure system thresholds cflash-cap-alarm-percent thresholds-cflash-url rmon-event-type keyword | |
| Tree | rmon-event-type | |
| Options | ||
| Default | both | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
startup-alarm keyword
| Synopsis | Alarm type when the alarm is first created | |
| Context | configure system thresholds cflash-cap-alarm-percent thresholds-cflash-url startup-alarm keyword | |
| Tree | startup-alarm | |
Description | This command specifies the alarm type that may be sent when this alarm is first created. If the first sample is greater than or equal to the rising threshold value and startup-alarm is equal to rising or either, a single rising threshold crossing event is generated. If the first sample is less than or equal to the falling threshold value and startup-alarm is equal to falling or either, a single falling threshold crossing event is generated. | |
| Options | ||
| Default | either | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
cflash-cap-warn-percent [cflash-id] thresholds-cflash-url
| Synopsis | Enter the cflash-cap-warn-percent list instance | |
| Context | configure system thresholds cflash-cap-warn-percent thresholds-cflash-url | |
| Tree | cflash-cap-warn-percent | |
Description | Commands in this context configure the capacity monitoring of the compact flash. The usage is monitored as a percentage of the capacity of the compact flash. The severity level is warning. Both a rising and falling threshold can be specified. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[cflash-id] thresholds-cflash-url
| Synopsis | cflash device name monitored for capacity | |
| Context | configure system thresholds cflash-cap-warn-percent thresholds-cflash-url | |
| Tree | cflash-cap-warn-percent | |
| String length | 1 to 200 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
falling-threshold number
| Synopsis | Falling threshold for the sampled statistic | |
| Context | configure system thresholds cflash-cap-warn-percent thresholds-cflash-url falling-threshold number | |
| Tree | falling-threshold | |
Description | This command specifies a falling threshold for the sampled statistic. When the current sampled value is less than or equal to this threshold, and the value at the last sampling interval was greater than this threshold, a single threshold-crossing event is generated. A single threshold-crossing event is also generated if the first sample taken is less than or equal to this threshold and the associated startup-alarm command is equal to the falling or either values. After a falling threshold-crossing event is generated, another such event is not generated until the sampled value rises above this threshold and reaches greater than or equal to the rising-threshold command. | |
| Range | 0 to 100 | |
| Units | percent | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
interval number
| Synopsis | Polling period over which data is sampled and compared | |
| Context | configure system thresholds cflash-cap-warn-percent thresholds-cflash-url interval number | |
| Tree | interval | |
Description | This command specifies the polling interval over which the data is sampled and compared with the rising and falling thresholds. | |
| Range | 1 to 2147483647 | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
rising-threshold number
| Synopsis | Rising threshold for the sampled statistic | |
| Context | configure system thresholds cflash-cap-warn-percent thresholds-cflash-url rising-threshold number | |
| Tree | rising-threshold | |
Description | This command specifies a rising threshold for the sampled statistic. When the current sampled value is greater than or equal to this threshold, and the value at the last sampling interval was less than this threshold, a single threshold-crossing event is generated. A single threshold crossing event is also generated if the first sample taken is greater than or equal to this threshold and the associated startup-alarm command is equal to the rising or either values. After a rising threshold-crossing event is generated, another such event is not generated until the sampled value falls below this threshold and reaches less than or equal the falling-threshold command. | |
| Range | 0 to 100 | |
| Units | percent | |
Notes |
This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
rmon-event-type keyword
| Synopsis | Notification type specifying action when event occurs | |
| Context | configure system thresholds cflash-cap-warn-percent thresholds-cflash-url rmon-event-type keyword | |
| Tree | rmon-event-type | |
| Options | ||
| Default | both | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
startup-alarm keyword
| Synopsis | Alarm type when the alarm is first created | |
| Context | configure system thresholds cflash-cap-warn-percent thresholds-cflash-url startup-alarm keyword | |
| Tree | startup-alarm | |
Description | This command specifies the alarm type that may be sent when this alarm is first created. If the first sample is greater than or equal to the rising threshold value and startup-alarm is equal to rising or either, a single rising threshold crossing event is generated. If the first sample is less than or equal to the falling threshold value and startup-alarm is equal to falling or either, a single falling threshold crossing event is generated. | |
| Options | ||
| Default | either | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
kb-memory-use-alarm
| Synopsis | Enable the kb-memory-use-alarm context | |
| Context | configure system thresholds kb-memory-use-alarm | |
| Tree | kb-memory-use-alarm | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
falling-threshold number
| Synopsis | Falling threshold for the sampled statistic | |
| Context | configure system thresholds kb-memory-use-alarm falling-threshold number | |
| Tree | falling-threshold | |
Description | This command specifies a falling threshold for the sampled statistic. When the current sampled value is less than or equal to this threshold, and the value at the last sampling interval was greater than this threshold, a single threshold-crossing event is generated. A single threshold-crossing event is also generated if the first sample taken is less than or equal to this threshold and the associated startup-alarm command is equal to the falling or either values. After a falling threshold-crossing event is generated, another such event is not generated until the sampled value rises above this threshold and reaches greater than or equal to the rising-threshold command. | |
| Range | -2147483648 to 2147483647 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
interval number
| Synopsis | Polling period over which data is sampled and compared | |
| Context | configure system thresholds kb-memory-use-alarm interval number | |
| Tree | interval | |
Description | This command specifies the polling interval over which the data is sampled and compared with the rising and falling thresholds. | |
| Range | 1 to 2147483647 | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
rising-threshold number
| Synopsis | Rising threshold for the sampled statistic | |
| Context | configure system thresholds kb-memory-use-alarm rising-threshold number | |
| Tree | rising-threshold | |
Description | This command specifies a rising threshold for the sampled statistic. When the current sampled value is greater than or equal to this threshold, and the value at the last sampling interval was less than this threshold, a single threshold-crossing event is generated. A single threshold crossing event is also generated if the first sample taken is greater than or equal to this threshold and the associated startup-alarm command is equal to the rising or either values. After a rising threshold-crossing event is generated, another such event is not generated until the sampled value falls below this threshold and reaches less than or equal the falling-threshold command. | |
| Range | -2147483648 to 2147483647 | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
rmon-event-type keyword
| Synopsis | Notification type specifying action when event occurs | |
| Context | configure system thresholds kb-memory-use-alarm rmon-event-type keyword | |
| Tree | rmon-event-type | |
| Options | ||
| Default | both | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
startup-alarm keyword
| Synopsis | Alarm type when the alarm is first created | |
| Context | configure system thresholds kb-memory-use-alarm startup-alarm keyword | |
| Tree | startup-alarm | |
Description | This command specifies the alarm type that may be sent when this alarm is first created. If the first sample is greater than or equal to the rising threshold value and startup-alarm is equal to rising or either, a single rising threshold crossing event is generated. If the first sample is less than or equal to the falling threshold value and startup-alarm is equal to falling or either, a single falling threshold crossing event is generated. | |
| Options | ||
| Default | either | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
kb-memory-use-warn
| Synopsis | Enable the kb-memory-use-warn context | |
| Context | configure system thresholds kb-memory-use-warn | |
| Tree | kb-memory-use-warn | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
falling-threshold number
| Synopsis | Falling threshold for the sampled statistic | |
| Context | configure system thresholds kb-memory-use-warn falling-threshold number | |
| Tree | falling-threshold | |
Description | This command specifies a falling threshold for the sampled statistic. When the current sampled value is less than or equal to this threshold, and the value at the last sampling interval was greater than this threshold, a single threshold-crossing event is generated. A single threshold-crossing event is also generated if the first sample taken is less than or equal to this threshold and the associated startup-alarm command is equal to the falling or either values. After a falling threshold-crossing event is generated, another such event is not generated until the sampled value rises above this threshold and reaches greater than or equal to the rising-threshold command. | |
| Range | -2147483648 to 2147483647 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
interval number
| Synopsis | Polling period over which data is sampled and compared | |
| Context | configure system thresholds kb-memory-use-warn interval number | |
| Tree | interval | |
Description | This command specifies the polling interval over which the data is sampled and compared with the rising and falling thresholds. | |
| Range | 1 to 2147483647 | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
rising-threshold number
| Synopsis | Rising threshold for the sampled statistic | |
| Context | configure system thresholds kb-memory-use-warn rising-threshold number | |
| Tree | rising-threshold | |
Description | This command specifies a rising threshold for the sampled statistic. When the current sampled value is greater than or equal to this threshold, and the value at the last sampling interval was less than this threshold, a single threshold-crossing event is generated. A single threshold crossing event is also generated if the first sample taken is greater than or equal to this threshold and the associated startup-alarm command is equal to the rising or either values. After a rising threshold-crossing event is generated, another such event is not generated until the sampled value falls below this threshold and reaches less than or equal the falling-threshold command. | |
| Range | -2147483648 to 2147483647 | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
rmon-event-type keyword
| Synopsis | Notification type specifying action when event occurs | |
| Context | configure system thresholds kb-memory-use-warn rmon-event-type keyword | |
| Tree | rmon-event-type | |
| Options | ||
| Default | both | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
startup-alarm keyword
| Synopsis | Alarm type when the alarm is first created | |
| Context | configure system thresholds kb-memory-use-warn startup-alarm keyword | |
| Tree | startup-alarm | |
Description | This command specifies the alarm type that may be sent when this alarm is first created. If the first sample is greater than or equal to the rising threshold value and startup-alarm is equal to rising or either, a single rising threshold crossing event is generated. If the first sample is less than or equal to the falling threshold value and startup-alarm is equal to falling or either, a single falling threshold crossing event is generated. | |
| Options | ||
| Default | either | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
rmon
| Synopsis | Enter the rmon context | |
| Context | configure system thresholds rmon | |
| Tree | rmon | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
alarm [rmon-alarm-id] number
| Synopsis | Enter the alarm list instance | |
| Context | configure system thresholds rmon alarm number | |
| Tree | alarm | |
| Max. instances | 1200 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[rmon-alarm-id] number
| Synopsis | Index ID for an entry in the alarm table | |
| Context | configure system thresholds rmon alarm number | |
| Tree | alarm | |
| Range | 0 to 65400 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
falling-event number
| Synopsis | RMON event ID for falling threshold crossing event | |
| Context | configure system thresholds rmon alarm number falling-event number | |
| Tree | falling-event | |
| Range | 0 to 65400 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
falling-threshold number
| Synopsis | Falling threshold for the sampled statistic | |
| Context | configure system thresholds rmon alarm number falling-threshold number | |
| Tree | falling-threshold | |
Description | This command specifies a falling threshold for the sampled statistic. When the current sampled value is less than or equal to this threshold and the value at the last sampling interval was greater than this threshold, a single threshold crossing event is generated. A single threshold crossing event is also generated if the first sample taken is less than or equal to this threshold and the associated startup-alarm command is set to falling or either. After a falling threshold crossing event is generated, another such event is not generated until the sampled value exceeds this threshold and reaches or exceeds the rising-threshold command setting. | |
| Range | -2147483648 to 2147483647 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
interval number
| Synopsis | Polling period over which data is sampled and compared | |
| Context | configure system thresholds rmon alarm number interval number | |
| Tree | interval | |
Description | This command specifies the polling interval over which the data is sampled and compared with the rising and falling thresholds | |
| Range | 1 to 2147483647 | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
owner string
rising-event number
| Synopsis | RMON event ID for rising threshold crossing event | |
| Context | configure system thresholds rmon alarm number rising-event number | |
| Tree | rising-event | |
| Range | 0 to 65400 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
rising-threshold number
| Synopsis | Rising threshold for the sampled statistic | |
| Context | configure system thresholds rmon alarm number rising-threshold number | |
| Tree | rising-threshold | |
Description | This command specifies the rising threshold for the sampled statistic. When the current sampled value is greater than or equal to this threshold and the value at the last sampling interval was below this threshold, a single threshold crossing event is generated. A single threshold crossing event is also generated if the first sample taken is greater than or equal to this threshold and the associated startup-alarm command is set to rising or either. After a rising threshold crossing event is generated, another such event is not generated until the sampled value falls below this threshold and reaches or falls below the falling-threshold command setting. | |
| Range | -2147483648 to 2147483647 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
sample-type keyword
| Synopsis | Sampling type for value comparison with thresholds | |
| Context | configure system thresholds rmon alarm number sample-type keyword | |
| Tree | sample-type | |
| Options | ||
| Default | absolute | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
startup-alarm keyword
| Synopsis | Alarm to send when this entry is first set to valid | |
| Context | configure system thresholds rmon alarm number startup-alarm keyword | |
| Tree | startup-alarm | |
| Options | ||
| Default | either | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
variable-oid string
| Synopsis | Object identifier to sample the specific variable | |
| Context | configure system thresholds rmon alarm number variable-oid string | |
| Tree | variable-oid | |
| String length | 1 to 255 | |
Notes | This element is mandatory. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
event [rmon-event-id] number
| Synopsis | Enter the event list instance | |
| Context | configure system thresholds rmon event number | |
| Tree | event | |
| Max. instances | 1200 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[rmon-event-id] number
| Synopsis | Index ID for an entry in the event table | |
| Context | configure system thresholds rmon event number | |
| Tree | event | |
| Range | 1 to 65400 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
description description
| Synopsis | Text description | |
| Context | configure system thresholds rmon event number description description | |
| Tree | description | |
| String length | 1 to 80 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
event-type keyword
| Synopsis | Notification action to be taken when the event occurs | |
| Context | configure system thresholds rmon event number event-type keyword | |
| Tree | event-type | |
| Options | ||
| Default | both | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
owner string
time
daylight-saving-time-zone
| Synopsis | Enter the daylight-saving-time-zone context | |
| Context | configure system time daylight-saving-time-zone | |
| Tree | daylight-saving-time-zone | |
Description | Commands in this context configure the start and end dates and offset for summer time (or Daylight Savings Time [DST]). A daylight savings time zone can be specified using a standard name or a non-standard name. The parameters (start day, end day, and offset) for a standard name zone are well defined and not configurable. The parameters for a nonstandard name zone are configurable. The time is adjusted by adding the offset when summer time starts and subtracting the offset when summer time ends. If no summer (daylight savings) time is supplied, the system assumes no summer time adjustment is required. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
non-standard
| Synopsis | Enter the non-standard context | |
| Context | configure system time daylight-saving-time-zone non-standard | |
| Tree | non-standard | |
Notes | The following elements are part of a choice: non-standard or standard. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
end
| Synopsis | Enter the end context | |
| Context | configure system time daylight-saving-time-zone non-standard end | |
| Tree | end | |
Description | Commands in this context configure the end of summer time settings. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
day keyword
| Synopsis | Day of the week when summer time ends | |
| Context | configure system time daylight-saving-time-zone non-standard end day keyword | |
| Tree | day | |
| Options | ||
| Default | sunday | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
hours-minutes hours-minutes-twenty-four
| Synopsis | Time when summer time ends, in hh:mm format | |
| Context | configure system time daylight-saving-time-zone non-standard end hours-minutes hours-minutes-twenty-four | |
| Tree | hours-minutes | |
| String length | 5 | |
| Default | 00:00 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
month keyword
| Synopsis | Month when summer time ends | |
| Context | configure system time daylight-saving-time-zone non-standard end month keyword | |
| Tree | month | |
| Options | ||
| Default | january | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
week keyword
| Synopsis | Week of the month when summer time ends | |
| Context | configure system time daylight-saving-time-zone non-standard end week keyword | |
| Tree | week | |
| Options | ||
| Default | first | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
name string
| Synopsis | Nonstandard summer time zone name | |
| Context | configure system time daylight-saving-time-zone non-standard name string | |
| Tree | name | |
| String length | 1 to 5 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
offset number
| Synopsis | Summer time offset | |
| Context | configure system time daylight-saving-time-zone non-standard offset number | |
| Tree | offset | |
Description | This command configures the number of minutes that are added to the time when summer time takes effect. The same number of minutes are subtracted from the time when summer time ends. | |
| Range | 0 to 60 | |
| Units | minutes | |
| Default | 60 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
start
| Synopsis | Enter the start context | |
| Context | configure system time daylight-saving-time-zone non-standard start | |
| Tree | start | |
Description | Commands in this context configure the start of summer time settings. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
day keyword
| Synopsis | Day of the week when summer time starts | |
| Context | configure system time daylight-saving-time-zone non-standard start day keyword | |
| Tree | day | |
| Options | ||
| Default | sunday | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
hours-minutes hours-minutes-twenty-four
| Synopsis | Time when summer time starts, in hh:mm format | |
| Context | configure system time daylight-saving-time-zone non-standard start hours-minutes hours-minutes-twenty-four | |
| Tree | hours-minutes | |
| String length | 5 | |
| Default | 00:00 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
month keyword
| Synopsis | Month when summer time starts | |
| Context | configure system time daylight-saving-time-zone non-standard start month keyword | |
| Tree | month | |
| Options | ||
| Default | january | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
week keyword
| Synopsis | Week of the month when summer time starts | |
| Context | configure system time daylight-saving-time-zone non-standard start week keyword | |
| Tree | week | |
| Options | ||
| Default | first | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
standard
| Synopsis | Enter the standard context | |
| Context | configure system time daylight-saving-time-zone standard | |
| Tree | standard | |
Notes | The following elements are part of a choice: non-standard or standard. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
name keyword
| Synopsis | Standard time zone name | |
| Context | configure system time daylight-saving-time-zone standard name keyword | |
| Tree | name | |
| Options | adt – Atlantic Daylight Time ndt – Newfoundland Daylight Time akdt – Alaska Daylight Time cdt – Central Daylight Time cest – Central European Summer Time edt – Eastern Daylight Time eest – Eastern European Summer Time mdt – Mountain Daylight Time nzdt – New Zealand Daylight Time pdt – Pacific Daylight Time west – Western European Summer Time | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ntp
admin-state keyword
| Synopsis | Administrative state of NTP execution | |
| Context | configure system time ntp admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
authentication-check boolean
| Synopsis | Authenticate NTP PDUs and reject mismatches | |
| Context | configure system time ntp authentication-check boolean | |
| Tree | authentication-check | |
| Default | true | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
authentication-key [key-id] number
| Synopsis | Enter the authentication-key list instance | |
| Context | configure system time ntp authentication-key number | |
| Tree | authentication-key | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[key-id] number
| Synopsis | Authentication key ID used for NTP packets | |
| Context | configure system time ntp authentication-key number | |
| Tree | authentication-key | |
| Range | 1 to 255 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
key encrypted-leaf
type keyword
authentication-keychain reference
| Synopsis | Authentication keychain for unsolicited traffic | |
| Context | configure system time ntp authentication-keychain reference | |
| Tree | authentication-keychain | |
Description | This command configures the authentication keychain used to handle unsolicited NTP requests. If a request is received with a key ID that matches both a configured key and the keychain, the MAC is checked first using the key information. If the authentication fails, the MAC is checked using the information from the keychain. | |
Reference | ||
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
broadcast [router-instance] reference interface-name interface-name
[router-instance] reference
interface-name interface-name
authentication-keychain reference
| Synopsis | Keychain used to authenticate broadcast messages | |
| Context | configure system time ntp broadcast reference interface-name interface-name authentication-keychain reference | |
| Tree | authentication-keychain | |
Description | This command configures the keychain used to authenticate messages sent by this node. The keychain infrastructure is queried using this keychain name to get the youngest key used for generating the authentication value for the message. When an NTP packet is received by this node, the keychain infrastructure is queried using the keychain name and the key ID extracted from the received message to get the key used to perform the authentication check. If authentication does not pass, the packet is rejected. Keychain entries also have a direction. The key ID and authentication keychain are mutually exclusive. When neither one is set, for example, the key ID has a value of '0' and the value of this command is empty, no authentication is performed. | |
Reference | ||
Notes | The following elements are part of a choice: authentication-keychain or key-id. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
key-id reference
| Synopsis | Authentication key and type used by the node | |
| Context | configure system time ntp broadcast reference interface-name interface-name key-id reference | |
| Tree | key-id | |
Reference | configure system time ntp authentication-key number | |
Notes | The following elements are part of a choice: authentication-keychain or key-id. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ttl number
version number
broadcast-client [router-instance] string interface-name interface-name
| Synopsis | Enter the broadcast-client list instance | |
| Context | configure system time ntp broadcast-client string interface-name interface-name | |
| Tree | broadcast-client | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[router-instance] string
| Synopsis | Router name or VPRN service name | |
| Context | configure system time ntp broadcast-client string interface-name interface-name | |
| Tree | broadcast-client | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
interface-name interface-name
| Synopsis | Interface to transmit or receive NTP broadcast packets | |
| Context | configure system time ntp broadcast-client string interface-name interface-name | |
| Tree | broadcast-client | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
authenticate boolean
| Synopsis | Enforce authentication of NTP PDUs | |
| Context | configure system time ntp broadcast-client string interface-name interface-name authenticate boolean | |
| Tree | authenticate | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
multicast
authentication-keychain reference
| Synopsis | Keychain used to authenticate broadcast messages | |
| Context | configure system time ntp multicast authentication-keychain reference | |
| Tree | authentication-keychain | |
Description | This command configures the keychain used to authenticate messages sent by this node. The keychain infrastructure is queried using this keychain name to get the youngest key used for generating the authentication value for the message. When an NTP packet is received by this node, the keychain infrastructure is queried using the keychain name and the key ID extracted from the received message to get the key used to perform the authentication check. If authentication does not pass, the packet is rejected. Keychain entries also have a direction. The key ID and authentication keychain are mutually exclusive. When neither one is set, for example, the key ID has a value of '0' and the value of this command is empty, no authentication is performed. | |
Reference | ||
Notes | The following elements are part of a choice: authentication-keychain or key-id. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
key-id reference
| Synopsis | Authentication key and type used by the node | |
| Context | configure system time ntp multicast key-id reference | |
| Tree | key-id | |
Reference | configure system time ntp authentication-key number | |
Notes | The following elements are part of a choice: authentication-keychain or key-id. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
version number
| Synopsis | NTP version number generated by the node | |
| Context | configure system time ntp multicast version number | |
| Tree | version | |
Description | This command specifies the NTP version number that is generated by the node. This command does not need to be configured when in client mode, in which case all three versions are accepted. | |
| Range | 2 to 4 | |
| Default | 4 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
multicast-client
| Synopsis | Enable the multicast-client context | |
| Context | configure system time ntp multicast-client | |
| Tree | multicast-client | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
authenticate boolean
| Synopsis | Enforce authentication of NTP PDUs | |
| Context | configure system time ntp multicast-client authenticate boolean | |
| Tree | authenticate | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
ntp-server
| Synopsis | Enable the ntp-server context | |
| Context | configure system time ntp ntp-server | |
| Tree | ntp-server | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
authenticate boolean
| Synopsis | Authentication of NTP PDUs when acting as a server | |
| Context | configure system time ntp ntp-server authenticate boolean | |
| Tree | authenticate | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
peer [ip-address] (ipv4-address-no-zone | ipv6-address-no-zone) router-instance string
[ip-address] (ipv4-address-no-zone | ipv6-address-no-zone)
router-instance string
authentication-keychain reference
| Synopsis | Keychain used to authenticate broadcast messages | |
| Context | configure system time ntp peer (ipv4-address-no-zone | ipv6-address-no-zone) router-instance string authentication-keychain reference | |
| Tree | authentication-keychain | |
Description | This command configures the keychain used to authenticate messages sent by this node. The keychain infrastructure is queried using this keychain name to get the youngest key used for generating the authentication value for the message. When an NTP packet is received by this node, the keychain infrastructure is queried using the keychain name and the key ID extracted from the received message to get the key used to perform the authentication check. If authentication does not pass, the packet is rejected. Keychain entries also have a direction. The key ID and authentication keychain are mutually exclusive. When neither one is set, for example, the key ID has a value of '0' and the value of this command is empty, no authentication is performed. | |
Reference | ||
Notes | The following elements are part of a choice: authentication-keychain or key-id. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
key-id reference
| Synopsis | Authentication key and type used by the node | |
| Context | configure system time ntp peer (ipv4-address-no-zone | ipv6-address-no-zone) router-instance string key-id reference | |
| Tree | key-id | |
Reference | configure system time ntp authentication-key number | |
Notes | The following elements are part of a choice: authentication-keychain or key-id. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
prefer boolean
version number
| Synopsis | NTP version number generated by the node | |
| Context | configure system time ntp peer (ipv4-address-no-zone | ipv6-address-no-zone) router-instance string version number | |
| Tree | version | |
Description | This command specifies the NTP version number that is generated by the node. This command does not need to be configured when in client mode, in which case all three versions are accepted. | |
| Range | 2 to 4 | |
| Default | 4 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
server [ip-address] (ipv4-address-no-zone | ipv6-address-no-zone | keyword) router-instance string
[ip-address] (ipv4-address-no-zone | ipv6-address-no-zone | keyword)
router-instance string
authentication-keychain reference
| Synopsis | Keychain used to authenticate broadcast messages | |
| Context | configure system time ntp server (ipv4-address-no-zone | ipv6-address-no-zone | keyword) router-instance string authentication-keychain reference | |
| Tree | authentication-keychain | |
Description | This command configures the keychain used to authenticate messages sent by this node. The keychain infrastructure is queried using this keychain name to get the youngest key used for generating the authentication value for the message. When an NTP packet is received by this node, the keychain infrastructure is queried using the keychain name and the key ID extracted from the received message to get the key used to perform the authentication check. If authentication does not pass, the packet is rejected. Keychain entries also have a direction. The key ID and authentication keychain are mutually exclusive. When neither one is set, for example, the key ID has a value of '0' and the value of this command is empty, no authentication is performed. | |
Reference | ||
Notes | The following elements are part of a choice: authentication-keychain or key-id. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
key-id reference
| Synopsis | Authentication key and type used by the node | |
| Context | configure system time ntp server (ipv4-address-no-zone | ipv6-address-no-zone | keyword) router-instance string key-id reference | |
| Tree | key-id | |
Reference | configure system time ntp authentication-key number | |
Notes | The following elements are part of a choice: authentication-keychain or key-id. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
prefer boolean
version number
| Synopsis | NTP version number generated by the node | |
| Context | configure system time ntp server (ipv4-address-no-zone | ipv6-address-no-zone | keyword) router-instance string version number | |
| Tree | version | |
Description | This command specifies the NTP version number that is generated by the node. This command does not need to be configured when in client mode, in which case all three versions are accepted. | |
| Range | 2 to 4 | |
| Default | 4 | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
prefer-local-time boolean
| Synopsis | Use local time over UTC time in the system | |
| Context | configure system time prefer-local-time boolean | |
| Tree | prefer-local-time | |
Description | When configured to true, the system uses local time. This preference is applied to objects such as log file names, created and completed times reported in log files, NETCONF and gRPC date-and-time leafs, and rollback times displayed in show command outputs. When configured to false, the system uses UTC time. Note: The timezone used for show command outputs during a CLI session can be controlled using the environment time-display command. Note: The format used for the date-time strings may change, depending on the command setting. For example, when this command is set to true, all date-time strings include a suffix of three to five characters that indicates the timezone used. Note: The time format for timestamps on log events is controlled on a per-log basis, using the configure log log-id time-format command. | |
| Default | false | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
sntp
admin-state keyword
| Synopsis | Administrative state of SNTP | |
| Context | configure system time sntp admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
server [ip-address] (ipv4-address-no-zone | ipv6-address-no-zone)
[ip-address] (ipv4-address-no-zone | ipv6-address-no-zone)
interval number
prefer boolean
version number
sntp-state keyword
| Synopsis | Mode for Simple Network Time Protocol (SNTP) | |
| Context | configure system time sntp sntp-state keyword | |
| Tree | sntp-state | |
| Options | ||
| Default | unicast | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
zone
non-standard
| Synopsis | Enter the non-standard context | |
| Context | configure system time zone non-standard | |
| Tree | non-standard | |
Notes | The following elements are part of a choice: non-standard or standard. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
name string
offset hours-minutes-with-range
standard
name keyword
transmission-profile [name] named-item
| Synopsis | Enter the transmission-profile list instance | |
| Context | configure system transmission-profile named-item | |
| Tree | transmission-profile | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
[name] named-item
| Synopsis | File transmission profile name | |
| Context | configure system transmission-profile named-item | |
| Tree | transmission-profile | |
| String length | 1 to 32 | |
Notes | This element is part of a list key. | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
http-version keyword
| Synopsis | HTTP version | |
| Context | configure system transmission-profile named-item http-version keyword | |
| Tree | http-version | |
| Options | ||
| Default | 1.1 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ipv4-source-address ipv4-unicast-address
| Synopsis | IPv4 source address used for the transport protocol | |
| Context | configure system transmission-profile named-item ipv4-source-address ipv4-unicast-address | |
| Tree | ipv4-source-address | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
ipv6-source-address ipv6-address
| Synopsis | IPv6 source address used for the transport protocol | |
| Context | configure system transmission-profile named-item ipv6-source-address ipv6-address | |
| Tree | ipv6-source-address | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
redirection number
| Synopsis | Maximum level of redirection | |
| Context | configure system transmission-profile named-item redirection number | |
| Tree | redirection | |
| Range | 1 to 8 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
retry number
| Synopsis | Number of attempts to reconnecting to the server | |
| Context | configure system transmission-profile named-item retry number | |
| Tree | retry | |
| Range | 1 to 256 | |
| Introduced | 25.3.R2 | |
|
Platforms | 7705 SAR Gen 2 |
router-instance router-instance-base-management-vprn-loose
| Synopsis | Router instance used by the transport protocol | |
| Context | configure system transmission-profile named-item router-instance router-instance-base-management-vprn-loose | |
| Tree | router-instance | |
| String length | 1 to 64 | |
| Default | Base | |
| Introduced | 25.3.R2 | |
Platforms |
7705 SAR Gen 2 |
timeout number
| Synopsis | Timeout for a response from the server | |
| Context | configure system transmission-profile named-item timeout number | |
| Tree | timeout | |
| Range | 1 to 3600 | |
| Units | seconds | |
| Default | 60 | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |
usb [usb-cflash] keyword
[usb-cflash] keyword
admin-state keyword
| Synopsis | Administrative state of the USB port | |
| Context | configure system usb keyword admin-state keyword | |
| Tree | admin-state | |
| Options | ||
| Default | disable | |
| Introduced | 25.3.R2 | |
Platforms | 7705 SAR Gen 2 |