Reference
Documents under this category include information about the attributes, APIs, and the full set of CLI commands (MD-CLI and classic) supported by SR OS.
- Acronyms Guide
  This guide provides expansions of acronyms found in the user guides.
- Classic CLI Command Reference Guide
  This guide describes all classic CLI commands (except for the clear, monitor, show, and tools commands) and their supported values and parameters.
- Clear, Monitor, Show, and Tools CLI Command Reference Guide
  This guide describes all clear, monitor, show, and tools CLI commands and their supported values and parameters.
- Gx AVPs Reference Guide
  This guide describes Gx Attribute Value Pairs (AVPs).
- Gy AVPs Reference Guide
  This guide describes Gy Attribute Value Pairs (AVPs).
- MD-CLI Command Reference Guide
  This guide describes all MD-CLI commands (except for the clear, monitor, show, and tools commands) and their supported values and parameters.
- MD-CLI Quick Reference Guide
  This guide provides a comparison of the Nokia SR OS Model-Driven Command Line Interface (MD-CLI) with those used by Junos OS and IOS XR.
- NISH Installation and User Guide
  This guide describes the Nokia Network Interface Shell (NISH) system architecture, functional overview, features, and how to install and set up the NISH.
- Pay-as-you-Grow Licensing Guide
- pySROS API
- RADIUS Guide
  This guide describes all supported RADIUS authentication, authorization, and accounting attributes.
- SR BNG TPSDA Python 3 API
  Python developers can use these APIs for a model-driven management interface to integrate with supported Nokia routers running the SR OS.

anysec commands

configure 
   —  anysec 
      —  apply-groups reference
      —  apply-groups-exclude reference
      —  mka-over-ip 
         —  mka-udp-port number
      —  reserved-label-block reference
      —  tunnel-encryption 
         —  encryption-group string 
            —  admin-state keyword
            —  apply-groups reference
            —  apply-groups-exclude reference
            —  ca-name reference
            —  encryption-label number
            —  peer (ipv4-address-no-zone | ipv6-address-no-zone) 
               —  admin-state keyword
               —  apply-groups reference
               —  apply-groups-exclude reference
            —  peer-tunnel-attributes 
               —  flex-algo-id number
               —  igp-instance-id number
               —  protocol keyword
            —  security-termination-policy reference
         —  security-termination-policy string 
            —  admin-state keyword
            —  apply-groups reference
            —  apply-groups-exclude reference
            —  flex-algo-id number
            —  igp-instance-id number
            —  local-address (ipv4-address-no-zone | ipv6-address-no-zone)
            —  protocol keyword
            —  rx-must-be-encrypted boolean

anysec command descriptions

anysec


	Synopsis	Enter the anysec context
	Context	configure anysec
	Tree	anysec
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

mka-over-ip


	Synopsis	Enter the mka-over-ip context
	Context	configure anysec mka-over-ip
	Tree	mka-over-ip
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

mka-udp-port number


	Synopsis	ANYSec MKA UDP port
	Context	configure anysec mka-over-ip mka-udp-port number
	Tree	mka-udp-port
	Description	This command configures the UDP port that identifies the MKA packet on the system. Nokia recommends configuring this UDP port network wide. In addition, ensure the UDP port is not used by any other protocols in the network.
	Range	1024 to 49151
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

reserved-label-block reference


	Synopsis	ANYSec reserved label block
	Context	configure anysec reserved-label-block reference
	Tree	reserved-label-block
	Description	This command assigns the label block that is reserved for the ANYsec encryption SID. Without this reserved block, ANYsec cannot assign any encryption SIDs. The encryption SID uniquely identifies the encrypting node within a network and avoids double encryption scenarios. The encryption SID can be assigned per encryption group. However, all encryption groups can have the same encryption SID. To save label space, Nokia recommends limiting the number of encryption SIDs within a network.
	Reference	configure router string mpls-labels reserved-label-block string
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

tunnel-encryption


	Synopsis	Enter the tunnel-encryption context
	Context	configure anysec tunnel-encryption
	Tree	tunnel-encryption
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

encryption-group [group-name] string


	Synopsis	Enter the encryption-group list instance
	Context	configure anysec tunnel-encryption encryption-group string
	Tree	encryption-group
	Description	Commands in this context create an encryption group. An encryption group is a group of LSPs that use the same CA and preshared keys (PSK). For ease of PSK management, SR OS allows a group of LSPs to use the same CA with the same PSKs. The PSK is used to secure the SAK for distribution to other PEERs. Note: Although the LSPs are unidirectional, ANYsec is a bidirectional concept where a pair of LSPs between two peers are encrypted and decrypted. Each pair of LSPs uses its own SAK for maximum security, although they may share the same CA and PSK with all other LSPs in the encryption group to secure the SAK.
	Max. Instances	1023
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

[group-name] string


	Synopsis	ANYsec encryption group name
	Context	configure anysec tunnel-encryption encryption-group string
	Tree	encryption-group
	String Length	1 to 32
	Notes	This element is part of a list key.
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

admin-state keyword


	Synopsis	Administrative state of the encryption group
	Context	configure anysec tunnel-encryption encryption-group string admin-state keyword
	Tree	admin-state
	Options	enable, disable
	Default	disable
	Introduced	23.3.R2
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

ca-name reference


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Connectivity association for the encryption group
	Context	configure anysec tunnel-encryption encryption-group string ca-name reference
	Tree	ca-name
	Description	This command configures the CA used for this encryption group. A CA must be configured with the keyword anysec for use in the encryption group.
	Reference	configure macsec connectivity-association string
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

encryption-label number


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Label identifying packets sent from the node to peers
	Context	configure anysec tunnel-encryption encryption-group string encryption-label number
	Tree	encryption-label
	Description	This command creates an encryption SD for the encryption group. The encryption SID uniquely identifies the encrypting node within a network to avoid double encryption scenarios. The encryption SID can be assigned per encryption group. However, all encryption groups can have the same encryption SID. To save label space, Nokia recommends limiting the number of encryption SIDs within a network. To configure the encryption SID, a reserved-label-block command must be configured under the anysec context. The encryption SID is programmed at the bottom of the stack with the S-it set.
	Range	32 to 1048575
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

peer [peer-ip-address] (ipv4-address-no-zone | ipv6-address-no-zone)


	Synopsis	Enter the peer list instance
	Context	configure anysec tunnel-encryption encryption-group string peer (ipv4-address-no-zone \| ipv6-address-no-zone)
	Tree	peer
	Max. Instances	1023
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

[peer-ip-address] (ipv4-address-no-zone | ipv6-address-no-zone)


	Synopsis	Peer IP address of the node SID
	Context	configure anysec tunnel-encryption encryption-group string peer (ipv4-address-no-zone \| ipv6-address-no-zone)
	Tree	peer
	Description	This command configures the IPv4 or IPv6 address of the node SID of the peer that is part of this encryption group. This configuration identifies the segment routing node SID of the peer and programs the egress label stack for matching on the FP5 for encrypting the LSP. When the label stack is downloaded, the encryption SID is also included at the bottom of the stack with the S-bit set.
	Notes	This element is part of a list key.
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

admin-state keyword


	Synopsis	Administrative state of the encryption group peer
	Context	configure anysec tunnel-encryption encryption-group string peer (ipv4-address-no-zone \| ipv6-address-no-zone) admin-state keyword
	Tree	admin-state
	Options	enable, disable
	Default	disable
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

peer-tunnel-attributes


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Enter the peer-tunnel-attributes context
	Context	configure anysec tunnel-encryption encryption-group string peer-tunnel-attributes
	Tree	peer-tunnel-attributes
	Description	Commands in this context configure the peer-tunnel attributes. Tunnel attributes are used to match and identify the outgoing tunnels for encryptoin with ANYsec. A single tunnel attribute is used for multiple peers. Since an LSP is unidirectional, the outgoing tunnel can have different attributes from the incoming tunnel (for example, security termination policy).
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

flex-algo-id number


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Flexible algorithm ID
	Context	configure anysec tunnel-encryption encryption-group string peer-tunnel-attributes flex-algo-id number
	Tree	flex-algo-id
	Description	This command configures the flexible algorithm ID. This ID must match the local terminating ANYsec tunnel.
	Range	128 to 255
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

igp-instance-id number


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	IGP instance ID
	Context	configure anysec tunnel-encryption encryption-group string peer-tunnel-attributes igp-instance-id number
	Tree	igp-instance-id
	Description	This command configures the IGP instance ID. This IGP instance ID must match the IGP instance that the incoming encrypted LSP was signaled on.
	Range	0 to 31 \| 64 to 95
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

protocol keyword


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Protocol used to advertise node SID of incoming tunnel
	Context	configure anysec tunnel-encryption encryption-group string peer-tunnel-attributes protocol keyword
	Tree	protocol
	Options	sr-ospf, sr-ospf3, sr-isis
	Default	sr-isis
	Introduced	23.10.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

security-termination-policy reference


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Security termination policy used by encryption group
	Context	configure anysec tunnel-encryption encryption-group string security-termination-policy reference
	Tree	security-termination-policy
	Reference	configure anysec tunnel-encryption security-termination-policy string
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

security-termination-policy [policy-name] string


	Synopsis	Enter the security-termination-policy list instance
	Context	configure anysec tunnel-encryption security-termination-policy string
	Tree	security-termination-policy
	Max. Instances	1023
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

[policy-name] string


	Synopsis	ANYsec security termination policy name
	Context	configure anysec tunnel-encryption security-termination-policy string
	Tree	security-termination-policy
	String Length	1 to 32
	Notes	This element is part of a list key.
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

admin-state keyword


	Synopsis	Administrative state of the security termination policy
	Context	configure anysec tunnel-encryption security-termination-policy string admin-state keyword
	Tree	admin-state
	Options	enable, disable
	Default	disable
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

flex-algo-id number


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Flexible algorithm ID
	Context	configure anysec tunnel-encryption security-termination-policy string flex-algo-id number
	Tree	flex-algo-id
	Description	This command configures the flexible algorithm ID. This ID must match the local terminating ANYsec tunnel.
	Range	128 to 255
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

igp-instance-id number


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	IGP instance ID
	Context	configure anysec tunnel-encryption security-termination-policy string igp-instance-id number
	Tree	igp-instance-id
	Description	This command configures the IGP instance ID. This IGP instance ID must match the IGP instance that the incoming encrypted LSP was signaled on.
	Range	0 to 31 \| 64 to 95
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

local-address (ipv4-address-no-zone | ipv6-address-no-zone)


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Local address of node SID associated with ANYsec tunnel
	Context	configure anysec tunnel-encryption security-termination-policy string local-address (ipv4-address-no-zone \| ipv6-address-no-zone)
	Tree	local-address
	Description	This command configures the local IPv4 or IPv6 address for the system IP or loopback node SID. This is used to program the FP5 label stack to match the incoming ANYsec tunnel and decryption of the tunnel.
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

protocol keyword


WARNING: Modifying this element toggles the admin-state of the parent element automatically for the new value to take effect.
	Synopsis	Protocol used to advertise node SID of incoming tunnel
	Context	configure anysec tunnel-encryption security-termination-policy string protocol keyword
	Tree	protocol
	Options	sr-ospf, sr-ospf3, sr-isis
	Default	sr-isis
	Introduced	23.10.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

rx-must-be-encrypted boolean


	Synopsis	Enforce encryption for received packets
	Context	configure anysec tunnel-encryption security-termination-policy string rx-must-be-encrypted boolean
	Tree	rx-must-be-encrypted
	Description	When configured to true, the router accepts all arriving traffic that is ANYsec secured on the port. All other traffic is dropped. When configured to false, the router accepts all arriving traffic on the port.
	Default	false
	Introduced	23.3.R1
	Platforms	7750 SR-1-24D, 7750 SR-1-46S, 7750 SR-1-48D, 7750 SR-1-92S, 7750 SR-1x-48D, 7750 SR-1x-92S, 7750 SR-1se

October 31, 2023