Tip

This is the documentation for the 19.02 version. Looking for the documentation of the latest version? Have a look here.

Commands

Mode List

Mode Name	Description
access_list	BGP Accesss List mode
acl	Access Control List mode
acl_rule	ACL Rule mode
aspath	AS Path ordered rule mode
auth	User Authentication mode
bfd	Bidirectional Forwarding Detection mode
bfd_key	BFD key mode
bgp_af	BGP Address Family mode
bgp_af_nbr	BGP Address Family Neighbor mode
bgp_neighbor	BGP Neighbor mode
bond	Interface bonding mode
bridge	Bridge mode
community_list	BGP community list mode
config	Configuration mode
gre	Generic Route Encapsulation mode
host_if	Host interface mode
http	HTTP server mode
ike_authentication	IKE peer authentication mode
ike_authentication_round	IKE peer authentication round mode
ike_child	IKE child SA mode
ike_child_proposal	IKE child SA proposal mode
ike_identity	IKE peer identity mode
ike_proposal	IKE proposal mode
interface	Interface mode
ipsec_crypto_ike	IKE mode
ipsec_crypto_manual	IPsec static keying mode
ipsec_tunnel	IPsec tunnel mode
kea_dhcp4	Kea DHCP4 Server mode
kea_dhcp4_log	Kea DHCP4 Log mode
kea_dhcp4_log_out	Kea DHCP4 Log output mode
kea_dhcp4_opt	Kea DHCP4 option mode
kea_logging	Kea DHCP Server mode
kea_subnet4	Kea DHCP4 subnet4 mode
kea_subnet4_opt	Kea DHCP4 subnet4 option mode
kea_subnet4_pool	Kea DHCP4 subnet4 pool mode
kea_subnet4_pool_opt	Kea DHCP4 subnet4 pool option mode
kea_subnet4_reservation	Kea DHCP4 subnet4 host reservation mode
kea_subnet4_reservation_opt	Kea DHCP4 subnet4 host reservation option mode
loopback	Loopback interface mode
macip	MAC/IP access control list mode
macip_rule	MACIP Rule mode
map	MAP-E/MAP-T mode
map_param	MAP-E/MAP-T global parameter mode
master	Initial, priviledged mode
memif	Memif interface mode
nacm_group	NACM group mode
nacm_rule	NACM rule mode
nacm_rule_list	NACM rule list mode
nat_reassembly	NAT reassembly mode
ntp	NTP mode
ntp_restrict	NTP restriction mode
ntp_server	NTP server mode
prefix_list	BGP prefix list mode
route_dynamic	Dynamic routing mode
route_dynamic_bgp	BGP dynamic routing mode
route_dynamic_bgp_server	BGP server mode
route_dynamic_manager	Dynamic routing manager mode
route_map	Route Map mode
route_table_v4	IPv4 Static Route Table mode
route_table_v6	IPv6 Static Route Table mode
rttbl4_next_hop	Ipv4 Next Hop mode
rttbl6_next_hop	Ipv6 Next Hop mode
span	SPAN mode
subif	Sub-interface VLAN mode
tap	Tap mode
unbound	Unbound DNS Server mode
unbound_fwd_zone	Unbound forward-zone mode
unbound_local_host	Unbound local host override mode
unbound_local_zone	Unbound local zone override mode
vxlan	VXLAN mode

Master Mode Commands

tnsr# configure [terminal]
tnsr# debug cli [level <n>]
tnsr# debug tnsr (clear|set|value) <flags>
tnsr# debug vmgmt (clear|set|value) <flags>
tnsr# no debug (cli|tnsr|vmgmt)
tnsr# exit
tnsr# ls
tnsr# ping (<dest-host>|<dest-ip>) [ipv4|ipv6] [interface <if-name>]
        [source <src-addr>] [count <count>] [packet-size <bytes>]
        [ttl <ttl-hops>] [timeout <wait-sec>]
tnsr# pwd
tnsr# shell [<command>]
tnsr# traceroute (<dest-host>|<dest-ip>) [ipv4|ipv6] [interface <if-name>]
        [source <src-addr>] [packet-size <bytes>] [no-dns] [timeout <seconds>]
        [ttl <ttl-hos>] [waittime <wait-sec>]
tnsr# whoami

Package Management Commands

tnsr# package (info|list) [available|installed|updates] [<pkg-name>]
tnsr# package install <pkg-glob>
tnsr# package remove <pkg-glob>
tnsr# package search <term>
tnsr# package upgrade <pkg-glob>

Public Key Infrastructure Commands

tnsr# pki ca list
tnsr# pki ca <name> (append <source-name>|delete|enter|get|import <file>)
tnsr# pki certificate list
tnsr# pki certificate <name> (delete|enter|get|import <file>)
tnsr# pki private-key list
tnsr# pki private-key <name> (delete|enter|get|import <file>)
tnsr# pki private-key <name> generate [key-length (2048|3072|4096)]
tnsr# pki signing-request list
tnsr# pki signing-request <name> (delete|generate|get|sign (ca-name <ca>|self))
tnsr# pki signing-request set (city|common-name|country|org|org-unit|state) <text>
tnsr# pki signing-request set digest (md5|sha1|sha224|sha256|sha384|sha512)
tnsr# pki signing-request settings (clear|show)

Exit Master Mode

tnsr# exit

Config Mode Commands

tnsr(config)# [no] acl <acl-name>
tnsr(config)# [no] auth system-certificate <certificate>
tnsr(config)# [no] auth user <user-name>
tnsr(config)# bfd conf-key-id <conf-key-id>
tnsr(config)# bfd session <bfd-session>
tnsr(config)# [no] cli option auto-discard
tnsr(config)# configuration candidate clear
tnsr(config)# configuration candidate commit
tnsr(config)# configuration candidate discard
tnsr(config)# configuration candidate load <filename> [(replace|merge)]
tnsr(config)# configuration candidate validate
tnsr(config)# configuration copy candidate startup
tnsr(config)# configuration copy running (candidate|startup)
tnsr(config)# configuration copy startup candidate
tnsr(config)# configuration save (candidate|running) <filename>
tnsr(config)# [no] dataplane cpu workers [<num-workers>]
tnsr(config)# [no] dataplane dpdk uio-driver [<uio-driver>]
tnsr(config)# [no] dataplane dpdk dev <pci-id> (crypto|network)
                   [num-rx-queues [<num-rxqs>]] [num-tx-queues [<num-txqs>]]
tnsr(config)# [no] dataplane dpdk vdev <sw-dev-type>
tnsr(config)# [no] dataplane dpdk no-tx-checksum-offload
tnsr(config)# [no] dataplane ip heap-size [<size>]
tnsr(config)# [no] dataplane ip6 heap-size [<size>]
tnsr(config)# [no] dataplane ip6 hash-buckets [<size>]
tnsr(config)# [no] dataplane nat dslite-ce
tnsr(config)# [no] dataplane nat max-translations-per-user <n>
tnsr(config)# [no] dataplane nat mode (deterministic|endpoint-dependent|simple)
tnsr(config)# [no] dataplane nat mode-options simple (out2in-dpo|static-mapping-only)
tnsr(config)# debug cli [level <n>]
tnsr(config)# debug tnsr (clear|set|value) <flags>
tnsr(config)# debug vmgmt (clear|set|value) <flags>
tnsr(config)# no debug (cli|tnsr|vmgmt)
tnsr(config)# dhcp4 (enable|disable)
tnsr(config)# dhcp4 server
tnsr(config)# dslite aftr endpoint <ip6-address>
tnsr(config)# dslite b4 endpoint <ip6-address>
tnsr(config)# dslite pool address <ipv4-addr-first> [- <ipv4-addr-last>]
tnsr(config)# exit
tnsr(config)# [no] gre <gre-name>
tnsr(config)# [no] host interface <host-if-name>
tnsr(config)# http (enable|disable)
tnsr(config)# [no] http server
tnsr(config)# [no] interface <if-name>
tnsr(config)# interface clear counters [<interface>]
tnsr(config)# [no] interface bond <instance>
tnsr(config)# [no] interface bridge domain <domain-id>
tnsr(config)# [no] interface loopback <name>
tnsr(config)# [no] interface memif interface <id>
tnsr(config)# [no] interface memif socket id <id> filename <file>
tnsr(config)# [no] interface subif <interface> <subid>
tnsr(config)# [no] interface tap <host-name>
tnsr(config)# nacm (enable|disable)
tnsr(config)# [no] nacm exec-default (deny|permit)
tnsr(config)# [no] nacm group <group-name>
tnsr(config)# [no] nacm read-default (deny|permit)
tnsr(config)# [no] nacm rule-list <rule-list-name>
tnsr(config)# [no] nacm write-default (deny|permit)
tnsr(config)# [no] nat deterministic mapping inside <inside-prefix> outside <outside-prefix>
tnsr(config)# [no] nat global-options nat44 forwarding (true|false)
tnsr(config)# [no] nat ipfix logging [domain <domain-id>] [src-port <src-port>]
tnsr(config)# [no] nat nat64 map <domain-name>
tnsr(config)# [no] nat nat64 map parameters
tnsr(config)# [no] nat pool (addresses <ip-first> [- <ip-last>]|interface <if-name>)
                   [twice-nat] [route-table <rt-tbl-name>]
tnsr(config)# [no] nat reassembly (ipv4|ipv6)
tnsr(config)# [no] nat static mapping (icmp|udp|tcp) local <ip-local> [<port-local>]
                   external (<ip-external>|<if-name>) [<port-external>]
                   [twice-nat] [out-to-in-only] [route-table <rt-tbl-name>]
tnsr(config)# [no] ipsec tunnel <tunnel-num>
tnsr(config)# [no] lldp system-name <system-name>
tnsr(config)# [no] lldp tx-hold <transmit-hold>
tnsr(config)# [no] lldp tx-interval <transmit-interval>
tnsr(config)# [no] macip <macip-name>
tnsr(config)# ntp (enable|disable)
tnsr(config)# no ntp enable
tnsr(config)# ntp server
tnsr(config)# [no] route dynamic access-list <access-list-name>
tnsr(config)# route dynamic bgp
tnsr(config)# route dynamic manager
tnsr(config)# [no] route dynamic prefix-list <prefix-list-name>
tnsr(config)# [no] route dynamic route-map <route-map-name> (permit|deny) sequence <sequence>
tnsr(config)# [no] route (ipv4|ipv6) table <route-table-name>
tnsr(config)# service backend (enable|disable) coredump
tnsr(config)# service bgp (enable|disable) coredump
tnsr(config)# service bgp (start|stop|restart|status)
tnsr(config)# service dataplane (enable|disable) coredump
tnsr(config)# service dataplane (start|stop|restart|status)
tnsr(config)# service dhcp (enable|disable) coredump
tnsr(config)# service dhcp (start|stop|reload|status) [dhcp4|dhcp6|dhcp_ddns]
tnsr(config)# service http (start|stop|restart|status)
tnsr(config)# service ntp (start|stop|restart|status)
tnsr(config)# service restconf (enable|disable) coredump
tnsr(config)# service unbound (start|stop|status|restart|reload)
tnsr(config)# [no] sysctl vm nr_hugepages <u64>
tnsr(config)# [no] sysctl vm max_map_count <u64>
tnsr(config)# [no] sysctl kernel shmmem <u64>
tnsr(config)# [no] system contact <text>
tnsr(config)# [no] system description <text>
tnsr(config)# [no] system location <text>
tnsr(config)# [no] system name <text>
tnsr(config)# unbound server
tnsr(config)# unbound (enable|disable)
tnsr(config)# vxlan <vxlan-name>

Exit Configure Mode

tnsr(config)# exit

Show Commands in Both Master and Config Modes

tnsr# show acl [<acl-name>]
tnsr# show bfd
tnsr# show bfd keys [conf-key-id <conf-key-id>]
tnsr# show bfd sessions [conf-key-id <conf-key-id> | peer-ip-addr <peer-addr>]
tnsr# show cli
tnsr# show clock
tnsr# show configuration (candidate|running|startup) [xml|json]
tnsr# show counters [<interface>]
tnsr# show dslite
tnsr# show gre [<tunnel-name>]
tnsr# show host interface (acl|bonding|counters|ipv4|ipv6|link|mac|nat)
tnsr# show http [<config-file>]
tnsr# show interface [<if-name>] [(acl|bonding|counters|ipv4|ipv6|link|mac|nat)]

tnsr# show interface bridge domain [<bdi>]
tnsr# show interface loopback [<loopback-name>]
tnsr# show interface memif [<id>]
tnsr# show interface bond [<id>]
tnsr# show interface lacp [<if-name>]
tnsr# show interface tap
tnsr# show ipsec tunnel [<tunnel_number> [child|ike|verbose]]
tnsr# show kea [keactrl|dhcp4] [config-file]
tnsr# show macip [<macip-name>]
tnsr# show map [<map-domain-name>]
tnsr# show nacm [group [<group-name>] | rule-list [<rule-list-name>]]
tnsr# show nat [config|deterministic-mappings|interface-sides|reassembly|static-mappings]
tnsr# show nat dynamic (addresses|interfaces)
tnsr# show neighbor [interface <if-name>]
tnsr# show route dynamic access-list [<access-list-name>]
tnsr# show route dynamic bgp as-path [<as-path-name>]
tnsr# show route dynamic bgp community-list [<community-list-name>]
tnsr# show route dynamic bgp config [<as-number>]
tnsr# show route dynamic bgp neighbors [[<peer>] [advertised-routes|dampened-routes|
        flap-statistics|prefix-counts|received|received-routes|routes]]
tnsr# show route dynamic bgp network <prefix>
tnsr# show route dynamic bgp nexthop [detail]
tnsr# show route dynamic bgp peer-group <peer-group-name>
tnsr# show route dynamic bgp summary
tnsr# show route dynamic manager
tnsr# show route dynamic prefix-list [<prefix-list-name>]
tnsr# show route dynamic route-map [<route-map-name>]
tnsr# show route [table <route-table-name>]
tnsr# show span
tnsr# show sysctl
tnsr# show system
tnsr# show unbound [config-file]
tnsr# show version
tnsr# show vxlan [<vxlan-name>]

Access Control List Modes

Enter Access Control List Mode

tnsr(config)# acl <acl-name>

Access Control List Mode Commands

tnsr(config-acl)# rule <seq-number>

Exit Access Control List Mode

tnsr(config-acl)# exit

Delete Access Control List

tnsr(config)# no acl <acl-name>

Enter ACL Rule Mode

tnsr(config-acl)# rule <seq-number>

ACL Rule Mode Commands

tnsr(config-acl-rule)# action (deny|permit|reflect)
tnsr(config-acl-rule)# no action [deny|permit|reflect]
tnsr(config-acl-rule)# destination (ip|ipv4) address <ipv4-prefix>
tnsr(config-acl-rule)# no destination [ip|ipv4 [address [<ipv4-prefix>]]]
tnsr(config-acl-rule)# destination ipv6 address <ipv6-prefix>
tnsr(config-acl-rule)# no destination ipv6 [address [<ipv6-prefix>]]
tnsr(config-acl-rule)# [no] destination (ip|ipv4|ipv6) port (any|<first> [- <last>])
tnsr(config-acl-rule)# [no] icmp type (any|<type-first> [- <type-last>])
tnsr(config-acl-rule)# [no] icmp code (any|<code-first> [- <code-last>])
tnsr(config-acl-rule)# [no] protocol (icmp|udp|tcp)
tnsr(config-acl-rule)# source (ip|ipv4) address <ipv4-prefix>
tnsr(config-acl-rule)# no source (ip|ipv4) [address [<ipv4-prefix>]]
tnsr(config-acl-rule)# source ipv6 address <ipv6-prefix>
tnsr(config-acl-rule)# no source ipv6 [address [<ipv6-prefix>]]
tnsr(config-acl-rule)# [no]source (ip|ipv4|ipv6) port <port>
tnsr(config-acl-rule)# [no] tcp flags mask <mask> value <value>
tnsr(config-acl-rule)# [no] tcp flags value <value> mask <mask>

Exit ACL Rule Mode

tnsr(config-acl-rule)# exit

Delete ACL Rule

tnsr(config-acl)# no rule <seq>

ACL Rule Notes

• If both src and dst IP addrs are given, they must agree on IP version

• If protocol is UDP or TCP, then port source/dest may be specified

• If protocol is ICMP, then icmp type/code may be specified

• If protocol is ICMP, then ip => ICMP and ipv6 => ICMPv6

• If protocol is TCP, tcp flags mask and value may be specified

• protocol default is 0 == “any”

• port first default is 0, port last is 65535 == “any”

• icmp type and code ranges are 0-255

MACIP ACL Mode

Enter MACIP ACL Mode

tnsr(config)# macip <macip-name>

MACIP ACL Mode Commands

tnsr(config-macip)# rule <seq>

Exit MACIP ACL Mode

tnsr(config-macip)# exit

Delete MACIP ACL

tnsr(config-macip)# no macip <macip-name>

Enter MACIP ACL Rule Mode

tnsr(config-macip)# rule <seq-number>

MACIP Rule Mode Commands

tnsr(config-macip-rule)# action (deny|permit)
tnsr(config-macip-rule)# no action [deny|permit]
tnsr(config-macip-rule)# (ip|ipv4) address <ipv4-prefix>
tnsr(config-macip-rule)# no (ip|ipv4) address [<ipv4-prefix>]
tnsr(config-macip-rule)# ipv6 address <ipv6-prefix>
tnsr(config-macip-rule)# no ipv6 address [<ipv6-prefix>]
tnsr(config-macip-rule)# mac address <mac-address> [mask <mac-mask>]
tnsr(config-macip-rule)# mac mask <mac-mask> [address <mac-address>]
tnsr(config-macip-rule)# no mac
tnsr(config-macip-rule)# no mac address [<mac-address>] [mask [<mac-mask>]]
tnsr(config-macip-rule)# no mac mask [<mac-mask>] [address [<mac-address>]]

Exit MACIP ACL Rule Mode

tnsr(config-macip-rule)# exit

Delete MACIP ACL Rule

tnsr(config-macip)# no rule <seq-number>

GRE Mode

Enter GRE Mode

tnsr(config)# [no] gre <gre-name>

Exit GRE Mode

tnsr(config-gre)# exit

GRE Mode Commands

tnsr(config-gre)# encapsulation route-table <rt-table-name>
tnsr(config-gre)# instance <id>
tnsr(config-gre)# destination <ip-address>
tnsr(config-gre)# source <ip-address>
tnsr(config-gre)# tunnel-type erspan session-id <session-id>
tnsr(config-gre)# tunnel-type (l3|teb)

GRE Mode Notes

• <session-id> has the range [0..1023]

• The comands instance, source, and destination are required.

• The source and destination <ip-address> must agree on address family

• The default tunnel-type is l3.

HTTP mode

Enter HTTP mode

tnsr(config)# http server

Exit HTTP mode

tnsr(config-http)# exit

HTTP Mode Commands

tnsr(config-http)# authentication client-certificate-ca <cert-name>
tnsr(config-http)# authentication type (client-certificate|password|none)
tnsr(config-http)# enable restconf
tnsr(config-http)# disable restconf
tnsr(config-http)# server certificate <cert-name>

Remove http Configuration

tnsr(config)# no http server

Interface Mode

Enter Interface mode

tnsr(config)# interface <if-name>

Interface Notes

• Maximum interface name length is 63 characters.

Interface Mode Commands

tnsr(config-if)# access-list (input|output) acl <acl-name> sequence <number>
tnsr(config-if)# access-list macip <macip-name>
tnsr(config-if)# no access-list
tnsr(config-if)# no access-list acl <acl-name>
tnsr(config-if)# no access-list macip [<macip-name>]
tnsr(config-if)# no access-list [(input|output) [acl <acl-name> [sequence <number>]]]
tnsr(config-if)# bond <instance> [long-timeout] [passive]
tnsr(config-if)# [no] bond <instance>
tnsr(config-if)# bridge domain <bridge-domain-id> [bvi <bvi>] [shg <shg>]
tnsr(config-if)# description <string-description>
tnsr(config-if)# [no] dhcp client ipv4 [hostname <host-name>]
tnsr(config-if)# disable
tnsr(config-if)# [no] enable
tnsr(config-if)# [no] ip address <ip-prefix>
tnsr(config-if)# [no] ip nat (inside|outside)
tnsr(config-if)# [no] ip route-table <route-table-name-ipv4>
tnsr(config-if)# [no] ipv6 address <ipv6-prefix>
tnsr(config-if)# [no] ipv6 route-table <route-table-name-ipv6>
tnsr(config-if)# lldp port-name <port-name>
tnsr(config-if)# lldp management ipv4 <ip-address>
tnsr(config-if)# lldp management ipv6 <ipv6-address>
tnsr(config-if)# lldp management oid <oid>
tnsr(config-if)# map (disable|enable|translate)
tnsr(config-if)# no map (enable|translate)
tnsr(config-if)# mac-address <mac-address>
tnsr(config-if)# mtu <mtu>

Exit interface mode

tnsr(config-if)# exit

Remove Interface

tnsr(config)# no interface <if-name>

Loopback Mode

Enter Loopback Mode

tnsr(config)# interface loopback <loopback-name>

Exit Loopback Mode

tnsr(config-loopback)# exit

Remove a Loopback interface

tnsr(config)# no interface <loop<n>>
tnsr(config)# no interface loopback <loopback-name>

Loopback Mode Commands

tnsr(config-loopback)# instance <u16>
tnsr(config-loopback)# mac-address <mac-addr>
tnsr(config-loopback)# description <rest>

Bridge Mode

Enter Bridge Mode

tnsr(config)# interface bridge <bdi>

Bridge Mode commands

tnsr(config-bridge)# [no] arp entry ip <ip-addr> mac <mac-addr>
tnsr(config-bridge)# [no] arp term
tnsr(config-bridge)# [no] flood
tnsr(config-bridge)# [no] forward
tnsr(config-bridge)# [no] learn
tnsr(config-bridge)# [no] mac-age <mins>
tnsr(config-bridge)# [no] rewrite
tnsr(config-bridge)# [no] uu-flood

Exit Bridge Mode

tnsr(config-bridge)# exit

Remove a Bridge

tnsr(config)# no interface bridge <bdi>

NAT Commands in Configure Mode

tnsr(config)# [no] nat static mapping (icmp|udp|tcp)
               local <ip> [<port>]
               external (<ip>|<if-name>) [<port>]
               [twice-nat] [out-to-in-only]
               [route-table <rt-tbl-name>]
tnsr(config)# [no] nat ipfix logging [domain <domain-id>] [src-port <port>]
tnsr(config)# [no] nat pool address <ip-first> [- <ip-last>] [twice-nat]
tnsr(config)# [no] nat pool interface <if-name> [twice-nat]
tnsr(config)# show nat [config|interface-sides|static-mappings]
tnsr(config)# show nat dynamic (addresses|interfaces)
tnsr(config)# show nat reassembly

NAT Reassmbly Mode

Enter NAT Reassmbly Mode

tnsr(config)# nat reassembly (ipv4|ipv6)

NAT Reassmbly Mode

tnsr(config-nat-reassembly)# concurrent-reassemblies <max-reassemblies>
tnsr(config-nat-reassembly)# disable
tnsr(config-nat-reassembly)# enable
tnsr(config-nat-reassembly)# fragments <max-fragments>
tnsr(config-nat-reassembly)# timeout <seconds>

Exit NAT Reassembly Mode

tnsr(config-nat-reassembly)# exit

DS-Lite Commands in Configure Mode

tnsr(config)# dslite aftr endpoint <ip6-address>
tnsr(config)# dslite b4 endpoint <ip6-address>
tnsr(config)# dslite pool address <ipv4-addr-first> [- <ipv4-addr-last>]
tnsr(config)# show dslite

Tap Mode

Enter Tap Mode

tnsr(config)# interface tap <tap-name>

Tap Mode commands

tnsr(config-tap)# [no] host bridge <bridge-name>
tnsr(config-tap)# [no] host ipv4 gateway <ipv4-addr>
tnsr(config-tap)# [no] host ipv4 prefix <ipv4-prefix>
tnsr(config-tap)# [no] host ipv6 gateway <ipv6-addr>
tnsr(config-tap)# [no] host ipv6 prefix <ipv6-prefix>
tnsr(config-tap)# [no] host mac-address <host-mac-address>
tnsr(config-tap)# [no] host name-space <netns>
tnsr(config-tap)# [no] instance <instance>
tnsr(config-tap)# [no] mac-address <mac-address>
tnsr(config-tap)# [no] rx-ring-size <size>
tnsr(config-tap)# [no] tx-ring-size <size>

Exit Tap Mode

tnsr(config-tap)# exit

Remove a Tap

tnsr(config)# no interface tap <tap-name>

Tap Notes

• Instance is required

• Can not have both and IP address and a bridge name set.

• Default ring size is 256; must be power of 2; must be <= 32768.

BFD Key Mode

Enter BFD Key Mode

tnsr(config)# bfd conf-key-id <conf-key-id>

BFD Key Mode Commands

tnsr(config-bfdkey)# authentication type (keyed-sha1|meticulous-keyed-sha1)
tnsr(config-bfdkey)# secret < (<hex-pair>)[1-20] >

Exit BFD Key Mode

tnsr(config-bfdkey)# exit

Delete a BFD Key Configuration

tnsr(config)# no bfd conf-key-id <conf-key-id>

BFD Mode

Enter BFD Mode

tnsr(config)# bfd session <bfd-session>

BFD Mode

tnsr(config-bfd)# [no] bfd-key-id <bfd-key-id>
tnsr(config-bfd)# [no] conf-key-id <conf-key-id>
tnsr(config-bfd)# delayed (true|false)
tnsr(config-bfd)# desired-min-tx <microseconds>
tnsr(config-bfd)# detect-multiplier <n-packets>
tnsr(config-bfd)# disable
tnsr(config-bfd)# [no] enable
tnsr(config-bfd)# interface <if-name>
tnsr(config-bfd)# local address <ip-address>
tnsr(config-bfd)# peer address <ip-address>
tnsr(config-bfd)# remote address <ip-address>
tnsr(config-bfd)# required-min-rx <microseconds>

BFD Notes

• <if-name> Name of an ethernet interface

• Both <ip-addresses> must be of the same protocol (IPv4 or IPv6)

• The <ip-address> must be present on the interface <if-name>

• Both (bfd-key-id and conf-key-id) or neither.

  • 0 <= bfd-key-id <= 255

  • conf-key-id is u32

  • 1 <= n-packets <= 255

• RFC-5880 Says:

  • The Detect Mult value is (roughly speaking, due to jitter) the number of packets that have to be missed in a row to declare the session to be down.

• Supported Auth-type:

  • "keyed-sha1"            == 4 - Keyed SHA1

  • "meticulous-keyed-sha1" == 5 - Meticulous Keyed SHA1

Exit BFD Mode

tnsr(config-bfd)# exit

Delete a BFD Configuration

tnsr(config)# no bfd session <bfd-session>

Change BFD Admin State

tnsr# bfd session <bfd-session>
tnsr(config-bfd)# disable
tnsr(config-bfd)# [no] enable
tnsr(config-bfd)# exit

Change BFD Authentication

tnsr(config)# bfd session <bfd-session>
tnsr(config-bfd)# bfd-key-id <bfd-key-id>
tnsr(config-bfd)# conf-key-id <conf-key-id>
tnsr(config-bfd)# delayed (true|false)
tnsr(config-bfd)# exit

Host Interface Mode

tnsr(config-host-if)# [no] description <rest>
tnsr(config-host-if)# disable
tnsr(config-host-if)# [no] enable
tnsr(config-host-if)# [no] ip address <ipv4-prefix>
tnsr(config-host-if)# [no] ipv6 address <ipv6-prefix>
tnsr(config-host-if)# mtu <mtu-value>

IPsec Tunnel Mode

Enter IPsec Tunnel Mode

tnsr(config)# ipsec tunnel <tunnel-num>

IPsec Tunnel Mode Commands

tnsr(config-ipsec-tun)# crypto config-type (ike|manual)
tnsr(config-ipsec-tun)# crypto (ike|manual)
tnsr(config-ipsec-tun)# [no] local-address <ip-address>
tnsr(config-ipsec-tun)# [no] remote-address (<ip-address>|<hostname>)

Exit IPsec Tunnel Mode

tnsr(config-ipsec-tun)# exit

Delete an IPsec Tunnel

tnsr(config)# no ipsec tunnel <tunnel-num>

IKE mode

Enter IKE mode

tnsr(config-ipsec-tun)# crypto ike

IKE Mode Commands

tnsr(config-ipsec-crypto-ike)# [no] authentication (local|remote)
tnsr(config-ipsec-crypto-ike)# [no] child <name>
tnsr(config-ipsec-crypto-ike)# [no] identity (local|remote)
tnsr(config-ipsec-crypto-ike)# lifetime <seconds>
tnsr(config-ipsec-crypto-ike)# no lifetime
tnsr(config-ipsec-crypto-ike)# [no] proposal <number>
tnsr(config-ipsec-crypto-ike)# version (0|1|2)
tnsr(config-ipsec-crypto-ike)# no version

Exit IKE Mode

tnsr(config-ipsec-crypto-ike)# exit

Delete IKE configuration

tnsr(config-ipsec-tun)# no crypto ike

IKE Peer Authentication Mode

Enter IKE Peer Authentication Mode

tnsr(config-ipsec-crypto-ike)# authentication (local|remote)

IKE Peer Authentication Commands

tnsr(config-ike-auth)# [no] round (1|2)

Exit IKE Peer Authentication Mode

tnsr(config-ike-auth)# exit

Delete IKE Peer Authentication Configuration

tnsr(config-ipsec-crypto-ike)# no authentication (local|remote)

IKE Peer Authentication Round Mode

Enter IKE Peer Authentication Round Mode

tnsr(config-ike-auth)# round (1|2)

IKE Peer Authentication Round Commands

tnsr(config-ike-auth-round)# type psk
tnsr(config-ike-auth-round)# no type
tnsr(config-ike-auth-round)# psk <pre-shared-key>
tnsr(config-ike-auth-round)# no psk

Exit IKE Peer Authentication Round Mode

tnsr(config-ike-auth-round)# exit

Delete IKE Peer Authentication Round Configuration

tnsr(config-ike-auth)# no round (1|2)

IKE Child SA Mode

Enter IKE Child SA Mode

tnsr(config-ipsec-crypto-ike)# child <name>

IKE Child SA Mode Commands

tnsr(config-ike-child)# lifetime <seconds>
tnsr(config-ike-child)# no lifetime
tnsr(config-ike-child)# [no] proposal <number>

Exit IKE Child Mode

tnsr(config-ike-child)# exit

Delete IKE Child SA

tnsr(config-ipsec-crypto-ike)# no child <name>

IKE Child SA Proposal Mode

Enter IKE Child SA Proposal Mode

tnsr(config-ike-child)# proposal <number>

IKE Child SA Proposal Commands

tnsr(config-ike-child-proposal)# encryption <crypto-algorithm>
tnsr(config-ike-child-proposal)# no encryption
tnsr(config-ike-child-proposal)# integrity <integrity-algorithm>
tnsr(config-ike-child-proposal)# no integrity
tnsr(config-ike-child-proposal)# group <pfs-group>
tnsr(config-ike-child-proposal)# no group
tnsr(config-ike-child-proposal)# sequence-number (esn|noesn)
tnsr(config-ike-child-proposal)# no sequence-number

Exit Child SA Proposal Mode

tnsr(config-ike-child-proposal)# exit

Delete IKE Child SA Proposal

tnsr(config-ike-child)# no proposal <number>

IKE Peer Identity Mode

Enter IKE Peer Identity Mode

tnsr(config-ipsec-crypto-ike)# identity (local|remote)

IKE Peer Identity Commands

tnsr(config-ike-identity)# type (none|address|email|fqdn|dn|key-id)
tnsr(config-ike-identity)# no type
tnsr(config-ike-identity)# value <identity>
tnsr(config-ike-identity)# no value

Exit IKE Peer Identity Mode

tnsr(config-ike-identity)# exit

Delete IKE Peer Identity Configuration

tnsr(config-ipsec-crypto-ike)# no identity (local|remote)

IKE Proposal Mode

Enter IKE Proposal Mode

tnsr(config-ipsec-crypto-ike)# proposal <number>

IKE Proposal Mode Commands

tnsr(config-ike-proposal)# encryption <crypto-algorithm>
tnsr(config-ike-proposal)# no encryption
tnsr(config-ike-proposal)# integrity <integrity-algorithm>
tnsr(config-ike-proposal)# no integrity
tnsr(config-ike-proposal)# prf <prf-algorithm>
tnsr(config-ike-proposal)# no prf
tnsr(config-ike-proposal)# group <diffie-hellman-group>
tnsr(config-ike-proposal)# no group

Exit IKE Proposal Mode

tnsr(config-ike-proposal)# exit

Delete IKE Proposal Configuration

tnsr(config-ipsec-crypto-ike)# no proposal <number>

IPsec Related Enumerated Types

• ng-ike-encryption-algorithm

  3des
  cast128
  blowfish128
  blowfish192
  blowfish256
  null
  aes128
  aes192
  aes256
  aes128ctr
  aes192ctr
  aes256ctr
  aes128ccm8
  aes192ccm8
  aes256ccm8
  aes128ccm12
  aes192ccm12
  aes256ccm12
  aes128ccm16
  aes192ccm16
  aes256ccm16
  aes128gcm8
  aes192gcm8
  aes256gcm8
  aes128gcm12
  aes192gcm12
  aes256gcm12
  aes128gcm16
  aes192gcm16
  aes256gcm16
  aes128gmac
  aes192gmac
  aes256gmac
  camellia128
  camellia192
  camellia256
  camellia128ctr
  camellia192ctr
  camellia256ctr
  camellia128ccm8
  camellia192ccm8
  camellia256ccm8
  camellia128ccm12
  camellia192ccm12
  camellia256ccm12
  camellia128ccm16
  camellia192ccm16
  camellia256ccm16
  chacha20poly1305
  

• vpp-esp-encryption-algorithm

  aes128gcm16
  aes192gcm16
  aes256gcm16
  aes128
  aes192
  aes256
  

• ng-ike-integrity-algorithm

  none
  md5
  sha1
  aesxcbc
  md5_128
  sha1_160
  aescmac
  aes128gmac
  aes192gmac
  aes256gmac
  sha256
  sha384
  sha512
  sha256_96
  

• vpp-esp-integrity-algorithm

  md5
  sha1
  sha256
  sha384
  sha512
  

• ng-diffie-hellman-group

  none
  modp768
  modp1024
  modp1536
  modp2048
  modp3072
  modp4096
  modp6144
  modp8192
  ecp256
  ecp384
  ecp521
  modp1024s160
  modp2048s224
  modp2048s256
  ecp192
  ecp224
  

• ng-pseudo-random-function

  none
  prfmd5
  prfsha1
  prfaesxcbc
  prfsha256
  prfsha384
  prfsha512
  prfaescmac
  

• ike-identity-type

  none
  email
  fqdn
  dn
  key-id
  address
  

• authentication-method

  pre-shared-key
  certificate
  

• ike-phase1-mode

  main
  aggressive
  

• ipsec-protocol

  esp
  

• ipsec-mode

  transport
  tunnel
  

• peer-position

  remote
  local
  

Map Mode

Enter Map Mode

tnsr(config)# nat nat64 map <domain-name>

Map Mode Commands

tnsr(config-map)# [no] description <desc>
tnsr(config-map)# [no] embedded-address bit-length <ea-width>
tnsr(config-map)# [no] ipv4 prefix <ip4-prefix>
tnsr(config-map)# [no] ipv6 prefix <ip6-prefix>
tnsr(config-map)# [no] ipv6 source <ip6-src>
tnsr(config-map)# [no] mtu <mtu-val>
tnsr(config-map)# [no] port-set length <psid-length>
tnsr(config-map)# [no] port-set offset <psid-offset>
tnsr(config-map)# [no] rule port-set <psid> ipv6-destination <ip6-address>

Delete a Map Entry

tnsr(config)# [no] nat nat64 map <domain-name>

Map Parameters Mode

Enter Map Parameters Mode

tnsr(config)# nat nat64 map parameters

Map Parameters Mode Commands

tnsr(config-map-param)# [no] fragment (inner|outer)
tnsr(config-map-param)# [no] fragment ignore-df
tnsr(config-map-param)# [no] icmp source-address <ipv4-address>
tnsr(config-map-param)# [no] icmp6 unreachable-msgs (disable|enable)
tnsr(config-map-param)# [no] pre-resolve (ipv4|ipv6) next-hop <ip46-address>
tnsr(config-map-param)# [no] reassembly (ipv4|ipv6) (buffers|ht-ratio|lifetime|pool-size) <value>
tnsr(config-map-param)# [no] security-check (disable|enable)
tnsr(config-map-param)# [no] security-check fragments (disable|enable)
tnsr(config-map-param)# [no] traffic-class copy (disable|enable)
tnsr(config-map-param)# [no] traffic-class tc <tc-value>

memif Mode

Enter memif Mode

tnsr(config)# interface memif interface <id>

Exit memif Mode

tnsr(config-memif)# exit

Delete memif Interface

tnsr(config)# no interface memif interface <id>

memif mode Commands

tnsr(config-memif)# buffer-size <u16>
tnsr(config-memif)# mac-address <mac-addr>
tnsr(config-memif)# mode (ethernet|ip|punt/inject)
tnsr(config-memif)# ring-size <power-of-2>
tnsr(config-memif)# role master
tnsr(config-memif)# role slave [rx-queues <u8>|tx-queues <u8>]
tnsr(config-memif)# secret <string-24>
tnsr(config-memif)# socket-id <socket-id>

memif Mode Notes

• <power-of-2> is [8..32], default is 10 for 1024 entries

• Default role is master

• The <socket-id> is required

• Mode punt/inject is not implemented yet

• If <mac-address> is not supplied in ethernet mode, it will be random.

• Default buffer-size is 2048 bytes.

Dynamic Routing Access List Mode

Enter Dynamic Routing Access List Mode

tnsr(config)# route dynamic access-list <access-list-name>

Dynamic Routing Access List Mode Commands

tnsr(config-access)# [no] remark <rest>
tnsr(config-access)# rule <seq#> (permit|deny) <ip-prefix>
tnsr(config-access)# no rule <seq#> [(permit|deny) [<ip-prefix>]]

Exit Dynamic Routing Access List Mode

tnsr(config-access)# exit

Delete Dynamic Routing Access List

tnsr(config)# no access-list <access-list-name>

Dynamic Routing Prefix List Mode

Enter Dynamic Routing Prefix List Mode

tnsr(config)# route dynamic prefix-list <pl-name>

Exit Dynamic Routing Prefix List Mode

tnsr(config-pref-list)# exit

Delete a Dynamic Routing Prefix List

tnsr(config)# no prefix-list <pl-name>

Dynamic Routing Prefix List Mode Commands

tnsr(config-pref-list)# [no] sequence <seq> [(permit|deny) [le <upper-bound>] [ge <lower-bound>]]
tnsr(config-pref-list)# descripton <desc...>

Dynamic Routing Route Map Rule Mode

Enter Dynamic Routing Route Map Rule Mode

tnsr(config)# route dynamic route-map <route-map-name> (permit|deny) sequence <sequence>

Exit Dynamic Routing Route Map Mode

tnsr(config-rt-map)# exit

Delete a Dynamic Routing Route Map

tnsr(config-rt-map)# no route-map <route-map-name> [permit|deny]

Delete a Dynamic Routing Route Map Rule

tnsr(config-rt-map)# no route-map <route-map-name> [permit|deny] sequence <sequence>

Dynamic Routing Route Map Mode Commands

tnsr(config-rt-map)# [no] description <string>

tnsr(config-rt-map)# [no] match as-path <as-path-name>
tnsr(config-rt-map)# [no] match community <comm-list-name> [exact-match]
tnsr(config-rt-map)# [no] match extcommunity <extcomm-list-name>
tnsr(config-rt-map)# [no] match interface <if-name>
tnsr(config-rt-map)# [no] match ip address access-list <access-list-name>
tnsr(config-rt-map)# [no] match ip address prefix-list <prefix-list-name>
tnsr(config-rt-map)# [no] match ip next-hop access-list <access-list-name>
tnsr(config-rt-map)# [no] match ip next-hop <ipv4-address>
tnsr(config-rt-map)# [no] match ip next-hop prefix-list <prefix-list-name>
tnsr(config-rt-map)# [no] match ipv6 address access-list <access-list-name>
tnsr(config-rt-map)# [no] match ipv6 address prefix-list <prefix-list-name>
tnsr(config-rt-map)# [no] match large-community <large-comm-list-name>
tnsr(config-rt-map)# [no] match local-preference <preference-uint32>
tnsr(config-rt-map)# [no] match metric <metric-uint32>
tnsr(config-rt-map)# [no] match origin (egp|igp|incomplete)
tnsr(config-rt-map)# [no] match peer <peer-ip-address>
tnsr(config-rt-map)# [no] match probability <percent>
tnsr(config-rt-map)# [no] match source-protocol <src-protocol>
tnsr(config-rt-map)# [no] match tag <value-(1-4294967295)>

tnsr(config-rt-map)# [no] set aggregator as <asn> ip address <ipv4-address>
tnsr(config-rt-map)# [no] set as-path exclude <string-of-as-numbers>
tnsr(config-rt-map)# [no] set as-path prepend <string-of-as-numbers>
tnsr(config-rt-map)# [no] set as-path prepend last-as <asn>
tnsr(config-rt-map)# [no] set atomic-aggregate
tnsr(config-rt-map)# [no] set community none
tnsr(config-rt-map)# [no] set community <community-value> [additive]
tnsr(config-rt-map)# [no] set comm-list <community-list-name> delete
tnsr(config-rt-map)# [no] set extcommunity (rt|soo) <extcommunity-list-name>
tnsr(config-rt-map)# [no] set forwarding-address <ipv6-address>
tnsr(config-rt-map)# [no] set ip next-hop <ipv4-address>|peer-address|unchanged
tnsr(config-rt-map)# [no] set ipv4 vpn next-hop (<ipv4-address>|<ipv6-address>)
tnsr(config-rt-map)# [no] set ipv6 next-hop global <ipv6-address>
tnsr(config-rt-map)# [no] set ipv6 next-hop local <ipv6-address>
tnsr(config-rt-map)# [no] set ipv6 next-hop peer-address
tnsr(config-rt-map)# [no] set ipv6 next-hop prefer-global
tnsr(config-rt-map)# [no] set ipv6 vpn next-hop (<ipv4-address>|<ipv6-address>)
tnsr(config-rt-map)# [no] set label-index <label>
tnsr(config-rt-map)# [no] set large-community none
tnsr(config-rt-map)# [no] set large-community <large-community-value> [additive]
tnsr(config-rt-map)# [no] set large-comm-list <large-comm-list-name> delete
tnsr(config-rt-map)# [no] set local-preference <preference>
tnsr(config-rt-map)# [no] set metric <metric-uint32>
tnsr(config-rt-map)# [no] set metric (+metric|-metric|+rtt|-rtt|rtt)
tnsr(config-rt-map)# [no] set metric (type-1|type-2)
tnsr(config-rt-map)# [no] set origin (egp|igp|unknown)
tnsr(config-rt-map)# [no] set originator <ipv4-addr>
tnsr(config-rt-map)# [no] set src <ip-address>
tnsr(config-rt-map)# [no] set tag <tag-(1-4294967295)>
tnsr(config-rt-map)# [no] set weight <weight>

tnsr(config-rt-map)# [no] call <rt-map-name>

tnsr(config-rt-map)# [no] on-match next
tnsr(config-rt-map)# [no] on-match goto <sequence>

Dynamic Routing Route Map Notes

• <src-protocol> is one of:

  • babel - BABEL protocol

  • bgp - BGP protocol

  • connected - Routes from directly connected peer

  • eigrp - EIGRP protocol

  • isis - ISIS protocol

  • kernel - Routes from kernel

  • nhrp - NHRP protocol

  • ospf - OSPF protocol

  • ospf6 - OSPF6 protocol

  • pim - PIM protocol

  • rip - RIP protocol

  • ripng - RIPNG protocol

  • static - Statically configured routes

  • system - Routes from system configuration

Dynamic Routing BGP Mode

Enter Dynamic Routing BGP Mode

tnsr(config)# route dynamic bgp

Exit Dynamic Routing BGP Mode

tnsr(config-route-dynamic-bgp)# exit

Dynamic Routing BGP Mode Commands

tnsr(config-route-dynamic-bgp)# [no] as-path <as-path-name>
tnsr(config-route-dynamic-bgp)# clear * [soft]
tnsr(config-route-dynamic-bgp)# [no] community-list <comm-list-name> (standard|expanded)
                                  [extended|large]
tnsr(config-route-dynamic-bgp)# disable
tnsr(config-route-dynamic-bgp)# [no] enable
tnsr(config-route-dynamic-bgp)# [no] option debug (allow-martians|nht|update-groups)
tnsr(config-route-dynamic-bgp)# [no] option debug as4 [segment]
tnsr(config-route-dynamic-bgp)# [no] option debug bestpath <ipv6-prefix>
tnsr(config-route-dynamic-bgp)# [no] option debug keepalive [<peer>]
tnsr(config-route-dynamic-bgp)# [no] option debug neighbor-events [<peer>]
tnsr(config-route-dynamic-bgp)# [no] option debug updates
                                  [in <peer>|out <peer>|prefix (<ipv4-prefix>|<ipv6-prefix>)]
tnsr(config-route-dynamic-bgp)# [no] option debug zebra [prefix (<ipv4-prefix>|<ipv6-prefix>)]
tnsr(config-route-dynamic-bgp)# [no] server <asn>
tnsr(config-route-dynamic-bgp)# [no] route-map delay-timer <interval-sec>
tnsr(config-route-dynamic-bgp)# neighbor <if-name> <ip-address> <mac-address>
                                  [no-adj-route-table-entry]
tnsr(config-route-dynamic-bgp)# no neighbor <if-name> [<ip-address>
                                  [<mac-address> [no-adj-route-table-entry]]]

Dynamic Routing BGP Server Mode

Enter Dynamic Routing BGP Server Mode

tnsr(config-route-dynamic-bgp)# server <asn>

Exit Dynamic Routing BGP Server Mode

tnsr(config-bgp)# exit

Delete a Dynamic Routing BGP Server

tnsr(config-route-dynamic-bgp)# no server <asn>

Dynamic Routing BGP Server Mode Commands

tnsr(config-bgp)# [no] address-family (ipv4|ipv6) (unicast|multicast|vpn|labeled-unicast)
tnsr(config-bgp)# [no] address-family (vpnv4|vpnv6) unicast
tnsr(config-bgp)# [no] address-family <l2vpn evpn>
tnsr(config-bgp)# [no] always-compare-med
tnsr(config-bgp)# [no] bestpath as-path (confed|ignore|multipath-relax [as-set|no-as-set])
tnsr(config-bgp)# [no] bestpath compare-routerid
tnsr(config-bgp)# [no] bestpath med [confed|missing-as-worst]
tnsr(config-bgp)# [no] client-to-client reflection
tnsr(config-bgp)# [no] coalesce-time <uint32>
tnsr(config-bgp)# [no] cluster-id (<ipv4>|<(1..4294967295)>)
tnsr(config-bgp)# [no] confederation identifier <ASN>
tnsr(config-bgp)# [no] confederation peer <ASN>
tnsr(config-bgp)# [no] deterministic-med
tnsr(config-bgp)# [no] disable-ebgp-connected-route-check
tnsr(config-bgp)# [no] enforce-first-as
tnsr(config-bgp)# [no] listen limit <1-5000>
tnsr(config-bgp)# [no] listen range (<ip4-prefix>|<ip6-prefx>) peer-group <peer-group-name>
tnsr(config-bgp)# [no] max-med administrative [<med-value>]
tnsr(config-bgp)# [no] max-med on-startup period <secs-(5-86400)> [<med-value>]
tnsr(config-bgp)# [no] neighbor <peer>
tnsr(config-bgp)# [no] network import-check
tnsr(config-bgp)# [no] route-reflector allow-outbound-policy
tnsr(config-bgp)# [no] router-id <A.B.C.D>
tnsr(config-bgp)# [no] timers keep-alive <interval> hold-time <hold-time>
tnsr(config-bgp)# [no] update-delay <delay>
tnsr(config-bgp)# [no] write-quanta <num-of-packets>

Dynamic Routing BGP Neighbor Mode

Enter Dynamic Routing BGP Neighbor Mode

tnsr(config-bgp)# neighbor <peer>

Exit Dynamic Routing BGP Neighbor Mode

tnsr(config-bgp-neighbor)# exit

Remove a Dynamic Routing BGP Neighbor

tnsr(config-bgp)# no neighbor <peer>

Dynamic Routing BGP Neighbor Mode Commands

tnsr(config-bgp-neighbor)# [no] advertisement-interval <interval-sec-0-600>
tnsr(config-bgp-neighbor)# [no] bfd [mutiplier <detect-multiplier-2-255> receive <rx-50-60000>
                                  transmit <tx-50-60000>]
tnsr(config-bgp-neighbor)# [no] capability (dynamic|extended-nexthop)
tnsr(config-bgp-neighbor)# [no] disable-connected-check
tnsr(config-bgp-neighbor)# [no] description <string>
tnsr(config-bgp-neighbor)# disable
tnsr(config-bgp-neighbor)# [no] dont-capability-negotiate
tnsr(config-bgp-neighbor)# [no] ebgp-multihop [hop-maximum <max-hop-count-1-255>]
tnsr(config-bgp-neighbor)# [no] enable
tnsr(config-bgp-neighbor)# [no] enforce-multihop
tnsr(config-bgp-neighbor)# [no] interface <ifname>
tnsr(config-bgp-neighbor)# [no] local-as <asn> [no-prepend [replace-as]]
tnsr(config-bgp-neighbor)# [no] override-capability
tnsr(config-bgp-neighbor)# [no] passive
tnsr(config-bgp-neighbor)# [no] password <line>
tnsr(config-bgp-neighbor)# [no] peer-group [<peer-group-name>]
tnsr(config-bgp-neighbor)# [no] port <port>
tnsr(config-bgp-neighbor)# [no] remote-as <asn>
tnsr(config-bgp-neighbor)# [no] solo
tnsr(config-bgp-neighbor)# [no] strict-capability-match
tnsr(config-bgp-neighbor)# [no] timers keepalive <interval-0-65535> holdtime <hold-0-65535>
tnsr(config-bgp-neighbor)# [no] timers connect <bgp-connect-1-65535>
tnsr(config-bgp-neighbor)# [no] ttl-security hops <n-hops>
tnsr(config-bgp-neighbor)# [no] update-source (<ifname>|<ip-address>)

Dynamic Routing BGP Address Family Mode

Enter Dynamic Routing BGP Address Family Mode

tnsr(config-bgp)# address-family (ipv4|ipv6) (unicast|multicast|vpn|labeled-unicast)
tnsr(config-bgp)# address-family (vpnv4|vpnv6) unicast
tnsr(config-bgp)# address-family <l2vpn evpn>

Exit Dynamic Routing BGP Address Family Mode

tnsr(config-bgp-af)# exit

Delete a Dynamic Routing BGP Address Family

tnsr(config-bgp)# no address-family (ipv4|ipv6) (unicast|multicast|vpn|labeled-unicast)
tnsr(config-bgp)# no address-family (vpnv4|vpnv6) unicast
tnsr(config-bgp)# no address-family <l2vpn evpn>

Dynamic Routing BGP Address Family Mode Commands

tnsr(config-bgp-af)# [no] aggregate-address <ipv4-prefix> [as-set] [summary-only]
tnsr(config-bgp-af)# [no] dampening [penalty <half-life> [reuse <reuse>
                            suppress <suppress> maximum <maximum>]]
tnsr(config-bgp-af)# [no] distance external <extern> internal <intern> local <local>
tnsr(config-bgp-af)# [no] distance administrative <dist> prefix <ipv4-prefix>
                            access-list <access-list-name>
tnsr(config-bgp-af)# [no] maximum-paths <non-ibgp-paths> [igbp <ibgp-paths>
                            [equal-cluster-length]]
tnsr(config-bgp-af)# [no] neighbor <peer>
tnsr(config-bgp-af)# [no] network <ipv4-prefix> [route-map <route-map>] [label-index <index>]
tnsr(config-bgp-af)# [no] redistribute from <route-source> [metric <val>|
                            route-map <rt-map>]
tnsr(config-bgp-af)# [no] redistribute ospf instance <ospf-instance-id> [metric <val>|
                            route-map <route-map-name>]
tnsr(config-bgp-af)# [no] redistribute table id <kernel-table-id> [metric <val>|
                            route-map <route-map-name>]
tnsr(config-bgp-af)# [no] table-map <route-map-name>

Dynamic Routing BGP Notes

• <peer> == IP address

• <asn> == uint32? uint16?

• <weight> == uint32?

• <n-hops> == [1 .. max TTL]

• <route-source> == kernel|static|connected|rip|ospf

Dynamic Routing BGP Address Family Neighbor Mode

Enter Dynamic Routing BGP Address Family Neighbor Mode

tnsr(config-bgp-af)# [no] neighbor <peer>

Enter Dynamic Routing BGP Address Family Neighbor Mode

tnsr(config-bgp-af-nbr)# exit

Dynamic Routing BGP Address Family Neighbor Mode Commands

tnsr(config-bgp-af-nbr)# [no] activate
tnsr(config-bgp-af-nbr)# [no] addpath-tx-all-paths
tnsr(config-bgp-af-nbr)# [no] addpath-tx-bestpath-per-as
tnsr(config-bgp-af-nbr)# [no] allowas-in [<occurence-1-10>|<origin>]
tnsr(config-bgp-af-nbr)# [no] as-override
tnsr(config-bgp-af-nbr)# [no] attribute-unchanged [as-path|next-hop|med]
tnsr(config-bgp-af-nbr)# [no] capability orf prefix-list (send|receive|both)
tnsr(config-bgp-af-nbr)# [no] default-originate [route-map <route-map>]
tnsr(config-bgp-af-nbr)# [no] distribute-list <access-list-name> (in|out)
tnsr(config-bgp-af-nbr)# [no] filter-list <access-list-name> (in|out)
tnsr(config-bgp-af-nbr)# [no] maximum-prefix limit <val-1-4294967295>
tnsr(config-bgp-af-nbr)# [no] maximum-prefix restart <val-1-65535>
tnsr(config-bgp-af-nbr)# [no] maximum-prefix threshold <val-1-100>
tnsr(config-bgp-af-nbr)# [no] maximum-prefix warning-only
tnsr(config-bgp-af-nbr)# [no] next-hop-self [force]
tnsr(config-bgp-af-nbr)# [no] prefix-list <prefix-list-name> (in|out)
tnsr(config-bgp-af-nbr)# [no] remove-private-AS [all] [replace-AS]
tnsr(config-bgp-af-nbr)# [no] route-map <name> (in|out)
tnsr(config-bgp-af-nbr)# [no] route-reflector-client
tnsr(config-bgp-af-nbr)# [no] route-server-client
tnsr(config-bgp-af-nbr)# [no] send-community (standard|large|extended)
tnsr(config-bgp-af-nbr)# [no] soft-reconfiguration inbound
tnsr(config-bgp-af-nbr)# [no] unsuppress-map <route-map>
tnsr(config-bgp-af-nbr)# [no] weight <weight>

Dynamic Routing BGP Community List Mode

Enter Dynamic Routing BGP Community List Mode

tnsr(config-route-dynamic-bgp)# community-list <cl-name> (standard|expanded) [extended|large]

Exit Dynamic Routing BGP Community List Mode

tnsr(config-community)# exit

Delete a Dynamic Routing BGP Community List

tnsr(config-route-dynamic-bgp)# no community-list <cl-name> (standard|expanded) [extended|large]

Dynamic Routing BGP Community List Mode Commands

tnsr(config-community)# description <desc...>
tnsr(config-community)# sequence <seq> (permit|deny) <community-value>
tnsr(config-community)# no description [<desc...>]
tnsr(config-community)# no sequence <seq> [(permit|deny) <community-value>]

Dynamic Routing BGP AS Path Mode

Enter Dynamic Routing BGP AS Path Mode

tnsr(config-route-dynamic-bgp)# as-path <as-path-name>

Exit Dynamic Routing BGP AS Path Mode

tnsr(config-aspath)# exit

Delete a Dynamic Routing BGP AS Path

tnsr(config-route-dynamic-bgp)# no as-path <as-path-name>

Dynamic Routing BGP AS Path Mode Commands

tnsr(config-aspath)# [no] rule <seq> (permit|deny) <pattern>

Dynamic Routing Manager Mode

Enter Dynamic Routing Manager Mode

tnsr(config)# route dynamic manager

Exit Dynamic Routing Manager Mode

tnsr(route_dynamic_manager)# exit

Dynamic Routing Manager Mode Commands

tnsr(route_dynamic_manager)# [no] zebra debug (events|fpm|nht)
tnsr(route_dynamic_manager)# [no] zebra debug kernel [msgdump [send|receive]]
tnsr(route_dynamic_manager)# [no] zebra debug packet [send|receive] [detailed]
tnsr(route_dynamic_manager)# [no] zebra debug rib [detailed]
tnsr(route_dynamic_manager)# [no] zebra log file <filename> [<level>]
tnsr(route_dynamic_manager)# [no] zebra log syslog [<level>]

IPv4 Route Table Mode

Enter IPv4 Route Table Mode

tnsr(config)# route (ip|ipv4) table <route-table-name>

Exit IPv4 Route Table Mode

tnsr(config-rt-table-v4)# exit

Delete IPv4 Route Table

tnsr(config-rt-table-v4)# no route (ip|ipv4) table <route-table-name>

IPv4 Route Table Commands

tnsr(config-rt-table-v4)# description <rest-of-line>
tnsr(config-rt-table-v4)# [no] route <destination-prefix>

IPv6 Route Table Mode

Enter IPv6 Route Table Mode

tnsr(config)# route (ip|ipv6) table <route-table-name>

Exit IPv6 Route Table Mode

tnsr(config-rt-table-v6)# exit

Delete IPv6 Route Table

tnsr(config-rt-table-v6)# no route (ip|ipv6) table <route-table-name>

IPv6 Route Table Commands

tnsr(config-rt-table-v6)# description <rest-of-line>
tnsr(config-rt-table-v6)# [no] route <destination-prefix>

IPv4 or IPv6 Next Hop Mode

Enter IPv4 or IPv6 Next Hop Mode

tnsr(config-rt-table-v46)# route <destination-prefix>

Exit IPv4 or IPv6 Next Hop Mode

tnsr(config-rt46-next-hop)# exit

Delete IPv4 or IPv6 Next Hop

tnsr(config-rt46-next-hop)# no next-hop <hop-id>

IPv4 or IPv6 Next Hop Mode Commands

tnsr(config-rt46-next-hop)# [no] description <rest-of-line>
tnsr(config-rt46-next-hop)# [no] next-hop <hop-id> via <ip46-addr>
                                   [<if-name>|<next-hop-table <route-table-name>>]
                                   [weight <multi-path-weight>]
                                   [preference <admin-preference>]
                                   [resolve-via-host] [resolve-via-attached]

tnsr(config-rt46-next-hop)# [no] next-hop <hop-id> via drop
tnsr(config-rt46-next-hop)# [no] next-hop <hop-id> via local
tnsr(config-rt46-next-hop)# [no] next-hop <hop-id> via null-send-unreach
tnsr(config-rt46-next-hop)# [no] next-hop <hop-id> via null-send-prohibit
tnsr(config-rt46-next-hop)# [no] next-hop <hop-id> classify <classify-table-name>
tnsr(config-rt46-next-hop)# [no] next-hop <hop-id> lookup [in] route-table <route-table-name>

SPAN Mode

Enter SPAN Mode

tnsr(config)# span <if-name-src>

Exit SPAN Mode

tnsr(config-span)# exit

Delete a SPAN

tnsr(config)# no span <if-name-src>
tnsr(config-span)# no onto <if-name-dst> [(hw|l2) [rx|tx|both]]

SPAN Mode Commands

tnsr(config-span)# onto <if-name-dst> (h2|l2) (rx|tx|both)

SPAN Notes

• <if-name-src> and <if-name-dst> can not name the same interface

• When removing a mirror any [rx|tx}both] indication is ignored

VXLAN Mode

Enter VXLAN Mode

tnsr(config)# vxlan <tunnel-name>

Exit VXLAN Mode

tnsr(config-vxlan)# exit

Delete a VXLAN Tunnel

tnsr(config)# no vxlan [<tunnel-name>]

VXLAN Mode Commands

tnsr(config-vxlan)# [no] destination <ip-addr>
tnsr(config-vxlan)# [no] encapsulation (ipv4|ipv6) route-table <rt-table-name>
tnsr(config-vxlan)# [no] instance <id>
tnsr(config-vxlan)# [no] multicast interface <if-name>
tnsr(config-vxlan)# [no] source <ip-addr>
tnsr(config-vxlan)# [no] vni <u24>

VXLAN Notes

• Source IP, Destination IP and Encapsulation route table must agree on AF.

• Instance, Source IP, Destination IP and VNI are required fields.

• If Destination IP is a multicast addres, the multicast IF is required.

• If a multicast interface is given, the Destination IP must be mutlicast.

User Authentication Configuration Mode

Enter User Authentication Configuration Mode

tnsr(config)# auth user <user-name>

User Authentication Mode Commands

tnsr(config-user)# [no] password <user-password>
tnsr(config-user)# [no] user-keys <key-name>

Exit User Authentication Configuration Mode

tnsr(config-user)# exit

Delete User

tnsr(config)# no auth user <user-name>

NTP Configuration Mode

Enter NTP Configuration Mode

tnsr(config)# ntp server

Exit NTP Configuration Mode

tnsr(config-ntp)# exit

Delete an NTP Server

tnsr(config)# no ntp server

NTP Mode Commands

tnsr(config-ntp)# disable monitor
tnsr(config-ntp)# enable monitor
tnsr(config-ntp)# driftfile <file-path>
tnsr(config-ntp)# interface sequence <seq> (drop|ignore|listen)
                    (all|interface <if-name>|prefix <ip-prefix>)
tnsr(config-ntp)# logconfig sequence <seq> (add|delete|set)
                    (all|clock|peer|sync|sys) (all|events|info|statistics|status)
tnsr(config-ntp)# restrict (default|host <fqdn>|prefix <ip-prefix>|source)
tnsr(config-ntp)# server (address <ip-address>|host <fqdn>)
tnsr(config-ntp)# statsdir <directory-path>
tnsr(config-ntp)# tinker panic <n-secs>
tnsr(config-ntp)# tos orphan <stratum>

NTP Restrict Mode Commands

tnsr(config-ntp-restrict)# kod
tnsr(config-ntp-restrict)# limited
tnsr(config-ntp-restrict)# nomodify
tnsr(config-ntp-restrict)# nopeer
tnsr(config-ntp-restrict)# noquery
tnsr(config-ntp-restrict)# noserve
tnsr(config-ntp-restrict)# notrap

NTP Server Mode Commands

tnsr(config-ntp-server)# iburst
tnsr(config-ntp-server)# maxpoll <power-of-2-sec>
tnsr(config-ntp-server)# noselect
tnsr(config-ntp-server)# operational-mode (pool|server)
tnsr(config-ntp-server)# prefer

Notes

• <power-of-2-sec> is in the range 7..17

• <stratum> is in the range 1..16

• An NTP operational mode is required in config-ntp-server mode.

NACM Group Mode

Enter NACM Group Mode

tnsr(config)# nacm group <group-name>

NACM Group Mode Commands

tnsr(config-nacm-group)# [no] member <user-name>

Exit NACM Group Mode

tnsr(config-nacm-group)# exit

Delete NACM Group

tnsr(config)# no nacm group <group-name>

NACM Rule-list Mode

Enter NACM Rule-list Mode

tnsr(config)# nacm rule-list <rule-list-name>

NACM Rule-list Mode Commands

tnsr(config-nacm-rule-list)# [no] group (*|<group-name>)
tnsr(config-nacm-rule-list)# [no] rule <rule-name>

Enter NACM Rule-list Mode

tnsr(config-nacm-rule-list)# exit

Delete NACM Rule-list

tnsr(config)# no nacm rule-list <rule-list-name>

NACM Rule Mode

Enter NACM Rule Mode

tnsr(config-nacm-rule-list)# rule <rule-name>

Exit NACM Rule Mode

tnsr(config-nacm-rule)# exit

NACM Rule Mode Commands

tnsr(config-nacm-rule)# [no] access-operations (*|create|read|update|delete|exec)
tnsr(config-nacm-rule)# [no] action (deny|permit)
tnsr(config-nacm-rule)# [no] module (*|<module-name>)
tnsr(config-nacm-rule)# [no] comment <rest>
tnsr(config-nacm-rule)# [no] rpc (*|<rpc-name>)
tnsr(config-nacm-rule)# [no] notification (*|<notification-name>)
tnsr(config-nacm-rule)# [no] path <node-id>

Delete NACM Rule

tnsr(config-nacm-rule-list)# no rule <rule-name>

DHCP IPv4 Server Config Mode

Enter DHCP IPv4 Server Mode

tnsr(config)# [no] dhcp4 server
tnsr(config)# dhcp4 {disable|enable}
tnsr(config)# no dhcp4 enable
tnsr(config-kea-dhcp4)#

DHCP IPv4 Server Mode

tnsr(config-kea-dhcp4)# [no] decline-probation-period <seconds>
tnsr(config-kea-dhcp4)# [no] description <desc>
tnsr(config-kea-dhcp4)# [no] echo-client-id <boolean>
tnsr(config-kea-dhcp4)# [no] interface listen <if-name>
tnsr(config-kea-dhcp4)# [no] interface listen *
tnsr(config-kea-dhcp4)# [no] interface socket (raw|udp)
tnsr(config-kea-dhcp4)# [no] lease filename <filename>
tnsr(config-kea-dhcp4)# [no] lease lfc-interval <seconds>
tnsr(config-kea-dhcp4)# [no] lease persist <boolean>
tnsr(config-kea-dhcp4)# [no] logging <logger-name>
tnsr(config-kea-dhcp4)# [no] match-client-id <boolean>
tnsr(config-kea-dhcp4)# [no] next-server <ipv4-address>
tnsr(config-kea-dhcp4)# [no] option <dhcp4-option>
tnsr(config-kea-dhcp4)# [no] rebind-timer <seconds>
tnsr(config-kea-dhcp4)# [no] renew-timer <seconds>
tnsr(config-kea-dhcp4)# [no] valid-lifetime <seconds>

Exit DHCP IPv4 Server Mode

tnsr(config-kea-dhcp4)# exit

Delete DHCP IPv4 Server Configuration

tnsr(config)# no dhcp4 server

DHCP4 Subnet4 Mode

Enter DHCP4 Subnet4 Mode

tnsr(config-kea-dhcp4)# subnet <ipv4-prefix>

DHCP4 Subnet4 Mode Commands

tnsr(config-kea-subnet4)# [no] id <uint32>
tnsr(config-kea-subnet4)# [no] option <dhcp4-option>
tnsr(config-kea-subnet4)# [no] pool <ipv4-prefix>|<ipv4-range>
tnsr(config-kea-subnet4)# [no] interface <if-name>

Exit DHCP4 IPv4 Subnet4 Mode

tnsr(config-kea-subnet4)# exit

Delete DHCP4 IPv4 Subnet4 Configuration

tnsr(config-kea-dhcp4)# no subnet <ipv4-prefix>|<ipv4-range>

DHCP4 Subnet4 Pool Mode

Enter DHCP4 Subnet4 Pool Mode

tnsr(config-kea-subnet4)# pool <ipv4-prefix>|<ipv4-range>

DHCP4 Subnet4 Pool Mode Commands

tnsr(config-kea-subnet4-pool)# [no] option <dhcp4-option>

Exit DHCP4 Subnet4 Pool Mode

tnsr(config-kea-subnet4-pool)# exit

Delete DHCP4 IPv4 Subnet4 Pool

tnsr(config-kea-subnet4)# no pool <ipv4-prefix>|<ipv4-range>

DHCP4 Subnet4 Reservation Mode

Enter DHCP4 Subnet4 Reservation Mode

tnsr(config-kea-subnet4)# reservation <ipv4-address>

DHCP4 Subnet4 Reservation Mode Commands

tnsr(config-kea-subnet4-reservation)# [no] hostname <hostname>
tnsr(config-kea-subnet4-reservation)# [no] mac-address <mac-address>
tnsr(config-kea-subnet4-reservation)# [no] option <dhcp4-option>

Exit DHCP4 Subnet4 Reservation Mode

tnsr(config-kea-subnet4-reservation)# exit

Delete DHCP4 IPv4 Subnet4 Reservation

tnsr(config-kea-subnet4)# no reservation <ipv4-address>

Kea DHCP4, Subnet4, Pool, or Reservation Option Mode

tnsr(config-kea-*-opt)#

DHCP4 Option Mode Commands

tnsr(config-kea-*-opt)# [no] always-send <boolean>
tnsr(config-kea-*-opt)# [no] csv-format <boolean>
tnsr(config-kea-*-opt)# [no] data <option-data>
tnsr(config-kea-*-opt)# [no] space <space-name>

Exit DHCP4 Option Mode

tnsr(config-kea-*-opt)# exit

Delete DHCP4 Option Configuration

tnsr(config-kea-*)# no option <dhcp4-option>

Kea Notes

• The interface <if-name> within a subnet4 is mandatory.

• <ipv4-range> is <ipv4-addr>-<ipv4-addr>

• <option-data> is a well-formed string of data appropriate for the option

• <logger-name> is one of:

  kea-ctrl-agent
  kea-ctrl-agent.http
  kea-dhcp-ddns
  kea-dhcp-ddns.d2-to-dns
  kea-dhcp-ddns.dctl
  kea-dhcp-ddns.dhcp-to-d2
  kea-dhcp-ddns.dhcpddns
  kea-dhcp4
  kea-dhcp4.alloc-engine
  kea-dhcp4.bad-packets
  kea-dhcp4.callouts
  kea-dhcp4.commands
  kea-dhcp4.ddns
  kea-dhcp4.dhcp4
  kea-dhcp4.dhcpsrv
  kea-dhcp4.eval
  kea-dhcp4.hooks
  kea-dhcp4.hosts
  kea-dhcp4.leases
  kea-dhcp4.options
  kea-dhcp4.packets
  kea-dhcp4.stat-cmds-hooks
  kea-dhcp6
  kea-dhcp6.alloc-engine
  kea-dhcp6.bad-packets
  kea-dhcp6.callouts
  kea-dhcp6.commands
  kea-dhcp6.ddns
  kea-dhcp6.dhcp6
  kea-dhcp6.dhcpsrv
  kea-dhcp6.eval
  kea-dhcp6.hooks
  kea-dhcp6.hosts
  kea-dhcp6.leases
  kea-dhcp6.options
  kea-dhcp6.packets
  kea-dhcp6.stat-cmds-hooks
  

• <dhcp4-option> is one of

  all-subnets-local
  arp-cache-timeout
  auto-config
  bcms-controller-address
  bcms-controller-names
  boot-file-name
  boot-size
  broadcast-address
  capwap-ac-v4
  client-ndi
  client-system
  cookie-servers
  default-ip-ttl
  default-tcp-ttl
  default-url
  dhcp-max-message-size
  dhcp-message
  dhcp-option-overload
  dhcp-server-identifier
  domain-name
  domain-name-servers
  domain-search
  extensions-path
  finger-server
  font-servers
  geoconf-civic
  ieee802-3-encapsulation
  impress-servers
  interface-mtu
  ip-forwarding
  irc-server
  log-servers
  lpr-servers
  mask-supplier
  max-dgram-reassembly
  merit-dump
  mobile-ip-home-agent
  name-servers
  name-service-search
  nds-context
  nds-server
  nds-tree-name
  netbios-dd-server
  netbios-name-servers
  netbios-node-type
  netbios-scope
  netinfo-server-address
  netinfo-server-tag
  nis-domain
  nis-servers
  nisplus-domain-name
  nisplus-servers
  nntp-server
  non-local-source-routing
  ntp-servers
  nwip-domain-name
  nwip-suboptions
  option-6rd
  pana-agent
  path-mtu-aging-timeout
  path-mtu-plateau-table
  pcode
  perform-mask-discovery
  policy-filter
  pop-server
  rdnss-selection
  resource-location-servers
  root-path
  router-discovery
  router-solicitation-address
  routers
  sip-ua-cs-domains
  slp-directory-agent
  slp-service-scope
  smtp-server
  static-routes
  streettalk-directory-assistance-server
  streettalk-server
  subnet-selection
  swap-server
  tcode
  tcp-keepalive-garbage
  tcp-keepalive-interval
  tftp-server-name
  time-offset
  time-servers
  trailer-encapsulation
  uap-servers
  user-class
  uuid-guid
  v4-access-domain
  v4-captive-portal
  v4-lost
  v4-portparams
  vendor-class-identifier
  vendor-encapsulated-options
  vivco-suboptions
  vivso-suboptions
  www-server
  x-display-manager
  

Unbound Mode

Enter Unbound Mode

tnsr(config)# unbound server

Exit Unbound Mode

tnsr(config-unbound)# exit

Delete an Unbound Server

tnsr(config)# no unbound server

Unbound Mode Commands

tnsr(config-unbound)# disable (caps-for-id | harden (dnssec-stripped|glue) |
                        hide (version|identity) | ip4 | ip6 | message prefetch |
                        serve-expired | tcp | udp)
tnsr(config-unbound)# edns reassembly size <s>
tnsr(config-unbound)# enable (caps-for-id | harden (dnssec-stripped|glue) |
                        hide (version|identity) | ip4 | ip6 | message prefetch |
                        serve-expired | tcp | udp)
tnsr(config-unbound)# forward-zone <zone-name>
tnsr(config-unbound)# host cache (num-hosts <num> | slabs <s> | ttl <t>)
tnsr(config-unbound)# interface <ip4-address>
tnsr(config-unbound)# jostle timeout <t>
tnsr(config-unbound)# key cache slabs <s>
tnsr(config-unbound)# message cache (size <s> | slabs <s>)
tnsr(config-unbound)# port outgoing range <n>
tnsr(config-unbound)# rrset cache (size <s> | slabs <s>)
tnsr(config-unbound)# rrset-message cache ttl (minimum <min> | maximum <max>)
tnsr(config-unbound)# socket receive-buffer size <s>
tnsr(config-unbound)# tcp buffers (incoming <n> | outgoing <n>)
tnsr(config-unbound)# thread (num-queries <n> | num-threads <n> |
                        unwanted-reply-threshold <threshold>)
tnsr(config-unbound)# verbosity <level-0..5>

Unbound Forward-Zone Mode

Enter Unbound Forward-Zone Mode

tnsr(config-unbound)# forward-zone <zone-name>

Exit Unbound Forward-Zone Mode

tnsr(config-unbound-fwd-zone)# exit

Delete an Unbound Forward-Zone Zone

tnsr(config-unbound)# no forward-zone <zone-name>

Unbound Forward-Zone Mode Commands

tnsr(config-unbound-fwd-zone)# disable (forward-first | forward-tls-upstream)
tnsr(config-unbound-fwd-zone)# enable (forward-first | forward-tls-upstream)
tnsr(config-unbound-fwd-zone)# nameserver address <ip-address> [port <port>] [auth-name <name>]
tnsr(config-unbound-fwd-zone)# nameserver host <host-name>

Subif Mode

Enter Subif Mode

tnsr(config)# interface subif <if-name> <subid>

Subif Mode Commands

tnsr(config-subif)# default
tnsr(config-subif)# dot1q (<outer-vlan-id>|any)
tnsr(config-subif)# exact-match
tnsr(config-subif)# inner-dot1q (inner-vlan-id>|any)
tnsr(config-subif)# outer-dot1ad (<outer-vlan-id>|any)
tnsr(config-subif)# outer-dot1q (<outer-vlan-id>|any)
tnsr(config-subif)# vlan tag-rewrite (disable|pop-1|pop-2)
tnsr(config-subif)# vlan tag-rewrite push-1 (dot1ad|dot1q) <tag1>
tnsr(config-subif)# vlan tag-rewrite push-2 (dot1ad|dot1q) <tag1> <tag2>
tnsr(config-subif)# vlan tag-rewrite (translate-1-1|translate-2-1) (dot1ad|dot1q) <tag1>
tnsr(config-subif)# vlan tag-rewrite (translate-1-2|translate-2-2) (dot1ad|dot1q) <tag1> <tag2>

Exit Subif Mode

tnsr(config-subif)# exit

Delete a Subif

tnsr(config)# no interface subif <if-name> <subid>

Bond Mode

Enter Bond Mode

tnsr(config)# interface bond <instance>

Bond Mode Commands

tnsr(config-bond)# [no] load-balance (l2|l23|l34)
tnsr(config-bond)# [no] mode (round-robin|active-backup|xor|broadcast|lacp)
tnsr(config-bond)# [no] mac-address <mac-address>

Exit Bond Mode

tnsr(config-bond)# exit

Delete a Bond

tnsr(config)# no interface bond <instance>