CLI command reference

Every command the appliance accepts, with the same help text the CLI prints for ?. Commands are grouped by mode: operational (the prompt you land on) and configuration (after configure).

Operational mode

Command	Description
clear	Clear operational state
clear alarms	Clear (dismiss) an active alarm: clear alarms <id> [<instance>]
clear web-ui	Clear Web UI state
clear web-ui auth	Clear Web UI authentication state
clear web-ui auth lockout	Clear Web UI auth lockout for a user
clear web-ui auth session	Revoke a Web UI session
configure	Enter configuration mode
ping	Send ICMP echo requests from the data plane
request	Perform operational actions
request address-pools	Address-pool operations
request address-pools clear-reservations	Release IPv6 blocks held for IPoE lines whose session has ended: clear-reservations <pool> [owner <key> | prefix <prefix>] | all
request address-pools clear-reservations all	Release every reservation in every pool
request captures	Packet capture operations
request captures start	Start a packet capture
request captures start session	Start capture for session
request captures stop	Stop a packet capture
request captures stop session	Stop capture for session
request cgn	CG-NAT operations
request cgn reclaim-blocks	Give back a CGN binding's unused port blocks: the empty blocks at the top, never the first, to quarantine. The data plane judges each block empty under the binding's locks; translations in the blocks kept are untouched
request cgn reclaim-blocks all	Every binding that holds more than one block (one at a time; translation goes on between them)
request diagnostics	Data-plane diagnostics
request diagnostics inject	Trace a synthetic packet through the forwarding pipeline
request licensing	Licensing management (activate, renew, offline)
request licensing activate	Activate this box with a one-time token
request licensing load-offline	Install an offline licence file
request licensing renew-now	Force an immediate licence renewal
request subscribers	Subscriber operations
request subscribers disconnect	Disconnect a subscriber session
request subscribers disconnect id	Disconnect by session ID
request subscribers disconnect reference	Disconnect by subscriber reference, as the session list shows it; add 'all' when several sessions share it
request subscribers disconnect reference all	Disconnect every session that has the reference
request subscribers disconnect username	Disconnect by username (the session's true username, not a subscriber reference)
request subscribers reapply	Re-apply the CGN limits (port cap, setup rate, binding timeout) of the CGN IP group to live sessions, in place: same public address and port blocks, translations kept. CGN limits only; for rates and shaping use 'request subscribers refresh' or a CoA
request subscribers reapply all	Re-apply the CGN limits of every live session
request subscribers reapply all vrf	Only the sessions of one inside VRF
request subscribers reapply id	Re-apply one session's CGN limits
request subscribers refresh	Load the subscriber source now, apply it to the live sessions, and report what was done
request subscribers source	Subscriber source operations
request subscribers source accept	Accept the subscriber load that was read and not believed (empty, or most rows gone or turned off) and apply exactly that load
request system	System operations
request system cache-refresh	Refresh the subscriber cache from the subscriber source now (same as 'request subscribers refresh')
request system configuration	Configuration backup
request system configuration export	Export a backup of the active configuration
request system configuration export encrypted	Print a restorable backup, encrypted under a passphrase you are asked for
request system configuration export encrypted file	Write the encrypted backup to a file on the appliance
request system configuration export redacted	Print a backup with every secret replaced by a placeholder
request system configuration export redacted file	Write the redacted backup to a file on the appliance
request system drain	Stop admitting new subscribers (maintenance drain)
request system restart	Restart the control plane and data plane so pending config changes take effect
request system undrain	Resume admitting new subscribers
request system upgrade	Stage a package for reviewed upgrade (path or HTTPS URL)
request system upgrade apply	Apply a staged upgrade ID with automatic rollback
request system upgrade drain-apply	Apply a staged upgrade ID with automatic rollback
request system upgrade status	Show persistent upgrade transactions
request web-ui	Web UI operations
request web-ui auth	Web UI authentication operations
request web-ui auth test-oidc	Test OIDC discovery and JWKS reachability
request web-ui auth test-tacacs	Test TACACS+ server reachability
request webui	Web UI account rescue operations
request webui reset-password	Reset a user's password (prints a generated one)
request webui unlock	Clear lockout and TOTP enrolment for a user
show	Show system information
show accounting	Show accounting backend status and unpublished records
show address-pools	Show dynamic address pools: show address-pools [<name>]
show address-pools reservations	Show IPv6 blocks held for IPoE lines whose session has ended: show address-pools reservations [<pool>]
show alarms	Show active alarms
show captures	Show active packet captures
show cgn	Show CG-NAT (NAT44) information
show cgn bindings	Show CG-NAT bindings: show cgn bindings [<inside-ip>]
show cgn groups	Show CG-NAT IP groups and pool utilisation
show cgn summary	Show CG-NAT status and counters
show cgn translations	Show a subscriber's live CG-NAT translations: show cgn translations <inside-ip> [vrf <name>] [protocol tcp|udp|icmp] [port <n>] [limit <n>]
show circuits	Show CPE GRE/BGP circuits with tunnel and BGP session state
show circuits vrf	Show circuits in one customer VRF
show configuration	Show running configuration
show dataplane	Show the data plane's own forwarding state
show dataplane drops	Show packets the data plane dropped, by reason and by pipeline stage
show dataplane drops all	Include the counters that are at zero
show dataplane load	Show how busy each forwarding worker is, port rates and NIC drops, and pools and tables against their limits
show dataplane mpls	Show what the data plane does with an MPLS label: show dataplane mpls <label>
show dataplane route	Show what the data plane itself would do with a destination: show dataplane route <address> [vrf <name>]
show ipsec	Show IPsec (strongSwan) status
show ipsec peer	Show one IPsec peer in detail
show licensing	Show licensing status
show licensing telemetry	Show the exact telemetry payload the box will send
show protocols	Show protocol information
show protocols bgp	Show BGP information
show protocols bgp neighbor	Show BGP neighbor detail
show protocols bgp summary	Show BGP peer summary
show protocols frr-residue	Show what FRR still holds that the configuration no longer generates
show protocols isis	Show IS-IS information
show protocols isis adjacencies	Show IS-IS adjacencies
show protocols l2tp	Show L2TP information
show protocols l2tp switched	Show L2TP calls switched to another LNS
show protocols l2tp tunnels	Show L2TP tunnels
show protocols ospf	Show OSPF information
show protocols ospf adjacencies	Show OSPF adjacencies (OSPFv2 and OSPFv3)
show protocols pppoe	Show PPPoE information
show protocols pppoe statistics	Show PPPoE statistics
show punt	Show the punt rules installed in the data plane, their counters and the class budgets
show radius	Show RADIUS information
show radius servers	Show RADIUS server status
show route	Show the IPv4 routing table (default VRF)
show route vrf	Show the IPv4 routing table for a VRF
show source-vrf	Show source-VRF classification information
show source-vrf rules	Show programmed source-VRF classification rules
show subscribers	Show subscriber information
show subscribers local	Show locally-defined subscribers (no external auth server)
show subscribers sessions	Show subscriber sessions
show subscribers source	Show the subscriber source and its last refresh
show subscribers summary	Show subscriber summary
show subscribers unclaimed	Show unclaimed (guest) sessions on access NNIs
show system	Show system information
show system disks	Show drive SMART health and filesystem state
show system environment	Show hardware sensors, memory errors, CPU throttling and the BMC event log
show system hardware	Show hardware inventory
show system interfaces	Show network interfaces
show system raid	Show hardware RAID controller and drive health
show system status	Show system status
show system uptime	Show system uptime
show system version	Show system version
show vrfs	Show configured VRFs and live session counts
show web-ui	Show Web UI information
show web-ui auth	Show Web UI authentication configuration
show web-ui auth sessions	Show active Web UI sessions
traceroute	Trace the path to a destination from the data plane

Configuration mode

In addition to every operational show command listed above:

Command	Description
commit	Commit configuration changes
commit and-quit	Commit and exit configuration mode
commit check	Validate configuration without applying
commit comment	Commit with a comment
commit confirm	Commit with automatic rollback timer
compare	Show changes between candidate and active
delete	Delete configuration parameter
exit	Exit configuration mode
load	Load a configuration backup into the candidate
load override	Replace the whole candidate with the configuration in a backup
load override file	Read the backup from a file on the appliance
load override terminal	Paste the backup at the terminal; end with Ctrl-D
quit	Exit configuration mode
rollback	Roll back to previous configuration
set	Set configuration parameter
top	Return to top of configuration hierarchy
up	Move up one level in configuration hierarchy

---

126 operational and 17 configuration-mode commands; 35 of 98 commands that can carry one have recorded example output.