Configuration reference#
Every configurable field, addressed by the CLI path used with set and delete. The same paths back the web UI configuration editor and the GET /api/v1/config/schema endpoint, so all three surfaces agree by construction.
Fields marked secret are stored encrypted and read back as a redaction placeholder — show configuration and | display set never disclose them.
Sections#
accountingaddress-poolalertingapi-rate-limitauthbinding-persistencecapturecgndataplanefrripseclicensingloggingmanagementprotocolsroutingsecuritysnmpsource-vrf-rulesubscriber-historysubscriberssyslogsystemvxlanwalled-gardenweb-ui
accounting#
| Path | Type | Accepted values | Description |
|---|---|---|---|
accounting driver |
String | servicebus, radius |
Accounting driver (servicebus or radius) |
accounting interim-interval |
Int | — | Accounting interim interval in seconds |
accounting radius max-buffer-size |
Int | — | RADIUS accounting max buffer size |
accounting radius transport-vrf |
String | <configured VRF name> |
VRF for accounting RADIUS transport |
accounting servicebus connection-string |
String | — | Azure Service Bus connection string (secret) |
accounting servicebus max-batch-size |
Int | — | Max messages per Service Bus batch |
accounting servicebus max-buffer-size |
Int | — | Maximum records buffered to local disk when Service Bus is unreachable |
accounting servicebus max-retries |
Int | — | Send attempts before a batch is buffered locally |
accounting servicebus nas-client-type |
String | — | NAS client type reported in each accounting record |
accounting servicebus nas-identifier |
String | — | NAS identifier reported in each accounting record |
accounting servicebus nas-ip-address |
IpV4Address | — | NAS IP address reported in each accounting record |
accounting servicebus queue-name |
String | — | Service Bus queue name |
accounting servicebus send-timeout |
Int | — | Per-batch send timeout in seconds |
accounting servicebus source |
String | — | Source name stamped on records, identifying this appliance fleet |
accounting servicebus source-instance |
String | — | Instance name stamped on records, identifying this box |
accounting radius server <host>#
RADIUS accounting servers (empty = reuse auth servers, port+1)
A keyed list: set accounting radius server <host> <field> <value> creates or updates an entry; delete accounting radius server <host> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
port |
Int | — | RADIUS server UDP port |
secret |
String | — | RADIUS shared secret (secret) |
weight |
Int | — | Load-balancing weight |
address-pool#
address-pool <name>#
Dynamic address pool referenced by name from AAA (Framed-Pool, Framed-IPv6-Pool, Delegated-IPv6-Prefix-Pool)
A keyed list: set address-pool <name> <field> <value> creates or updates an entry; delete address-pool <name> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
announce |
String (list) | — | Subnets announced into BGP as an aggregate (adds the subnet if absent). Must be off for IPv4 in a VRF translated by on-box CGN |
delegation-length |
Int | — | Prefix length delegated to each subscriber (ipv6-pd only, 16-64) |
description |
String | — | Free-text description |
exclude |
String (list) | — | An address or prefix inside the pool's subnets that is never allocated |
family |
String | ipv4, ipv6-wan, ipv6-pd |
What the pool hands out: ipv4 (/32s), ipv6-wan (a /64 per subscriber) or ipv6-pd (delegated prefixes) |
gateway |
IpV4Address (list) | — | The appliance's own address in a subnet (ipv4 pools; one per subnet, set on the subnet that contains it). A lease for an address of that subnet names it as the router and carries the subnet's mask; it is never allocated and need not be excluded |
subnet |
String (list) | — | A subnet this appliance allocates from (CIDR, host bits zero). Removing one disconnects the sessions holding addresses in it |
vrf |
String | <configured VRF name> |
VRF the pool's addresses live in; empty = the default table |
alerting#
| Path | Type | Accepted values | Description |
|---|---|---|---|
alerting bus kinds |
String | alarm, event, both |
Kinds the bus sink accepts: alarm|event|both |
alerting bus min-severity |
String | critical, major, minor, warning, info |
Severity floor for the bus sink (default info) |
alerting bus queue-name |
String | — | Azure Service Bus queue for alert notifications |
alerting bus transport-vrf |
String | <configured VRF name> |
VRF metadata for the bus sink |
alerting enabled |
Bool | — | Run the alerting subsystem (alarm manager + sink fan-out) |
alerting rate-limit events-per-minute |
Int | — | Global transient-event flood cap (per alarm ID) |
alerting sinks |
String (list) | syslog, snmp, webhook, smtp, bus |
Enabled delivery sinks (multi-select): syslog|snmp|webhook|smtp |
alerting smtp from |
String | — | Envelope From address |
alerting smtp host |
String | — | External SMTP server hostname |
alerting smtp kinds |
String | alarm, event, both |
Kinds the SMTP sink accepts: alarm|event|both |
alerting smtp min-severity |
String | critical, major, minor, warning, info |
Severity floor for the SMTP sink (default critical) |
alerting smtp password |
String | — | SMTP AUTH password (secret) (secret) |
alerting smtp port |
Int | — | SMTP port: 25|587|465|custom |
alerting smtp subject |
String | — | Subject template ({severity}/{id}/{state}) |
alerting smtp timeout |
Int | — | SMTP send timeout in seconds |
alerting smtp tls-mode |
String | none, starttls, implicit |
TLS mode: none|starttls|implicit |
alerting smtp tls-verify |
Bool | — | Verify the SMTP server's TLS certificate |
alerting smtp to |
String (list) | — | Recipient address(es) |
alerting smtp transport-vrf |
String | <configured VRF name> |
VRF the SMTP socket egresses from |
alerting smtp username |
String | — | SMTP AUTH username (empty = no auth) |
alerting snmp kinds |
String | alarm, event, both |
Kinds the SNMP sink accepts: alarm|event|both |
alerting snmp min-severity |
String | critical, major, minor, warning, info |
Severity floor for the SNMP trap sink (default minor) |
alerting snmp transport-vrf |
String | <configured VRF name> |
VRF the SNMP trap socket egresses from (sink default) |
alerting spool-size |
Int | — | Per-sink in-memory alert spool (drop-oldest) |
alerting syslog kinds |
String | alarm, event, both |
Kinds the syslog sink accepts: alarm|event|both |
alerting syslog min-severity |
String | critical, major, minor, warning, info |
Severity floor for the syslog sink (default info = all) |
alerting syslog transport-vrf |
String | — | VRF used to reach the syslog sink for alerts |
alerting webhook auth-secret |
String | — | Bearer auth token added as Authorization header (secret) (secret) |
alerting webhook kinds |
String | alarm, event, both |
Kinds the webhook sink accepts: alarm|event|both |
alerting webhook method |
String | POST, GET |
HTTP method: POST (JSON body) or GET (query string) |
alerting webhook min-severity |
String | critical, major, minor, warning, info |
Severity floor for the webhook sink (default major) |
alerting webhook timeout |
Int | — | Per-request timeout (seconds) |
alerting webhook tls-verify |
Bool | — | Verify the receiver's TLS certificate |
alerting webhook transport-vrf |
String | <configured VRF name> |
VRF the webhook socket egresses from |
alerting webhook url |
String | — | Webhook target URL |
alerting alarm <id>#
Per-alarm threshold/severity overrides
A keyed list: set alerting alarm <id> <field> <value> creates or updates an entry; delete alerting alarm <id> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
disabled |
Bool | — | Disable this alarm entirely |
high-water |
Int | — | Raise threshold (%) |
low-water |
Int | — | Clear threshold (%) |
severity |
String | critical, major, minor, warning, info |
Override severity |
alerting snmp destination <host>#
SNMP trap/inform receivers
A keyed list: set alerting snmp destination <host> <field> <value> creates or updates an entry; delete alerting snmp destination <host> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
auth-password |
String | — | v3 auth passphrase (secret) (secret) |
auth-protocol |
String | none, md5, sha |
v3 auth protocol: none|md5|sha |
community |
String | — | v2c community string (secret) (secret) |
engine-boots |
Int | — | v3 authoritative engine boots |
engine-id |
String | — | v3 authoritative engine ID (hex) |
inform |
Bool | — | Send INFORM (acknowledged) instead of TRAP |
port |
Int | — | UDP port (trap default 162) |
priv-password |
String | — | v3 privacy passphrase (secret) (secret) |
priv-protocol |
String | none, aes |
v3 privacy protocol: none|aes |
transport-vrf |
String | <configured VRF name> |
Per-destination VRF override |
user |
String | — | v3 USM security user |
version |
String | 2c, 3 |
SNMP version: 2c|3 |
alerting webhook header <name>#
Custom HTTP request headers
A keyed list: set alerting webhook header <name> <field> <value> creates or updates an entry; delete alerting webhook header <name> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
value |
String | — | Header value (secret) |
api-rate-limit#
| Path | Type | Accepted values | Description |
|---|---|---|---|
api-rate-limit control burst |
Int | — | Tight bucket for capture, config and restart controls: maximum burst tokens |
api-rate-limit control requests-per-minute |
Int | — | Tight bucket for capture, config and restart controls: refill tokens per minute |
api-rate-limit default burst |
Int | — | Default /api/v1 request bucket: maximum burst tokens |
api-rate-limit default requests-per-minute |
Int | — | Default /api/v1 request bucket: refill tokens per minute |
api-rate-limit enabled |
Bool | — | Enable post-auth /api/v1 request rate limiting |
api-rate-limit heavy-read burst |
Int | — | Tighter bucket for expensive table dumps and streams: maximum burst tokens |
api-rate-limit heavy-read requests-per-minute |
Int | — | Tighter bucket for expensive table dumps and streams: refill tokens per minute |
auth#
| Path | Type | Accepted values | Description |
|---|---|---|---|
auth database cache-refresh-interval |
Int | — | Auth database cache refresh interval in seconds |
auth database connection-string |
String | — | Database connection string for auth (secret) |
auth database credential-check |
String | enforce, log-only |
Wrong password from a known subscriber: enforce (reject) or log-only (accept and log) |
auth database kept-view-max-age-days |
Int | — | How old the subscriber view kept on disk may be and still be used after a restart, to judge the first load and to answer logins while the source cannot be read, in days (default 7; 0 = never use it; passwords and tunnel secrets are not kept in it). Checked once, at start-up: it limits what is loaded, not how long a view that was loaded goes on being served |
auth database max-row-loss-percent |
Int | — | Largest share of the subscriber view's rows that may be lost, or turn from active to disabled/blocked/suspended, in one load and still be believed, in percent (default 50; a load beyond it is not applied) |
auth database min-row-loss |
Int | — | Fewest rows that must be lost or turned non-active in one subscriber load before max-row-loss-percent applies (default 10) |
auth database source |
String | — | View subscribers are read from, as schema.name (default bng.SimSubscribers) |
auth database startup-hold-seconds |
Int | — | How long a new PPP or L2TP login is held, unanswered, while the subscriber source has not yet made its first attempt since start-up, in seconds (default 20; 0 = do not hold, 120 at most). It is then decided from the view loaded, or from the view kept on disk if the load failed. A login still waiting when this runs out is ended as one that could not be decided, and redials |
auth driver |
String | database, radius |
Authentication driver (database or radius) |
auth radius coa-allowed-source |
IpAddress (list) | — | RADIUS CoA allowed source IPs |
auth radius coa-port |
Int | — | RADIUS CoA listening port |
auth radius coa-secret |
String | — | RADIUS CoA shared secret (secret) |
auth radius coa-timestamp-window-seconds |
Int | — | Maximum past or future skew in seconds for CoA/Disconnect Event-Timestamp (default 300). Requests without Event-Timestamp are accepted |
auth radius dead-after-failures |
Int | — | Mark RADIUS server dead after N failures |
auth radius max-retries |
Int | — | RADIUS max retries |
auth radius nas-identifier |
String | — | RADIUS NAS identifier |
auth radius nas-ip-address |
IpV4Address | — | RADIUS NAS IP address |
auth radius option82-encoding |
String | bbf-vsa, nas-port-id, calling-station-suffix |
How the Option-82 circuit-id is carried (bbf-vsa|nas-port-id|calling-station-suffix) |
auth radius probe-interval |
Int | — | RADIUS probe interval in milliseconds |
auth radius rate-attribute-mode |
String | auto, strict, bbf, mikrotik, netavo |
Which rate-limit attribute family to honour (auto|strict|bbf|mikrotik|netavo) |
auth radius timeout |
Int | — | RADIUS authentication timeout in milliseconds |
auth radius transport-vrf |
String | <configured VRF name> |
VRF for RADIUS transport |
auth radius server <host>#
RADIUS authentication servers
A keyed list: set auth radius server <host> <field> <value> creates or updates an entry; delete auth radius server <host> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
port |
Int | — | RADIUS server UDP port |
secret |
String | — | RADIUS shared secret (secret) |
weight |
Int | — | Load-balancing weight |
binding-persistence#
| Path | Type | Accepted values | Description |
|---|---|---|---|
binding-persistence enabled |
Bool | — | Persist subscriber bindings so they survive a control-plane restart |
binding-persistence path |
String | — | Path to the binding database |
binding-persistence sweep-interval |
Int | — | How often expired bindings are swept, in seconds |
capture#
| Path | Type | Accepted values | Description |
|---|---|---|---|
capture default-destination-ip |
IpAddress | — | Default GRE mirror destination IP |
capture mirror-allowlist |
String (list) | — | Destinations a GRE capture mirror may be sent to. Empty = no restriction; a populated list is what stops capture being used to exfiltrate subscriber traffic |
capture source-ip |
IpAddress | — | GRE mirror source IP |
cgn#
| Path | Type | Accepted values | Description |
|---|---|---|---|
cgn default-vrf-ip-group |
String | — | CGN IP group translating subscribers in the default table (per-VRF: routing vrf <name> cgn-ip-group) |
cgn enabled |
Bool | — | Run the carrier-grade NAT engine (restart required) |
cgn logger driver |
String (list) | — | Explicit CGN traceability logger. Leaving this unset creates no logger; syslog is best-effort/lossy and is not a durable compliance record |
cgn logger servicebus connection-string |
String | — | Azure Service Bus connection string for CGN compliance records (secret) |
cgn logger servicebus queue-name |
String | — | Service Bus queue for CGN compliance records |
cgn logger spool-size |
Int | — | Per-driver in-memory event spool (events) |
cgn logger syslog-sink |
String | — | Named logging syslog sink used when cgn logger driver includes syslog |
cgn max-bindings |
Int | — | Maximum concurrent NAT bindings (subscribers) (restart required) |
cgn max-flows |
Int | — | Maximum tracked NAT flows (conntrack ceiling) (restart required) |
cgn ip-group <name>#
CGNAT public IP groups (pools)
A keyed list: set cgn ip-group <name> <field> <value> creates or updates an entry; delete cgn ip-group <name> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
auto-learn |
String (list) | — | Auto-learn sources as "prefix" or "vrf:prefix" (applies live) |
binding-timeout |
Int | — | Auto-learned binding inactivity timeout (seconds); applies to new bindings on commit, to existing ones with 'request subscribers reapply' |
bypass-prefixes |
String (list) | — | Inside IPv4 prefixes that bypass NAT (CIDR) (applies live) |
chunk-size |
Int | — | Ports per allocation chunk (power of two, 64-1024) (applies live once drained) |
description |
String | — | Free-text description |
outbound-allow-prefixes |
String (list) | — | Outbound destinations exempt from every block, such as your own mail relay (CIDR); the longest prefix decides (applies live) |
outbound-block-ports |
String (list) | — | Further outbound destination ports to refuse, as tcp/23 or udp/137-138 (applies live) |
outbound-block-prefixes |
String (list) | — | Further outbound destinations to refuse, any protocol (CIDR) (applies live) |
outbound-block-private |
Bool | — | Refuse outbound traffic to RFC 1918 and RFC 6598 addresses, unless a bypass or outbound-allow prefix covers them. Check nothing subscribers need is reached that way first (applies live) |
outbound-block-standard |
Bool | — | Refuse outbound SMTP (TCP 25) and Windows RPC, NetBIOS and SMB (TCP/UDP 135, UDP 137-138, TCP 139, TCP/UDP 445). On unless set false (applies live) |
outside-vrf |
String | <configured VRF name> |
Outside (public) VRF; empty = default table (applies live once drained) |
port-cap |
Int | — | Per-binding port cap (multiple of chunk-size, max 8 chunks); applies to new bindings on commit, to existing ones with 'request subscribers reapply' |
public-subnets |
String (list) | — | Public IPv4 subnets (CIDR) (applies live once drained) |
quarantine-seconds |
Int | — | Freed port-block hold-down (seconds); applies on commit, to blocks already held down too |
setups-per-sec |
Int | — | Per-binding flow-setup rate limit (0 = unlimited); applies to new bindings on commit, to existing ones with 'request subscribers reapply' |
timeout icmp |
Int | — | ICMP flow timeout (seconds); applies on commit |
timeout tcp-established |
Int | — | TCP established flow timeout (seconds); applies on commit |
timeout tcp-transitory |
Int | — | TCP transitory flow timeout (seconds); applies on commit |
timeout udp |
Int | — | UDP flow timeout (seconds); applies on commit |
timeout udp-dns |
Int | — | UDP flow timeout for DNS lookups, port 53 (seconds; never longer than the UDP timeout); applies on commit |
dataplane#
| Path | Type | Accepted values | Description |
|---|---|---|---|
dataplane command-ring-name |
String | — | POSIX shared-memory name of the CP->DP command ring |
dataplane control-punt-limits aggregate-pps |
Int | — | Box-wide aggregate control-punt cap across all tiers (0 disables the tier; unset leaves the data-plane default) |
dataplane control-punt-limits global-pps |
Int | — | Box-wide control-punt cap for traffic not bound to a port/peer/circuit (0 disables the tier; unset leaves the data-plane default) |
dataplane control-punt-limits management-pps |
Int | — | Box-wide budget for management punts (SSH, ICMP to the box, diagnostics) (0 removes the ceiling; unset leaves the data-plane default of 2000) |
dataplane control-punt-limits per-circuit-pps |
Int | — | Box-wide control-punt cap per subscriber circuit (0 disables the tier; unset leaves the data-plane default) |
dataplane control-punt-limits per-peer-pps |
Int | — | Box-wide control-punt cap per protocol peer (0 disables the tier; unset leaves the data-plane default) |
dataplane control-punt-limits per-port-pps |
Int | — | Box-wide control-punt cap per ingress port (0 disables the tier; unset leaves the data-plane default) |
dataplane control-punt-limits routing-pps |
Int | — | Box-wide budget for routing-protocol punts (BGP, LDP, BFD, OSPF, IS-IS, core ARP/ND) - a bucket of its own that subscriber signalling cannot spend (0 removes the ceiling; unset leaves the data-plane default of 20000) |
dataplane drop-source-routing |
Bool | — | Drop RH0/RH1 and IPv4 LSRR/SSRR or malformed option lengths on locally terminated subscriber ingress. Off by default; requires a data-plane restart |
dataplane fib-sync-enabled |
Bool | — | Mirror kernel/FRR routes into the data-plane FIB. On by default and required for forwarding in ipc mode — an escape hatch, not an opt-in |
dataplane ipsec-egress-prefix |
String | — | Prefix whose egress traffic is handed to the IPsec path |
dataplane l2tp-local-ip |
IpV4Address | — | Local IPv4 address the data plane sources L2TP from |
dataplane lcore-map |
String | — | Data-plane worker core map, e.g. "2,3,4,5" (read by the C data plane) |
dataplane max-sessions |
Int | — | Maximum subscriber sessions |
dataplane max-sessions-per-port |
Int | — | Maximum concurrent sessions one ingress port may hold (0 = unlimited). Fairness backstop: without it one access node can fill the whole session table and deny bring-up to every other port |
dataplane max-sessions-per-s-vlan |
Int | — | Maximum concurrent sessions under one (port, S-VLAN) — i.e. one access node or OLT parent tag (0 = unlimited). For QinQ access where many C-VLANs share an S-VLAN |
dataplane mode |
String | mock, dpdk, afxdp |
Data plane mode (mock, dpdk, afxdp) |
dataplane punt-ring-name |
String | — | POSIX shared-memory name of the DP->CP punt ring |
dataplane routing-protocol-trusted-source |
String (list) | — | Extra IP or CIDR allowed to reach BGP (179) and LDP (646) on the box, beyond the BGP peers and core link subnets |
dataplane socket-mem |
String | — | DPDK hugepage memory per NUMA socket in MB, as a string per DPDK convention |
dataplane state-shm-name |
String | — | POSIX shared-memory name of the data-plane session table (read-only to the CP) |
dataplane tx-ring-name |
String | — | POSIX shared-memory name of the CP->DP transmit ring |
dataplane network-interface <name>#
A network-facing data-plane port, keyed by interface name or PCI address — or <port>.<vlan> for a core uplink carried on a VLAN of a port declared above (e.g. ens1f0.100)
A keyed list: set dataplane network-interface <name> <field> <value> creates or updates an entry; delete dataplane network-interface <name> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
access-protocol |
String (list) | — | Access encapsulations expected on this port. Declaring them lets the data plane spread unhashable traffic (PPPoE/QinQ/L2TP) that hardware RSS cannot |
ifname |
String | — | Kernel interface name (AF_XDP and mock backends) |
label |
String | — | Operator label shown in the UI and interface table, e.g. "MS3 NNI 2" |
mtu |
Int | — | Port MTU |
pci |
String | — | PCI address of a DPDK-bound port, e.g. 0000:3b:00.0 |
punt-address |
String | — | Address assigned to the port's punt TAP, which is what FRR runs its adjacencies on (the DP-bound port is invisible to the kernel) |
rx-queues |
Int | — | Receive queues to configure on the port |
spray |
String | on, off, auto |
Software RSS dispatch for traffic hardware RSS cannot hash: on, off, or auto |
vlan |
Int | — | Network interfaces only: makes this a logical port on 802.1Q VLAN <n> of the port named by pci/ifname, which must be declared (without a vlan) as a subscriber interface or an earlier network interface. Lets a core uplink share a NIC with subscriber VLANs; it has its own punt TAP, punt-address and mtu |
dataplane subscriber-interface <name>#
A subscriber-facing data-plane port, keyed by interface name or PCI address
A keyed list: set dataplane subscriber-interface <name> <field> <value> creates or updates an entry; delete dataplane subscriber-interface <name> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
access-protocol |
String (list) | — | Access encapsulations expected on this port. Declaring them lets the data plane spread unhashable traffic (PPPoE/QinQ/L2TP) that hardware RSS cannot |
ifname |
String | — | Kernel interface name (AF_XDP and mock backends) |
label |
String | — | Operator label shown in the UI and interface table, e.g. "MS3 NNI 2" |
mtu |
Int | — | Port MTU |
pci |
String | — | PCI address of a DPDK-bound port, e.g. 0000:3b:00.0 |
punt-address |
String | — | Address assigned to the port's punt TAP, which is what FRR runs its adjacencies on (the DP-bound port is invisible to the kernel) |
rx-queues |
Int | — | Receive queues to configure on the port |
spray |
String | on, off, auto |
Software RSS dispatch for traffic hardware RSS cannot hash: on, off, or auto |
vlan |
Int | — | Network interfaces only: makes this a logical port on 802.1Q VLAN <n> of the port named by pci/ifname, which must be declared (without a vlan) as a subscriber interface or an earlier network interface. Lets a core uplink share a NIC with subscriber VLANs; it has its own punt TAP, punt-address and mtu |
frr#
| Path | Type | Accepted values | Description |
|---|---|---|---|
frr conf-path |
String | — | Path to frr.conf |
frr daemons-path |
String | — | Path to the FRR daemons file |
frr enable-kernel-mpls |
Bool | — | Enable the kernel MPLS data path so zebra can program the label table |
frr manage |
Bool | — | Let the control plane own frr.conf and /etc/frr/daemons. Off leaves both files alone — routing must then be configured by hand |
frr mpls-platform-labels |
Int | — | Size of the kernel MPLS label space (net.mpls.platform_labels) |
frr reload-method |
String | vtysh, restart |
How configuration is applied: vtysh (hot-apply) or restart. A change to the IGP daemon set forces a restart either way — vtysh cannot start or stop a daemon |
frr zapi-socket-path |
String | — | Path to zebra's ZAPI socket, used to inject subscriber routes |
frr zapi-write-timeout-seconds |
Int | — | Seconds zebra may leave one route message unread before the ZAPI connection is treated as broken and re-established (5-300). Waiting behind other route writes does not count |
ipsec#
| Path | Type | Accepted values | Description |
|---|---|---|---|
ipsec enabled |
Bool | — | Manage strongSwan from this configuration (renders and loads the peers below) |
ipsec swanctl-conf-path |
String | — | The swanctl drop-in file this box owns |
ipsec peer <name>#
An IKEv2 peer carrying L2TP over IPsec — a LAC, or a far LNS calls are switched to
A keyed list: set ipsec peer <name> <field> <value> creates or updates an entry; delete ipsec peer <name> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
child-rekey-seconds |
Int | — | Child (ESP) SA rekey interval |
dpd-delay-seconds |
Int | — | Dead-peer-detection interval |
dpd-timeout-seconds |
Int | — | Dead-peer-detection timeout (IKEv1 only) |
esp-proposals |
String | — | ESP proposals, swanctl syntax (e.g. aes256-sha256) |
force-udp-encap |
Bool | — | Always UDP-encapsulate ESP (NAT-T) |
ike-proposals |
String | — | IKE proposals, swanctl syntax (e.g. aes256-sha256-modp2048) |
ike-rekey-seconds |
Int | — | IKE SA rekey interval |
local-address |
String | — | Our IKE address (unset: any) |
local-id |
String | — | Our IKE identity (default: local-address) |
local-ts |
String (list) | — | Our inner prefix(es): must cover this box's L2TP source address |
pre-shared-secret |
String | — | IKE pre-shared key (secret) |
remote-address |
String | — | The peer's IKE address |
remote-id |
String | — | The peer's IKE identity (default: remote-address) |
remote-ts |
String (list) | — | The peer's inner prefix(es): the LAC or far LNS L2TP addresses |
start-action |
String | none, start, trap |
none (wait for the peer), start, or trap (on first traffic) |
licensing#
| Path | Type | Accepted values | Description |
|---|---|---|---|
licensing licence-id |
String | — | Licence identifier issued by the licensing server |
licensing mode |
String | — | Licensing mode. A verified lease promotes the effective mode to online regardless (doc 27 §27.9.3), so this cannot be used to disable enforcement |
licensing offline-licence-path |
String | — | Path to a signed offline licence file, for air-gapped deployments |
licensing role |
String | — | Licensing role of this appliance in a redundant pair |
licensing server-url |
String | — | Licensing server base URL |
licensing state-directory |
String | — | Directory holding lease and telemetry state |
licensing telemetry |
String | — | How much telemetry is reported. show licensing telemetry prints exactly what would be sent |
logging#
| Path | Type | Accepted values | Description |
|---|---|---|---|
logging sources alerting enabled |
Bool | — | Enable this log source class |
logging sources alerting min-severity |
String | debug, info, notice, warning, error, critical |
Minimum severity accepted from this source class |
logging sources alerting spool-size |
Int | — | Reserved queue size for this source class |
logging sources cgn-traceability enabled |
Bool | — | Enable this log source class |
logging sources cgn-traceability min-severity |
String | debug, info, notice, warning, error, critical |
Minimum severity accepted from this source class |
logging sources cgn-traceability spool-size |
Int | — | Reserved queue size for this source class |
logging sources events enabled |
Bool | — | Enable this log source class |
logging sources events min-severity |
String | debug, info, notice, warning, error, critical |
Minimum severity accepted from this source class |
logging sources events spool-size |
Int | — | Reserved queue size for this source class |
logging sources host-logs enabled |
Bool | — | Enable this log source class |
logging sources host-logs min-severity |
String | debug, info, notice, warning, error, critical |
Minimum severity accepted from this source class |
logging sources host-logs spool-size |
Int | — | Reserved queue size for this source class |
logging sources host-logs units |
String (list) | frr, kernel, bng-dataplane |
Host log streams to ship: frr, kernel, bng-dataplane |
logging sink <name>#
Named log-export sink registry
A keyed list: set logging sink <name> <field> <value> creates or updates an entry; delete logging sink <name> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
destination |
String | — | Collector host, address or URL for this sink |
enabled |
Bool | — | Whether this sink exports anything (a disabled sink stays resolvable by name) |
max-message-bytes |
Int | — | Maximum encoded syslog event size before truncation |
min-severity |
String | debug, info, notice, warning, error, critical |
Sink severity floor |
port |
Int | — | Collector port |
protocol |
String | udp, tcp, tls |
Transport protocol for syslog sinks: udp, tcp or tls |
sources |
String (list) | events, alerting, cgn-traceability, host-logs |
Streams sent to this sink: events, alerting, cgn-traceability, host-logs |
tls ca-file |
String | — | CA bundle used to verify the remote TLS certificate |
tls certificate-file |
String | — | Client certificate file for mutual TLS |
tls key-file |
String | — | Client private key file for mutual TLS |
tls server-name |
String | — | TLS SNI/verification name when the destination is an IP |
tls verify |
Bool | — | Verify the remote TLS certificate where the transport uses TLS |
transport-vrf |
String | <configured VRF name> |
Linux VRF device for the collector socket; DNS still uses the host resolver |
type |
String | — | Sink type. Supported now: syslog; future types keep this shape |
management#
| Path | Type | Accepted values | Description |
|---|---|---|---|
management gateway |
String | — | Default gateway to move into the management VRF |
management interface |
String | — | Management interface to isolate into a VRF. Unset leaves host networking untouched |
management table-id |
Int | — | Route table id for the host management VRF |
management vrf |
String | — | Name of the host management VRF |
protocols#
| Path | Type | Accepted values | Description |
|---|---|---|---|
protocols dhcp default-lease-time |
Int | — | Default DHCP lease time in seconds |
protocols dhcp gateway-mac |
MacAddress | — | DHCP gateway MAC address |
protocols dhcp ipv6-preferred-lifetime |
Int | — | DHCPv6 preferred lifetime of the address and prefix, in seconds |
protocols dhcp ipv6-rebind-time |
Int | — | DHCPv6 T2 in seconds (0 = 1.6 x T1, at most 0.8 of the preferred lifetime) |
protocols dhcp ipv6-renew-time |
Int | — | DHCPv6 T1 in seconds (0 = half of protocols ipoe lease-seconds, at most half the preferred lifetime) |
protocols dhcp ipv6-valid-lifetime |
Int | — | DHCPv6 valid lifetime of the address and prefix, in seconds. Also how long a client's lease is remembered after its session ends |
protocols dhcp options acs-url |
String | — | DHCP ACS URL (TR-069) |
protocols dhcp options aftr-name |
String | — | DS-Lite AFTR name (DHCPv6 option 64) |
protocols dhcp options domain-name |
String | — | DHCP domain name option |
protocols dhcp options domain-search |
String (list) | — | DHCP domain search list |
protocols dhcp options domain-search-v6 |
String (list) | — | DHCPv6 domain search list |
protocols dhcp options mtu |
Int | — | DHCP MTU option |
protocols dhcp options ntp-server |
IpV4Address (list) | — | DHCP NTP servers |
protocols dhcp options ntp-server-v6 |
IpV6Address (list) | — | DHCPv6 NTP servers |
protocols dhcp options provisioning-code |
String | — | DHCP provisioning code |
protocols dhcp server-ip |
IpV4Address | — | DHCP server IP address |
protocols ipoe enabled |
Bool | — | Terminate IPoE (DHCP-learned) subscribers |
protocols ipoe ipv6-reservation-hours |
Int | — | Hours an IPoE line's IPv6 WAN and delegated prefix stay reserved for it after its session ends, so it gets them back (0 to 720, default 24; 0 = none) |
protocols ipoe ipv6-wan-slaac |
Bool | — | Allocate the IPv6 WAN /64 when a DHCPv4 session comes up and advertise it for SLAAC (default true) |
protocols ipoe lease-seconds |
Int | — | DHCP lease time offered to IPoE subscribers, in seconds (60 to 604800) |
protocols ipoe server-duid |
String | — | DHCPv6 server DUID |
protocols ipoe server-ip |
IpV4Address | — | Address the DHCP server answers from |
protocols ipoe server-mac |
MacAddress | — | MAC used as the gateway for IPoE subscribers |
protocols ipoe unsolicited-ra |
Bool | — | Send Router Advertisements unasked to a DHCPv4 session that is entitled to IPv6 and has none yet (default true) |
protocols ipoe username-mode |
String | — | How a subscriber identity is derived from the circuit (TR-101 Option 82 fields) |
protocols l2tp auth-protocol |
String | pap, chap |
PPP authentication to negotiate with the subscriber |
protocols l2tp cdn-delay-after-lcp-terminate-ms |
Int | — | Milliseconds to wait for the LAC's own CDN after a subscriber LCP Terminate before sending ours (0 = immediately); applied live |
protocols l2tp challenge-peer |
Bool | — | Require the peer to answer the tunnel authentication challenge |
protocols l2tp debug-avp-dump |
Bool | — | Log every AVP of each incoming SCCRQ/ICRQ/ICCN (secrets masked) to see what a LAC sends; applied live |
protocols l2tp enabled |
Bool | — | Terminate L2TP as an LNS |
protocols l2tp host-name |
String | — | Hostname sent in the L2TP SCCRQ/SCCRP — the LAC may match on it |
protocols l2tp icrq-burst-per-source |
Int | — | Inbound ICRQ token-bucket burst per source IP in sessions |
protocols l2tp max-half-open-tunnels |
Int | — | Maximum L2TP tunnels still awaiting SCCCN |
protocols l2tp max-icrq-per-second-per-source |
Double | — | Maximum inbound ICRQ setup rate per source IP in sessions per second |
protocols l2tp max-sessions |
Int | — | Maximum concurrent L2TP sessions (unset = data-plane session table size) |
protocols l2tp max-sessions-per-source |
Int | — | Maximum concurrent L2TP sessions from one source IP |
protocols l2tp max-sessions-per-tunnel |
Int | — | Maximum concurrent L2TP sessions on one tunnel |
protocols l2tp max-tunnels |
Int | — | Maximum concurrent L2TP tunnels |
protocols l2tp max-tunnels-per-source |
Int | — | Maximum concurrent L2TP tunnels from one source IP |
protocols l2tp ppp-echo-interval-seconds |
Int | — | Seconds between PPP LCP Echo-Requests to each L2TP subscriber (0 = off); applied live |
protocols l2tp ppp-gateway-ip |
IpV4Address | — | Gateway address presented to PPP subscribers on this LNS |
protocols l2tp ppp-max-missed-echoes |
Int | — | Unanswered LCP Echo-Requests before an L2TP subscriber is torn down; applied live |
protocols l2tp reject-called-number-pattern |
String | — | Regex of Called-Number values to reject at call setup |
protocols l2tp restart-enabled |
Bool | — | Resume validated LNS tunnels after a planned restart (default on); read at control-plane start, off revokes the snapshot and uses ordinary recovery, delayed if revocation fails |
protocols l2tp restart-liveness-seconds |
Int | — | Seconds from adoption to prove resumed LNS tunnel liveness while routing recovers (30-300, default 120); abandoned calls retain sessions and routes until expiry |
protocols l2tp restart-max-age-seconds |
Int | — | Maximum age in seconds of a clean LNS restart checkpoint (1–60; default 30) |
protocols l2tp route-replies-via-fib |
Bool | — | Route L2TP control replies via the FIB rather than back down the receiving path |
protocols l2tp single-session-per-user |
Bool | — | Replace a user's existing L2TP session (Stop cause 13 + CDN) when the same user authenticates again in the same VRF, e.g. mobile SIMs behind a LAC that restarts; applied live |
protocols l2tp switching setup-timeout |
Int | — | Seconds a switched call may take to reach the far LNS before it is cleared |
protocols l2tp trust-lac-calling-number |
Bool | — | Trust Calling-Number for proxy auth only after a verified tunnel challenge with a nonempty secret; default true, ignored with one warning per unauthenticated tunnel, otherwise verify proxy PPP credentials |
protocols l2tp tunnel-mtu |
Int | — | MTU applied to L2TP tunnels |
protocols l2tp tunnel-secret |
String | — | Shared secret for tunnel authentication (default for all listeners) (secret) |
protocols pppoe ac-cookie-enabled |
Bool | — | Enable AC cookie in PPPoE |
protocols pppoe ac-cookie-lifetime |
Int | — | AC cookie lifetime in seconds |
protocols pppoe ac-name |
String | — | PPPoE Access Concentrator name |
protocols pppoe auth-failure-capacity |
Int | — | Maximum authentication failure histories |
protocols pppoe auth-failure-quiet-seconds |
Int | — | Seconds without authentication failures before reset |
protocols pppoe auth-failure-threshold |
Int | — | Authentication failures before hold-down |
protocols pppoe auth-failure-window-seconds |
Int | — | Window for initial authentication failures |
protocols pppoe auth-hold-down-max-seconds |
Int | — | Maximum authentication hold-down in seconds |
protocols pppoe auth-hold-down-seconds |
Int | — | Initial authentication hold-down in seconds |
protocols pppoe auth-protocols |
String | — | PPP authentication protocols for locally terminated PPPoE, in order of preference, comma-separated (chap, pap). The first is requested; a client that Naks it for another on the list gets that one |
protocols pppoe enabled |
Bool | — | Enable PPPoE server |
protocols pppoe l2tp-local-endpoint-ip |
IpV4Address | — | Local endpoint the PPPoE LAC sources L2TP tunnels from |
protocols pppoe max-sessions |
Int | — | Maximum PPPoE sessions |
protocols pppoe padi-bucket-capacity |
Double | — | Per-circuit PADI token-bucket burst in packets |
protocols pppoe padi-bucket-refill-per-second |
Double | — | Per-circuit PADI token-bucket refill rate in packets per second |
protocols pppoe service-name |
String | — | PPPoE service name |
protocols soft-l2tp enabled |
Bool | — | Use the kernel L2TP path with veth listeners |
protocols soft-l2tp remove-on-stop |
Bool | — | Tear the veth listeners down when the control plane stops |
protocols l2tp listener <name>#
An L2TP listener: one endpoint, optionally in its own VRF. Unset fields inherit the protocols l2tp defaults
A keyed list: set protocols l2tp listener <name> <field> <value> creates or updates an entry; delete protocols l2tp listener <name> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
auth-protocol |
String | pap, chap |
PPP authentication for this listener |
challenge-peer |
Bool | — | Require tunnel authentication |
endpoint-ip |
IpV4Address | — | Local address the listener binds |
ipsec |
Bool | — | MTU hint only: include IPsec ESP overhead; does not require or authenticate IPsec on incoming tunnels |
ppp-gateway-ip |
IpV4Address | — | Gateway presented to PPP subscribers |
reject-called-number-pattern |
String | — | Regex of Called-Number values this listener rejects |
trust-lac-calling-number |
Bool | — | Override default calling-number trust; requires a verified tunnel challenge with a nonempty secret, otherwise verify proxy PPP credentials; IPsec is only an MTU hint |
tunnel-mtu |
Int | — | MTU for tunnels on this listener |
tunnel-secret |
String | — | Shared secret for this listener (secret) |
vrf-name |
String | <configured VRF name> |
VRF the listener's endpoint lives in |
protocols l2tp switching rule <name>#
A tunnel-switching rule: calls matching every key it sets are relayed to a far LNS instead of terminated here. Rules are tried in the order they were added
A keyed list: set protocols l2tp switching rule <name> <field> <value> creates or updates an entry; delete protocols l2tp switching rule <name> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
aaa |
Bool | — | Ask the auth driver where to switch the call (RFC 2868 tunnel attributes) |
called-number-pattern |
String | — | Match: regex over the Called Number (from a mobile LAC, the APN) |
calling-number-pattern |
String | — | Match: regex over the Calling Number (from a mobile LAC, the IMSI) |
lac-host-name |
String | — | Match: the LAC's host name, with * and ? wildcards |
listener |
String | — | Match: the listener the call arrived on ("default" for protocols l2tp) |
proxy-auth-realm |
String | — | Match: regex over the realm (after the last @) of the proxied PPP username |
service-id |
String | — | Accounting subject id (GUID) for calls this rule switches; optional |
tunnel-endpoint |
String (list) | — | Far LNS: "address [port N] [vrf NAME] [secret S] [assignment-id ID] [priority N]" (quote the whole value) |
protocols soft-l2tp listener <name>#
A kernel L2TP veth listener
A keyed list: set protocols soft-l2tp listener <name> <field> <value> creates or updates an entry; delete protocols soft-l2tp listener <name> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
endpoint-ip |
IpV4Address | — | Address the listener terminates tunnels on |
kernel-address |
String | — | Address configured on the kernel side of the veth pair |
routing#
| Path | Type | Accepted values | Description |
|---|---|---|---|
routing asn |
Int | — | Local autonomous system number |
routing enable-vrf-ipv6 |
Bool | — | Carry IPv6 inside VRFs (VPNv6 / 6VPE). Kernel-forwarded deployments set this false; global-table IPv6 is unaffected either way |
routing hostname |
String | — | Hostname FRR announces (also the RADIUS NAS-Identifier fallback) |
routing igp interface |
String (list) | — | Interfaces the IGP runs on. Loopbacks (lo/loop/dummy) are made passive; the rest are point-to-point core links and also carry LDP |
routing igp isis level |
String | level-1, level-2-only, level-1-2 |
IS-IS level (instance is-type and each core link's circuit-type) |
routing igp isis net |
String | — | IS-IS ISO NET address, e.g. 49.0001.0102.5525.5001.00 |
routing igp ospf area |
String | — | Default OSPF area for every IGP interface, as a dotted quad (0.0.0.0) or an integer (0) |
routing igp ospf enable-ospfv3 |
Bool | — | Run OSPFv3 (ospf6d) for IPv6 alongside OSPFv2. Unset follows dual-stack — on whenever router-id6 is set |
routing igp ospf interface-area |
String (list) | — | Per-interface OSPF area override, as "interface:area" (e.g. core1:0.0.0.7). Interfaces without an override use routing igp ospf area |
routing igp protocol |
String | isis, ospf, none |
Interior gateway protocol. Changing this restarts FRR — a routing daemon cannot be started or stopped by a configuration reload |
routing management-network address |
String | — | Management interface address in CIDR form, e.g. 10.20.2.11/25 |
routing management-network gateway-ip |
String | — | Next-hop for a default route inside the management VRF's table; unset = connected-subnet reachability only |
routing management-network interface |
String | — | Physical interface to enslave into the isolated out-of-band management VRF |
routing originate-default-route |
Bool | — | Originate an IPv4 default route (0.0.0.0/0) into BGP in the default (global) table |
routing originate-default-route-vrfs |
String (list) | <configured VRF name> |
VRFs to originate an IPv4 default route into (standalone-CGN inside VRFs) |
routing router-id |
IpV4Address | — | IPv4 router id — also the loopback /32 the IGP advertises and the address BGP sources sessions from |
routing router-id6 |
IpV6Address | — | IPv6 loopback /128; setting it makes the box dual-stack (IS-IS multi-topology or OSPFv3, plus BGP ipv6-unicast). Unset = IPv4 only |
routing cpe-gre-circuit <id>#
One CPE/SIM's GRE tunnel and the PE-CE eBGP session inside it. The kernel device name is derived from this id (a SIM reference does not fit in a 15-character interface name)
A keyed list: set routing cpe-gre-circuit <id> <field> <value> creates or updates an entry; delete routing cpe-gre-circuit <id> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
bfd |
Bool | — | Enable BFD on the session — a mobile path can black-hole while the tunnel stays administratively up |
clamp-mss |
Bool | — | Clamp forwarded TCP MSS to the route MTU. On by default because PMTUD is unreliable across tunnels |
description |
String | — | Free text, rendered as the FRR neighbor description (defaults to the id) |
key |
Int | — | GRE key (RFC 2890) — endpoint hygiene on shared transport, not security |
listener-id |
String | — | Which routing gre-tunnel-listener this circuit's tunnel terminates on |
local-as |
Int | — | AS this CPE sees us as, overriding the VRF's local-as (unset inherits it) |
local-tunnel-address |
String | — | Our inner point-to-point address in CIDR form, e.g. 172.31.40.0/31 |
maximum-prefix |
Int | — | Cap on prefixes accepted from this CPE, so one misbehaving site cannot fill the customer VRF's table |
mtu |
Int | — | Tunnel MTU (0 leaves the kernel's GRE default) |
peer-asn |
Int | — | The CPE's autonomous system number |
remote |
String | — | The CPE's outer (carrier-side) IP address |
remote-tunnel-address |
String | — | The CPE's inner address — also the BGP neighbor address (no prefix length) |
vrf |
String | <configured VRF name> |
Customer VRF — both the tunnel device and the BGP peer live here |
routing gre-tunnel-listener <id>#
A shared local endpoint that CPE GRE tunnels terminate on — the outer 'local' address every circuit referencing it is built with
A keyed list: set routing gre-tunnel-listener <id> <field> <value> creates or updates an entry; delete routing gre-tunnel-listener <id> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
local-address |
String | — | Our outer (underlay) address every circuit on this listener uses as the tunnel's local endpoint |
ttl |
Int | — | Outer TTL applied to every tunnel on this listener |
underlay-interface |
String | — | Pin the tunnels' underlay routing to this device. Set it whenever circuits are enslaved to a VRF, or the outer packet is looked up in the customer's table instead of the underlay's |
routing interface <name>#
A locally-provisioned interface the appliance creates at startup: dummy, vlan, gre, or an existing physical NIC it configures but never creates
A keyed list: set routing interface <name> <field> <value> creates or updates an entry; delete routing interface <name> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
address |
String (list) | — | Addresses in CIDR form, IPv4 or IPv6 |
clamp-mss |
Bool | — | gre only: clamp forwarded TCP MSS to the route MTU. On by default because PMTUD is unreliable across tunnels |
key |
Int | — | gre only: GRE key (RFC 2890) — endpoint hygiene, not security |
local |
String | — | gre only: local outer endpoint (unset lets the kernel pick) |
mac |
MacAddress | — | physical only: pin this name to the NIC with this MAC via a systemd .link file, so the name survives reboots and NIC re-enumeration |
mtu |
Int | — | Interface MTU (0 leaves the kernel default) |
parent |
String | — | vlan only: parent device |
pin-via |
String | — | gre only: pin a host route for the tunnel endpoint via this underlay gateway, so a route learned through the tunnel can never claim the tunnel's own endpoint (recursion collapse) |
remote |
String | — | gre only: remote outer tunnel endpoint |
ttl |
Int | — | gre only: outer TTL |
type |
String | dummy, vlan, physical, gre |
dummy (created), vlan (802.1Q sub-interface), physical (existing NIC, never created), or gre (MPLS-capable tunnel) |
vlan-id |
Int | — | vlan only: 802.1Q tag |
vrf |
String | <configured VRF name> |
VRF to enslave the interface into; enslaving flushes addresses |
routing peer <address>#
iBGP peer (route reflector or PE) — keyed by IPv4 address
A keyed list: set routing peer <address> <field> <value> creates or updates an entry; delete routing peer <address> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
bfd |
Bool | — | Enable BFD on the session — the only fast liveness signal on a statically-routed tunnel with no IGP |
description |
String | — | Free-text peer description |
vpn-only |
Bool | — | Activate only the vpnv4/vpnv6 address-families, never ipv4/ipv6 unicast — a remote-PE spoke that keeps its own internet |
routing static-route <prefix>#
Static route rendered into frr.conf (family inferred from the prefix). Routes with a src hint are installed by the provisioner as kernel routes instead
A keyed list: set routing static-route <prefix> <field> <value> creates or updates an entry; delete routing static-route <prefix> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
dev |
String | — | Egress interface (via and/or dev is required) |
src |
String | — | Source-address hint. Routes with this set are installed as kernel routes, not rendered into frr.conf (FRR 10.3 has no working src mechanism), so BGP cannot resolve next-hops over them |
via |
String | — | Next-hop address (via and/or dev is required) |
routing vrf <name>#
L3VPN VRF — becomes a Linux VRF device, so the name is bound by IFNAMSIZ (15 chars, no whitespace or '/')
A keyed list: set routing vrf <name> <field> <value> creates or updates an entry; delete routing vrf <name> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
bgp-asn |
Int | — | AS this VRF's BGP instance runs under, in place of the box's own AS — what its CPE circuits peer with, iBGP included |
cgn-ip-group |
String | — | CGN IP group translating subscribers in this VRF (on-box CGN). The VRF's IPv4 address pools are then private and must not be announced |
circuit-default-route-only |
Bool | — | Send this VRF's CPE circuits only the default route, not the VRF's whole table |
export-rt |
String (list) | — | Route targets exported from this VRF |
gateway-ip |
IpV4Address | — | IPv4 gateway address the BNG owns inside this VRF |
gateway-ipv6 |
IpV6Address | — | IPv6 gateway address the BNG owns inside this VRF |
import-rt |
String (list) | — | Route targets imported into this VRF |
l2tp-endpoint-ip |
IpV4Address | — | L2TP tunnel endpoint address inside this VRF (LNS role) |
local-as |
Int | — | AS this VRF's PE-CE eBGP neighbours (CPE circuits) see us as, in place of the box's own AS — for taking over CEs configured for another AS |
rd |
String | — | Route distinguisher, e.g. 65000:10 |
table-id |
Int | — | Linux route-table id for the VRF. Required — a VRF left at 0 silently fails to create its device and breaks FibSync mapping |
security#
| Path | Type | Accepted values | Description |
|---|---|---|---|
security dp-socket-path |
String | — | No effect — reserved. The data plane creates no socket at this path |
security drop-capabilities |
Bool | — | No effect — reserved. The control plane does not drop Linux capabilities: it keeps the full root set, which provisioning routing, interfaces and kernel modules needs |
security ipc-socket-path |
String | — | No effect — reserved. The control and data planes communicate over shared memory, and no socket is created at this path |
security service-group |
String | — | No effect — reserved. Both services run as root; this does not choose the group |
security service-user |
String | — | No effect — reserved. Both services run as root; this does not choose the account |
security socket-file-mode |
Int | — | No effect — reserved. No socket takes its permissions from this value |
security validate-socket-ownership |
Bool | — | No effect — reserved. No socket ownership check is performed |
snmp#
| Path | Type | Accepted values | Description |
|---|---|---|---|
snmp agentx-perms |
String | — | Permissions applied to the AgentX socket |
snmp agentx-socket-path |
String | — | AgentX socket the subagent connects to |
snmp community |
String | — | SNMPv2c read-only community string (secret) |
snmp conf-path |
String | — | Path to the generated snmpd configuration |
snmp enabled |
Bool | — | Run the SNMP AgentX subagent |
snmp listen-address |
String (list) | — | Agent listen endpoints (e.g. udp:127.0.0.1:161); empty auto-derives |
snmp manage |
Bool | — | Render and own /etc/snmp/snmpd.conf |
snmp sample-interval |
Int | — | Data-plane counter sample interval in seconds |
snmp subscriber-table enabled |
Bool | — | Serve the per-subscriber interface table (bngSubscriberTable) |
snmp subscriber-table flush-interval |
Int | — | Seconds between writes of the subscriber counter bases to disk (60-3600) |
snmp subscriber-table max-entries |
Int | — | Most subscriber rows kept (0 = twice the session table size) |
snmp subscriber-table path |
String | — | File the subscriber indexes and counter bases are kept in |
snmp subscriber-table retention-days |
Int | — | Days a subscriber may go unseen before its row and index are retired |
snmp sys-contact |
String | — | SNMP sysContact string |
snmp sys-location |
String | — | SNMP sysLocation string |
snmp ro-community <community>#
Read-only community grants for remote pollers
A keyed list: set snmp ro-community <community> <field> <value> creates or updates an entry; delete snmp ro-community <community> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
sources |
String (list) | — | Allowed source CIDRs/IPs (a v6 source renders rocommunity6) |
subscriber-table |
Bool | — | Let this community read the per-subscriber table (names cross the network in clear text; prefer an SNMPv3 user) |
snmp user <name>#
SNMPv3 read-only users (authPriv users can read the subscriber table)
A keyed list: set snmp user <name> <field> <value> creates or updates an entry; delete snmp user <name> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
auth-password |
String | — | Authentication passphrase, 8 characters or more (secret) |
auth-protocol |
String | sha, sha-256, sha-512 |
Authentication protocol: sha|sha-256|sha-512 |
priv-password |
String | — | Privacy passphrase, 8 characters or more (secret) |
priv-protocol |
String | aes, none |
Privacy protocol: aes|none (none cannot read the subscriber table) |
source-vrf-rule#
source-vrf-rule <name>#
Source-subnet VRF classification: route a source subnet arriving in an ingest VRF into a target VRF with no NAT
A keyed list: set source-vrf-rule <name> <field> <value> creates or updates an entry; delete source-vrf-rule <name> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
ingest-vrf |
String | <configured VRF name> |
The VRF traffic arrives in before classification |
source-subnet |
String (list) | — | Source CIDRs that route into target-vrf |
target-vrf |
String | <configured VRF name> |
The VRF matching traffic is routed into (no NAT) |
subscriber-history#
| Path | Type | Accepted values | Description |
|---|---|---|---|
subscriber-history enabled |
Bool | — | Keep a rolling 24 hours of download and upload rate for each subscriber, shown as the graph on a session and the sparkline in the session list |
subscriber-history flush-interval |
Int | — | How often new history is written to disk, in seconds (60-3600, whole minutes). A power loss loses at most this much; a clean restart loses nothing |
subscriber-history max-subscribers |
Int | — | Most subscribers a history is kept for; the least recently seen are dropped first. 0 sizes it from the session table (dataplane max-sessions plus a quarter) |
subscriber-history path |
String | — | Path to the subscriber history database; must be on persistent disk |
subscribers#
| Path | Type | Accepted values | Description |
|---|---|---|---|
subscribers default-pools ipv4-pool |
String | — | IPv4 pool for local subscribers with no static IPv4 and no pool of their own |
subscribers default-pools ipv6-pd-pool |
String | — | IPv6 PD pool for local subscribers with no static delegated prefix and no pool of their own |
subscribers default-pools ipv6-wan-pool |
String | — | IPv6 WAN pool for local subscribers with no static IPv6 WAN and no pool of their own |
subscribers access-nni <name>#
Access NNIs this box serves: the platform's NNI key, tied to the subscriber interface and outer VLAN its circuits arrive on
A keyed list: set subscribers access-nni <name> <field> <value> creates or updates an entry; delete subscribers access-nni <name> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
description |
String | — | Free-text description |
interface |
String | — | Subscriber interface the NNI arrives on (ifname or PCI address of a data-plane subscriber interface); use this or port |
port |
Int | — | Subscriber-facing data-plane port index (0-255); use this or interface |
s-vlan |
Int | — | Outer (service) VLAN of the NNI (1-4094) |
subscribers ipoe <circuit>#
Local IPoE (DHCP) subscribers, keyed by access circuit (portP.V / portP.S.V, or an Option-82 circuit-id)
A keyed list: set subscribers ipoe <circuit> <field> <value> creates or updates an entry; delete subscribers ipoe <circuit> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
additional-routes |
String (list) | — | Extra site prefixes routed to the subscriber (CIDR) |
dns-1 |
IpV4Address | — | Primary IPv4 DNS server |
dns-2 |
IpV4Address | — | Secondary IPv4 DNS server |
dns-v6-1 |
IpV6Address | — | Primary IPv6 DNS server |
dns-v6-2 |
IpV6Address | — | Secondary IPv6 DNS server |
download-burst |
Int | — | Download burst override (KB); unset = rate-proportional |
download-rate |
Int | — | Download rate (kbit/s) |
download-rate-pps |
Int | — | Download packet rate (pps); 0 = unlimited |
framed-ip |
IpV4Address | — | IPv4 address (omit for v6-only) |
framed-ipv6 |
IpV6Address | — | IPv6 WAN address (omit for v4-only) |
ipv4-pool |
String | — | Dynamic IPv4 address pool, used when no framed-ip is set (else subscribers default-pools) |
ipv6-pd-length |
Int | — | Delegated prefix length (1-64) |
ipv6-pd-pool |
String | — | Dynamic IPv6 delegated-prefix pool, used when no ipv6-pd-prefix is set |
ipv6-pd-prefix |
IpV6Address | — | Delegated IPv6 prefix |
ipv6-wan-pool |
String | — | Dynamic IPv6 WAN pool (a /64 per subscriber), used when no framed-ipv6 is set |
name |
String | — | Name the subscriber's session runs under (shown in the session list, carried by accounting); unset = the circuit's own name |
plan-name |
String | — | Service plan name |
service-id |
String | — | Accounting subject id (GUID); optional |
service-type |
String | broadband, sim, ethernet |
Kind of service the service-id names (broadband, sim, ethernet); default broadband |
upload-burst |
Int | — | Upload burst override (KB); unset = rate-proportional |
upload-rate |
Int | — | Upload rate (kbit/s) |
upload-rate-pps |
Int | — | Upload packet rate (pps); 0 = unlimited |
vrf |
String | <configured VRF name> |
VRF the subscriber terminates in; empty = global table |
subscribers ppp <username>#
Local PPP subscribers (username/password; LNS-terminated L2TP and PPPoE-local)
A keyed list: set subscribers ppp <username> <field> <value> creates or updates an entry; delete subscribers ppp <username> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
additional-routes |
String (list) | — | Extra site prefixes routed to the subscriber (CIDR) |
dns-1 |
IpV4Address | — | Primary IPv4 DNS server |
dns-2 |
IpV4Address | — | Secondary IPv4 DNS server |
dns-v6-1 |
IpV6Address | — | Primary IPv6 DNS server |
dns-v6-2 |
IpV6Address | — | Secondary IPv6 DNS server |
download-rate |
Int | — | Download rate (kbit/s) |
download-rate-pps |
Int | — | Download packet rate (pps); 0 = unlimited |
enforce-credentials |
Bool | — | Check the password (default true); false accepts any PAP or CHAP password (MS-CHAPv2 still needs the right one) |
framed-ip |
IpV4Address | — | IPv4 address (omit for v6-only) |
framed-ipv6 |
IpV6Address | — | IPv6 WAN address (omit for v4-only) |
ipv4-pool |
String | — | Dynamic IPv4 address pool, used when no framed-ip is set (else subscribers default-pools) |
ipv6-pd-length |
Int | — | Delegated prefix length (1-64) |
ipv6-pd-pool |
String | — | Dynamic IPv6 delegated-prefix pool, used when no ipv6-pd-prefix is set |
ipv6-pd-prefix |
IpV6Address | — | Delegated IPv6 prefix |
ipv6-wan-pool |
String | — | Dynamic IPv6 WAN pool (a /64 per subscriber), used when no framed-ipv6 is set |
password |
String | — | PPP password (PAP/CHAP shared secret) (secret) |
plan-name |
String | — | Service plan name |
service-id |
String | — | Accounting subject id (GUID); optional |
service-type |
String | broadband, sim, ethernet |
Kind of service the service-id names (broadband, sim, ethernet); default broadband |
shared-login |
Bool | — | Let many CPEs use this login at once (a factory provisioning account): answered here before RADIUS or the subscriber source, never replaced by a newer login, and not accounted |
status |
String | active, blocked, suspended, disabled |
Subscriber status: active | blocked (traffic dropped, session stays up) | suspended (a login is refused "account suspended") | disabled (rejected) |
upload-rate |
Int | — | Upload rate (kbit/s) |
upload-rate-pps |
Int | — | Upload packet rate (pps); 0 = unlimited |
vrf |
String | <configured VRF name> |
VRF the subscriber terminates in; empty = global table |
subscribers pppoe <circuit>#
Local PPPoE wholesale subscribers (relayed to remote L2TP endpoints), keyed by access circuit (portP.V / portP.S.V, or an Option-82 circuit-id)
A keyed list: set subscribers pppoe <circuit> <field> <value> creates or updates an entry; delete subscribers pppoe <circuit> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
service-id |
String | — | Accounting subject id (GUID); optional |
tunnel-endpoint |
String (list) | — | Remote LNS endpoint: "address [port N] [vrf NAME] [secret S] [assignment-id ID] [priority N]" (quote the whole value) |
syslog#
| Path | Type | Accepted values | Description |
|---|---|---|---|
syslog enabled |
Bool | — | Deprecated alias for logging sink syslog enabled — export the appliance event stream |
syslog port |
Int | — | Deprecated alias for logging sink syslog port — syslog collector port |
syslog server |
IpAddress | — | Deprecated alias for logging sink syslog destination — syslog collector address |
system#
| Path | Type | Accepted values | Description |
|---|---|---|---|
system cli admin-socket-path |
String | — | Unix socket the bng-cli relay connects to |
system cli admin-socket-peer-uid |
Int | — | UID required of the socket's peer; the relay is rejected if it does not match |
system cli admin-socket-relay-user |
String | — | User the SSH ForceCommand relay runs as |
system cli host-key-path |
String | — | Path to SSH host key |
system cli idle-timeout |
Int | — | CLI idle timeout in minutes |
system cli max-sessions |
Int | — | Maximum concurrent CLI sessions |
system cli serial-console-baud |
Int | — | Serial console baud rate (8N1) |
system cli serial-console-device |
String | — | Serial device for the console (e.g. /dev/ttyS0; ttyS1 for IPMI SOL) |
system cli serial-console-enabled |
Bool | — | Run the local CLI on the appliance serial port (restart required) |
system cli ssh-enabled |
Bool | — | Enable SSH for CLI access |
system cli ssh-listen-address |
IpAddress | — | SSH listen address |
system cli ssh-port |
Int | — | SSH port for CLI |
system cli telnet-enabled |
Bool | — | Enable Telnet for CLI access |
system cli telnet-listen-address |
IpAddress | — | Telnet listen address |
system cli telnet-port |
Int | — | Telnet port for CLI |
system login user <name>#
Login users
A keyed list: set system login user <name> <field> <value> creates or updates an entry; delete system login user <name> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
authentication encrypted-password |
String | — | Encrypted password hash (secret) |
authentication passkey |
String (list) | — | An enrolled passkey, as "credential-id public-key [label]". Written by enrolment; set it only to restore a backup. Delete revokes it |
authentication ssh-key |
String (list) | — | Authorized SSH key in authorized_keys form, e.g. "ssh-ed25519 AAAAC3Nz…" (quote the whole value) |
authentication totp-secret |
String | — | TOTP shared secret. Normally written by enrolment; settable so a seed can be restored from backup. Masked on read (secret) |
class |
String | super-user, operator, read-only |
User class |
full-name |
String | — | User full name |
vxlan#
| Path | Type | Accepted values | Description |
|---|---|---|---|
vxlan local-address |
IpV4Address | — | VTEP source address for the layer-2 hand-off of access circuits, and the only address VXLAN is accepted on: one of this box's own IPv4 addresses in the underlay VRF, normally its IGP loopback. Unset: VXLAN is not configured and every circuit the subscriber view hands off is denied (dropped), never served |
vxlan underlay-mtu |
Int | — | Provisioned end-to-end IP MTU of the VXLAN underlay (576-9216, default 1600). A customer frame whose VXLAN datagram would exceed it is dropped, never fragmented |
vxlan underlay-vrf |
String | <configured VRF name> |
VRF the far VTEPs are routed in, and the only one VXLAN is accepted from. Unset: the global table |
walled-garden#
| Path | Type | Accepted values | Description |
|---|---|---|---|
walled-garden captive-dns-interception-enabled |
String | — | Enable data-plane captive DNS interception for restricted sessions |
walled-garden captive-dns-ttl |
Int | — | TTL for data-plane captive DNS answers |
walled-garden captive-portal-ip |
IpAddress | — | IPv4 address the data-plane captive DNS responder answers with (the portal, not a resolver) |
walled-garden captive-portal-ip-v6 |
IpV6Address | — | IPv6 address the data-plane captive DNS responder answers AAAA queries with |
walled-garden dns-server |
IpV4Address (list) | — | Walled garden DNS servers |
walled-garden dns-server-v6 |
IpV6Address (list) | — | Walled garden IPv6 DNS servers |
walled-garden domain-name |
String | — | Walled garden domain name |
walled-garden lease-time |
Int | — | Walled garden lease time in seconds |
walled-garden max-allocations-per-port-s-vlan |
Int | — | Maximum concurrent walled-garden temporary pool allocations per access port/S-VLAN |
walled-garden temp-pool-cidr |
String | — | Temporary IPv4 pool CIDR for unknown subscribers |
walled-garden temp-pool-gateway |
IpV4Address | — | Temporary pool gateway IP |
walled-garden vrf-name |
String | <configured VRF name> |
Walled garden VRF name |
web-ui#
| Path | Type | Accepted values | Description |
|---|---|---|---|
web-ui appliance-name |
String | — | Name shown in the UI header and used to tell appliances apart in the fleet view |
web-ui auth allow-self-service-device-tokens |
Bool | — | Whether signed-in operators may mint revocable 90-day sliding device tokens for themselves (secret) |
web-ui auth lockout max-attempts |
Int | — | Failed sign-ins before an account is locked out |
web-ui auth lockout window |
Int | — | Window the failed-attempt count is measured over, in minutes |
web-ui auth passkey mode |
String | — | Whether passkeys are off, a second factor, or may replace the password |
web-ui auth session-state-path |
String | — | Where session state is persisted so logins survive a control-plane restart |
web-ui auth session-timeout |
Int | — | Idle timeout for a UI session, in minutes |
web-ui auth tacacs auth-type |
String | — | TACACS+ authentication type |
web-ui auth tacacs authorize-service |
String | — | Service name presented in the TACACS+ authorization request |
web-ui auth tacacs command-accounting-enabled |
Bool | — | Emit TACACS+ START/STOP accounting for each TACACS+ CLI command |
web-ui auth tacacs command-authorization-fallback |
String | — | Fallback on TACACS+ command authorization error: local or deny |
web-ui auth tacacs enabled |
Bool | — | Authenticate management users against TACACS+ |
web-ui auth tacacs per-command-authorization-enabled |
Bool | — | Authorize each TACACS+ CLI command before execution |
web-ui auth tacacs role-attribute |
String | — | Attribute carrying the user's role in the authorization reply |
web-ui auth tacacs role-map |
String (list) | — | Maps a TACACS+ attribute value to a Netavo role, as "match:role" |
web-ui auth tacacs secret |
String | — | TACACS+ shared secret (secret) |
web-ui auth tacacs timeout |
Int | — | TACACS+ request timeout in milliseconds |
web-ui auth tacacs transport-vrf |
String | — | VRF used to reach the TACACS+ servers |
web-ui auth totp-mode |
String | — | Whether TOTP is off, optional or required |
web-ui demo |
Bool | — | Serve fabricated demo data instead of live state. For demonstrations only — never on an appliance carrying traffic |
web-ui enabled |
Bool | — | Serve the web management UI and REST API |
web-ui hostname |
String | — | Hostname the UI presents and issues certificates for |
web-ui tls custom cert-path |
String | — | Path to the operator-supplied certificate (PEM) |
web-ui tls custom key-path |
String | — | Path to the operator-supplied private key (PEM) |
web-ui tls mode |
String | self-signed, custom |
Certificate source: self-signed or an operator-supplied pair |
web-ui tls self-signed store-path |
String | — | Where the generated self-signed certificate is kept |
web-ui trusted-proxy |
String (list) | — | Proxies whose X-Forwarded-For may be believed. Trusting the wrong hop lets a client spoof its source address past IP-based restrictions |
web-ui auth oidc provider <name>#
An OIDC identity provider for management-plane SSO (doc 33)
A keyed list: set web-ui auth oidc provider <name> <field> <value> creates or updates an entry; delete web-ui auth oidc provider <name> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
client-id |
String | — | OAuth client id |
client-secret |
String | — | OAuth client secret (secret) |
display-name |
String | — | Label shown on the sign-in button |
enabled |
Bool | — | Offer this provider on the sign-in page |
fetch-user-info |
Bool | — | Call the userinfo endpoint when the id token lacks the needed claims |
groups-claim |
String | — | Claim carrying group membership |
issuer |
String | — | Issuer URL; discovery hangs off it |
redirect-uri |
String | — | Redirect URI registered with the provider; must match exactly |
role-map |
String (list) | — | Maps a group claim value to a Netavo role, as "match:role" |
scope |
String (list) | — | Scopes requested at authorization |
username-claim |
String | — | Claim used as the username |
web-ui auth tacacs server <host>#
A TACACS+ server, tried in configuration order
A keyed list: set web-ui auth tacacs server <host> <field> <value> creates or updates an entry; delete web-ui auth tacacs server <host> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
port |
Int | — | TACACS+ port |
web-ui auth token <name>#
A named API bearer token. The token itself is never stored — only its hash, which is what token-hash sets and which is masked on read
A keyed list: set web-ui auth token <name> <field> <value> creates or updates an entry; delete web-ui auth token <name> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
created-utc |
String | — | UTC time the token was created |
device-user |
String | — | Local user authenticated by a self-service device token |
label |
String | — | Operator-facing label for a self-service device token |
last-used-utc |
String | — | UTC time the token last authenticated successfully |
role |
String | — | Role the token is granted |
token-hash |
String | — | Hash of the bearer token (secret) |
web-ui listener <address>#
An address the web UI binds, optionally inside a VRF
A keyed list: set web-ui listener <address> <field> <value> creates or updates an entry; delete web-ui listener <address> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
port |
Int | — | TCP port |
vrf |
String | <configured VRF name> |
VRF the listener binds inside |
web-ui peer <name>#
Another appliance this one proxies to in the fleet view
A keyed list: set web-ui peer <name> <field> <value> creates or updates an entry; delete web-ui peer <name> removes the whole entry.
| Field | Type | Accepted values | Description |
|---|---|---|---|
allow-untrusted |
Bool | — | Accept the peer's certificate without validating it. Only for a lab — it removes the protection the fingerprint pin provides |
api-token |
String | — | Bearer token used to authenticate to the peer (secret) |
cert-fingerprint |
String | — | Expected TLS certificate fingerprint — how a self-signed peer is pinned |
url |
String | — | Base URL of the peer's API |
582 configurable fields across 26 sections (33 keyed lists).