Merge branch 'master' of https://github.com/goodNETnick/vyos-documentation

5 files changed, 158 insertions, 54 deletions

diff --git a/docs/configuration/system/acceleration.rst b/docs/configuration/system/acceleration.rst
new file mode 100644
index 00000000..4c595022
--- /dev/null
+++ b/docs/configuration/system/acceleration.rst
@@ -0,0 +1,146 @@
+.. _acceleration:
+
+############
+Acceleration
+############
+
+In this command tree, all hardware acceleration options will be handled.
+At the moment only `Intel® QAT`_ is supported
+
+**********
+Intel® QAT
+**********
+
+.. opcmd:: show system acceleration qat
+
+    use this command to check if there is an Intel® QAT supported Processor in
+    your system.
+
+    .. code-block::
+
+        vyos@vyos:~$ show system acceleration qat
+        01:00.0 Co-processor [0b40]: Intel Corporation Atom Processor C3000 Series QuickAssist Technology [8086:19e2] (rev 11)
+
+    if there is non device the command will show ```No QAT device found```
+
+.. cfgcmd:: set system acceleration qat
+
+    if there is a supported device, enable Intel® QAT
+
+.. opcmd:: show system acceleration qat status
+
+    Check if the Intel® QAT device is up and ready to do the job.
+
+    .. code-block::
+
+        vyos@vyos:~$ show system acceleration qat status
+        Checking status of all devices.
+        There is 1 QAT acceleration device(s) in the system:
+        qat_dev0 - type: c3xxx,  inst_id: 0,  node_id: 0,  bsf: 0000:01:00.0,  #accel: 3 #engines: 6 state: up
+    
+Operation Mode
+==============
+
+.. opcmd:: show system acceleration qat device <device> config
+
+    Show the full config uploaded to the QAT device.
+
+.. opcmd:: show system acceleration qat device <device> flows
+
+    Get an overview over the encryption counters.
+
+.. opcmd:: show system acceleration qat interrupts
+
+    Show binded qat device interrupts to certain core.
+
+
+Example
+=======
+
+Let's build a simple VPN between 2 Intel® QAT ready devices.
+
+Side A:
+
+.. code-block::
+
+    set interfaces vti vti1 address '192.168.1.2/24'
+    set vpn ipsec esp-group MyESPGroup proposal 1 encryption 'aes256'
+    set vpn ipsec esp-group MyESPGroup proposal 1 hash 'sha256'
+    set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group '14'
+    set vpn ipsec ike-group MyIKEGroup proposal 1 encryption 'aes256'
+    set vpn ipsec ike-group MyIKEGroup proposal 1 hash 'sha256'
+    set vpn ipsec ipsec-interfaces interface 'eth0'
+    set vpn ipsec site-to-site peer 10.10.10.1 authentication mode 'pre-shared-secret'
+    set vpn ipsec site-to-site peer 10.10.10.1 authentication pre-shared-secret 'Qwerty123'
+    set vpn ipsec site-to-site peer 10.10.10.1 connection-type 'initiate'
+    set vpn ipsec site-to-site peer 10.10.10.1 default-esp-group 'MyESPGroup'
+    set vpn ipsec site-to-site peer 10.10.10.1 ike-group 'MyIKEGroup'
+    set vpn ipsec site-to-site peer 10.10.10.1 local-address '10.10.10.2'
+    set vpn ipsec site-to-site peer 10.10.10.1 vti bind 'vti1'
+
+Side B:
+
+.. code-block::
+
+    set interfaces vti vti1 address '192.168.1.1/24'
+    set vpn ipsec esp-group MyESPGroup proposal 1 encryption 'aes256'
+    set vpn ipsec esp-group MyESPGroup proposal 1 hash 'sha256'
+    set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group '14'
+    set vpn ipsec ike-group MyIKEGroup proposal 1 encryption 'aes256'
+    set vpn ipsec ike-group MyIKEGroup proposal 1 hash 'sha256'
+    set vpn ipsec ipsec-interfaces interface 'eth0'
+    set vpn ipsec site-to-site peer 10.10.10.2 authentication mode 'pre-shared-secret'
+    set vpn ipsec site-to-site peer 10.10.10.2 authentication pre-shared-secret 'Qwerty123'
+    set vpn ipsec site-to-site peer 10.10.10.2 connection-type 'initiate'
+    set vpn ipsec site-to-site peer 10.10.10.2 default-esp-group 'MyESPGroup'
+    set vpn ipsec site-to-site peer 10.10.10.2 ike-group 'MyIKEGroup'
+    set vpn ipsec site-to-site peer 10.10.10.2 local-address '10.10.10.1'
+    set vpn ipsec site-to-site peer 10.10.10.2 vti bind 'vti1'
+
+a bandwidth test over the VPN got these results:
+
+.. code-block::
+
+    Connecting to host 192.168.1.2, port 5201
+    [  9] local 192.168.1.1 port 51344 connected to 192.168.1.2 port 5201
+    [ ID] Interval           Transfer     Bitrate         Retr  Cwnd
+    [  9]   0.00-1.01   sec  32.3 MBytes   268 Mbits/sec    0    196 KBytes
+    [  9]   1.01-2.03   sec  32.5 MBytes   268 Mbits/sec    0    208 KBytes
+    [  9]   2.03-3.03   sec  32.5 MBytes   271 Mbits/sec    0    208 KBytes
+    [  9]   3.03-4.04   sec  32.5 MBytes   272 Mbits/sec    0    208 KBytes
+    [  9]   4.04-5.00   sec  31.2 MBytes   272 Mbits/sec    0    208 KBytes
+    [  9]   5.00-6.01   sec  32.5 MBytes   272 Mbits/sec    0    234 KBytes
+    [  9]   6.01-7.04   sec  32.5 MBytes   265 Mbits/sec    0    234 KBytes
+    [  9]   7.04-8.04   sec  32.5 MBytes   272 Mbits/sec    0    234 KBytes
+    [  9]   8.04-9.04   sec  32.5 MBytes   273 Mbits/sec    0    336 KBytes
+    [  9]   9.04-10.00  sec  31.2 MBytes   272 Mbits/sec    0    336 KBytes
+    - - - - - - - - - - - - - - - - - - - - - - - - -
+    [ ID] Interval           Transfer     Bitrate         Retr
+    [  9]   0.00-10.00  sec   322 MBytes   270 Mbits/sec    0           sender
+    [  9]   0.00-10.00  sec   322 MBytes   270 Mbits/sec                receiver
+
+with :cfgcmd:`set system acceleration qat` on both systems the bandwidth
+increases.
+
+.. code-block::
+
+    Connecting to host 192.168.1.2, port 5201
+    [  9] local 192.168.1.1 port 51340 connected to 192.168.1.2 port 5201
+    [ ID] Interval           Transfer     Bitrate         Retr  Cwnd
+    [  9]   0.00-1.00   sec  97.3 MBytes   817 Mbits/sec    0   1000 KBytes
+    [  9]   1.00-2.00   sec  92.5 MBytes   776 Mbits/sec    0   1.07 MBytes
+    [  9]   2.00-3.00   sec  92.5 MBytes   776 Mbits/sec    0    820 KBytes
+    [  9]   3.00-4.00   sec  92.5 MBytes   776 Mbits/sec    0    899 KBytes
+    [  9]   4.00-5.00   sec  91.2 MBytes   765 Mbits/sec    0    972 KBytes
+    [  9]   5.00-6.00   sec  92.5 MBytes   776 Mbits/sec    0   1.02 MBytes
+    [  9]   6.00-7.00   sec  92.5 MBytes   776 Mbits/sec    0   1.08 MBytes
+    [  9]   7.00-8.00   sec  92.5 MBytes   776 Mbits/sec    0   1.14 MBytes
+    [  9]   8.00-9.00   sec  91.2 MBytes   765 Mbits/sec    0    915 KBytes
+    [  9]   9.00-10.00  sec  92.5 MBytes   776 Mbits/sec    0   1000 KBytes
+    - - - - - - - - - - - - - - - - - - - - - - - - -
+    [ ID] Interval           Transfer     Bitrate         Retr
+    [  9]   0.00-10.00  sec   927 MBytes   778 Mbits/sec    0             sender
+    [  9]   0.00-10.01  sec   925 MBytes   775 Mbits/sec                  receiver
+
+
+.. _`Intel® QAT`: https://www.intel.com/content/www/us/en/architecture-and-technology/intel-quick-assist-technology-overview.html
\ No newline at end of file
diff --git a/docs/configuration/system/eventhandler.rst b/docs/configuration/system/eventhandler.rst
deleted file mode 100644
index 3eab4e2c..00000000
--- a/docs/configuration/system/eventhandler.rst
+++ /dev/null
@@ -1,51 +0,0 @@
-.. _event-handler:
-
-Event Handler
--------------
-
-Event handler allows you to execute scripts when a string that matches a regex
-appears in a text stream (e.g. log file).
-
-It uses "feeds" (output of commands, or a named pipes) and "policies" that
-define what to execute if a regex is matched.
-
-.. code-block:: none
-
-  system
-  event-handler
-      feed <name>
-      description <feed description>
-      policy <policy name>
-      source
-          preset
-          syslog # Use the syslog logs for feed
-          custom
-          command <command to execute> # E.g. "tail -f /var/log/somelogfile"
-          named-pipe <path to a names pipe>
-      policy <policy name>
-      description <policy description>
-      event <event name>
-          description <event description>
-          pattern <regex>
-          run <command to run>
-
-In this small example a script runs every time a login failed and an interface
-goes down
-
-.. code-block:: none
-
-  vyos@vyos# show system event-handler
-  feed Syslog {
-      policy MyPolicy
-      source {
-          preset syslog
-      }
-  }
-  policy MyPolicy {
-      description "Test policy"
-      event BadThingsHappened {
-          pattern "authentication failure"
-          pattern "interface \.* index \d+ .* DOWN.*"
-          run /config/scripts/email-to-admin
-      }
-  }
\ No newline at end of file
diff --git a/docs/configuration/system/index.rst b/docs/configuration/system/index.rst
index 9b4bf2e3..5bf781af 100644
--- a/docs/configuration/system/index.rst
+++ b/docs/configuration/system/index.rst
@@ -7,6 +7,7 @@ System
    :maxdepth: 1
    :includehidden:
 
+   acceleration
    conntrack
    console
    flow-accounting
@@ -29,4 +30,3 @@ System
    :includehidden:
 
    default-route
-   eventhandler
diff --git a/docs/configuration/system/ip.rst b/docs/configuration/system/ip.rst
index 78aeef4e..29f46ae9 100644
--- a/docs/configuration/system/ip.rst
+++ b/docs/configuration/system/ip.rst
@@ -9,6 +9,15 @@ System configuration commands
 
    Use this command to disable IPv4 forwarding on all interfaces.
 
+.. cfgcmd:: set system ip disable-directed-broadcast
+
+   Use this command to disable IPv4 directed broadcast forwarding on all
+   interfaces.
+
+   If set, IPv4 directed broadcast forwarding will be completely disabled
+   regardless of whether per-interface directed broadcast forwarding is
+   enabled or not.
+
 .. cfgcmd:: set system ip arp table-size <number>
 
    Use this command to define the maximum number of entries to keep in
@@ -67,4 +76,4 @@ And the different IPv4 **reset** commands available:
      bgp           Clear Border Gateway Protocol (BGP) statistics or status
      igmp          IGMP clear commands
      multicast     IP multicast routing table
-     route         Reset IP route
\ No newline at end of file
+     route         Reset IP route
diff --git a/docs/configuration/system/ipv6.rst b/docs/configuration/system/ipv6.rst
index 19016e7b..0b9f9cc8 100644
--- a/docs/configuration/system/ipv6.rst
+++ b/docs/configuration/system/ipv6.rst
@@ -160,7 +160,7 @@ Show commands
 Reset commands
 ^^^^^^^^^^^^^^
 
-.. opcmd:: reset ipv6 bgp <address>
+.. opcmd:: reset bgp ipv6 <address>
 
    Use this command to clear Border Gateway Protocol statistics or
    status.