diff options
Diffstat (limited to 'docs/system')
| -rw-r--r-- | docs/system/config-management.rst | 2 | ||||
| -rw-r--r-- | docs/system/default-route.rst | 4 | ||||
| -rw-r--r-- | docs/system/flow-accounting.rst | 133 | ||||
| -rw-r--r-- | docs/system/host-information.rst | 12 | ||||
| -rw-r--r-- | docs/system/ntp.rst | 8 | ||||
| -rw-r--r-- | docs/system/proxy.rst | 8 | ||||
| -rw-r--r-- | docs/system/serial-console.rst | 6 | ||||
| -rw-r--r-- | docs/system/task-scheduler.rst | 8 | ||||
| -rw-r--r-- | docs/system/time-zone.rst | 2 | ||||
| -rw-r--r-- | docs/system/user-management.rst | 26 |
10 files changed, 132 insertions, 77 deletions
diff --git a/docs/system/config-management.rst b/docs/system/config-management.rst index df2a80aa..9d65adb3 100644 --- a/docs/system/config-management.rst +++ b/docs/system/config-management.rst @@ -13,7 +13,7 @@ stored on a remote host for archiving/backup reasons. Change the number of commit revisions to `<number>`, the default setting for this value is to store 20 revisions locally. -.. cfgcmd:: set system config-management commit-archive location '<url>' +.. cfgcmd:: set system config-management commit-archive location <url> If you want to save all config changes to a remote destination. Set the commit-archive location. Every time a commit is successfully the diff --git a/docs/system/default-route.rst b/docs/system/default-route.rst index a46790e4..27c74188 100644 --- a/docs/system/default-route.rst +++ b/docs/system/default-route.rst @@ -5,13 +5,13 @@ Default Gateway/Route ##################### In the past (VyOS 1.1) used a gateway-address configured under the system tree -(:cfgcmd:`set system gateway-address '<address>'`), this is no longer supported +(:cfgcmd:`set system gateway-address <address>`), this is no longer supported and existing configurations are migrated to the new CLI command. Configuration ============= -.. cfgcmd:: set protocols static route 0.0.0.0/0 next-hop '<address>' +.. cfgcmd:: set protocols static route 0.0.0.0/0 next-hop <address> Specify static route into the routing table sending all non local traffic to the nexthop address `<address>`. diff --git a/docs/system/flow-accounting.rst b/docs/system/flow-accounting.rst index 4f566490..df58e1f3 100644 --- a/docs/system/flow-accounting.rst +++ b/docs/system/flow-accounting.rst @@ -4,6 +4,20 @@ Flow Accounting ############### +VyOS supports flow-accounting for both IPv4 and IPv6 traffic. The system acts +as a flow exporter, and you are free to use it with any compatible collector. + +Flows can be exported via two different protocols: NetFlow (versions 5, 9 and +10/IPFIX) and sFlow. Additionally, you may save flows to an in-memory table +internally in a router. + +.. warning:: You need to disable the in-memory table in production environments! + Using :abbr:`IMT (In-Memory Table)` may lead to heavy CPU overloading and + unstable flow-accounting behavior. + + +NetFlow / IPFIX +=============== NetFlow is a feature that was introduced on Cisco routers around 1996 that provides the ability to collect IP network traffic as it enters or exits an interface. By analyzing the data provided by NetFlow, a network administrator @@ -18,8 +32,8 @@ NetFlow) consists of three main components: * **application**: analyzes received flow data in the context of intrusion detection or traffic profiling, for example -For connectionless protocols as like ICMP and UDP, a flow is considered complete -once no more packets for this flow appear after configurable timeout. +For connectionless protocols as like ICMP and UDP, a flow is considered +complete once no more packets for this flow appear after configurable timeout. NetFlow is usually enabled on a per-interface basis to limit load on the router components involved in NetFlow, or to limit the amount of NetFlow records @@ -31,7 +45,7 @@ Configururation In order for flow accounting information to be collected and displayed for an interface, the interface must be configured for flow accounting. -.. cfgcmd:: set system flow-accounting interface '<interface>' +.. cfgcmd:: set system flow-accounting interface <interface> Configure and enable collection of flow information for the interface identified by `<interface>`. @@ -39,15 +53,41 @@ interface, the interface must be configured for flow accounting. You can configure multiple interfaces which whould participate in flow accounting. +.. note:: Will be recorded only packets/flows on **incoming** direction in + configured interfaces. + + +By default, recorded flows will be saved internally and can be listed with the +CLI command. You may disable using the local in-memory table with the command: + +.. cfgcmd:: set system flow-accounting disable-imt + +Internally, in flow-accounting processes exist a buffer for data exchanging +between core process and plugins (each export target is a separated plugin). If +you have high traffic levels or noted some problems with missed records or +stopping exporting, you may try to increase a default buffer size (10 MiB) with +the next command: + +.. cfgcmd:: set system flow-accounting buffer-size <buffer size> + +In case, if you need to catch some logs from flow-accounting daemon, you may +configure logging facility: + +.. cfgcmd:: set system flow-accounting syslog-facility <facility> + + Flow Export ----------- In addition to displaying flow accounting information locally, one can also exported them to a collection server. -.. cfgcmd:: set system flow-accounting netflow version '<version>' +NetFlow +^^^^^^^ + +.. cfgcmd:: set system flow-accounting netflow version <version> - There are multiple versions available for the NetFlo data. The `<version>` + There are multiple versions available for the NetFlow data. The `<version>` used in the exported flow data can be configured here. The following versions are supported: @@ -55,20 +95,20 @@ exported them to a collection server. * **9** - NetFlow version 9 (default) * **10** - :abbr:`IPFIX (IP Flow Information Export)` as per :rfc:`3917` -.. cfgcmd:: set system flow-accounting netflow server '<address>' +.. cfgcmd:: set system flow-accounting netflow server <address> Configure address of NetFlow collector. NetFlow server at `<address>` can be both listening on an IPv4 or IPv6 address. -.. cfgcmd:: set system flow-accounting netflow source-ip '<address>' +.. cfgcmd:: set system flow-accounting netflow source-ip <address> IPv4 or IPv6 source address of NetFlow packets -.. cfgcmd:: set system flow-accounting netflow engine-id '<id>' +.. cfgcmd:: set system flow-accounting netflow engine-id <id> NetFlow engine-id which will appear in NetFlow data. The range is 0 to 255. -.. cfgcmd:: set system flow-accounting netflow sampling-rate '<rate>' +.. cfgcmd:: set system flow-accounting netflow sampling-rate <rate> Use this command to configure the sampling rate for flow accounting. The system samples one in every `<rate>` packets, where `<rate>` is the value @@ -80,11 +120,37 @@ exported them to a collection server. Per default every packet is sampled (that is, the sampling rate is 1). -.. cfgcmd:: set system flow-accounting netflow timeout expiry interval '<interval>' +.. cfgcmd:: set system flow-accounting netflow timeout expiry interval <interval> Specifies the interval at which Netflow data will be sent to a collector. As per default, Netflow data will be sent every 60 seconds. + You may also additionally configure timeouts for different types of + connections. + +.. cfgcmd:: set system flow-accounting netflow max-flows <n> + + If you want to change the maximum number of flows, which are tracking + simultaneously, you may do this with this command (default 8192). + +sFlow +^^^^^ +.. cfgcmd:: set system flow-accounting sflow server <address> + + Configure address of sFlow collector. sFlow server at `<address>` can + be an IPv4 or IPv6 address. But you cannot export to both IPv4 and + IPv6 collectors at the same time! + +.. cfgcmd:: set system flow-accounting sflow sampling-rate <rate> + + Enable sampling of packets, which will be transmitted to sFlow collectors. + +.. cfgcmd:: set system flow-accounting sflow agent-address <address> + + Configure a sFlow agent address. It can be IPv4 or IPv6 address, but you + must set the same protocol, which is used for sFlow collector addresses. By + default, using router-id from BGP or OSPF protocol, or the primary IP + address from the first interface. Example: -------- @@ -103,44 +169,33 @@ Operation Once flow accounting is configured on an interfaces it provides the ability to display captured network traffic information for all configured interfaces. -.. opcmd:: show flow-accounting interface '<interface>' +.. opcmd:: show flow-accounting interface <interface> Show flow accounting information for given `<interface>`. .. code-block:: none vyos@vyos:~$ show flow-accounting interface eth0 - flow-accounting for [eth0] - Src Addr Dst Addr Sport Dport Proto Packets Bytes Flows - 0.0.0.0 192.0.2.50 811 811 udp 7733 591576 0 - 0.0.0.0 192.0.2.50 811 811 udp 7669 586558 1 - 192.0.2.200 192.0.2.51 56188 22 tcp 586 36504 1 - 192.0.2.99 192.0.2.51 61636 161 udp 46 6313 4 - 192.0.2.99 192.0.2.51 61638 161 udp 42 5364 9 - 192.0.2.99 192.0.2.51 61640 161 udp 42 5111 3 - 192.0.2.200 192.0.2.51 54702 22 tcp 86 4432 1 - 192.0.2.99 192.0.2.51 62509 161 udp 24 3540 1 - 192.0.2.99 192.0.2.51 0 0 icmp 49 2989 8 - 192.0.2.99 192.0.2.51 54667 161 udp 18 2658 1 - 192.0.2.99 192.0.2.51 54996 161 udp 18 2622 1 - 192.0.2.99 192.0.2.51 63708 161 udp 18 2622 1 - 192.0.2.99 192.0.2.51 62111 161 udp 18 2622 1 - 192.0.2.99 192.0.2.51 61646 161 udp 16 1977 4 - 192.0.2.99 192.0.2.51 56038 161 udp 10 1256 1 - 192.0.2.99 192.0.2.51 55570 161 udp 6 1146 1 - 192.0.2.99 192.0.2.51 54599 161 udp 6 1134 1 - 192.0.2.99 192.0.2.51 56304 161 udp 8 1029 1 - - -.. opcmd:: show flow-accounting interface '<interface>' host '<address>' + IN_IFACE SRC_MAC DST_MAC SRC_IP DST_IP SRC_PORT DST_PORT PROTOCOL TOS PACKETS FLOWS BYTES + ---------- ----------------- ----------------- ------------------------ --------------- ---------- ---------- ---------- ----- --------- ------- ------- + eth0 00:53:01:a8:28:ac ff:ff:ff:ff:ff:ff 192.0.2.2 255.255.255.255 5678 5678 udp 0 1 1 178 + eth0 00:53:01:b2:2f:34 33:33:ff:00:00:00 fe80::253:01ff:feb2:2f34 ff02::1:ff00:0 0 0 ipv6-icmp 0 2 1 144 + eth0 00:53:01:1a:b4:53 33:33:ff:00:00:00 fe80::253:01ff:fe1a:b453 ff02::1:ff00:0 0 0 ipv6-icmp 0 1 1 72 + eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14 40152 22 tcp 16 39 1 2064 + eth0 00:53:01:c8:33:af ff:ff:ff:ff:ff:ff 192.0.2.3 255.255.255.255 5678 5678 udp 0 1 1 154 + eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14 40006 22 tcp 16 146 1 9444 + eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14 0 0 icmp 192 27 1 4455 + +.. opcmd:: show flow-accounting interface <interface> host <address> Show flow accounting information for given `<interface>` for a specific host only. .. code-block:: none - vyos@vyos:~$ show flow-accounting interface eth0 host 192.0.2.200 - flow-accounting for [eth0] - Src Addr Dst Addr Sport Dport Proto Packets Bytes Flows - 192.0.2.200 192.0.2.51 56188 22 tcp 586 36504 1 - 192.0.2.200 192.0.2.51 54702 22 tcp 86 4432 1 + vyos@vyos:~$ show flow-accounting interface eth0 host 192.0.2.14 + IN_IFACE SRC_MAC DST_MAC SRC_IP DST_IP SRC_PORT DST_PORT PROTOCOL TOS PACKETS FLOWS BYTES + ---------- ----------------- ----------------- ----------- ---------- ---------- ---------- ---------- ----- --------- ------- ------- + eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14 40006 22 tcp 16 197 2 12940 + eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14 40152 22 tcp 16 94 1 4924 + eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14 0 0 icmp 192 36 1 5877 diff --git a/docs/system/host-information.rst b/docs/system/host-information.rst index 89f1c6ad..30efe01e 100644 --- a/docs/system/host-information.rst +++ b/docs/system/host-information.rst @@ -20,7 +20,7 @@ network and is used to distinguish one device from another on specific networks or over the internet. On the other hand this will be the name which appears on the command line prompt. -.. cfgcmd:: set system host-name '<hostname>' +.. cfgcmd:: set system host-name <hostname> Set system hostname. The hostname can be up to 63 characters. A hostname must start and end with a letter or digit, and have as interior characters @@ -36,7 +36,7 @@ unique. VyOS appends the domain name as a suffix to any unqualified name. For example, if you set the domain name `example.com`, and you would ping the unqualified name of `crux`, then VyOS qualifies the name to `crux.example.com`. -.. cfgcmd:: set system domain-name '<domain>' +.. cfgcmd:: set system domain-name <domain> Configure system domain name. A domain name must start and end with a letter or digit, and have as interior characters only letters, digits, or a hyphen. @@ -44,20 +44,20 @@ unqualified name of `crux`, then VyOS qualifies the name to `crux.example.com`. Static Hostname Mapping ======================= -How an IP address is assigned to an interface in :ref:`interfaces-addresses`. +How an IP address is assigned to an interface in :ref:`ethernet-interface`. This section shows how to statically map an IP address to a hostname for local (meaning on this VyOS instance) name resolution. -.. cfgcmd:: set system static-host-mapping host-name '<hostname>' inet '<address>' +.. cfgcmd:: set system static-host-mapping host-name <hostname> inet <address> Create a static hostname mapping which will always resolve the name `<hostname>` to IP address `<address>`. -.. cfgcmd:: set system static-host-mapping host-name '<hostname>' alias '<alias>' +.. cfgcmd:: set system static-host-mapping host-name <hostname> alias <alias> Create named `<alias>` for the configured static mapping for `<hostname>`. Thus the address configured as :cfgcmd:`set system static-host-mapping - host-name '<hostname>' inet '<address>'` can be reached via multiple names. + host-name <hostname> inet <address>` can be reached via multiple names. Multiple aliases can pe specified per host-name. diff --git a/docs/system/ntp.rst b/docs/system/ntp.rst index 0836f2fa..5fd1837f 100644 --- a/docs/system/ntp.rst +++ b/docs/system/ntp.rst @@ -33,9 +33,9 @@ in :rfc:`1305`. Configuration ============= -.. cfgcmd:: set system ntp server '<address | fqdn>' +.. cfgcmd:: set system ntp server <address> - Configure one or more servers for synchronisation. Server name cen be either + Configure one or more servers for synchronisation. Server name can be either an IP address or :abbr:`FQDN (Fully Qualified Domain Name)`. There are 3 default NTP server set. You are able to change them. @@ -44,13 +44,13 @@ Configuration * 1.pool.ntp.org * 2.pool.ntp.org -.. cfgcmd:: set system ntp listen-address '<address>' +.. cfgcmd:: set system ntp listen-address <address> Setup VyOS as an NTP responder, you must specify the `<address>` and optionally the permitted clients. Multiple listen addresses can be configured. -.. cfgcmd:: set system ntp allow-clients address '<address>' +.. cfgcmd:: set system ntp allow-clients address <address> List of networks or client addresses permitted to contact this NTP server. Multiple networks can be configured. diff --git a/docs/system/proxy.rst b/docs/system/proxy.rst index 40bdf998..8e0339a7 100644 --- a/docs/system/proxy.rst +++ b/docs/system/proxy.rst @@ -8,21 +8,21 @@ Some IT environments require the use of a proxy to connect to the Internet. Without this configuration VyOS updates could not be installed directly by using the :opcmd:`add system image` command (:ref:`update_vyos`). -.. cfgcmd:: set system proxy url '<url>' +.. cfgcmd:: set system proxy url <url> Set proxy for all connections initiated by VyOS, including HTTP, HTTPS, and FTP (anonymous ftp). -.. cfgcmd:: set system proxy port '<port>' +.. cfgcmd:: set system proxy port <port> Configure proxy port if it does not listen to the default port 80. -.. cfgcmd:: set system proxy username '<username>' +.. cfgcmd:: set system proxy username <username> Some proxys require/support the "basic" HTTP authentication scheme as per :rfc:`7617`, thus a username can be configured. -.. cfgcmd:: set system proxy password '<password>' +.. cfgcmd:: set system proxy password <password> Some proxys require/support the "basic" HTTP authentication scheme as per :rfc:`7617`, thus a password can be configured. diff --git a/docs/system/serial-console.rst b/docs/system/serial-console.rst index cd27fa21..309c6ad2 100644 --- a/docs/system/serial-console.rst +++ b/docs/system/serial-console.rst @@ -16,7 +16,7 @@ access to the console is the only way to diagnose and correct software failures. Major upgrades to the installed distribution may also require console access. -.. cfgcmd:: set system console device '<device>' +.. cfgcmd:: set system console device <device> Defines the specified device as a system console. Available console devices can be (see completion helper): @@ -25,7 +25,7 @@ Major upgrades to the installed distribution may also require console access. * ``ttyUSBX`` - USB Serial device name * ``hvc0`` - Xen console -.. cfgcmd:: set system console device '<device>' speed '<speed>' +.. cfgcmd:: set system console device <device> speed <speed> The speed (baudrate) of the console device. Supported values are: @@ -44,6 +44,6 @@ Network Console TBD. -.. cfgcmd:: set system console network '<netconXX>' +.. cfgcmd:: set system console network <netconXX> ... and many more commands ...
\ No newline at end of file diff --git a/docs/system/task-scheduler.rst b/docs/system/task-scheduler.rst index 869a0600..382da39f 100644 --- a/docs/system/task-scheduler.rst +++ b/docs/system/task-scheduler.rst @@ -11,7 +11,7 @@ use of UNIX cron_. be dangerous. Together with :ref:`command-scripting` this can be used for automating (re-)configuration. -.. cfgcmd:: set system task-scheduler task '<task>' interval '<interval>' +.. cfgcmd:: set system task-scheduler task <task> interval <interval> Specify the time interval when `<task>` should be executed. The interval is specified as number with one of the following suffixes: @@ -23,17 +23,17 @@ use of UNIX cron_. .. note:: If suffix is omitted, minutes are implied. -.. cfgcmd:: set system task-scheduler task '<task>' crontab-spec '<spec>' +.. cfgcmd:: set system task-scheduler task <task> crontab-spec <spec> Set execution time in common cron_ time format. A cron `<spec>` of ``30 */6 * * *`` would execute the `<task>` at minute 30 past every 6th hour. -.. cfgcmd:: set system task-scheduler task '<task>' executable path '<path>' +.. cfgcmd:: set system task-scheduler task <task> executable path <path> Specify absolute `<path>` to script which will be run when `<task>` is executed. -.. cfgcmd:: set system task-scheduler task '<task>' executable arguments '<args>' +.. cfgcmd:: set system task-scheduler task <task> executable arguments <args> Arguments which will be passed to the executable. diff --git a/docs/system/time-zone.rst b/docs/system/time-zone.rst index d65e1d78..025c4376 100644 --- a/docs/system/time-zone.rst +++ b/docs/system/time-zone.rst @@ -8,7 +8,7 @@ Time Zone setting is very important as e.g all your logfile entries will be based on the configured zone. Without proper time zone configuration it will be very difficult to compare logfiles from different systems. -.. cfgcmd:: set system time-zone '<timezone>' +.. cfgcmd:: set system time-zone <timezone> Specify the systems `<timezone>` as the Region/Location that best defines your location. For example, specifying US/Pacific sets the time zone to US diff --git a/docs/system/user-management.rst b/docs/system/user-management.rst index b2dd3d08..bb9a6e90 100644 --- a/docs/system/user-management.rst +++ b/docs/system/user-management.rst @@ -15,23 +15,23 @@ Authentication Dial-In User Service)` accounts are supported. Local ===== -.. cfgcmd:: set system login user '<name>' full-name "<string>" +.. cfgcmd:: set system login user <name> full-name "<string>" Create new system user with username `<name>` and real-name specified by `<string>`. -.. cfgcmd:: set system login user '<name>' authentication plaintext-password '<password>' +.. cfgcmd:: set system login user <name> authentication plaintext-password <password> Specify the plaintext password user by user `<name>` on this system. The plaintext password will be automatically transferred into a secure hashed password and not saved anywhere in plaintext. -.. cfgcmd:: set system login user '<name>' authentication encrypted-password '<password>' +.. cfgcmd:: set system login user <name> authentication encrypted-password <password> Setup encrypted password for given username. This is usefull for transferring a hashed password from system to system. -.. cfgcmd:: set system login user '<name>' group '<group>' +.. cfgcmd:: set system login user <name> group <group> Specify additional group membership for given username `<name>`. @@ -55,12 +55,12 @@ and paste it. Some terminal emulators may accidentally split this over several lines. Be attentive when you paste it that it only pastes as a single line. The third part is simply an identifier, and is for your own reference. -.. cfgcmd:: set system login user '<username>' authentication public-keys '<identifier>' key '<key>' +.. cfgcmd:: set system login user <username> authentication public-keys <identifier> key <key> Assign the SSH public key portion `<key>` identified by per-key `<identifier>` to the local user `<username>`. -.. cfgcmd:: set system login user '<username>' authentication public-keys '<identifier>' type '<type>' +.. cfgcmd:: set system login user <username> authentication public-keys <identifier> type <type> Every SSH public key portion referenced by `<identifier>` requires the configuration of the `<type>` of public-key used. This type can be any of: @@ -75,7 +75,7 @@ The third part is simply an identifier, and is for your own reference. .. note:: You can assign multiple keys to the same user by using a unique identifier per SSH key. -.. cfgcmd:: loadkey '<username>' '<location>' +.. cfgcmd:: loadkey <username> <location> SSH keys can not only be specified on the command-line but also loaded for a given user with `<username>` from a file pointed to by `<location>.` Keys @@ -113,17 +113,17 @@ Dial-In User Service)` servers as backend for user authentication. Configuration ------------- -.. cfgcmd:: set system login radius server '<address>' secret '<secret>' +.. cfgcmd:: set system login radius server <address> secret <secret> Specify the `<address>` of the RADIUS server user with the pre-shared-secret given in `<secret>`. Multiple servers can be specified. -.. cfgcmd:: set system login radius server '<address>' port '<port>' +.. cfgcmd:: set system login radius server <address> port <port> Configure the discrete port under which the RADIUS server can be reached. This defaults to 1812. -.. cfgcmd:: set system login radius server '<address>' timeout '<timeout>' +.. cfgcmd:: set system login radius server <address> timeout <timeout> Setup the `<timeout>` in seconds when querying the RADIUS server. @@ -132,7 +132,7 @@ Configuration the attribute you will only get regular, non privilegued, system users. -.. cfgcmd:: set system login radius source-address '<address>' +.. cfgcmd:: set system login radius source-address <address> RADIUS servers could be hardened by only allowing certain IP addresses to connect. As of this the source address of each RADIUS query can be @@ -148,12 +148,12 @@ Login Banner You are able to set post-login or pre-login banner messages to display certain information for this system. -.. cfgcmd:: set system login banner pre-login '<message>' +.. cfgcmd:: set system login banner pre-login <message> Configure `<message>` which is shown during SSH connect and before a user is logged in. -.. cfgcmd:: set system login banner post-login '<message>' +.. cfgcmd:: set system login banner post-login <message> Configure `<message>` which is shown after user has logged in to the system. |