From efd6ea180ad96a82ee8b0cc38582a9d505e794fb Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Wed, 15 Apr 2026 12:08:34 +0300 Subject: perf: convert all images to WebP with PDF fallback MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add WebP versions of all 187 PNG/JPG images (38MB → 17MB, 55% reduction). Update RST/MD references to use Sphinx wildcard syntax (.*) so HTML builds use WebP while PDF/LaTeX builds fall back to original PNG/JPG. Co-Authored-By: Claude Opus 4.6 (1M context) --- docs/configexamples/ansible.rst | 2 +- .../DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst | 2 +- .../DHCPRelay_through_GRE/_include/topology.webp | Bin 0 -> 20146 bytes .../autotest/L3VPN_EVPN/L3VPN_EVPN.rst | 2 +- .../autotest/L3VPN_EVPN/_include/topology.webp | Bin 0 -> 49416 bytes .../OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst | 2 +- .../OpenVPN_with_LDAP/_include/topology.webp | Bin 0 -> 11392 bytes .../configexamples/autotest/Wireguard/Wireguard.rst | 2 +- .../autotest/Wireguard/_include/topology.webp | Bin 0 -> 31422 bytes .../autotest/tunnelbroker/_include/topology.webp | Bin 0 -> 8464 bytes .../autotest/tunnelbroker/tunnelbroker.rst | 2 +- docs/configexamples/dmvpn-dualhub-dualcloud.rst | 2 +- docs/configexamples/fwall-and-vrf.rst | 2 +- docs/configexamples/inter-vrf-routing-vrf-lite.rst | 2 +- docs/configexamples/ipsec-cisco-policy-based.rst | 2 +- docs/configexamples/ipsec-cisco-route-based.rst | 2 +- docs/configexamples/ipsec-pa-route-based.rst | 18 +++++++++--------- docs/configexamples/l3vpn-hub-and-spoke.rst | 2 +- docs/configexamples/lac-lns.rst | 4 ++-- docs/configexamples/nmp.rst | 14 +++++++------- .../policy-based-ipsec-and-firewall.rst | 2 +- docs/configexamples/pppoe-ipv6-basic.rst | 2 +- docs/configexamples/qos.rst | 20 ++++++++++---------- docs/configexamples/segment-routing-isis.rst | 2 +- docs/configexamples/wan-load-balancing.rst | 4 ++-- docs/configexamples/zone-policy.rst | 2 +- 26 files changed, 46 insertions(+), 46 deletions(-) create mode 100644 docs/configexamples/autotest/DHCPRelay_through_GRE/_include/topology.webp create mode 100644 docs/configexamples/autotest/L3VPN_EVPN/_include/topology.webp create mode 100644 docs/configexamples/autotest/OpenVPN_with_LDAP/_include/topology.webp create mode 100644 docs/configexamples/autotest/Wireguard/_include/topology.webp create mode 100644 docs/configexamples/autotest/tunnelbroker/_include/topology.webp (limited to 'docs/configexamples') diff --git a/docs/configexamples/ansible.rst b/docs/configexamples/ansible.rst index 0f4dbbda..ab3413eb 100644 --- a/docs/configexamples/ansible.rst +++ b/docs/configexamples/ansible.rst @@ -14,7 +14,7 @@ We have four pre-configured routers with this configuration: Using the general schema for example: -.. image:: /_static/images/ansible.png +.. image:: /_static/images/ansible.* :width: 80% :align: center :alt: Network Topology Diagram diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst b/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst index 77f9b118..f2a98479 100644 --- a/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst +++ b/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst @@ -18,7 +18,7 @@ The topology has 3 VyOS routers and one client. Between the DHCP Server and the DHCP Relay is a GRE tunnel. The `transport` VyOS represent a large Network. -.. image:: _include/topology.png +.. image:: _include/topology.* :alt: Ansible Example topology image ************* diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/_include/topology.webp b/docs/configexamples/autotest/DHCPRelay_through_GRE/_include/topology.webp new file mode 100644 index 00000000..592484cb Binary files /dev/null and b/docs/configexamples/autotest/DHCPRelay_through_GRE/_include/topology.webp differ diff --git a/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst b/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst index 2a528852..6092199b 100644 --- a/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst +++ b/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst @@ -53,7 +53,7 @@ Topology We use the following network topology in this example: -.. image:: _include/topology.png +.. image:: _include/topology.* :alt: L3VPN EVPN with VyOS topology image diff --git a/docs/configexamples/autotest/L3VPN_EVPN/_include/topology.webp b/docs/configexamples/autotest/L3VPN_EVPN/_include/topology.webp new file mode 100644 index 00000000..f3218799 Binary files /dev/null and b/docs/configexamples/autotest/L3VPN_EVPN/_include/topology.webp differ diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst index 6666399d..0ddd7e3e 100644 --- a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst +++ b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst @@ -14,7 +14,7 @@ Topology consists of: * VyOS as a OpenVPN Server * VyOS as Client -.. image:: _include/topology.png +.. image:: _include/topology.* :alt: OpenVPN with LDAP topology image Active Directory on Windows server diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/_include/topology.webp b/docs/configexamples/autotest/OpenVPN_with_LDAP/_include/topology.webp new file mode 100644 index 00000000..13bf2d73 Binary files /dev/null and b/docs/configexamples/autotest/OpenVPN_with_LDAP/_include/topology.webp differ diff --git a/docs/configexamples/autotest/Wireguard/Wireguard.rst b/docs/configexamples/autotest/Wireguard/Wireguard.rst index 1feb03e8..7d7b216a 100644 --- a/docs/configexamples/autotest/Wireguard/Wireguard.rst +++ b/docs/configexamples/autotest/Wireguard/Wireguard.rst @@ -17,7 +17,7 @@ Topology The topology have a central and a branch VyOS router and one client, to test, in each site. -.. image:: _include/topology.png +.. image:: _include/topology.* :alt: Ansible Example topology image ************* diff --git a/docs/configexamples/autotest/Wireguard/_include/topology.webp b/docs/configexamples/autotest/Wireguard/_include/topology.webp new file mode 100644 index 00000000..3cc5e992 Binary files /dev/null and b/docs/configexamples/autotest/Wireguard/_include/topology.webp differ diff --git a/docs/configexamples/autotest/tunnelbroker/_include/topology.webp b/docs/configexamples/autotest/tunnelbroker/_include/topology.webp new file mode 100644 index 00000000..c3a812ab Binary files /dev/null and b/docs/configexamples/autotest/tunnelbroker/_include/topology.webp differ diff --git a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst index 370cf9d6..194fbbad 100644 --- a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst +++ b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst @@ -28,7 +28,7 @@ Topology The example topology has 2 VyOS routers. One as The WAN Router and on as a Client, to test a single LAN setup -.. image:: _include/topology.png +.. image:: _include/topology.* :alt: Tunnelbroker topology image diff --git a/docs/configexamples/dmvpn-dualhub-dualcloud.rst b/docs/configexamples/dmvpn-dualhub-dualcloud.rst index 5a789647..7bcfcf84 100644 --- a/docs/configexamples/dmvpn-dualhub-dualcloud.rst +++ b/docs/configexamples/dmvpn-dualhub-dualcloud.rst @@ -15,7 +15,7 @@ as a Spoke. Network Topology ================ -.. image:: /_static/images/dual-hub-DMVPN.png +.. image:: /_static/images/dual-hub-DMVPN.* :width: 80% :align: center :alt: DMVPN Network Topology diff --git a/docs/configexamples/fwall-and-vrf.rst b/docs/configexamples/fwall-and-vrf.rst index 38663a18..fb65e3a4 100644 --- a/docs/configexamples/fwall-and-vrf.rst +++ b/docs/configexamples/fwall-and-vrf.rst @@ -8,7 +8,7 @@ This example shows how to configure a VyOS router with VRFs and firewall rules. Diagram used in this example: -.. image:: /_static/images/firewall-and-vrf-blueprints.png +.. image:: /_static/images/firewall-and-vrf-blueprints.* :width: 80% :align: center :alt: Network Topology Diagram diff --git a/docs/configexamples/inter-vrf-routing-vrf-lite.rst b/docs/configexamples/inter-vrf-routing-vrf-lite.rst index 11c23bf0..fd4f6489 100644 --- a/docs/configexamples/inter-vrf-routing-vrf-lite.rst +++ b/docs/configexamples/inter-vrf-routing-vrf-lite.rst @@ -70,7 +70,7 @@ community(ies) into that prefix. ******** Topology ******** -.. image:: /_static/images/inter-vrf-routing-vrf-lite.png +.. image:: /_static/images/inter-vrf-routing-vrf-lite.* :width: 70% :align: center :alt: Network Topology Diagram diff --git a/docs/configexamples/ipsec-cisco-policy-based.rst b/docs/configexamples/ipsec-cisco-policy-based.rst index 787c1140..257d98a1 100644 --- a/docs/configexamples/ipsec-cisco-policy-based.rst +++ b/docs/configexamples/ipsec-cisco-policy-based.rst @@ -15,7 +15,7 @@ initiator role on VyOS side. Network Topology ================ -.. image:: /_static/images/cisco-vpn-ipsec.png +.. image:: /_static/images/cisco-vpn-ipsec.* :align: center :alt: Network Topology Diagram diff --git a/docs/configexamples/ipsec-cisco-route-based.rst b/docs/configexamples/ipsec-cisco-route-based.rst index f7c3cb08..955c21d4 100644 --- a/docs/configexamples/ipsec-cisco-route-based.rst +++ b/docs/configexamples/ipsec-cisco-route-based.rst @@ -16,7 +16,7 @@ inside the tunnel. Network Topology ================ -.. image:: /_static/images/cisco-vpn-ipsec.png +.. image:: /_static/images/cisco-vpn-ipsec.* :align: center :alt: Network Topology Diagram diff --git a/docs/configexamples/ipsec-pa-route-based.rst b/docs/configexamples/ipsec-pa-route-based.rst index b6f6f3a7..0b629041 100644 --- a/docs/configexamples/ipsec-pa-route-based.rst +++ b/docs/configexamples/ipsec-pa-route-based.rst @@ -17,7 +17,7 @@ include firewall configuration. Network Topology ================ -.. image:: /_static/images/ipsec-vyos-pa.png +.. image:: /_static/images/ipsec-vyos-pa.* :align: center :alt: Network Topology Diagram @@ -137,36 +137,36 @@ Palo Alto GUI Configuration: Network -> Network Profiles -> IKE Crypto - .. image:: /_static/images/PA-IKE-group.png + .. image:: /_static/images/PA-IKE-group.* :align: center Network -> Network Profiles -> IKE Gateways - .. image:: /_static/images/PA-IKE-GW-1.png + .. image:: /_static/images/PA-IKE-GW-1.* :align: center - .. image:: /_static/images/PA-IKE-GW-2.png + .. image:: /_static/images/PA-IKE-GW-2.* :align: center Network -> Network Profiles -> IPSec Crypto - .. image:: /_static/images/PA-ESP-group.png + .. image:: /_static/images/PA-ESP-group.* :align: center Network -> Interfaces - .. image:: /_static/images/PA-tunnel-1.png + .. image:: /_static/images/PA-tunnel-1.* :align: center - .. image:: /_static/images/PA-tunnel-2.png + .. image:: /_static/images/PA-tunnel-2.* :align: center - .. image:: /_static/images/PA-tunnel-3.png + .. image:: /_static/images/PA-tunnel-3.* :align: center Network -> IPSec Tunnels - .. image:: /_static/images/PA-IPsec-tunnel.png + .. image:: /_static/images/PA-IPsec-tunnel.* :align: center CLI configuration with OSPF: diff --git a/docs/configexamples/l3vpn-hub-and-spoke.rst b/docs/configexamples/l3vpn-hub-and-spoke.rst index e4b0d933..1533d0d8 100644 --- a/docs/configexamples/l3vpn-hub-and-spoke.rst +++ b/docs/configexamples/l3vpn-hub-and-spoke.rst @@ -53,7 +53,7 @@ General information can be found in the :ref:`configuration/vrf/index:L3VPN VRFs ******** Topology ******** -.. image:: /_static/images/L3VPN_hub_and_spoke.png +.. image:: /_static/images/L3VPN_hub_and_spoke.* :width: 80% :align: center :alt: Network Topology Diagram diff --git a/docs/configexamples/lac-lns.rst b/docs/configexamples/lac-lns.rst index 8443ddff..98bad773 100644 --- a/docs/configexamples/lac-lns.rst +++ b/docs/configexamples/lac-lns.rst @@ -20,7 +20,7 @@ All users with domain **vyos.io** will be tunneled to LNS via L2TP. Network Topology ================ -.. image:: /_static/images/lac-lns-diagram.jpg +.. image:: /_static/images/lac-lns-diagram.* :width: 60% :align: center :alt: Network Topology Diagram @@ -105,7 +105,7 @@ Client In this lab we use Windows PPPoE client. -.. image:: /_static/images/lac-lns-winclient.jpg +.. image:: /_static/images/lac-lns-winclient.* :width: 100% :align: center :alt: Window PPPoE Client Configuration diff --git a/docs/configexamples/nmp.rst b/docs/configexamples/nmp.rst index 913e7107..b25142cd 100644 --- a/docs/configexamples/nmp.rst +++ b/docs/configexamples/nmp.rst @@ -27,37 +27,37 @@ Configuration 'NMP' Next, you just should follow the pictures: -.. image:: /_static/images/nmp1.png +.. image:: /_static/images/nmp1.* :width: 80% :align: center :alt: Network Topology Diagram -.. image:: /_static/images/nmp2.png +.. image:: /_static/images/nmp2.* :width: 80% :align: center :alt: Network Topology Diagram -.. image:: /_static/images/nmp3.png +.. image:: /_static/images/nmp3.* :width: 80% :align: center :alt: Network Topology Diagram -.. image:: /_static/images/nmp4.png +.. image:: /_static/images/nmp4.* :width: 80% :align: center :alt: Network Topology Diagram -.. image:: /_static/images/nmp5.png +.. image:: /_static/images/nmp5.* :width: 80% :align: center :alt: Network Topology Diagram -.. image:: /_static/images/nmp6.png +.. image:: /_static/images/nmp6.* :width: 80% :align: center :alt: Network Topology Diagram -.. image:: /_static/images/nmp7.png +.. image:: /_static/images/nmp7.* :width: 80% :align: center :alt: Network Topology Diagram diff --git a/docs/configexamples/policy-based-ipsec-and-firewall.rst b/docs/configexamples/policy-based-ipsec-and-firewall.rst index 60f8b888..cb93daa9 100644 --- a/docs/configexamples/policy-based-ipsec-and-firewall.rst +++ b/docs/configexamples/policy-based-ipsec-and-firewall.rst @@ -40,7 +40,7 @@ This configuration example and the requirements consists of: - Allow connections from LANs to LANs through the tunnel. -.. image:: /_static/images/policy-based-ipsec-and-firewall.png +.. image:: /_static/images/policy-based-ipsec-and-firewall.* Configuration diff --git a/docs/configexamples/pppoe-ipv6-basic.rst b/docs/configexamples/pppoe-ipv6-basic.rst index ad588def..520ca00b 100644 --- a/docs/configexamples/pppoe-ipv6-basic.rst +++ b/docs/configexamples/pppoe-ipv6-basic.rst @@ -17,7 +17,7 @@ please contact your ISP for more information. Network Topology ================ -.. image:: /_static/images/pppoe-ipv6-pd-diagram.jpg +.. image:: /_static/images/pppoe-ipv6-pd-diagram.* :width: 60% :align: center :alt: Network Topology Diagram diff --git a/docs/configexamples/qos.rst b/docs/configexamples/qos.rst index 842719c5..66751286 100644 --- a/docs/configexamples/qos.rst +++ b/docs/configexamples/qos.rst @@ -15,7 +15,7 @@ We recommend you to go through the main article about `QoS CS6 -.. image:: /_static/images/qos5.png +.. image:: /_static/images/qos5.* :width: 80% :align: center :alt: Network Topology Diagram @@ -128,28 +128,28 @@ Next on the router VyOS2 we will change labels on all incoming traffic only from set qos policy shaper vyos2 default queue-type 'fair-queue' set qos interface eth2 egress 'vyos2' -.. image:: /_static/images/qos6.png +.. image:: /_static/images/qos6.* :width: 80% :align: center :alt: Network Topology Diagram * 172.17.1.2/24 CS0 -.. image:: /_static/images/qos7.png +.. image:: /_static/images/qos7.* :width: 80% :align: center :alt: Network Topology Diagram * 172.17.1.2/24 CS0 - > CS4 -.. image:: /_static/images/qos8.png +.. image:: /_static/images/qos8.* :width: 80% :align: center :alt: Network Topology Diagram * 172.17.1.2/24 CS4 - > CS5 -.. image:: /_static/images/qos9.png +.. image:: /_static/images/qos9.* :width: 80% :align: center :alt: Network Topology Diagram @@ -174,7 +174,7 @@ Set up bandwidth limits on the eth2 interface of the router “VyOS2”. Check the result. -.. image:: /_static/images/qos10.png +.. image:: /_static/images/qos10.* :width: 80% :align: center :alt: Network Topology Diagram diff --git a/docs/configexamples/segment-routing-isis.rst b/docs/configexamples/segment-routing-isis.rst index d9bc439b..86cbec26 100644 --- a/docs/configexamples/segment-routing-isis.rst +++ b/docs/configexamples/segment-routing-isis.rst @@ -11,7 +11,7 @@ blue print as an initial setup to get MPLS ISIS-SR working between those two devices.The lab was build using :abbr:`EVE-NG (Emulated Virtual Environment NG)`. -.. figure:: /_static/images/vyos-sr-isis.png +.. figure:: /_static/images/vyos-sr-isis.* :alt: ISIS-SR network ISIS-SR example network diff --git a/docs/configexamples/wan-load-balancing.rst b/docs/configexamples/wan-load-balancing.rst index 0952cfe5..906078bb 100644 --- a/docs/configexamples/wan-load-balancing.rst +++ b/docs/configexamples/wan-load-balancing.rst @@ -13,7 +13,7 @@ Example 1: Distributing load evenly The setup used in this example is shown in the following diagram: -.. image:: /_static/images/Wan_load_balancing1.png +.. image:: /_static/images/Wan_load_balancing1.* :width: 80% :align: center :alt: Network Topology Diagram @@ -158,7 +158,7 @@ Example 5: Exclude traffic from load balancing In this example two LAN interfaces exist in different subnets instead of one like in the previous examples: -.. image:: /_static/images/Wan_load_balancing_exclude1.png +.. image:: /_static/images/Wan_load_balancing_exclude1.* :width: 80% :align: center :alt: Network Topology Diagram diff --git a/docs/configexamples/zone-policy.rst b/docs/configexamples/zone-policy.rst index d0101ebf..3c387519 100644 --- a/docs/configexamples/zone-policy.rst +++ b/docs/configexamples/zone-policy.rst @@ -39,7 +39,7 @@ adapted for however many NICs you have**: * DMZ cannot access LAN resources. * Inbound WAN connect to DMZ host. -.. image:: /_static/images/zone-policy-diagram.png +.. image:: /_static/images/zone-policy-diagram.* :width: 80% :align: center :alt: Network Topology Diagram -- cgit v1.2.3 From 7dc1c055340cff3acf941ee63ede798fcc566dfb Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Tue, 21 Apr 2026 15:05:30 +0300 Subject: fix: suppress linter for real HE tunnel broker IPv6 addresses MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The tunnelbroker.net example intentionally uses real Hurricane Electric IPv6 addresses (2001:470:*) — needed for authenticity. Wrap all affected code blocks with stop/start_vyoslinter. 🤖 Generated by [robots](https://vyos.io) --- .../autotest/tunnelbroker/tunnelbroker.rst | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) (limited to 'docs/configexamples') diff --git a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst index 194fbbad..a14a3199 100644 --- a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst +++ b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst @@ -64,6 +64,7 @@ Setup the IPv6 default route to the tunnel interface Now you should be able to ping a public IPv6 Address +.. stop_vyoslinter .. code-block:: none @@ -73,11 +74,13 @@ Now you should be able to ping a public IPv6 Address 64 bytes from 2001:470:20::2: icmp_seq=2 ttl=64 time=43.9 ms 64 bytes from 2001:470:20::2: icmp_seq=3 ttl=64 time=43.4 ms 64 bytes from 2001:470:20::2: icmp_seq=4 ttl=64 time=42.5 ms - + --- 2001:470:20::2 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 2999ms rtt min/avg/max/mdev = 33.802/40.920/43.924/4.139 ms +.. start_vyoslinter + Assuming the pings are successful, you need to add some DNS servers. Some options: @@ -88,6 +91,7 @@ Some options: You should now be able to ping something by IPv6 DNS name: +.. stop_vyoslinter .. code-block:: none @@ -97,11 +101,13 @@ You should now be able to ping something by IPv6 DNS name: 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=2 ttl=48 time=186 ms 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=3 ttl=48 time=178 ms 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=4 ttl=48 time=177 ms - + --- tunnelbroker.net ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3002ms rtt min/avg/max/mdev = 176.707/206.638/285.128/45.457 ms +.. start_vyoslinter + ***************** LAN Configuration @@ -151,6 +157,7 @@ This accomplishes a few things: Now the Client is able to ping a public IPv6 address +.. stop_vyoslinter .. code-block:: none @@ -160,11 +167,13 @@ Now the Client is able to ping a public IPv6 address 64 bytes from 2001:470:20::2: icmp_seq=2 ttl=63 time=41.8 ms 64 bytes from 2001:470:20::2: icmp_seq=3 ttl=63 time=41.7 ms 64 bytes from 2001:470:20::2: icmp_seq=4 ttl=63 time=47.1 ms - + --- 2001:470:20::2 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3005ms rtt min/avg/max/mdev = 32.128/40.688/47.107/5.403 ms +.. start_vyoslinter + Multiple LAN/DMZ Setup ====================== @@ -186,6 +195,8 @@ In the above examples, 1,2,ffff are all chosen by you. You can use 1-ffff So, when your LAN is eth1, your DMZ is eth2, your cameras are on eth3, etc: +.. stop_vyoslinter + .. code-block:: none set interfaces ethernet eth1 address '2001:470:xxxx:1::1/64' @@ -200,6 +211,8 @@ So, when your LAN is eth1, your DMZ is eth2, your cameras are on eth3, etc: set service router-advert interface eth3 name-server '2001:470:20::2' set service router-advert interface eth3 prefix 2001:470:xxxx:3::/64 +.. start_vyoslinter + Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, 'valid-lifetime' and 'preferred-lifetime' are set to default values of 30 days and 4 hours respectively. -- cgit v1.2.3 From 5d4cdc95200e8ef8fa9ef0f52c5607b76e980692 Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Tue, 21 Apr 2026 15:18:07 +0300 Subject: fix: suppress linter for real/protocol IPs in config examples MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The following files were touched by the WebP image PR and exposed pre-existing lint violations — real IPs needed for authenticity or actual protocol addresses (OSPF router-IDs, MAC-embedded IPv6): - inter-vrf-routing-vrf-lite.rst: 195.51.100.1, 198.51.0.0/16 - ipsec-cisco-route-based.rst: 1.1.1.1, 2.2.2.2, 1.0.0.0 (Cisco loopback/OSPF RID) - ipsec-pa-route-based.rst: 1.1.1.1, 2.2.2.2 (PA/VyOS OSPF RIDs) - lac-lns.rst: 8.8.8.8 (DNS example) - pppoe-ipv6-basic.rst: ::64 (prefix format illustration) - bridge.rst: 33:33::16:50:0 (MAC address in firewall log) 🤖 Generated by [robots](https://vyos.io) --- docs/configexamples/inter-vrf-routing-vrf-lite.rst | 7 ++++++- docs/configexamples/ipsec-cisco-route-based.rst | 15 +++++++++++++++ docs/configexamples/ipsec-pa-route-based.rst | 16 ++++++++++++++++ docs/configexamples/lac-lns.rst | 4 ++++ docs/configexamples/pppoe-ipv6-basic.rst | 5 +++++ docs/configuration/firewall/bridge.rst | 4 ++++ 6 files changed, 50 insertions(+), 1 deletion(-) (limited to 'docs/configexamples') diff --git a/docs/configexamples/inter-vrf-routing-vrf-lite.rst b/docs/configexamples/inter-vrf-routing-vrf-lite.rst index fd4f6489..36dabd73 100644 --- a/docs/configexamples/inter-vrf-routing-vrf-lite.rst +++ b/docs/configexamples/inter-vrf-routing-vrf-lite.rst @@ -467,7 +467,7 @@ Now we perform some end-to-end testing - From Management to Outside (fails as intended) - +.. stop_vyoslinter .. code-block:: none @@ -515,6 +515,7 @@ Now we perform some end-to-end testing --- 2001:db8:2::1 ping statistics --- 2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms +.. start_vyoslinter - LAN1 to Outside @@ -772,6 +773,8 @@ route-map with an prefix-list. We create a prefix-list first and add all the routes we need to. +.. stop_vyoslinter + .. code-block:: none # set both ipv4 and ipv6 policies @@ -795,6 +798,8 @@ We create a prefix-list first and add all the routes we need to. set policy prefix-list6 LAN2-Internet-v6 rule 4 action 'permit' set policy prefix-list6 LAN2-Internet-v6 rule 4 prefix '2001:db8:0:1::/64' +.. start_vyoslinter + Then add a route-map and reference to above prefix. Consider that the actions taken inside the prefix will MATCH the routes that will be affected by the actions inside the rules of the route-map. diff --git a/docs/configexamples/ipsec-cisco-route-based.rst b/docs/configexamples/ipsec-cisco-route-based.rst index 955c21d4..553c5e2a 100644 --- a/docs/configexamples/ipsec-cisco-route-based.rst +++ b/docs/configexamples/ipsec-cisco-route-based.rst @@ -89,6 +89,8 @@ Configuration VyOS ---- +.. stop_vyoslinter + .. code-block:: none set interfaces ethernet eth0 address '10.0.1.2/30' @@ -132,9 +134,13 @@ VyOS set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' set vpn ipsec site-to-site peer CISCO vti bind 'vti1' +.. start_vyoslinter + Cisco ----- +.. stop_vyoslinter + .. code-block:: none crypto isakmp policy 10 @@ -196,6 +202,7 @@ Cisco ! ip route 0.0.0.0 0.0.0.0 10.0.2.1 +.. start_vyoslinter Monitoring @@ -230,6 +237,8 @@ IPsec SAs: OSPF Neighbor Status: +.. stop_vyoslinter + .. code-block:: none vyos@vyos:~$ show ip ospf neighbor @@ -237,6 +246,8 @@ OSPF Neighbor Status: Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL 1.1.1.1 1 Full/- 1h29m37s 39.317s 10.100.100.2 vti1:10.100.100.1 0 0 0 +.. start_vyoslinter + Routing Table: .. code-block:: none @@ -268,6 +279,8 @@ Routing Table: Monitoring on Cisco side ------------------------ +.. stop_vyoslinter + IKE SAs: .. code-block:: none @@ -378,6 +391,8 @@ Routing Table: C 192.168.11.0/24 is directly connected, GigabitEthernet0/2 L 192.168.11.1/32 is directly connected, GigabitEthernet0/2 +.. start_vyoslinter + Checking Connectivity --------------------- diff --git a/docs/configexamples/ipsec-pa-route-based.rst b/docs/configexamples/ipsec-pa-route-based.rst index 0b629041..96349d98 100644 --- a/docs/configexamples/ipsec-pa-route-based.rst +++ b/docs/configexamples/ipsec-pa-route-based.rst @@ -88,6 +88,8 @@ Configuration VyOS ---- +.. stop_vyoslinter + .. code-block:: none set interfaces ethernet eth0 address '10.0.1.2/30' @@ -131,9 +133,13 @@ VyOS set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' set vpn ipsec site-to-site peer CISCO vti bind 'vti1' +.. start_vyoslinter + Palo Alto --------- +.. stop_vyoslinter + GUI Configuration: Network -> Network Profiles -> IKE Crypto @@ -225,6 +231,8 @@ CLI configuration with OSPF: set network virtual-router default protocol ospf router-id 1.1.1.1 set network virtual-router default interface [ ethernet1/1 ethernet1/2 ethernet1/3 tunnel.1 ] +.. start_vyoslinter + Monitoring ========== @@ -260,6 +268,8 @@ IPsec SAs: OSPF Neighbor Status: +.. stop_vyoslinter + .. code-block:: none vyos@vyos:~$ show ip ospf neighbor @@ -267,6 +277,8 @@ OSPF Neighbor Status: Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL 1.1.1.1 1 Full/- 23m56s 37.948s 10.100.100.2 vti1:10.100.100.1 0 0 0 +.. start_vyoslinter + Routing Table: @@ -337,6 +349,8 @@ IPsec SAs: OSPF Neighbor Status: +.. stop_vyoslinter + .. code-block:: none admin@PA-VM> show routing protocol ospf neighbor @@ -361,6 +375,8 @@ OSPF Neighbor Status: restart helper time remaining: 0 restart helper exit reason: none +.. start_vyoslinter + Routing Table: diff --git a/docs/configexamples/lac-lns.rst b/docs/configexamples/lac-lns.rst index 98bad773..f622b48f 100644 --- a/docs/configexamples/lac-lns.rst +++ b/docs/configexamples/lac-lns.rst @@ -79,6 +79,8 @@ LAC LNS --- +.. stop_vyoslinter + .. code-block:: none set interfaces ethernet eth0 address '192.168.139.100/24' @@ -96,6 +98,8 @@ LNS set vpn l2tp remote-access name-server '8.8.8.8' set vpn l2tp remote-access ppp-options disable-ccp +.. start_vyoslinter + .. note:: This setup requires the Compression Control Protocol (CCP) being disabled, the command ``set vpn l2tp remote-access ppp-options disable-ccp`` accomplishes that. diff --git a/docs/configexamples/pppoe-ipv6-basic.rst b/docs/configexamples/pppoe-ipv6-basic.rst index 520ca00b..cc14451c 100644 --- a/docs/configexamples/pppoe-ipv6-basic.rst +++ b/docs/configexamples/pppoe-ipv6-basic.rst @@ -51,8 +51,13 @@ delegation (PD). set interfaces pppoe pppoe0 ipv6 address autoconf set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1 address '100' +.. stop_vyoslinter + * Here we use the prefix to configure the address of eth1 (LAN) to form ``::64``, where ``64`` is hexadecimal of address 100. + +.. start_vyoslinter + * For home network users, most of time ISP only provides /64 prefix, hence there is no need to set SLA ID and prefix length. See :ref:`pppoe-interface` for more information. diff --git a/docs/configuration/firewall/bridge.rst b/docs/configuration/firewall/bridge.rst index 832bdf67..53775514 100644 --- a/docs/configuration/firewall/bridge.rst +++ b/docs/configuration/firewall/bridge.rst @@ -557,6 +557,8 @@ And op-mode commands: Inspect logs: +.. stop_vyoslinter + .. code-block:: none vyos@BRI:~$ show log firewall bridge @@ -567,3 +569,5 @@ Inspect logs: vyos@BRI:~$ show log firewall bridge forward filter Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 + +.. start_vyoslinter -- cgit v1.2.3 From d0a0fd4998b35af5b4e59374a5706ffeb27c7ee5 Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Tue, 21 Apr 2026 20:35:22 +0300 Subject: fix: resolve all line-length lint warnings across 14 RST files MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Wrap prose lines exceeding 80 chars and apply stop/start_vyoslinter markers around cfgcmd/opcmd directive lines that cannot be shortened (e.g. long option names with placeholder arguments). Affected files: bonding, wireguard, pim, conntrack-sync, dmvpn, ipsec_general, site2site_ipsec, vrf/index, bare-metal, inter-vrf-routing-vrf-lite, lac-lns, tunnelbroker, OpenVPN_with_LDAP, dmvpn-dualhub-dualcloud. 🤖 Generated by [robots](https://vyos.io) --- .../OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst | 17 +- .../autotest/tunnelbroker/tunnelbroker.rst | 14 +- docs/configexamples/dmvpn-dualhub-dualcloud.rst | 39 ++- docs/configexamples/inter-vrf-routing-vrf-lite.rst | 3 +- docs/configexamples/lac-lns.rst | 3 +- docs/configuration/interfaces/bonding.rst | 334 ++++++++++++--------- docs/configuration/interfaces/wireguard.rst | 39 ++- docs/configuration/protocols/pim.rst | 39 ++- docs/configuration/service/conntrack-sync.rst | 12 +- docs/configuration/vpn/dmvpn.rst | 60 ++-- docs/configuration/vpn/ipsec/ipsec_general.rst | 20 +- docs/configuration/vpn/ipsec/site2site_ipsec.rst | 24 +- docs/configuration/vrf/index.rst | 21 +- docs/installation/bare-metal.rst | 3 +- 14 files changed, 383 insertions(+), 245 deletions(-) (limited to 'docs/configexamples') diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst index 0ddd7e3e..ae997905 100644 --- a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst +++ b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst @@ -39,14 +39,22 @@ Here are some PowerShell commands to quickly add a Test Active Directory. Configure VyOS as OpenVPN Server ==================================== -In this example OpenVPN will be setup with a client certificate and username / password authentication. +In this example OpenVPN will be setup with a client certificate and +username / password authentication. -First a CA, a signed server and client ceftificate and a Diffie-Hellman parameter musst be generated and installed. -Please look :ref:`here ` for more information. +First a CA, a signed server and client ceftificate and a +Diffie-Hellman parameter musst be generated and installed. +Please look :ref:`here ` for more +information. | Add the LDAP plugin configuration file `/config/auth/ldap-auth.config` + +.. stop_vyoslinter + | Check all possible settings `here `_ +.. start_vyoslinter + .. literalinclude:: _include/ldap-auth.config :language: none @@ -93,7 +101,8 @@ OpenVPN Server configuration can be carried out. Client configuration ==================== -One advantage of having the client certificate stored is the ability to create the client configuration. +One advantage of having the client certificate stored is the ability to +create the client configuration. .. code-block:: none diff --git a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst index a14a3199..e34cb779 100644 --- a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst +++ b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst @@ -220,9 +220,11 @@ Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, Firewall ======== -Finally, don't forget the :ref:`Firewall`. The usage is identical, except for -instead of `set firewall ipv4 name NAME`, you would use `set firewall ipv6 name -NAME`. - -Similarly, to attach the firewall, you would use `set firewall ipv6 name NAME rule N inbound-interface name eth0` or `set firewall zone LOCAL from WAN firewall -ipv6-name`. +Finally, don't forget the +:ref:`Firewall`. The usage is +identical, except instead of `set firewall ipv4 name NAME`, you would +use `set firewall ipv6 name NAME`. + +Similarly, to attach the firewall, you would use +`set firewall ipv6 name NAME rule N inbound-interface name eth0` or +`set firewall zone LOCAL from WAN firewall ipv6-name`. diff --git a/docs/configexamples/dmvpn-dualhub-dualcloud.rst b/docs/configexamples/dmvpn-dualhub-dualcloud.rst index 7bcfcf84..a3a4e619 100644 --- a/docs/configexamples/dmvpn-dualhub-dualcloud.rst +++ b/docs/configexamples/dmvpn-dualhub-dualcloud.rst @@ -6,11 +6,12 @@ DMVPN Dual HUB Dual Cloud ######################### -This document is to describe a basic setup to build DVMPN network with two Hubs and two clouds using DMVPN Phase3. +This document is to describe a basic setup to build DVMPN network with +two Hubs and two clouds using DMVPN Phase3. OSPF is used as routing protocol inside DMVPN. -In this example we use VyOS 1.5 as HUBs and Spokes (HUB-1, HUB-2, SPOKE-2, SPOKE-3) and Cisco IOSv 15.5(3)M (SPOKE-1) -as a Spoke. +In this example we use VyOS 1.5 as HUBs and Spokes (HUB-1, HUB-2, +SPOKE-2, SPOKE-3) and Cisco IOSv 15.5(3)M (SPOKE-1) as a Spoke. Network Topology ================ @@ -80,9 +81,12 @@ Spoke-3 NHRP configuration __________________ -The next step is to configure the NHRP protocol. In a Dual cloud network, every HUB has to be configured with one GRE -multipoint tunnel interface and every spoke has to be configured with two tunnel interfaces, one tunnel to each hub. -In this example tunnel networks are 10.100.100.0/24 for the first cloud and 10.100.101.0/24 for the second cloud. +The next step is to configure the NHRP protocol. In a Dual cloud +network, every HUB has to be configured with one GRE multipoint tunnel +interface and every spoke has to be configured with two tunnel +interfaces, one tunnel to each hub. +In this example tunnel networks are 10.100.100.0/24 for the first cloud +and 10.100.101.0/24 for the second cloud. But VyOS uses FRR for NHRP, that is why the tunnel address mask must be /32. HUB-1 @@ -211,8 +215,10 @@ Spoke-3 Overlay configuration _____________________ -The last step is to configure the routing protocol. In this scenario, OSPF was chosen as the dynamic routing protocol. -But you can use iBGP or eBGP. To form fast convergence it is possible to use BFD protocol. +The last step is to configure the routing protocol. In this scenario, +OSPF was chosen as the dynamic routing protocol. +But you can use iBGP or eBGP. To form fast convergence it is possible +to use BFD protocol. HUB-1 @@ -378,7 +384,8 @@ SPOKE-1 Monitoring ========== -All spokes created IPSec tunnels to Hubs, are registered on Hubs using NHRP protocol and formed adjacency in OSPF. +All spokes created IPSec tunnels to Hubs, are registered on Hubs using +NHRP protocol and formed adjacency in OSPF. .. code-block:: none @@ -468,7 +475,8 @@ For instance, traceroute was generated from PC-SPOKE-2 to PC-SPOKE-1 3 *192.168.11.2 3.241 ms (ICMP type:3, code:3, Destination port unreachable) First trace goes via HUB but the second goes directly from SPOKE-1 to SPOKE-2. -Now routing tables are changed. LAN networks 192.168.12.0/24 and 192.168.11.0/24 available directly via SPOKES. +Now routing tables are changed. LAN networks 192.168.12.0/24 and +192.168.11.0/24 available directly via SPOKES. .. code-block:: none @@ -541,8 +549,11 @@ A new Spoke to Spoke IPSec tunnel is created Summary ======= -If one of the Hubs loses connectivity to the Internet, the other Hub will be available and take the main role. -This is a simple example where only one internet connection is used. But in the real world, there can be two -connections to the Internet. In this case, there is a recommendation to build each tunnel via each Internet connection, -choose the main cloud, and manipulate traffic via a routing protocol. It allows the creation failover on link-level +If one of the Hubs loses connectivity to the Internet, the other Hub +will be available and take the main role. +This is a simple example where only one internet connection is used. +But in the real world, there can be two connections to the Internet. +In this case, there is a recommendation to build each tunnel via each +Internet connection, choose the main cloud, and manipulate traffic via +a routing protocol. It allows the creation failover on link-level connections too. \ No newline at end of file diff --git a/docs/configexamples/inter-vrf-routing-vrf-lite.rst b/docs/configexamples/inter-vrf-routing-vrf-lite.rst index 36dabd73..1f02da8e 100644 --- a/docs/configexamples/inter-vrf-routing-vrf-lite.rst +++ b/docs/configexamples/inter-vrf-routing-vrf-lite.rst @@ -16,7 +16,8 @@ where you might need that some network can access other in a different VRF. The scope of this document is to cover such cases in a dynamic way without the use of MPLS-LDP. -General information about L3VPNs can be found in the :ref:`configuration/vrf/index:L3VPN VRFs` chapter. +General information about L3VPNs can be found in the +:ref:`configuration/vrf/index:L3VPN VRFs` chapter. ******** Overview diff --git a/docs/configexamples/lac-lns.rst b/docs/configexamples/lac-lns.rst index f622b48f..5f344d54 100644 --- a/docs/configexamples/lac-lns.rst +++ b/docs/configexamples/lac-lns.rst @@ -101,7 +101,8 @@ LNS .. start_vyoslinter .. note:: This setup requires the Compression Control Protocol (CCP) - being disabled, the command ``set vpn l2tp remote-access ppp-options disable-ccp`` + being disabled, the command + ``set vpn l2tp remote-access ppp-options disable-ccp`` accomplishes that. Client diff --git a/docs/configuration/interfaces/bonding.rst b/docs/configuration/interfaces/bonding.rst index 187720a9..7637790c 100644 --- a/docs/configuration/interfaces/bonding.rst +++ b/docs/configuration/interfaces/bonding.rst @@ -62,20 +62,23 @@ Bond modes :widths: 20 80 * - **Description:** - - IEEE 802.3ad Dynamic Link Aggregation. Groups only member interfaces with - the same speed (e.g., 1 Gbps) and duplex settings. Member interfaces with - different speed and duplex settings are not included in the active bond. - - Provides load balancing and fault tolerance. Uses the :abbr:`LACP (Link - Aggregation Control Protocol)` to negotiate the bond with the switch. + - IEEE 802.3ad Dynamic Link Aggregation. Groups only member + interfaces with the same speed (e.g., 1 Gbps) and duplex + settings. Member interfaces with different speed and duplex + settings are not included in the active bond. + + Provides load balancing and fault tolerance. Uses the + :abbr:`LACP (Link Aggregation Control Protocol)` to + negotiate the bond with the switch. * - **Traffic distribution:** - - Traffic is distributed according to the **transmit hash policy** - (default: XOR). - - The bonding driver applies an XOR operation to specific packet header fields, - generating a hash value that maps to a particular member interface. This - ensures the same network flow is consistently transmitted over the same member - interface. + - Traffic is distributed according to the **transmit hash + policy** (default: XOR). + + The bonding driver applies an XOR operation to specific + packet header fields, generating a hash value that maps to + a particular member interface. This ensures the same network + flow is consistently transmitted over the same member + interface. The transmit hash policy is configured via the ``hash-policy`` option. * - **Failover:** @@ -92,15 +95,16 @@ Bond modes :widths: 20 80 * - **Description:** - - Provides fault tolerance. Only one member interface is active at a time. - Other member interfaces remain in a standby mode. - * - **Traffic distribution:** - - All traffic (incoming and outgoing) is routed via one active member interface. - * - **Failover:** - - If the designated member interface fails, all traffic is routed to - another member interface. The bonding driver sends a Gratuitous ARP - to update the peer's MAC address table, linking the bond's MAC address - to another physical port. + - Provides fault tolerance. Only one member interface is active + at a time. Other member interfaces remain in a standby mode. + * - **Traffic distribution:** + - All traffic (incoming and outgoing) is routed via one active + member interface. + * - **Failover:** + - If the designated member interface fails, all traffic is + routed to another member interface. The bonding driver sends + a Gratuitous ARP to update the peer's MAC address table, + linking the bond's MAC address to another physical port. * ``broadcast`` @@ -109,11 +113,12 @@ Bond modes * - **Description:** - Provides maximum fault tolerance by duplicating traffic. - * - **Traffic distribution:** - - Every packet is duplicated and transmitted on **all** member interfaces. - * - **Failover:** - - Traffic flow is not interrupted as long as at least one member interface - remains active. + * - **Traffic distribution:** + - Every packet is duplicated and transmitted on **all** member + interfaces. + * - **Failover:** + - Traffic flow is not interrupted as long as at least one + member interface remains active. * ``round-robin`` @@ -122,12 +127,13 @@ Bond modes * - **Description:** - Provides load balancing and fault tolerance. - * - **Traffic distribution:** - - Packets are transmitted in sequential order across the member interfaces - (e.g., packet 1 > interface A, packet 2 > interface B, etc.). - * - **Failover:** - - If a member interface fails, the sequence skips the failed interface and - continues with the remaining active members. + * - **Traffic distribution:** + - Packets are transmitted in sequential order across the member + interfaces (e.g., packet 1 > interface A, packet 2 > + interface B, etc.). + * - **Failover:** + - If a member interface fails, the sequence skips the failed + interface and continues with the remaining active members. * ``transmit-load-balance`` @@ -136,14 +142,15 @@ Bond modes * - **Description:** - Provides adaptive transmit load balancing and fault tolerance. - * - **Traffic distribution:** - - **Outgoing:** Distributed across all active member interfaces based on - the current load. + * - **Traffic distribution:** + - **Outgoing:** Distributed across all active member interfaces + based on the current load. - **Incoming:** Received by a designated member interface (active receiver). - * - **Failover:** - - If the active receiver fails, another member interface takes over as the new - active receiver. + **Incoming:** Received by a designated member interface + (active receiver). + * - **Failover:** + - If the active receiver fails, another member interface takes + over as the new active receiver. * ``adaptive-load-balance`` @@ -151,75 +158,88 @@ Bond modes :widths: 20 80 * - **Description:** - - Provides adaptive transmit load balancing identical to - ``transmit-load-balance``, receive load balancing for IPv4 traffic, and fault - tolerance for both incoming and outgoing traffic. + - Provides adaptive transmit load balancing identical to + ``transmit-load-balance``, receive load balancing for IPv4 + traffic, and fault tolerance for both incoming and outgoing + traffic. * - **Traffic distribution:** - **Outgoing:** Identical to ``transmit-load-balance``. - **Incoming:** Distributed based on ARP manipulation. For both local and remote - connections, the bonding driver intercepts ARP traffic and changes the source - MAC address to the MAC address of the least loaded member interface. + **Incoming:** Distributed based on ARP manipulation. For + both local and remote connections, the bonding driver + intercepts ARP traffic and changes the source MAC address + to the MAC address of the least loaded member interface. - All traffic from that peer is then routed to the chosen member interface. + All traffic from that peer is then routed to the chosen + member interface. * - **Failover:** - - If a member interface's state changes (fails, recovers, is added, or excluded), - the traffic is redistributed among all active member interfaces. + - If a member interface's state changes (fails, recovers, is + added, or excluded), the traffic is redistributed among all + active member interfaces. - * ``xor-hash``: Provides load balancing and fault tolerance based on a hash formula. - Distributes traffic and handles failover identically to ``802.3ad``, but operates - without the :abbr:`LACP (Link Aggregation Control Protocol)`. + * ``xor-hash``: Provides load balancing and fault tolerance + based on a hash formula. Distributes traffic and handles + failover identically to ``802.3ad``, but operates without + the :abbr:`LACP (Link Aggregation Control Protocol)`. .. cfgcmd:: set interfaces bonding min-links <0-16> - **Configure how many member interfaces must be active (in the link-up state) to - mark the bonding interface UP (carrier asserted).** + **Configure how many member interfaces must be active (in the + link-up state) to mark the bonding interface UP (carrier + asserted).** - This command applies only when the bonding interface is configured in 802.3ad - mode and functions like the Cisco EtherChannel min-links feature. It ensures - that a bonding interface is marked UP (carrier asserted) only when a specified - number of member interfaces are active (in the link-up state). This helps - guarantee a minimum level of bandwidth for higher-level services (such as - clustering) relying on the bonding interface. + This command applies only when the bonding interface is configured + in 802.3ad mode and functions like the Cisco EtherChannel min-links + feature. It ensures that a bonding interface is marked UP (carrier + asserted) only when a specified number of member interfaces are + active (in the link-up state). This helps guarantee a minimum level + of bandwidth for higher-level services (such as clustering) relying + on the bonding interface. - The default value is 0. This marks the bonding interface UP (carrier asserted) - whenever an active LACP aggregator exists, regardless of the number of member - interfaces in that aggregator. + The default value is 0. This marks the bonding interface UP + (carrier asserted) whenever an active LACP aggregator exists, + regardless of the number of member interfaces in that aggregator. - .. note:: In 802.3ad mode, a bond cannot be active without at least one active - member interface. Therefore, setting min-links to 0 or 1 has the same result: - the bonding interface is marked UP (carrier asserted). + .. note:: In 802.3ad mode, a bond cannot be active without at + least one active member interface. Therefore, setting min-links + to 0 or 1 has the same result: the bonding interface is marked + UP (carrier asserted). .. cfgcmd:: set interfaces bonding lacp-rate - **Configure the rate at which the bonding interface requests its link - partner to send** :abbr:`LACPDUs (Link Aggregation Control Protocol Data - Units)` **in 802.3ad mode.** + **Configure the rate at which the bonding interface requests its + link partner to send** + :abbr:`LACPDUs (Link Aggregation Control Protocol Data Units)` + **in 802.3ad mode.** - This command applies only when the bonding interface is configured in - 802.3ad mode. + This command applies only when the bonding interface is configured + in 802.3ad mode. The following options are available: - * **slow (default):** Requests the link partner to transmit LACPDUs every 30 seconds. + * **slow (default):** Requests the link partner to transmit + LACPDUs every 30 seconds. - * **fast:** Requests the link partner to transmit LACPDUs every 1 second. + * **fast:** Requests the link partner to transmit LACPDUs every + 1 second. .. cfgcmd:: set interfaces bonding system-mac **Configure a specific MAC address for the bonding interface.** - This sets the 802.3ad system MAC address, which is used for :abbr:`LACPDU (Link - Aggregation Control Protocol Data Unit)` exchanges with the link partner. - You can assign a fixed MAC address or generate a random one for these - :abbr:`LACPDU (Link Aggregation Control Protocol Data Unit)` exchanges. + This sets the 802.3ad system MAC address, which is used for + :abbr:`LACPDU (Link Aggregation Control Protocol Data Unit)` + exchanges with the link partner. You can assign a fixed MAC address + or generate a random one for these + :abbr:`LACPDU (Link Aggregation Control Protocol Data Unit)` + exchanges. .. cfgcmd:: set interfaces bonding hash-policy - **Configure which transmit hash policy to use for distributing traffic across - member interfaces.** + **Configure which transmit hash policy to use for distributing + traffic across member interfaces.** The following policies are available: @@ -229,10 +249,12 @@ Bond modes :widths: 20 80 * - **Description:** - - Routes all traffic destined for a specific network peer through the same - member interface. The policy is 802.3ad-compliant. + - Routes all traffic destined for a specific network peer + through the same member interface. The policy is + 802.3ad-compliant. * - **Hash inputs:** - - Source MAC address, destination MAC address, and Ethernet packet type ID. + - Source MAC address, destination MAC address, and Ethernet + packet type ID. * - **Formula:** - .. code-block:: none @@ -245,13 +267,16 @@ Bond modes :widths: 20 80 * - **Description:** - - Similar to ``layer2``, routes all traffic destined for a specific network - peer through the same member interface and is IEEE 802.3ad-compliant. Uses - both Layer 2 and Layer 3 information to provide a more balanced traffic distribution. + - Similar to ``layer2``, routes all traffic destined for a + specific network peer through the same member interface + and is IEEE 802.3ad-compliant. Uses both Layer 2 and + Layer 3 information to provide a more balanced traffic + distribution. * - **Hash inputs:** - - * Source MAC address, destination MAC address, and Ethernet packet type ID. - * Source IP address, destination IP address. IPv6 addresses are first hashed - using ``IPv6_addr_hash``. + - * Source MAC address, destination MAC address, and + Ethernet packet type ID. + * Source IP address, destination IP address. IPv6 + addresses are first hashed using ``IPv6_addr_hash``. * - **Formula:** - .. code-block:: none @@ -269,18 +294,21 @@ Bond modes :widths: 20 80 * - **Description:** - - Routes different connections (flows) destined for a specific network peer - through multiple member interfaces, but ensures each individual flow is - routed through only one member interface. - - .. note:: This policy is not fully 802.3ad-compliant. When a single TCP - or UDP flow contains both fragmented and unfragmented packets, the - algorithm may distribute them across different member interfaces. This - may result in out-of-order packet delivery, violating the 802.3ad standard. + - Routes different connections (flows) destined for a + specific network peer through multiple member interfaces, + but ensures each individual flow is routed through only + one member interface. + + .. note:: This policy is not fully 802.3ad-compliant. + When a single TCP or UDP flow contains both fragmented + and unfragmented packets, the algorithm may distribute + them across different member interfaces. This may + result in out-of-order packet delivery, violating the + 802.3ad standard. * - **Hash inputs:** - * Source port, destination port (if available). - * Source IP address, destination IP address. IPv6 addresses are first hashed - using ``IPv6_addr_hash``. + * Source IP address, destination IP address. IPv6 + addresses are first hashed using ``IPv6_addr_hash``. * - **Formula:** - .. code-block:: none @@ -290,8 +318,9 @@ Bond modes hash = hash XOR (hash RSHIFT 8) member interface number = hash modulo member interface count - For fragmented TCP or UDP packets and all other IPv4 and IPv6 traffic, the - source and destination port information is omitted. + For fragmented TCP or UDP packets and all other IPv4 and + IPv6 traffic, the source and destination port information + is omitted. For non-IP traffic, the formula is the same as for ``layer2``. @@ -299,29 +328,33 @@ Bond modes **Configure the primary member interface in the bond.** - The primary member interface remains active as long as it is operational; - alternative member interfaces are used only if it fails. + The primary member interface remains active as long as it is + operational; alternative member interfaces are used only if it + fails. - Use this configuration when a specific member interface is preferred, - such as one with higher throughput. + Use this configuration when a specific member interface is + preferred, such as one with higher throughput. - This command applies only to ``active-backup``, ``transmit-load-balance``, and - ``adaptive-load-balance`` modes. + This command applies only to ``active-backup``, + ``transmit-load-balance``, and ``adaptive-load-balance`` modes. .. cfgcmd:: set interfaces bonding arp-monitor interval