From a01c2c4ed50470141e7d7bbd31a3ab17418e9936 Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Mon, 30 Mar 2026 14:11:57 +0300 Subject: Add TODO markers, fill placeholders, mark stub pages (#1802) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * chore: add TODO markers for 12 files needing cfgcmd/opcmd conversion Co-Authored-By: Claude Sonnet 4.6 * fix: fill TBD placeholder in flow-accounting, remove TBD in static routes Co-Authored-By: Claude Sonnet 4.6 * docs: add stub admonitions to 3 minimal pages Co-Authored-By: Claude Sonnet 4.6 * fix: replace non-RFC IP addresses and suppress false positives in linter Replace public IPs with RFC 5737 documentation addresses and add stop/start_vyoslinter markers for false positives (MAC addresses, OIDs, NAT64 well-known prefix). Co-Authored-By: Claude Sonnet 4.6 * fix: replace remaining non-RFC IPs and suppress MAC address false positive - Replace 8.8.8.8 (Google DNS) with 192.0.2.1 (RFC 5737) in: - docs/configexamples/ansible.rst (3 occurrences) - docs/configexamples/nmp.rst (1 occurrence) - docs/automation/terraform/terraformvSphere.rst (1 occurrence) - Wrap SHA-256 certificate fingerprint in openvpn-examples.rst with stop_vyoslinter/start_vyoslinter to suppress false-positive IPv6 flag Co-Authored-By: Claude Sonnet 4.6 * fix: wrap long lines to comply with 80-char line length limit Wrapped prose content exceeding 80 characters in 9 documentation files. Only RST prose and directive content was modified; code block contents were left untouched as they are exempt from the linter. Co-Authored-By: Claude Sonnet 4.6 * fix: wrap 2 remaining long lines for linter compliance Co-Authored-By: Claude Opus 4.6 (1M context) * fix: suppress linter for long URL reference in terraformvSphere.rst * fix: address Copilot review suggestions — broken links, typos, YAML indentation - Fix broken inline RST links split across lines in sysctl.rst, eve-ng.rst, oracle.rst (stub notes with VyOS documentation repository link) - Fix YAML indentation in both playbook code blocks in ansible.rst - Fix typo "VyoS" -> "VyOS" in ansible.rst - Fix typo "desition" -> "decision" in terraformvSphere.rst - Fix 4 occurrences of "Terrafom" -> "Terraform" in terraformvSphere.rst - Fix :doc: role split across two lines in openvpn-examples.rst - Wrap long paragraph in openconnect.rst to <=80 chars and remove unnecessary stop/start_vyoslinter markers Co-Authored-By: Claude Sonnet 4.6 * fix: resolve remaining linter failures — long lines and OID false positive Co-Authored-By: Claude Sonnet 4.6 * fix: revert 8.8.8.8 replacements, use stop_vyoslinter instead --------- Co-authored-by: Claude Sonnet 4.6 --- docs/installation/cloud/oracle.rst | 6 ++++++ docs/installation/virtual/eve-ng.rst | 6 ++++++ 2 files changed, 12 insertions(+) (limited to 'docs/installation') diff --git a/docs/installation/cloud/oracle.rst b/docs/installation/cloud/oracle.rst index 1d02335b..f5e03329 100644 --- a/docs/installation/cloud/oracle.rst +++ b/docs/installation/cloud/oracle.rst @@ -4,6 +4,12 @@ Oracle ###### +.. note:: This page is a stub and needs expansion. + Contributions welcome via the + VyOS `documentation repository`_. + +.. _documentation repository: https://github.com/vyos/vyos-documentation + .. stop_vyoslinter References ---------- diff --git a/docs/installation/virtual/eve-ng.rst b/docs/installation/virtual/eve-ng.rst index 855daeb0..0dd07db8 100644 --- a/docs/installation/virtual/eve-ng.rst +++ b/docs/installation/virtual/eve-ng.rst @@ -4,6 +4,12 @@ EVE-NG ###### +.. note:: This page is a stub and needs expansion. + Contributions welcome via the + VyOS `documentation repository`_. + +.. _documentation repository: https://github.com/vyos/vyos-documentation + References ========== -- cgit v1.2.3 From d21db5fddd91e20e420b63928a8398745f571710 Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Fri, 10 Apr 2026 21:23:55 +0300 Subject: docs: fix code-block indentation (tabs to spaces) (#1825) * docs: fix tab-to-space indentation in code blocks across 5 files Replace tab characters with spaces inside code-block and output directives for consistent rendering. Also rewrap long prose lines for readability. Co-Authored-By: Claude Opus 4.6 (1M context) * chore: remove accidentally committed settings file Co-Authored-By: Claude Opus 4.6 (1M context) * docs: fix inconsistent indentation in trafficpolicy and qos code blocks Normalize indentation within code blocks where tab-to-space conversion left some entries misaligned (tbit, gibps, tibps in trafficpolicy; egress command in qos). Co-Authored-By: Claude Opus 4.6 (1M context) --------- Co-authored-by: Claude Opus 4.6 (1M context) --- docs/cli.rst | 44 +-- docs/configexamples/l3vpn-hub-and-spoke.rst | 419 ++++++++++++++-------------- docs/configexamples/qos.rst | 138 +++++---- docs/configuration/trafficpolicy/index.rst | 64 +++-- docs/installation/install.rst | 2 +- 5 files changed, 355 insertions(+), 312 deletions(-) (limited to 'docs/installation') diff --git a/docs/cli.rst b/docs/cli.rst index 515ea85a..778d3954 100644 --- a/docs/cli.rst +++ b/docs/cli.rst @@ -878,21 +878,21 @@ VyOS lets you compare different configurations. vyos@vyos# compare [tab] Possible completions: - Compare working & active configurations - saved Compare working & saved configurations - Compare working with revision N - Compare revision N with M + Compare working & active configurations + saved Compare working & saved configurations + Compare working with revision N + Compare revision N with M Revisions: - 0 2013-12-17 20:01:37 root by boot-config-loader - 1 2013-12-13 15:59:31 root by boot-config-loader - 2 2013-12-12 21:56:22 vyos by cli - 3 2013-12-12 21:55:11 vyos by cli - 4 2013-12-12 21:27:54 vyos by cli - 5 2013-12-12 21:23:29 vyos by cli - 6 2013-12-12 21:13:59 root by boot-config-loader - 7 2013-12-12 16:25:19 vyos by cli - 8 2013-12-12 15:44:36 vyos by cli - 9 2013-12-12 15:42:07 root by boot-config-loader + 0 2013-12-17 20:01:37 root by boot-config-loader + 1 2013-12-13 15:59:31 root by boot-config-loader + 2 2013-12-12 21:56:22 vyos by cli + 3 2013-12-12 21:55:11 vyos by cli + 4 2013-12-12 21:27:54 vyos by cli + 5 2013-12-12 21:23:29 vyos by cli + 6 2013-12-12 21:13:59 root by boot-config-loader + 7 2013-12-12 16:25:19 vyos by cli + 8 2013-12-12 15:44:36 vyos by cli + 9 2013-12-12 15:42:07 root by boot-config-loader 10 2013-12-12 15:42:06 root by init The command :cfgcmd:`compare` allows you to compare different type of @@ -1027,14 +1027,14 @@ to load it with the ``load`` command: vyos@vyos# load Possible completions: - Load from system config file - Load from file on local machine - scp://:@:/ Load from file on remote machine - sftp://:@/ Load from file on remote machine - ftp://:@/ Load from file on remote machine - http:/// Load from file on remote machine - https:/// Load from file on remote machine - tftp:/// Load from file on remote machine + Load from system config file + Load from file on local machine + scp://:@:/ Load from file on remote machine + sftp://:@/ Load from file on remote machine + ftp://:@/ Load from file on remote machine + http:/// Load from file on remote machine + https:/// Load from file on remote machine + tftp:/// Load from file on remote machine diff --git a/docs/configexamples/l3vpn-hub-and-spoke.rst b/docs/configexamples/l3vpn-hub-and-spoke.rst index e4b0d933..c05b9a3f 100644 --- a/docs/configexamples/l3vpn-hub-and-spoke.rst +++ b/docs/configexamples/l3vpn-hub-and-spoke.rst @@ -46,7 +46,8 @@ The following software was used in the creation of this document: **NOTE:** VyOS Router (tested with VyOS 1.4-rolling-202110310317) – The configurations below are specifically for VyOS 1.4.x. -General information can be found in the :ref:`configuration/vrf/index:L3VPN VRFs` chapter. +General information can be found in the +:ref:`configuration/vrf/index:L3VPN VRFs` chapter. @@ -64,8 +65,9 @@ Topology How does it work? ***************** -As we know the main assumption of L3VPN “Hub and Spoke” is, that the traffic -between spokes have to pass via hub, in our scenario VyOS-PE2 is the Hub PE +As we know the main assumption of L3VPN “Hub and Spoke” is, that the +traffic between spokes have to pass via hub, in our scenario VyOS-PE2 +is the Hub PE and the VyOS-CE1-HUB is the central customer office device that is responsible for controlling access between all spokes and announcing its network prefixes (10.0.0.100/32). VyOS-PE2 has the main VRF (its name is BLUE_HUB), its @@ -325,10 +327,12 @@ At this step we are going to enable iBGP protocol on MPLS nodes and Route Reflectors (two routers for redundancy) that will deliver IPv4 VPN (L3VPN) routes between them: +.. stop_vyoslinter + - VyOS-RR1: .. code-block:: none - + set protocols bgp system-as '65001' set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' @@ -554,81 +558,81 @@ Let’s check IPv4 routing and MPLS information on provider nodes vyos@VyOS-P1:~$ show ip ospf neighbor - Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL - 10.0.0.4 1 Full/Backup 34.718s 172.16.30.2 eth0:172.16.30.1 0 0 0 - 10.0.0.5 1 Full/Backup 35.132s 172.16.40.2 eth1:172.16.40.1 0 0 0 - 10.0.0.7 1 Full/Backup 34.764s 172.16.90.2 eth2:172.16.90.1 0 0 0 - 10.0.0.1 1 Full/Backup 35.642s 172.16.10.2 eth3:172.16.10.1 0 0 0 - 10.0.0.8 1 Full/Backup 35.484s 172.16.100.2 eth5:172.16.100.1 0 0 0 + Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL + 10.0.0.4 1 Full/Backup 34.718s 172.16.30.2 eth0:172.16.30.1 0 0 0 + 10.0.0.5 1 Full/Backup 35.132s 172.16.40.2 eth1:172.16.40.1 0 0 0 + 10.0.0.7 1 Full/Backup 34.764s 172.16.90.2 eth2:172.16.90.1 0 0 0 + 10.0.0.1 1 Full/Backup 35.642s 172.16.10.2 eth3:172.16.10.1 0 0 0 + 10.0.0.8 1 Full/Backup 35.484s 172.16.100.2 eth5:172.16.100.1 0 0 0 - “show mpls ldp neighbor “ for checking ldp neighbors .. code-block:: none vyos@VyOS-P1:~$ show mpls ldp neighbor - AF ID State Remote Address Uptime - ipv4 10.0.0.1 OPERATIONAL 10.0.0.1 07w5d06h - ipv4 10.0.0.4 OPERATIONAL 10.0.0.4 09w3d00h - ipv4 10.0.0.5 OPERATIONAL 10.0.0.5 09w2d23h - ipv4 10.0.0.7 OPERATIONAL 10.0.0.7 03w0d01h - ipv4 10.0.0.8 OPERATIONAL 10.0.0.8 01w3d02h + AF ID State Remote Address Uptime + ipv4 10.0.0.1 OPERATIONAL 10.0.0.1 07w5d06h + ipv4 10.0.0.4 OPERATIONAL 10.0.0.4 09w3d00h + ipv4 10.0.0.5 OPERATIONAL 10.0.0.5 09w2d23h + ipv4 10.0.0.7 OPERATIONAL 10.0.0.7 03w0d01h + ipv4 10.0.0.8 OPERATIONAL 10.0.0.8 01w3d02h - “show mpls ldp binding” for checking mpls label assignment .. code-block:: none vyos@VyOS-P1:~$ show mpls ldp discovery - AF Destination Nexthop Local Label Remote Label In Use - ipv4 10.0.0.1/32 10.0.0.1 23 imp-null yes - ipv4 10.0.0.1/32 10.0.0.4 23 20 no - ipv4 10.0.0.1/32 10.0.0.5 23 17 no - ipv4 10.0.0.1/32 10.0.0.7 23 16 no - ipv4 10.0.0.1/32 10.0.0.8 23 16 no - ipv4 10.0.0.2/32 10.0.0.1 20 16 no - ipv4 10.0.0.2/32 10.0.0.4 20 22 no - ipv4 10.0.0.2/32 10.0.0.5 20 24 yes - ipv4 10.0.0.2/32 10.0.0.7 20 17 no - ipv4 10.0.0.2/32 10.0.0.8 20 17 no - ipv4 10.0.0.3/32 10.0.0.1 imp-null 17 no - ipv4 10.0.0.3/32 10.0.0.4 imp-null 16 no - ipv4 10.0.0.3/32 10.0.0.5 imp-null 18 no - ipv4 10.0.0.3/32 10.0.0.7 imp-null 18 no - ipv4 10.0.0.3/32 10.0.0.8 imp-null 18 no - ipv4 10.0.0.4/32 10.0.0.1 16 18 no - ipv4 10.0.0.4/32 10.0.0.4 16 imp-null yes - ipv4 10.0.0.4/32 10.0.0.5 16 19 no - ipv4 10.0.0.4/32 10.0.0.7 16 19 no - ipv4 10.0.0.4/32 10.0.0.8 16 19 no - ipv4 10.0.0.5/32 10.0.0.1 21 19 no - ipv4 10.0.0.5/32 10.0.0.4 21 17 no - ipv4 10.0.0.5/32 10.0.0.5 21 imp-null yes - ipv4 10.0.0.5/32 10.0.0.7 21 20 no - ipv4 10.0.0.5/32 10.0.0.8 21 20 no - ipv4 10.0.0.6/32 10.0.0.1 17 20 no - ipv4 10.0.0.6/32 10.0.0.4 17 23 yes - ipv4 10.0.0.6/32 10.0.0.5 17 21 yes - ipv4 10.0.0.6/32 10.0.0.7 17 21 no - ipv4 10.0.0.6/32 10.0.0.8 17 21 no - ipv4 10.0.0.7/32 10.0.0.1 22 21 no - ipv4 10.0.0.7/32 10.0.0.4 22 18 no - ipv4 10.0.0.7/32 10.0.0.5 22 20 no - ipv4 10.0.0.7/32 10.0.0.7 22 imp-null yes - ipv4 10.0.0.7/32 10.0.0.8 22 22 no - ipv4 10.0.0.8/32 10.0.0.1 24 22 no - ipv4 10.0.0.8/32 10.0.0.4 24 19 no - ipv4 10.0.0.8/32 10.0.0.5 24 16 no - ipv4 10.0.0.8/32 10.0.0.7 24 22 no - ipv4 10.0.0.8/32 10.0.0.8 24 imp-null yes - ipv4 10.0.0.9/32 10.0.0.1 18 23 no - ipv4 10.0.0.9/32 10.0.0.4 18 21 yes - ipv4 10.0.0.9/32 10.0.0.5 18 22 no - ipv4 10.0.0.9/32 10.0.0.7 18 23 no - ipv4 10.0.0.9/32 10.0.0.8 18 23 no - ipv4 10.0.0.10/32 10.0.0.1 19 24 no - ipv4 10.0.0.10/32 10.0.0.4 19 24 yes - ipv4 10.0.0.10/32 10.0.0.5 19 23 yes - ipv4 10.0.0.10/32 10.0.0.7 19 24 no - ipv4 10.0.0.10/32 10.0.0.8 19 24 no + AF Destination Nexthop Local Label Remote Label In Use + ipv4 10.0.0.1/32 10.0.0.1 23 imp-null yes + ipv4 10.0.0.1/32 10.0.0.4 23 20 no + ipv4 10.0.0.1/32 10.0.0.5 23 17 no + ipv4 10.0.0.1/32 10.0.0.7 23 16 no + ipv4 10.0.0.1/32 10.0.0.8 23 16 no + ipv4 10.0.0.2/32 10.0.0.1 20 16 no + ipv4 10.0.0.2/32 10.0.0.4 20 22 no + ipv4 10.0.0.2/32 10.0.0.5 20 24 yes + ipv4 10.0.0.2/32 10.0.0.7 20 17 no + ipv4 10.0.0.2/32 10.0.0.8 20 17 no + ipv4 10.0.0.3/32 10.0.0.1 imp-null 17 no + ipv4 10.0.0.3/32 10.0.0.4 imp-null 16 no + ipv4 10.0.0.3/32 10.0.0.5 imp-null 18 no + ipv4 10.0.0.3/32 10.0.0.7 imp-null 18 no + ipv4 10.0.0.3/32 10.0.0.8 imp-null 18 no + ipv4 10.0.0.4/32 10.0.0.1 16 18 no + ipv4 10.0.0.4/32 10.0.0.4 16 imp-null yes + ipv4 10.0.0.4/32 10.0.0.5 16 19 no + ipv4 10.0.0.4/32 10.0.0.7 16 19 no + ipv4 10.0.0.4/32 10.0.0.8 16 19 no + ipv4 10.0.0.5/32 10.0.0.1 21 19 no + ipv4 10.0.0.5/32 10.0.0.4 21 17 no + ipv4 10.0.0.5/32 10.0.0.5 21 imp-null yes + ipv4 10.0.0.5/32 10.0.0.7 21 20 no + ipv4 10.0.0.5/32 10.0.0.8 21 20 no + ipv4 10.0.0.6/32 10.0.0.1 17 20 no + ipv4 10.0.0.6/32 10.0.0.4 17 23 yes + ipv4 10.0.0.6/32 10.0.0.5 17 21 yes + ipv4 10.0.0.6/32 10.0.0.7 17 21 no + ipv4 10.0.0.6/32 10.0.0.8 17 21 no + ipv4 10.0.0.7/32 10.0.0.1 22 21 no + ipv4 10.0.0.7/32 10.0.0.4 22 18 no + ipv4 10.0.0.7/32 10.0.0.5 22 20 no + ipv4 10.0.0.7/32 10.0.0.7 22 imp-null yes + ipv4 10.0.0.7/32 10.0.0.8 22 22 no + ipv4 10.0.0.8/32 10.0.0.1 24 22 no + ipv4 10.0.0.8/32 10.0.0.4 24 19 no + ipv4 10.0.0.8/32 10.0.0.5 24 16 no + ipv4 10.0.0.8/32 10.0.0.7 24 22 no + ipv4 10.0.0.8/32 10.0.0.8 24 imp-null yes + ipv4 10.0.0.9/32 10.0.0.1 18 23 no + ipv4 10.0.0.9/32 10.0.0.4 18 21 yes + ipv4 10.0.0.9/32 10.0.0.5 18 22 no + ipv4 10.0.0.9/32 10.0.0.7 18 23 no + ipv4 10.0.0.9/32 10.0.0.8 18 23 no + ipv4 10.0.0.10/32 10.0.0.1 19 24 no + ipv4 10.0.0.10/32 10.0.0.4 19 24 yes + ipv4 10.0.0.10/32 10.0.0.5 19 23 yes + ipv4 10.0.0.10/32 10.0.0.7 19 24 no + ipv4 10.0.0.10/32 10.0.0.8 19 24 no Now we’re checking iBGP status and routes from route-reflector nodes to other devices: @@ -644,11 +648,11 @@ nodes to other devices: Peers 4, using 85 KiB of memory Peer groups 1, using 64 bytes of memory - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 10.0.0.7 4 65001 7719 7733 0 0 0 5d07h56m 2 10 - 10.0.0.8 4 65001 7715 7724 0 0 0 5d08h28m 4 10 - 10.0.0.9 4 65001 7713 7724 0 0 0 5d08h28m 2 10 - 10.0.0.10 4 65001 7713 7724 0 0 0 5d08h28m 2 10 + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.0.0.7 4 65001 7719 7733 0 0 0 5d07h56m 2 10 + 10.0.0.8 4 65001 7715 7724 0 0 0 5d08h28m 4 10 + 10.0.0.9 4 65001 7713 7724 0 0 0 5d08h28m 2 10 + 10.0.0.10 4 65001 7713 7724 0 0 0 5d08h28m 2 10 Total number of neighbors 4 @@ -660,37 +664,37 @@ nodes to other devices: BGP table version is 2, local router ID is 10.0.0.1, vrf id 0 Default local pref 100, local AS 65001 Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed + i internal, r RIB-failure, S Stale, R Removed Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self Origin codes: i - IGP, e - EGP, ? - incomplete - Network Next Hop Metric LocPrf Weight Path + Network Next Hop Metric LocPrf Weight Path Route Distinguisher: 10.50.50.1:1011 - *>i10.50.50.0/24 10.0.0.7 0 100 0 i - UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 - *>i80.80.80.80/32 10.0.0.7 0 100 0 65035 i - UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 + *>i10.50.50.0/24 10.0.0.7 0 100 0 i + UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 + *>i80.80.80.80/32 10.0.0.7 0 100 0 65035 i + UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 Route Distinguisher: 10.60.60.1:1011 - *>i10.60.60.0/24 10.0.0.10 0 100 0 i - UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 - *>i90.90.90.90/32 10.0.0.10 0 100 0 65035 i - UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 + *>i10.60.60.0/24 10.0.0.10 0 100 0 i + UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 + *>i90.90.90.90/32 10.0.0.10 0 100 0 65035 i + UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 Route Distinguisher: 10.80.80.1:1011 - *>i10.80.80.0/24 10.0.0.8 0 100 0 i - UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 + *>i10.80.80.0/24 10.0.0.8 0 100 0 i + UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 *>i100.100.100.100/32 - 10.0.0.8 0 100 0 65035 i - UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 + 10.0.0.8 0 100 0 65035 i + UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 Route Distinguisher: 172.16.80.1:2011 - *>i10.110.110.0/24 10.0.0.8 0 100 0 65050 i - UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 - *>i172.16.80.0/24 10.0.0.8 0 100 0 i - UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 + *>i10.110.110.0/24 10.0.0.8 0 100 0 65050 i + UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 + *>i172.16.80.0/24 10.0.0.8 0 100 0 i + UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 Route Distinguisher: 172.16.100.1:2011 - *>i10.210.210.0/24 10.0.0.9 0 100 0 65050 i - UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 - *>i172.16.100.0/24 10.0.0.9 0 100 0 i - UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 + *>i10.210.210.0/24 10.0.0.9 0 100 0 65050 i + UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 + *>i172.16.100.0/24 10.0.0.9 0 100 0 i + UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 - “show bgp ipv4 vpn x.x.x.x/x” for checking best path selected for specific VPNv4 destination @@ -704,11 +708,11 @@ nodes to other devices: Advertised to non peer-group peers: 10.0.0.7 10.0.0.8 10.0.0.9 10.0.0.10 65035, (Received from a RR-client) - 10.0.0.8 from 10.0.0.8 (10.0.0.8) - Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) - Extended Community: RT:65035:1030 - Remote label: 80 - Last update: Tue Oct 19 13:45:32 202 + 10.0.0.8 from 10.0.0.8 (10.0.0.8) + Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) + Extended Community: RT:65035:1030 + Remote label: 80 + Last update: Tue Oct 19 13:45:32 202 Also we can verify how PE devices receives VPNv4 networks from the RRs and installing them to the specific customer VRFs: @@ -725,9 +729,9 @@ and installing them to the specific customer VRFs: Peers 2, using 43 KiB of memory Peer groups 1, using 64 bytes of memory - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 10.0.0.1 4 65001 8812 8794 0 0 0 01:18:42 8 2 - 10.0.0.2 4 65001 8800 8792 0 0 0 6d02h27m 8 2 + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.0.0.1 4 65001 8812 8794 0 0 0 01:18:42 8 2 + 10.0.0.2 4 65001 8800 8792 0 0 0 6d02h27m 8 2 - “show bgp vrf all” for checking all the prefix learning on BGP within VRFs: @@ -743,19 +747,19 @@ and installing them to the specific customer VRFs: BGP table version is 8, local router ID is 10.50.50.1, vrf id 6 Default local pref 100, local AS 65001 Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed + i internal, r RIB-failure, S Stale, R Removed Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self Origin codes: i - IGP, e - EGP, ? - incomplete - Network Next Hop Metric LocPrf Weight Path - * 10.50.50.0/24 0.0.0.0 0 32768 ? - *> 0.0.0.0 0 32768 i - *> 10.80.80.0/24 10.0.0.8@0< 0 100 0 i - * 10.0.0.8@0< 0 100 0 i - *> 10.0.0.80/32 10.50.50.2 0 0 65035 i + Network Next Hop Metric LocPrf Weight Path + * 10.50.50.0/24 0.0.0.0 0 32768 ? + *> 0.0.0.0 0 32768 i + *> 10.80.80.0/24 10.0.0.8@0< 0 100 0 i + * 10.0.0.8@0< 0 100 0 i + *> 10.0.0.80/32 10.50.50.2 0 0 65035 i *> 10.0.0.100/32 - 10.0.0.8@0< 0 100 0 65035 ? - * 10.0.0.8@0< 0 100 0 65035 ? + 10.0.0.8@0< 0 100 0 65035 ? + * 10.0.0.8@0< 0 100 0 65035 ? - “show bgp vrf BLUE_SPOKE summary” for checking EBGP neighbor information between PE and CE: @@ -771,8 +775,8 @@ and installing them to the specific customer VRFs: RIB entries 7, using 1344 bytes of memory Peers 1, using 21 KiB of memory - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 10.50.50.2 4 65035 9019 9023 0 0 0 6d06h12m 1 4 + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.50.50.2 4 65035 9019 9023 0 0 0 6d06h12m 1 4 Total number of neighbors 1 @@ -785,19 +789,19 @@ and installing them to the specific customer VRFs: vyos@VyOS-PE1:~$ show ip route vrf BLUE_SPOKE Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup VRF BLUE_SPOKE: K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 03w0d23h C>* 10.50.50.0/24 is directly connected, eth3, 03w0d23h B> 10.80.80.0/24 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 - * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 + * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 B>* 10.0.0.80/32 [20/0] via 10.50.50.2, eth3, weight 1, 6d05h30m B> 10.0.0.100/32 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 - * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 + * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 - “show bgp ipv4 vpn x.x.x.x/32” for checking the best-path to the specific VPNv4 destination including extended community and @@ -811,19 +815,19 @@ and installing them to the specific customer VRFs: Paths: (2 available, best #1) Not advertised to any peer 65035 - 10.0.0.8 from 10.0.0.1 (10.0.0.8) - Origin incomplete, metric 0, localpref 100, valid, internal, best (Neighbor IP) - Extended Community: RT:65035:1030 - Originator: 10.0.0.8, Cluster list: 10.0.0.1 - Remote label: 80 - Last update: Tue Oct 19 13:45:26 2021 + 10.0.0.8 from 10.0.0.1 (10.0.0.8) + Origin incomplete, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1030 + Originator: 10.0.0.8, Cluster list: 10.0.0.1 + Remote label: 80 + Last update: Tue Oct 19 13:45:26 2021 65035 - 10.0.0.8 from 10.0.0.2 (10.0.0.8) - Origin incomplete, metric 0, localpref 100, valid, internal - Extended Community: RT:65035:1030 - Originator: 10.0.0.8, Cluster list: 10.0.0.1 - Remote label: 80 - Last update: Wed Oct 13 12:39:34 202 + 10.0.0.8 from 10.0.0.2 (10.0.0.8) + Origin incomplete, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1030 + Originator: 10.0.0.8, Cluster list: 10.0.0.1 + Remote label: 80 + Last update: Wed Oct 13 12:39:34 202 Now, let’s check routing information on out Hub PE: @@ -839,9 +843,9 @@ Now, let’s check routing information on out Hub PE: Peers 2, using 43 KiB of memory Peer groups 1, using 64 bytes of memory - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 10.0.0.1 4 65001 15982 15949 0 0 0 05:41:28 6 4 - 10.0.0.2 4 65001 9060 9054 0 0 0 6d06h47m 6 4 + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.0.0.1 4 65001 15982 15949 0 0 0 05:41:28 6 4 + 10.0.0.2 4 65001 9060 9054 0 0 0 6d06h47m 6 4 Total number of neighbors @@ -858,31 +862,31 @@ Now, let’s check routing information on out Hub PE: BGP table version is 50, local router ID is 10.80.80.1, vrf id 8 Default local pref 100, local AS 65001 Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed + i internal, r RIB-failure, S Stale, R Removed Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self Origin codes: i - IGP, e - EGP, ? - incomplete - Network Next Hop Metric LocPrf Weight Path - *> 10.50.50.0/24 10.0.0.7@0< 0 100 0 i - * 10.0.0.7@0< 0 100 0 i - *> 10.60.60.0/24 10.0.0.10@0< 0 100 0 i - * 10.0.0.10@0< 0 100 0 i - * 10.80.80.0/24 10.80.80.2 0 0 65035 ? - * 0.0.0.0 0 32768 i - *> 0.0.0.0 0 32768 ? - *> 10.110.110.0/24 172.16.80.2@9< 0 0 65050 i - *> 10.210.210.0/24 10.0.0.9@0< 0 100 0 65050 i - * 10.0.0.9@0< 0 100 0 65050 i - *> 10.0.0.80/32 10.0.0.7@0< 0 100 0 65035 i - * 10.0.0.7@0< 0 100 0 65035 i - *> 10.0.0.90/32 10.0.0.10@0< 0 100 0 65035 i - * 10.0.0.10@0< 0 100 0 65035 i + Network Next Hop Metric LocPrf Weight Path + *> 10.50.50.0/24 10.0.0.7@0< 0 100 0 i + * 10.0.0.7@0< 0 100 0 i + *> 10.60.60.0/24 10.0.0.10@0< 0 100 0 i + * 10.0.0.10@0< 0 100 0 i + * 10.80.80.0/24 10.80.80.2 0 0 65035 ? + * 0.0.0.0 0 32768 i + *> 0.0.0.0 0 32768 ? + *> 10.110.110.0/24 172.16.80.2@9< 0 0 65050 i + *> 10.210.210.0/24 10.0.0.9@0< 0 100 0 65050 i + * 10.0.0.9@0< 0 100 0 65050 i + *> 10.0.0.80/32 10.0.0.7@0< 0 100 0 65035 i + * 10.0.0.7@0< 0 100 0 65035 i + *> 10.0.0.90/32 10.0.0.10@0< 0 100 0 65035 i + * 10.0.0.10@0< 0 100 0 65035 i *> 10.0.0.100/32 - 10.80.80.2 0 0 65035 ? - *> 172.16.80.0/24 0.0.0.0@9< 0 32768 ? - 0.0.0.0@9< 0 32768 i - *> 172.16.100.0/24 10.0.0.9@0< 0 100 0 i - * 10.0.0.9@0< 0 100 0 i + 10.80.80.2 0 0 65035 ? + *> 172.16.80.0/24 0.0.0.0@9< 0 32768 ? + 0.0.0.0@9< 0 32768 i + *> 172.16.100.0/24 10.0.0.9@0< 0 100 0 i + * 10.0.0.9@0< 0 100 0 i - “show bgp vrf BLUE_HUB summary” for checking EBGP neighbor CE Hub device @@ -897,8 +901,8 @@ Now, let’s check routing information on out Hub PE: RIB entries 19, using 3648 bytes of memory Peers 1, using 21 KiB of memory - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 10.80.80.2 4 65035 15954 15972 0 0 0 01w4d01h 2 10 + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.80.80.2 4 65035 15954 15972 0 0 0 01w4d01h 2 10 - “show ip route vrf BLUE_HUB” to view the RIB in our Hub PE. With this command we are able to check the transport and @@ -909,30 +913,30 @@ Now, let’s check routing information on out Hub PE: vyos@VyOS-PE2:~$ show ip route vrf BLUE_HUB Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup VRF BLUE_HUB: K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 01w4d01h B> 10.50.50.0/24 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 B> 10.60.60.0/24 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 C>* 10.80.80.0/24 is directly connected, eth3, 01w4d01h B>* 10.110.110.0/24 [200/0] via 172.16.80.2, eth2 (vrf GREEN), weight 1, 01w4d01h B> 10.210.210.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 B> 10.0.0.80/32 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 B> 10.0.0.90/32 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 B>* 10.0.0.100/32 [20/0] via 10.80.80.2, eth3, weight 1, 01w4d01h B>* 172.16.80.0/24 [200/0] is directly connected, eth2 (vrf GREEN), weight 1, 01w4d01h B> 172.16.100.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 - “show bgp ipv4 vpn x.x.x.x/32” for checking best-path, extended community and remote label of specific destination @@ -945,19 +949,19 @@ Now, let’s check routing information on out Hub PE: Paths: (2 available, best #1) Not advertised to any peer 65035 - 10.0.0.7 from 10.0.0.1 (10.0.0.7) - Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) - Extended Community: RT:65035:1011 - Originator: 10.0.0.7, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Tue Oct 19 13:45:30 2021 + 10.0.0.7 from 10.0.0.1 (10.0.0.7) + Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1011 + Originator: 10.0.0.7, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Tue Oct 19 13:45:30 2021 65035 - 10.0.0.7 from 10.0.0.2 (10.0.0.7) - Origin IGP, metric 0, localpref 100, valid, internal - Extended Community: RT:65035:1011 - Originator: 10.0.0.7, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Wed Oct 13 12:39:37 2021 + 10.0.0.7 from 10.0.0.2 (10.0.0.7) + Origin IGP, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1011 + Originator: 10.0.0.7, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Wed Oct 13 12:39:37 2021 vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.90/32 BGP routing table entry for 10.60.60.1:1011:10.0.0.90/32 @@ -965,19 +969,19 @@ Now, let’s check routing information on out Hub PE: Paths: (2 available, best #1) Not advertised to any peer 65035 - 10.0.0.10 from 10.0.0.1 (10.0.0.10) - Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) - Extended Community: RT:65035:1011 - Originator: 10.0.0.10, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Tue Oct 19 13:45:30 2021 + 10.0.0.10 from 10.0.0.1 (10.0.0.10) + Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1011 + Originator: 10.0.0.10, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Tue Oct 19 13:45:30 2021 65035 - 10.0.0.10 from 10.0.0.2 (10.0.0.10) - Origin IGP, metric 0, localpref 100, valid, internal - Extended Community: RT:65035:1011 - Originator: 10.0.0.10, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Wed Oct 13 12:45:44 2021 + 10.0.0.10 from 10.0.0.2 (10.0.0.10) + Origin IGP, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1011 + Originator: 10.0.0.10, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Wed Oct 13 12:45:44 2021 Finally, let’s check the reachability between CEs: @@ -989,10 +993,10 @@ Finally, let’s check the reachability between CEs: # check rib vyos@VyOS-CE1-SPOKE:~$ show ip route Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup B 10.50.50.0/24 [20/0] via 10.50.50.1 inactive, weight 1, 6d07h53m C>* 10.50.50.0/24 is directly connected, eth0, 09w0d00h @@ -1027,10 +1031,10 @@ Finally, let’s check the reachability between CEs: # check rib vyos@VyOS-CE-HUB:~$ show ip route Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup B>* 10.50.50.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m B>* 10.60.60.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m @@ -1086,10 +1090,10 @@ Finally, let’s check the reachability between CEs: # check rib vyos@rt-ce2-SPOKE:~$ show ip route Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup B 10.60.60.0/24 [20/0] via 10.60.60.1 inactive, weight 1, 02w6d00h C>* 10.60.60.0/24 is directly connected, eth0, 02w6d00h @@ -1117,4 +1121,7 @@ Finally, let’s check the reachability between CEs: 3 * * * 4 10.0.0.100 (10.0.0.100) 7.504 ms 7.480 ms 7.488 ms -**Note:** At the moment, trace mpls doesn’t show labels/paths. So we’ll see * * * for the transit routers of the mpls backbone. +.. start_vyoslinter + +**Note:** At the moment, trace mpls doesn’t show labels/paths. So we’ll +see ``* * *`` for the transit routers of the mpls backbone. diff --git a/docs/configexamples/qos.rst b/docs/configexamples/qos.rst index 842719c5..268163df 100644 --- a/docs/configexamples/qos.rst +++ b/docs/configexamples/qos.rst @@ -9,8 +9,11 @@ QoS example Configuration 'dcsp' and shaper using QoS ========================================= -In this case, we'll try to make a simple lab using QoS and the general ability of the VyOS system. -We recommend you to go through the main article about `QoS `_ first. +In this case, we'll try to make a simple lab using QoS and the +general ability of the VyOS system. +We recommend you to go through the main article about +`QoS `_ +first. Using the general schema for example: @@ -20,8 +23,11 @@ Using the general schema for example: :align: center :alt: Network Topology Diagram -We have four hosts on the local network 172.17.1.0/24. All hosts are labeled CS0 by default. We need to replace labels on all hosts except vpc8. -We will replace the labels on the nearest router “VyOS3” using the IP addresses of the sources. +We have four hosts on the local network 172.17.1.0/24. All hosts are +labeled CS0 by default. We need to replace labels on all hosts except +vpc8. +We will replace the labels on the nearest router “VyOS3” using the IP +addresses of the sources. * 172.17.1.2 CS0 -> CS4 * 172.17.1.3 CS0 -> CS5 @@ -32,30 +38,37 @@ Next, we will replace only all CS4 labels on the “VyOS2” router. * CS4 -> CS5 -In the end, we will configure the traffic shaper using QoS mechanisms on the “VYOS2” router. +In the end, we will configure the traffic shaper using QoS mechanisms +on the “VYOS2” router. Configuration: ============== -Set IP addresses on all VPCs and a default gateway 172.17.1.1. We'll use in this case only static routes. -On the VyOS3 router, we need to change the 'dscp' labels for the VPCs. To do this, we use this configuration. +Set IP addresses on all VPCs and a default gateway 172.17.1.1. We'll +use in this case only static routes. +On the VyOS3 router, we need to change the 'dscp' labels for the +VPCs. To do this, we use this configuration. + +.. stop_vyoslinter .. code-block:: none - set interfaces ethernet eth0 address '10.1.1.100/24' - set interfaces ethernet eth1 address '172.17.1.1/24' - set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 - set qos policy shaper vyos3 class 10 match ADDRESS10 ip source address '172.17.1.2/32' - set qos policy shaper vyos3 class 10 set-dscp 'CS4' - set qos policy shaper vyos3 class 20 match ADDRESS20 ip source address '172.17.1.3/32' - set qos policy shaper vyos3 class 20 set-dscp 'CS5' - set qos policy shaper vyos3 class 30 match ADDRESS20 ip source address '172.17.1.4/32' - set qos policy shaper vyos3 class 30 set-dscp 'CS6' - set qos policy shaper vyos3 default bandwidth '10%' - set qos policy shaper vyos3 default ceiling '100%' - set qos policy shaper vyos3 default priority '7' - set qos policy shaper vyos3 default queue-type 'fair-queue' - set qos interface eth0 egress 'vyos3' + set interfaces ethernet eth0 address '10.1.1.100/24' + set interfaces ethernet eth1 address '172.17.1.1/24' + set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 + set qos policy shaper vyos3 class 10 match ADDRESS10 ip source address '172.17.1.2/32' + set qos policy shaper vyos3 class 10 set-dscp 'CS4' + set qos policy shaper vyos3 class 20 match ADDRESS20 ip source address '172.17.1.3/32' + set qos policy shaper vyos3 class 20 set-dscp 'CS5' + set qos policy shaper vyos3 class 30 match ADDRESS20 ip source address '172.17.1.4/32' + set qos policy shaper vyos3 class 30 set-dscp 'CS6' + set qos policy shaper vyos3 default bandwidth '10%' + set qos policy shaper vyos3 default ceiling '100%' + set qos policy shaper vyos3 default priority '7' + set qos policy shaper vyos3 default queue-type 'fair-queue' + set qos interface eth0 egress 'vyos3' + +.. start_vyoslinter Main rules: @@ -85,25 +98,27 @@ After the interface eth0 on router VyOS3 :align: center :alt: Network Topology Diagram -On the router, VyOS4 set all traffic as CS4. We have to configure the default class and class for changing all labels from CS0 to CS4 +On the router, VyOS4 set all traffic as CS4. We have to configure the +default class and class for changing all labels from CS0 to CS4 .. code-block:: none - set interfaces ethernet eth0 address '10.2.1.100/24' - set protocols static route 0.0.0.0/0 next-hop 10.2.1.1 - set qos policy shaper vyos4 class 10 bandwidth '100%' - set qos policy shaper vyos4 class 10 burst '15k' - set qos policy shaper vyos4 class 10 match ALL ether protocol 'all' - set qos policy shaper vyos4 class 10 queue-type 'fair-queue' - set qos policy shaper vyos4 class 10 set-dscp 'CS4' - set qos policy shaper vyos4 default bandwidth '10%' - set qos policy shaper vyos4 default burst '15k' - set qos policy shaper vyos4 default ceiling '100%' - set qos policy shaper vyos4 default priority '7' - set qos policy shaper vyos4 default queue-type 'fair-queue' + set interfaces ethernet eth0 address '10.2.1.100/24' + set protocols static route 0.0.0.0/0 next-hop 10.2.1.1 + set qos policy shaper vyos4 class 10 bandwidth '100%' + set qos policy shaper vyos4 class 10 burst '15k' + set qos policy shaper vyos4 class 10 match ALL ether protocol 'all' + set qos policy shaper vyos4 class 10 queue-type 'fair-queue' + set qos policy shaper vyos4 class 10 set-dscp 'CS4' + set qos policy shaper vyos4 default bandwidth '10%' + set qos policy shaper vyos4 default burst '15k' + set qos policy shaper vyos4 default ceiling '100%' + set qos policy shaper vyos4 default priority '7' + set qos policy shaper vyos4 default queue-type 'fair-queue' set qos interface eth0 egress 'vyos4' -Next on the router VyOS2 we will change labels on all incoming traffic only from CS4-> CS6 +Next on the router VyOS2 we will change labels on all incoming +traffic only from CS4-> CS6 .. image:: /_static/images/qos5.png :width: 80% @@ -112,20 +127,20 @@ Next on the router VyOS2 we will change labels on all incoming traffic only from .. code-block:: none - set interfaces ethernet eth0 address '10.1.1.1/24' - set interfaces ethernet eth1 address '10.2.1.1/24' - set interfaces ethernet eth2 address '10.9.9.1/24' - set protocols static route 172.17.1.0/24 next-hop 10.1.1.100 - set qos policy shaper vyos2 class 10 bandwidth '100%' - set qos policy shaper vyos2 class 10 burst '15k' - set qos policy shaper vyos2 class 10 match VYOS2 ip dscp 'CS4' - set qos policy shaper vyos2 class 10 queue-type 'fair-queue' - set qos policy shaper vyos2 class 10 set-dscp 'CS5' - set qos policy shaper vyos2 default bandwidth '100%' - set qos policy shaper vyos2 default burst '15k' - set qos policy shaper vyos2 default ceiling '100%' - set qos policy shaper vyos2 default priority '7' - set qos policy shaper vyos2 default queue-type 'fair-queue' + set interfaces ethernet eth0 address '10.1.1.1/24' + set interfaces ethernet eth1 address '10.2.1.1/24' + set interfaces ethernet eth2 address '10.9.9.1/24' + set protocols static route 172.17.1.0/24 next-hop 10.1.1.100 + set qos policy shaper vyos2 class 10 bandwidth '100%' + set qos policy shaper vyos2 class 10 burst '15k' + set qos policy shaper vyos2 class 10 match VYOS2 ip dscp 'CS4' + set qos policy shaper vyos2 class 10 queue-type 'fair-queue' + set qos policy shaper vyos2 class 10 set-dscp 'CS5' + set qos policy shaper vyos2 default bandwidth '100%' + set qos policy shaper vyos2 default burst '15k' + set qos policy shaper vyos2 default ceiling '100%' + set qos policy shaper vyos2 default priority '7' + set qos policy shaper vyos2 default queue-type 'fair-queue' set qos interface eth2 egress 'vyos2' .. image:: /_static/images/qos6.png @@ -154,23 +169,26 @@ Next on the router VyOS2 we will change labels on all incoming traffic only from :align: center :alt: Network Topology Diagram -In the end, on the router “VyOS2” we will set outgoing bandwidth limits between the “VyOS3” and “VyOS1” routers. Let's set a limit for IP 10.1.1.100 = 5 Mbps(Tx). We will check the result of the work with the help of the “iPerf” utility. +In the end, on the router “VyOS2” we will set outgoing bandwidth +limits between the “VyOS3” and “VyOS1” routers. Let's set a limit for +IP 10.1.1.100 = 5 Mbps(Tx). We will check the result of the work +with the help of the “iPerf” utility. Set up bandwidth limits on the eth2 interface of the router “VyOS2”. .. code-block:: none - vyos@vyos2# show qos policy shaper vyos2 class 20 - bandwidth 5mbit - description "for VyOS3 eth0" - match VyOS3 { - ip { - source { - address 10.1.1.100/32 - } - } - } + vyos@vyos2# show qos policy shaper vyos2 class 20 + bandwidth 5mbit + description "for VyOS3 eth0" + match VyOS3 { + ip { + source { + address 10.1.1.100/32 + } + } + } Check the result. diff --git a/docs/configuration/trafficpolicy/index.rst b/docs/configuration/trafficpolicy/index.rst index 5414ce77..13cfb9dc 100644 --- a/docs/configuration/trafficpolicy/index.rst +++ b/docs/configuration/trafficpolicy/index.rst @@ -53,29 +53,29 @@ They can be **decimal** prefixes. .. code-block:: none - kbit (10^3) kilobit per second - mbit (10^6) megabit per second - gbit (10^9) gigabit per second - tbit (10^12) terabit per second - - kbps (8*10^3) kilobyte per second - mbps (8*10^6) megabyte per second - gbps (8*10^9) gigabyte per second - tbps (8*10^12) terabyte per second + kbit (10^3) kilobit per second + mbit (10^6) megabit per second + gbit (10^9) gigabit per second + tbit (10^12) terabit per second + + kbps (8*10^3) kilobyte per second + mbps (8*10^6) megabyte per second + gbps (8*10^9) gigabyte per second + tbps (8*10^12) terabyte per second Or **binary** prefixes. .. code-block:: none - kibit (2^10 = 1024) kibibit per second - mibit (2^20 = 1024^2) mebibit per second - gibit (2^30 = 1024^3) gibibit per second - tbit (2^40 = 1024^4) tebibit per second + kibit (2^10 = 1024) kibibit per second + mibit (2^20 = 1024^2) mebibit per second + gibit (2^30 = 1024^3) gibibit per second + tbit (2^40 = 1024^4) tebibit per second - kibps (1024*8) kibibyte (KiB) per second - mibps (1024^2*8) mebibyte (MiB) per second - gibps (1024^3*8) gibibyte (GiB) per second - tibps (1024^4*8) tebibyte (TiB) per second + kibps (1024*8) kibibyte (KiB) per second + mibps (1024^2*8) mebibyte (MiB) per second + gibps (1024^3*8) gibibyte (GiB) per second + tibps (1024^4*8) tebibyte (TiB) per second Suffixes @@ -88,7 +88,7 @@ A *bit* is written as **bit**, kbit (kilobits per second) mbit (megabits per second) gbit (gigabits per second) - tbit (terabits per second) + tbit (terabits per second) while a *byte* is written as a single **b**. @@ -134,10 +134,13 @@ configuring it. identify it, it also defines its priority. +.. stop_vyoslinter + .. code-block:: none set qos policy class match +.. start_vyoslinter In the command above, we set the type of policy we are going to work with and the name we choose for it; a class (so that we can @@ -199,10 +202,14 @@ is based on marks done by the firewall, You can also write a description for a filter: +.. stop_vyoslinter + .. code-block:: none set qos policy shaper MY-SHAPER class 30 match MY-FIRST-FILTER description "My filter description" +.. start_vyoslinter + .. note:: An IPv4 TCP filter will only match packets with an IPv4 header @@ -281,9 +288,11 @@ you want to do with the traffic of that class, what specific Traffic-Control treatment you want to give it. You will have different possibilities depending on the Traffic Policy you are configuring. +.. stop_vyoslinter + .. code-block:: none - vyos@vyos# set qos policy shaper MY-SHAPER class 30 + vyos@vyos# set qos policy shaper MY-SHAPER class 30 Possible completions: bandwidth Available bandwidth for this policy (default: auto) burst Burst size for this class (default: 15k) @@ -299,7 +308,8 @@ possibilities depending on the Traffic Policy you are configuring. queue-type Queue type for default traffic (default: fq-codel) set-dscp Change the Differentiated Services (DiffServ) field in the IP header target Acceptable minimum standing/persistent queue delay (default: 5) - + +.. start_vyoslinter For instance, with :code:`set qos policy shaper MY-SHAPER class 30 set-dscp EF` you would be modifying the DSCP field value of packets in @@ -1140,9 +1150,11 @@ parameters. Random Early Detection (RED) +.. stop_vyoslinter + .. code-block:: none - vyos@vyos# set qos policy shaper HTB class 10 + vyos@vyos# set qos policy shaper HTB class 10 Possible completions: bandwidth Available bandwidth for this policy (default: auto) burst Burst size for this class (default: 15k) @@ -1159,6 +1171,8 @@ parameters. set-dscp Change the Differentiated Services (DiffServ) field in the IP header target Acceptable minimum standing/persistent queue delay (default: 5) +.. start_vyoslinter + .. note:: If you configure a class for **VoIP traffic**, don't give it any @@ -1174,6 +1188,8 @@ Example A simple example of Shaper using priorities. +.. stop_vyoslinter + .. code-block:: none set qos policy shaper MY-HTB bandwidth '50mbit' @@ -1195,6 +1211,8 @@ A simple example of Shaper using priorities. set qos policy shaper MY-HTB default priority '7' set qos policy shaper MY-HTB default queue-type 'fair-queue' +.. start_vyoslinter + .. _CAKE: CAKE @@ -1255,8 +1273,8 @@ edge. .. cfgcmd:: set qos policy cake flow-isolation triple-isolate - **(Default)** Flows are defined by the 5-tuple, fairness is applied over source and - destination addresses and also over individual flows. + **(Default)** Flows are defined by the 5-tuple, fairness is applied + over source and destination addresses and also over individual flows. .. cfgcmd:: set qos policy cake rtt diff --git a/docs/installation/install.rst b/docs/installation/install.rst index 80e4a5f6..4071af64 100644 --- a/docs/installation/install.rst +++ b/docs/installation/install.rst @@ -147,7 +147,7 @@ To verify a VyOS image starting with VyOS ``1.3.0-rc6``, run: $ minisign -V -P RWSIhkR/dkM2DSaBRniv/bbbAf8hmDqdbOEmgXkf1RxRoxzodgKcDyGq -m vyos-1.5-rolling-202409250007-generic-amd64.iso vyos-1.5-rolling-202409250007-generic-amd64.iso.minisig Signature and comment signature verified - Trusted comment: timestamp:1727223408 file:vyos-1.5-rolling-202409250007-generic-amd64.iso hashed + Trusted comment: timestamp:1727223408 file:vyos-1.5-rolling-202409250007-generic-amd64.iso hashed During an image upgrade, VyOS runs the following command: -- cgit v1.2.3 From b5858598e32441560da34a4a62dc687fe4df9c16 Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Fri, 10 Apr 2026 21:26:49 +0300 Subject: docs: standardize RST heading hierarchy to # overline across 21 files (#1827) Normalize top-level page headings from = or * underline-only to # overline+underline format, following RST/Sphinx best practices for consistent heading hierarchy. Co-authored-by: Claude Opus 4.6 (1M context) --- docs/automation/vyos-ansible.rst | 3 ++- docs/automation/vyos-napalm.rst | 3 ++- docs/automation/vyos-netmiko.rst | 3 ++- docs/automation/vyos-pyvyos.rst | 3 ++- docs/configexamples/azure-vpn-bgp.rst | 3 ++- docs/configexamples/azure-vpn-dual-bgp.rst | 3 ++- docs/configexamples/firewall.rst | 6 ++++-- docs/configexamples/fwall-and-bridge.rst | 3 ++- docs/configexamples/fwall-and-vrf.rst | 3 ++- docs/configexamples/index.rst | 3 ++- docs/configexamples/policy-based-ipsec-and-firewall.rst | 3 ++- docs/configexamples/site-2-site-cisco.rst | 3 ++- docs/configexamples/wan-load-balancing.rst | 3 ++- docs/configexamples/zone-policy.rst | 3 ++- docs/configuration/interfaces/tunnel.rst | 3 ++- docs/configuration/service/mdns.rst | 3 ++- docs/configuration/system/lcd.rst | 4 ++-- docs/installation/update.rst | 3 ++- docs/installation/virtual/docker.rst | 4 ++-- docs/installation/virtual/libvirt.rst | 4 ++-- docs/installation/virtual/proxmox.rst | 4 ++-- 21 files changed, 44 insertions(+), 26 deletions(-) (limited to 'docs/installation') diff --git a/docs/automation/vyos-ansible.rst b/docs/automation/vyos-ansible.rst index 0ebcb924..993d1b21 100644 --- a/docs/automation/vyos-ansible.rst +++ b/docs/automation/vyos-ansible.rst @@ -2,8 +2,9 @@ .. _vyos-ansible: +####### Ansible -======= +####### VyOS supports configuration via ansible. Need to install ``ansible`` and ``python3-paramiko`` module diff --git a/docs/automation/vyos-napalm.rst b/docs/automation/vyos-napalm.rst index 75e20b3c..dc4d154f 100644 --- a/docs/automation/vyos-napalm.rst +++ b/docs/automation/vyos-napalm.rst @@ -2,8 +2,9 @@ .. _vyos-napalm: +###### Napalm -====== +###### VyOS supports some napalm_ functions for configuration and op-mode. It requires more tests. diff --git a/docs/automation/vyos-netmiko.rst b/docs/automation/vyos-netmiko.rst index 075b0f34..53082e52 100644 --- a/docs/automation/vyos-netmiko.rst +++ b/docs/automation/vyos-netmiko.rst @@ -2,8 +2,9 @@ .. _vyos-netmiko: +####### Netmiko -======= +####### VyOS supports configuration via netmiko_. It requires to install ``python3-netmiko`` module. diff --git a/docs/automation/vyos-pyvyos.rst b/docs/automation/vyos-pyvyos.rst index 948534f8..c178aeb6 100644 --- a/docs/automation/vyos-pyvyos.rst +++ b/docs/automation/vyos-pyvyos.rst @@ -2,8 +2,9 @@ .. _vyos-pyvyos: +###### pyvyos -====== +###### pyvyos is a Python library designed for interacting with VyOS devices through their API. This documentation is intended to guide you in using pyvyos for diff --git a/docs/configexamples/azure-vpn-bgp.rst b/docs/configexamples/azure-vpn-bgp.rst index 03d637d8..597a4d15 100644 --- a/docs/configexamples/azure-vpn-bgp.rst +++ b/docs/configexamples/azure-vpn-bgp.rst @@ -2,8 +2,9 @@ .. _examples-azure-vpn-bgp: +############################################################ Route-Based Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) ------------------------------------------------------------- +############################################################ This guide shows an example of a route-based IKEv2 site-to-site VPN to Azure using VTI and BGP for dynamic routing updates. diff --git a/docs/configexamples/azure-vpn-dual-bgp.rst b/docs/configexamples/azure-vpn-dual-bgp.rst index d37aa85c..04a6a631 100644 --- a/docs/configexamples/azure-vpn-dual-bgp.rst +++ b/docs/configexamples/azure-vpn-dual-bgp.rst @@ -2,8 +2,9 @@ .. _examples-azure-vpn-dual-bgp: +###################################################################### Route-Based Redundant Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) ----------------------------------------------------------------------- +###################################################################### This guide shows an example of a redundant (active-active) route-based IKEv2 site-to-site VPN to Azure using VTI diff --git a/docs/configexamples/firewall.rst b/docs/configexamples/firewall.rst index a1ad7e19..6968eb04 100644 --- a/docs/configexamples/firewall.rst +++ b/docs/configexamples/firewall.rst @@ -1,9 +1,11 @@ :lastproofread: 2024-09-11 +################# Firewall Examples -================= +################# -This section contains examples of firewall configurations for various deployments. +This section contains examples of firewall configurations for various +deployments. .. toctree:: :maxdepth: 2 diff --git a/docs/configexamples/fwall-and-bridge.rst b/docs/configexamples/fwall-and-bridge.rst index 34744a5d..134dd6c0 100644 --- a/docs/configexamples/fwall-and-bridge.rst +++ b/docs/configexamples/fwall-and-bridge.rst @@ -1,7 +1,8 @@ :lastproofread: 2024-09-11 +########################### Bridge and firewall example ---------------------------- +########################### Scenario and requirements ^^^^^^^^^^^^^^^^^^^^^^^^^ diff --git a/docs/configexamples/fwall-and-vrf.rst b/docs/configexamples/fwall-and-vrf.rst index 38663a18..992b625e 100644 --- a/docs/configexamples/fwall-and-vrf.rst +++ b/docs/configexamples/fwall-and-vrf.rst @@ -1,5 +1,6 @@ +######################## VRF and firewall example ------------------------- +######################## Scenario and requirements ^^^^^^^^^^^^^^^^^^^^^^^^^ diff --git a/docs/configexamples/index.rst b/docs/configexamples/index.rst index 7f173b4a..b5985d7f 100644 --- a/docs/configexamples/index.rst +++ b/docs/configexamples/index.rst @@ -1,7 +1,8 @@ .. _examples: +######################## Configuration Blueprints -======================== +######################## This chapter contains various configuration examples: diff --git a/docs/configexamples/policy-based-ipsec-and-firewall.rst b/docs/configexamples/policy-based-ipsec-and-firewall.rst index 60f8b888..5d98e944 100644 --- a/docs/configexamples/policy-based-ipsec-and-firewall.rst +++ b/docs/configexamples/policy-based-ipsec-and-firewall.rst @@ -1,8 +1,9 @@ .. _examples-policy-based-ipsec-and-firewall: +######################################################## Policy-Based Site-to-Site VPN and Firewall Configuration --------------------------------------------------------- +######################################################## This guide shows an example policy-based IKEv2 site-to-site VPN between two VyOS routers, and firewall configuration. diff --git a/docs/configexamples/site-2-site-cisco.rst b/docs/configexamples/site-2-site-cisco.rst index 5b5f1fd7..e8322002 100644 --- a/docs/configexamples/site-2-site-cisco.rst +++ b/docs/configexamples/site-2-site-cisco.rst @@ -1,7 +1,8 @@ .. _examples-site-2-site-cisco: +############################################# Site-to-Site IPSec VPN to Cisco using FlexVPN ---------------------------------------------- +############################################# This guide shows a sample configuration for FlexVPN site-to-site Internet Protocol Security (IPsec)/Generic Routing Encapsulation (GRE) tunnel. diff --git a/docs/configexamples/wan-load-balancing.rst b/docs/configexamples/wan-load-balancing.rst index 0952cfe5..38490616 100644 --- a/docs/configexamples/wan-load-balancing.rst +++ b/docs/configexamples/wan-load-balancing.rst @@ -4,8 +4,9 @@ .. stop_vyoslinter # pictures and text have to change +########################## WAN Load Balancer examples -========================== +########################## Example 1: Distributing load evenly diff --git a/docs/configexamples/zone-policy.rst b/docs/configexamples/zone-policy.rst index d0101ebf..0c1c2617 100644 --- a/docs/configexamples/zone-policy.rst +++ b/docs/configexamples/zone-policy.rst @@ -2,8 +2,9 @@ .. _examples-zone-policy: +################### Zone-Policy example -------------------- +################### .. note:: In :vytask:`T2199` the syntax of the zone configuration was changed. The zone configuration moved from ``zone-policy zone `` to ``firewall diff --git a/docs/configuration/interfaces/tunnel.rst b/docs/configuration/interfaces/tunnel.rst index 27c47a91..f1376cdf 100644 --- a/docs/configuration/interfaces/tunnel.rst +++ b/docs/configuration/interfaces/tunnel.rst @@ -2,8 +2,9 @@ .. _tunnel-interface: +###### Tunnel -====== +###### Tunnel interfaces are virtual links that transmit encapsulated traffic between private networks or hosts across public infrastructure, such as the Internet. diff --git a/docs/configuration/service/mdns.rst b/docs/configuration/service/mdns.rst index b4ca1fd1..8a26722e 100644 --- a/docs/configuration/service/mdns.rst +++ b/docs/configuration/service/mdns.rst @@ -1,5 +1,6 @@ +############# mDNS Repeater -------------- +############# Starting with VyOS 1.2 a :abbr:`mDNS (Multicast DNS)` repeater functionality is provided. Additional information can be obtained from diff --git a/docs/configuration/system/lcd.rst b/docs/configuration/system/lcd.rst index 808d45a2..3fcf01dd 100644 --- a/docs/configuration/system/lcd.rst +++ b/docs/configuration/system/lcd.rst @@ -1,8 +1,8 @@ .. _system-display: -******************** +#################### System Display (LCD) -******************** +#################### The system LCD :abbr:`LCD (Liquid-crystal display)` option is for users running VyOS on hardware that features an LCD display. This is typically a small display diff --git a/docs/installation/update.rst b/docs/installation/update.rst index 967f494b..81750dc1 100644 --- a/docs/installation/update.rst +++ b/docs/installation/update.rst @@ -2,8 +2,9 @@ .. _update_vyos: +########### Update VyOS -=========== +########### New system images can be added using the :opcmd:`add system image` command. This command extracts the image and prompts you to use the current system diff --git a/docs/installation/virtual/docker.rst b/docs/installation/virtual/docker.rst index 282e4e63..d62c011b 100644 --- a/docs/installation/virtual/docker.rst +++ b/docs/installation/virtual/docker.rst @@ -2,9 +2,9 @@ .. _docker: -****************************** +############################## Run VyOS in a Docker Container -****************************** +############################## Docker is an open-source project for deploying applications as standardized units called containers. Deploying VyOS in a container provides a simple and diff --git a/docs/installation/virtual/libvirt.rst b/docs/installation/virtual/libvirt.rst index 20b3ff1a..3aa665c0 100644 --- a/docs/installation/virtual/libvirt.rst +++ b/docs/installation/virtual/libvirt.rst @@ -2,9 +2,9 @@ .. _libvirt: -**************************** +############################ Run VyOS on Libvirt QEMU/KVM -**************************** +############################ Libvirt is an open-source API, daemon, and management tool for managing platform virtualization. You can deploy VyOS on libvirt KVM in several ways: diff --git a/docs/installation/virtual/proxmox.rst b/docs/installation/virtual/proxmox.rst index 070627aa..6bd030e3 100644 --- a/docs/installation/virtual/proxmox.rst +++ b/docs/installation/virtual/proxmox.rst @@ -2,9 +2,9 @@ .. _proxmox: -****************** +################## Running on Proxmox -****************** +################## Proxmox is an open-source platform for virtualization. Visit https://vyos.io to download a ``.qcow2`` image that you can import into -- cgit v1.2.3 From ac00e1c4a6b456628e412123383450653f668bdb Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Fri, 10 Apr 2026 21:46:24 +0300 Subject: docs: remove TODO markers, fix stub notes, add linter markers (#1828) Remove TODO tracking comments, reformat stub notes with inline links, add stop/start_vyoslinter markers around long code blocks, and fix minor structural issues across 23 documentation files. Co-authored-by: Claude Opus 4.6 (1M context) --- docs/automation/vyos-govyos.rst | 20 +++- docs/automation/vyos-salt.rst | 24 +++- docs/configuration/highavailability/index.rst | 45 +++++++- docs/configuration/loadbalancing/wan.rst | 6 +- docs/configuration/nat/nat64.rst | 3 - docs/configuration/nat/nat66.rst | 4 + docs/configuration/policy/examples.rst | 3 - docs/configuration/policy/index.rst | 2 +- docs/configuration/protocols/static.rst | 59 ++++++---- docs/configuration/service/eventhandler.rst | 126 +++++++++++++-------- docs/configuration/service/snmp.rst | 3 - docs/configuration/system/flow-accounting.rst | 14 ++- docs/configuration/system/sysctl.rst | 10 +- docs/configuration/vpn/index.rst | 2 +- docs/configuration/vpn/ipsec/index.rst | 2 + .../configuration/vpn/ipsec/remoteaccess_ipsec.rst | 6 +- .../vpn/ipsec/troubleshooting_ipsec.rst | 8 +- docs/configuration/vpn/openconnect.rst | 44 ++++++- docs/configuration/vpn/rsa-keys.rst | 8 ++ docs/installation/cloud/oracle.rst | 8 +- docs/installation/virtual/eve-ng.rst | 8 +- docs/operation/information.rst | 17 ++- docs/vpp/configuration/ipfix.rst | 16 ++- 23 files changed, 311 insertions(+), 127 deletions(-) (limited to 'docs/installation') diff --git a/docs/automation/vyos-govyos.rst b/docs/automation/vyos-govyos.rst index 32222441..659c2b6e 100644 --- a/docs/automation/vyos-govyos.rst +++ b/docs/automation/vyos-govyos.rst @@ -2,17 +2,21 @@ .. _vyos-govyos: +####### go-vyos -======= +####### go-vyos is a Go library designed for interacting with VyOS devices through their REST API. This documentation is intended to guide you in using go-vyos for programmatic management of your VyOS devices. -- `go-vyos Documentation & Source Code on GitHub `_ +- `go-vyos Documentation & Source Code on GitHub + `_ allows you to access and contribute to the library's code. -- `go-vyos on pkg.go.dev `_ for detailed instructions - on the installation, configuration, and operation of the go-vyos library. +- `go-vyos on pkg.go.dev + `_ + for detailed instructions on the installation, configuration, and + operation of the go-vyos library. Installation @@ -30,11 +34,15 @@ Getting Started Importing and Disabling TLS Verification ------------------------------------------------- +.. stop_vyoslinter + .. code-block:: none import "github.com/ganawaj/go-vyos/vyos" client := vyos.NewClient(nil).WithToken("AUTH_KEY").WithURL("https://192.168.0.1").Insecure() +.. start_vyoslinter + Initializing a VyDevice Object ------------------------------ @@ -64,6 +72,8 @@ Using go-vyos Configure, then Set ^^^^^^^^^^^^^^^^^^^^^^^^ +.. stop_vyoslinter + .. code-block:: none out, resp, err := c.Conf.Set(ctx, "interfaces ethernet eth0 address 192.168.1.1/24") @@ -73,6 +83,8 @@ Configure, then Set fmt.Println(out.Success) +.. start_vyoslinter + Show a Single Object Value ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ diff --git a/docs/automation/vyos-salt.rst b/docs/automation/vyos-salt.rst index 12be32a1..3a5b17d7 100644 --- a/docs/automation/vyos-salt.rst +++ b/docs/automation/vyos-salt.rst @@ -4,8 +4,9 @@ .. include:: /_include/need_improvement.txt +#### Salt -==== +#### VyOS supports op-mode and configuration via salt_. @@ -172,6 +173,8 @@ Examples Example of op-mode: +.. stop_vyoslinter + .. code-block:: none / # salt r11-proxy netmiko.send_command 'show interfaces ethernet eth0 brief' host=192.0.2.14 device_type=vyos username=vyos password=vyos @@ -180,10 +183,14 @@ Example of op-mode: Interface IP Address S/L Description --------- ---------- --- ----------- eth0 192.0.2.14/24 u/u Upstream - / # + / # + +.. start_vyoslinter Example of configuration: +.. stop_vyoslinter + .. code-block:: none / # salt r11-proxy netmiko.send_config config_commands=['set interfaces ethernet eth0 description Link_to_WAN'] commit=True host=192.0.2.14 device_type=vyos username=vyos password=vyos @@ -196,7 +203,12 @@ Example of configuration: vyos@r14# / # -Example of configuration commands from the file "/srv/salt/states/commands.txt" +.. start_vyoslinter + +Example of configuration commands from the file +"/srv/salt/states/commands.txt" + +.. stop_vyoslinter .. code-block:: none @@ -212,5 +224,9 @@ Example of configuration commands from the file "/srv/salt/states/commands.txt" vyos@r1# / # +.. start_vyoslinter + .. _salt: https://docs.saltproject.io/en/latest/contents.html -.. _netmiko: https://docs.saltproject.io/en/latest/ref/modules/all/salt.modules.netmiko_mod.html#module-salt.modules.netmiko_mod \ No newline at end of file +.. stop_vyoslinter +.. _netmiko: https://docs.saltproject.io/en/latest/ref/modules/all/salt.modules.netmiko_mod.html#module-salt.modules.netmiko_mod +.. start_vyoslinter \ No newline at end of file diff --git a/docs/configuration/highavailability/index.rst b/docs/configuration/highavailability/index.rst index 40465c30..c82391c7 100644 --- a/docs/configuration/highavailability/index.rst +++ b/docs/configuration/highavailability/index.rst @@ -2,8 +2,9 @@ .. _high-availability: +################# High availability -================= +################# VRRP (Virtual Router Redundancy Protocol) provides active/backup redundancy for routers. Every VRRP router has a physical IP/IPv6 address, and a virtual @@ -252,8 +253,12 @@ need to configure it. But if necessary, Gratuitous ARP can be configured in 0 if not defined. +.. stop_vyoslinter + .. cfgcmd:: set high-availability vrrp global-parameters garp master-delay <1-255> +.. start_vyoslinter + .. cfgcmd:: set high-availability vrrp group garp master-delay <1-255> Set delay for second set of gratuitous ARPs after transition to MASTER. @@ -316,37 +321,46 @@ vice versa and can be used to enable or disable certain services, for example. chmod +x /config/scripts/script-name.sh -.. warning:: It is not recommended to change VRRP configuration inside health-check - and transition scripts. +.. warning:: It is not recommended to change VRRP configuration + inside health-check and transition scripts. Health check scripts ^^^^^^^^^^^^^^^^^^^^ -There is the ability to run an arbitrary script at regular intervals according to health-check -parameters. If a script returns 0, it indicates success. If a script returns anything -else, it will indicate that the VRRP instance should enter the FAULT state. +There is the ability to run an arbitrary script at regular intervals +according to health-check parameters. If a script returns 0, it +indicates success. If a script returns anything else, it will indicate +that the VRRP instance should enter the FAULT state. This setup will make the VRRP process execute the ``/config/scripts/vrrp-check.sh script`` every 60 seconds, and transition the group to the fault state if it fails (i.e. exits with non-zero status) three times: +.. stop_vyoslinter + .. code-block:: none set high-availability vrrp group Foo health-check script /config/scripts/vrrp-check.sh set high-availability vrrp group Foo health-check interval 60 set high-availability vrrp group Foo health-check failure-count 3 +.. start_vyoslinter + When the vrrp group is a member of the sync group will use only the sync group health check script. This example shows how to configure it for the sync group: +.. stop_vyoslinter + .. code-block:: none set high-availability vrrp sync-group Bar health-check script /config/scripts/vrrp-check.sh set high-availability vrrp sync-group Bar health-check interval 60 set high-availability vrrp sync-group Bar health-check failure-count 3 +.. start_vyoslinter + Transition scripts ^^^^^^^^^^^^^^^^^^ @@ -356,12 +370,16 @@ This setup will make the VRRP process execute the ``/config/scripts/vrrp-fail.sh`` with argument ``Foo`` when VRRP fails, and the ``/config/scripts/vrrp-master.sh`` when the router becomes the master: +.. stop_vyoslinter + .. code-block:: none set high-availability vrrp group Foo transition-script backup "/config/scripts/vrrp-fail.sh Foo" set high-availability vrrp group Foo transition-script fault "/config/scripts/vrrp-fail.sh Foo" set high-availability vrrp group Foo transition-script master "/config/scripts/vrrp-master.sh Foo" +.. start_vyoslinter + To know more about scripting, check the :ref:`command-scripting` section. Virtual-server @@ -401,10 +419,14 @@ Health-check ^^^^^^^^^^^^ Custom health-check script allows checking real-server availability +.. stop_vyoslinter + .. code-block:: none set high-availability virtual-server 203.0.113.1 real-server 192.0.2.11 health-check script +.. start_vyoslinter + Fwmark ^^^^^^ Firewall mark. It possible to loadbalancing traffic based on ``fwmark`` value @@ -417,10 +439,14 @@ Real server ^^^^^^^^^^^ Real server IP address and port +.. stop_vyoslinter + .. code-block:: none set high-availability virtual-server 203.0.113.1 real-server 192.0.2.11 port '80' +.. start_vyoslinter + Example ^^^^^^^ @@ -432,6 +458,8 @@ protocol TCP is balanced between 2 real servers ``192.0.2.11`` and Real server is auto-excluded if port check with this server fail. +.. stop_vyoslinter + .. code-block:: none set interfaces ethernet eth0 address '203.0.113.11/24' @@ -451,6 +479,7 @@ Real server is auto-excluded if port check with this server fail. set high-availability virtual-server 203.0.113.1 real-server 192.0.2.11 port '80' set high-availability virtual-server 203.0.113.1 real-server 192.0.2.12 port '80' +.. start_vyoslinter A firewall mark ``fwmark`` allows using multiple ports for high-availability virtual-server. @@ -460,6 +489,8 @@ In this example all traffic destined to ports "80, 2222, 8888" protocol TCP marks to fwmark "111" and balanced between 2 real servers. Port "0" is required if multiple ports are used. +.. stop_vyoslinter + .. code-block:: none set interfaces ethernet eth0 address 'dhcp' @@ -483,6 +514,8 @@ Port "0" is required if multiple ports are used. set nat source rule 100 source address '192.0.2.0/24' set nat source rule 100 translation address 'masquerade' +.. start_vyoslinter + Op-mode check virtual-server status .. code-block:: none diff --git a/docs/configuration/loadbalancing/wan.rst b/docs/configuration/loadbalancing/wan.rst index 3d5a3cc6..b9a513bc 100644 --- a/docs/configuration/loadbalancing/wan.rst +++ b/docs/configuration/loadbalancing/wan.rst @@ -1,7 +1,11 @@ :lastproofread: 2026-04-06 +################## WAN load balancing -================== +################## + +.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd + directives for command coverage tracking. The load balancer distributes outbound traffic across two or more interfaces. If a path fails, the load balancer balances traffic across the diff --git a/docs/configuration/nat/nat64.rst b/docs/configuration/nat/nat64.rst index 8608da9f..04ba56f4 100644 --- a/docs/configuration/nat/nat64.rst +++ b/docs/configuration/nat/nat64.rst @@ -4,9 +4,6 @@ NAT64 ##### -.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd - directives for command coverage tracking. - :abbr:`NAT64 (IPv6-to-IPv4 Prefix Translation)` is a critical component in modern networking, facilitating communication between IPv6 and IPv4 networks. This documentation outlines the setup, configuration, and usage of the NAT64 diff --git a/docs/configuration/nat/nat66.rst b/docs/configuration/nat/nat66.rst index d7d8e8be..be5cf2b3 100644 --- a/docs/configuration/nat/nat66.rst +++ b/docs/configuration/nat/nat66.rst @@ -163,6 +163,8 @@ a VyOS HA pair. Configure both routers (a and b) for DHCPv6-PD via dummy interface: +.. stop_vyoslinter + .. code-block:: none set interfaces dummy dum1 description 'DHCPv6-PD NPT dummy' @@ -173,6 +175,8 @@ Configure both routers (a and b) for DHCPv6-PD via dummy interface: set interfaces bonding bond0 vif 20 dhcpv6-options rapid-commit commit +.. start_vyoslinter + Get the DHCPv6-PD prefixes from both routers: .. code-block:: none diff --git a/docs/configuration/policy/examples.rst b/docs/configuration/policy/examples.rst index 11c1d625..d822d839 100644 --- a/docs/configuration/policy/examples.rst +++ b/docs/configuration/policy/examples.rst @@ -2,9 +2,6 @@ BGP Example ########### -.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd - directives for command coverage tracking. - **Policy definition:** .. code-block:: none diff --git a/docs/configuration/policy/index.rst b/docs/configuration/policy/index.rst index 51f60479..0394eb21 100644 --- a/docs/configuration/policy/index.rst +++ b/docs/configuration/policy/index.rst @@ -1,4 +1,4 @@ -:lastproofread:2021-07-12 +:lastproofread: 2021-07-12 .. include:: /_include/need_improvement.txt diff --git a/docs/configuration/protocols/static.rst b/docs/configuration/protocols/static.rst index e9016abc..eb5a439c 100644 --- a/docs/configuration/protocols/static.rst +++ b/docs/configuration/protocols/static.rst @@ -70,12 +70,14 @@ IPv4 BFD Configure a static route for `` using gateway `
` and use the gateway address as BFD peer destination address. -.. cfgcmd:: set protocols static route next-hop
- bfd profile +.. stop_vyoslinter + +.. cfgcmd:: set protocols static route next-hop
bfd profile - Configure a static route for `` using gateway `
` - and use the gateway address as BFD peer destination address with - BFD profile ``. +.. start_vyoslinter + + Configure a static route for `` using gateway `
` and use the + gateway address as BFD peer destination address with BFD profile ``. .. cfgcmd:: set protocols static route next-hop
bfd multi-hop source-address @@ -155,15 +157,20 @@ IPv6 Unicast Routes .. note:: Routes with a distance of 255 are effectively disabled and not installed into the kernel. -.. cfgcmd:: set protocols static route6 next-hop
- segments +.. stop_vyoslinter - It is possible to specify a static route for ipv6 prefixes using - an SRv6 segments instruction. The `/` separator can be used to - specify multiple segment instructions. +.. cfgcmd:: set protocols static route6 next-hop
segments + +.. start_vyoslinter + + It is possible to specify a static route for ipv6 prefixes using an + SRv6 segments instruction. The ``/`` separator can be used to specify + multiple segment instructions. Example: +.. stop_vyoslinter + .. code-block:: none set protocols static route6 2001:db8:1000::/36 next-hop 2001:db8:201::ffff segments '2001:db8:aaaa::7/2002::4/2002::3/2002::2' @@ -180,6 +187,8 @@ IPv6 Unicast Routes C>* 2001:db8:201::/64 is directly connected, eth0.201, 00:00:46 S>* 2001:db8:1000::/36 [1/0] via 2001:db8:201::ffff, eth0.201, seg6 2001:db8:aaaa::7,2002::4,2002::3,2002::2, weight 1, 00:00:08 +.. start_vyoslinter + IPv6 Interface Routes ===================== @@ -206,16 +215,20 @@ IPv6 Interface Routes .. cfgcmd:: set protocols static route6 interface segments - It is possible to specify a static route for ipv6 prefixes using - an SRv6 segments instruction. The `/` separator can be used to - specify multiple segment instructions. + It is possible to specify a static route for ipv6 prefixes using an + SRv6 segments instruction. The ``/`` separator can be used to specify + multiple segment instructions. Example: +.. stop_vyoslinter + .. code-block:: none set protocols static route6 2001:db8:1000::/36 interface eth0 segments '2001:db8:aaaa::7/2002::4/2002::3/2002::2' +.. start_vyoslinter + IPv6 BFD ======== @@ -224,15 +237,21 @@ IPv6 BFD Configure a static route for `` using gateway `
` and use the gateway address as BFD peer destination address. -.. cfgcmd:: set protocols static route6 next-hop
- bfd profile +.. stop_vyoslinter - Configure a static route for `` using gateway `
` - and use the gateway address as BFD peer destination address with - BFD profile ``. +.. cfgcmd:: set protocols static route6 next-hop
bfd profile -.. cfgcmd:: set protocols static route6 next-hop
- bfd multi-hop source-address +.. start_vyoslinter + + Configure a static route for `` using gateway `
` and use the + gateway address as BFD peer destination address with BFD profile ``. + +.. stop_vyoslinter + +.. cfgcmd:: set protocols static route6 next-hop
bfd multi-hop + source-address + +.. start_vyoslinter Configure a static route for `` using gateway `
` and use the gateway address as BFD peer destination address with source address diff --git a/docs/configuration/service/eventhandler.rst b/docs/configuration/service/eventhandler.rst index 15f08239..9f4ebb04 100644 --- a/docs/configuration/service/eventhandler.rst +++ b/docs/configuration/service/eventhandler.rst @@ -8,8 +8,9 @@ Event Handler Event Handler Technology Overview ********************************* -Event handler allows you to execute scripts when a string that matches a regex or a regex with -a service name appears in journald logs. You can pass variables, arguments, and a full matching string to the script. +Event handler allows you to execute scripts when a string that matches +a regex or a regex with a service name appears in journald logs. You +can pass variables, arguments, and a full matching string to the script. ****************************** @@ -33,49 +34,76 @@ Event Handler Configuration Steps .. cfgcmd:: set service event-handler event - This is an optional command because the event handler will be automatically created after any of the next commands. + This is an optional command because the event handler will be + automatically created after any of the next commands. 2. Add regex to the script =========================================== - .. cfgcmd:: set service event-handler event filter pattern +.. stop_vyoslinter - This is a mandatory command. Sets regular expression to match against log string message. - - .. note:: The regular expression matches if and only if the entire string matches the pattern. + .. cfgcmd:: set service event-handler event filter pattern + +.. start_vyoslinter + + This is a mandatory command. Sets regular expression to match + against log string message. + + .. note:: The regular expression matches if and only if the entire + string matches the pattern. 3. Add a full path to the script ================================ +.. stop_vyoslinter + .. cfgcmd:: set service event-handler event script path - - This is a mandatory command. Sets the full path to the script. The script file must be executable. + +.. start_vyoslinter + + This is a mandatory command. Sets the full path to the script. + The script file must be executable. 4. Add optional parameters ========================== - .. cfgcmd:: set service event-handler event filter syslog-identifier +.. stop_vyoslinter + + .. cfgcmd:: set service event-handler event filter syslog-identifier + +.. start_vyoslinter This is an optional command. Filters log messages by syslog-identifier. +.. stop_vyoslinter + .. cfgcmd:: set service event-handler event script environment value - This is an optional command. Adds environment and its value to the script. Use separate commands for each environment. +.. start_vyoslinter + + This is an optional command. Adds environment and its value to the + script. Use separate commands for each environment. One implicit environment exists. * ``message``: Full message that has triggered the script. +.. stop_vyoslinter + .. cfgcmd:: set service event-handler event script arguments - This is an optional command. Adds arguments to the script. Arguments must be separated by spaces. +.. start_vyoslinter + + This is an optional command. Adds arguments to the script. + Arguments must be separated by spaces. - .. note:: We don't recomend to use arguments. Using environments is more preffereble. + .. note:: We don't recommend to use arguments. Using environments + is more preferable. ******* @@ -84,44 +112,48 @@ Example Event handler that monitors the state of interface eth0. +.. stop_vyoslinter + .. code-block:: none - set service event-handler event INTERFACE_STATE_DOWN filter pattern '.*eth0.*,RUNNING,.*->.*' - set service event-handler event INTERFACE_STATE_DOWN filter syslog-identifier 'netplugd' - set service event-handler event INTERFACE_STATE_DOWN script environment interface_action value 'down' - set service event-handler event INTERFACE_STATE_DOWN script environment interface_name value 'eth2' - set service event-handler event INTERFACE_STATE_DOWN script path '/config/scripts/eventhandler.py' + set service event-handler event INTERFACE_STATE_DOWN filter pattern '.*eth0.*,RUNNING,.*->.*' + set service event-handler event INTERFACE_STATE_DOWN filter syslog-identifier 'netplugd' + set service event-handler event INTERFACE_STATE_DOWN script environment interface_action value 'down' + set service event-handler event INTERFACE_STATE_DOWN script environment interface_name value 'eth0' + set service event-handler event INTERFACE_STATE_DOWN script path '/config/scripts/eventhandler.py' Event handler script .. code-block:: none - #!/usr/bin/env python3 - # - # VyOS event-handler script example - from os import environ - import subprocess - from sys import exit - - # Perform actions according to requirements - def process_event() -> None: - # Get variables - message_text = environ.get('message') - interface_name = environ.get('interface_name') - interface_action = environ.get('interface_action') - # Print the message that triggered this script - print(f'Logged message: {message_text}') - # Prepare a command to run - command = f'sudo ip link set {interface_name} {interface_action}'.split() - # Execute a command - subprocess.run(command) - - if __name__ == '__main__': - try: - # Run script actions and exit - process_event() - exit(0) - except Exception as err: - # Exit properly in case if something in the script goes wrong - print(f'Error running script: {err}') - exit(1) + #!/usr/bin/env python3 + # + # VyOS event-handler script example + from os import environ + import subprocess + from sys import exit + + # Perform actions according to requirements + def process_event() -> None: + # Get variables + message_text = environ.get('message') + interface_name = environ.get('interface_name') + interface_action = environ.get('interface_action') + # Print the message that triggered this script + print(f'Logged message: {message_text}') + # Prepare a command to run + command = f'sudo ip link set {interface_name} {interface_action}'.split() + # Execute a command + subprocess.run(command) + + if __name__ == '__main__': + try: + # Run script actions and exit + process_event() + exit(0) + except Exception as err: + # Exit properly in case if something in the script goes wrong + print(f'Error running script: {err}') + exit(1) + +.. start_vyoslinter diff --git a/docs/configuration/service/snmp.rst b/docs/configuration/service/snmp.rst index 9e91cc50..b444ab85 100644 --- a/docs/configuration/service/snmp.rst +++ b/docs/configuration/service/snmp.rst @@ -4,9 +4,6 @@ SNMP #### -.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd - directives for command coverage tracking. - :abbr:`SNMP (Simple Network Management Protocol)` is an Internet Standard protocol for collecting and organizing information about managed devices on IP networks and for modifying that information to change device behavior. diff --git a/docs/configuration/system/flow-accounting.rst b/docs/configuration/system/flow-accounting.rst index cb18839a..0664eac7 100644 --- a/docs/configuration/system/flow-accounting.rst +++ b/docs/configuration/system/flow-accounting.rst @@ -84,9 +84,9 @@ CLI command. You may disable using the local in-memory table with the command: .. cfgcmd:: set system flow-accounting syslog-facility - Configure the syslog facility used for flow-accounting log messages. - Available facilities follow standard syslog conventions (e.g., - ``daemon``, ``local0`` through ``local7``). + Set the syslog facility for flow-accounting log messages. Supported values + include ``daemon``, ``local0`` through ``local7``, and other standard syslog + facilities. Flow Export ----------- @@ -167,6 +167,8 @@ display captured network traffic information for all configured interfaces. Show flow accounting information for given ``. + .. stop_vyoslinter + .. code-block:: none vyos@vyos:~$ show flow-accounting interface eth0 @@ -180,11 +182,15 @@ display captured network traffic information for all configured interfaces. eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14 40006 22 tcp 16 146 1 9444 eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14 0 0 icmp 192 27 1 4455 + .. start_vyoslinter + .. opcmd:: show flow-accounting interface host
Show flow accounting information for given `` for a specific host only. + .. stop_vyoslinter + .. code-block:: none vyos@vyos:~$ show flow-accounting interface eth0 host 192.0.2.14 @@ -193,3 +199,5 @@ display captured network traffic information for all configured interfaces. eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14 40006 22 tcp 16 197 2 12940 eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14 40152 22 tcp 16 94 1 4924 eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14 0 0 icmp 192 36 1 5877 + + .. start_vyoslinter diff --git a/docs/configuration/system/sysctl.rst b/docs/configuration/system/sysctl.rst index d1398822..1fedb9bd 100644 --- a/docs/configuration/system/sysctl.rst +++ b/docs/configuration/system/sysctl.rst @@ -4,13 +4,11 @@ Sysctl ###### -.. note:: This page is a stub and needs expansion. - Contributions welcome via the - VyOS `documentation repository`_. +.. note:: This page is a stub and needs expansion. Contributions + welcome via the `VyOS documentation repository + `_. -.. _documentation repository: https://github.com/vyos/vyos-documentation - -This chapeter describes how to configure kernel parameters at runtime. +This chapter describes how to configure kernel parameters at runtime. ``sysctl`` is used to modify kernel parameters at runtime. The parameters available are those listed under /proc/sys/. diff --git a/docs/configuration/vpn/index.rst b/docs/configuration/vpn/index.rst index 228f83ca..6d38e5b5 100644 --- a/docs/configuration/vpn/index.rst +++ b/docs/configuration/vpn/index.rst @@ -7,10 +7,10 @@ VPN :maxdepth: 1 :includehidden: - dmvpn ipsec/index l2tp openconnect pptp rsa-keys sstp + dmvpn diff --git a/docs/configuration/vpn/ipsec/index.rst b/docs/configuration/vpn/ipsec/index.rst index 7647d8d2..973c76de 100644 --- a/docs/configuration/vpn/ipsec/index.rst +++ b/docs/configuration/vpn/ipsec/index.rst @@ -11,3 +11,5 @@ IPsec site2site_ipsec remoteaccess_ipsec troubleshooting_ipsec + + diff --git a/docs/configuration/vpn/ipsec/remoteaccess_ipsec.rst b/docs/configuration/vpn/ipsec/remoteaccess_ipsec.rst index 1a41d987..50499160 100644 --- a/docs/configuration/vpn/ipsec/remoteaccess_ipsec.rst +++ b/docs/configuration/vpn/ipsec/remoteaccess_ipsec.rst @@ -1,7 +1,11 @@ .. _remoteaccess_ipsec: +############################ IPSec IKEv2 Remote Access VPN -============================= +############################ + +.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd + directives for command coverage tracking. Internet Key Exchange version 2 (IKEv2) is a tunneling protocol, based on IPsec, that establishes a secure VPN communication between VPN devices, and defines diff --git a/docs/configuration/vpn/ipsec/troubleshooting_ipsec.rst b/docs/configuration/vpn/ipsec/troubleshooting_ipsec.rst index 8494f0ea..f0f2e208 100644 --- a/docs/configuration/vpn/ipsec/troubleshooting_ipsec.rst +++ b/docs/configuration/vpn/ipsec/troubleshooting_ipsec.rst @@ -29,6 +29,8 @@ Checking IKE SA Status The next command shows IKE SAs' statuses. +.. stop_vyoslinter + .. code-block:: none vyos@vyos:~$ show vpn ike sa @@ -289,8 +291,8 @@ The reason of this problem is showed on the responder side. Jun 23 08:16:12 charon-systemd[2440]: no acceptable proposal found Jun 23 08:16:12 charon[2440]: 01[IKE] failed to establish CHILD_SA, keeping IKE_SA -Encryption **AES_CBC_128** is configured in IKE policy on the -responder but **AES_CBC_256** is configured on the initiator side. +Encryption **AES_CBC_128** is configured in IKE policy on the responder but **AES_CBC_256** +is configured on the initiator side. Prefixes in Policies Mismatch ============================= @@ -320,6 +322,8 @@ The reason of this problem is showed on the responder side. Jun 23 14:13:19 charon[2440]: 01[ENC] generating IKE_AUTH response 1 [ IDr AUTH N(MOBIKE_SUP) N(NO_ADD_ADDR) N(TS_UNACCEPT) ] Jun 23 14:13:19 charon-systemd[2440]: generating IKE_AUTH response 1 [ IDr AUTH N(MOBIKE_SUP) N(NO_ADD_ADDR) N(TS_UNACCEPT) ] +.. start_vyoslinter + Traffic selectors **10.0.2.0/24 === 10.0.0.0/24** are unacceptable on the responder side. diff --git a/docs/configuration/vpn/openconnect.rst b/docs/configuration/vpn/openconnect.rst index d5c76e3e..0262b3f2 100644 --- a/docs/configuration/vpn/openconnect.rst +++ b/docs/configuration/vpn/openconnect.rst @@ -40,10 +40,14 @@ client that fetches a certificate from Let's Encrypt an open certificate authority launched by the EFF, Mozilla, and others and deploys it to a web server. +.. stop_vyoslinter + .. code-block:: none sudo certbot certonly --standalone --preferred-challenges http -d +.. start_vyoslinter + Server Configuration ==================== @@ -66,6 +70,8 @@ authentication + OTP key can be used. Alternatively, OTP authentication only, without a password, can be used. To do this, an OTP configuration must be added to the configuration above: +.. stop_vyoslinter + .. code-block:: none set vpn openconnect authentication mode local @@ -74,6 +80,8 @@ To do this, an OTP configuration must be added to the configuration above: set vpn openconnect authentication local-users username otp-length set vpn openconnect authentication local-users username token-type +.. start_vyoslinter + For generating an OTP key in VyOS, you can use the CLI command (operational mode): @@ -98,8 +106,7 @@ shortcuts for Common Name (OID 2.5.4.3) and User ID Otherwise a specific OID value must be provided. The user's certificate must be signed by the certificate authority -defined in the configuration for it to be validated for -authentication. +defined in the configuration for it to be validated for authentication. .. code-block:: none @@ -111,14 +118,17 @@ authentication. Verification ************ -.. code-block:: none +.. stop_vyoslinter +.. code-block:: none vyos@vyos:~$ sh openconnect-server sessions interface username ip remote IP RX TX state uptime ----------- ---------- ------------- ----------- ------- --------- --------- -------- sslvpn0 tst 172.20.20.198 192.168.6.1 0 bytes 152 bytes connected 3s +.. start_vyoslinter + .. note:: It is compatible with Cisco (R) AnyConnect (R) clients. ******* @@ -130,6 +140,8 @@ SSL Certificates generation Follow the instructions to generate CA cert (in configuration mode): +.. stop_vyoslinter + .. code-block:: none vyos@vyos# run generate pki ca install ca-ocserv @@ -167,6 +179,8 @@ Follow the instructions to generate server cert (in configuration mode): 2 value(s) installed. Use "compare" to see the pending changes, and "commit" to apply. [edit] +.. start_vyoslinter + Each of the install command should be applied to the configuration and commited before using under the openconnect configuration: @@ -184,6 +198,8 @@ Openconnect Configuration Simple setup with one user added and password authentication: +.. stop_vyoslinter + .. code-block:: none set vpn openconnect authentication local-users username tst password 'OC_bad_Secret' @@ -194,6 +210,8 @@ Simple setup with one user added and password authentication: set vpn openconnect ssl ca-certificate 'ca-ocserv' set vpn openconnect ssl certificate 'srv-ocserv' +.. start_vyoslinter + To enable the HTTP security headers in the configuration file, use the command: .. code-block:: none @@ -207,6 +225,8 @@ Adding a 2FA with an OTP-key First the OTP keys must be generated and sent to the user and to the configuration: +.. stop_vyoslinter + .. code-block:: none vyos@vyos:~$ generate openconnect username tst otp-key hotp-time @@ -238,13 +258,19 @@ configuration: # To add this OTP key to configuration, run the following commands: set vpn openconnect authentication local-users username tst otp key 'ebc1c91b13848ce0bb67d9212934546e41803cfa' +.. start_vyoslinter + Next it is necessary to configure 2FA for OpenConnect: +.. stop_vyoslinter + .. code-block:: none set vpn openconnect authentication mode local password-otp set vpn openconnect authentication local-users username tst otp key 'ebc1c91b13848ce0bb67d9212934546e41803cfa' +.. start_vyoslinter + Now when connecting the user will first be asked for the password and then the OTP key. @@ -270,6 +296,8 @@ outlines the set of configuration options that are allowed. This can be leveraged to apply different sets of configs to different users or groups of users. +.. stop_vyoslinter + .. code-block:: none sudo mkdir -p /config/auth/ocserv/config-per-user @@ -279,6 +307,8 @@ users. set vpn openconnect authentication identity-based-config directory /config/auth/ocserv/config-per-user set vpn openconnect authentication identity-based-config default-config /config/auth/ocserv/default-user.conf +.. start_vyoslinter + .. warning:: The above directory and default-config must be a child directory of /config/auth, since files outside this directory are not persisted after an image upgrade. @@ -313,6 +343,8 @@ connect/disconnect, data transferred, and so on. Configure an accounting server and enable accounting with: +.. stop_vyoslinter + .. code-block:: none set vpn openconnect accounting mode radius @@ -320,12 +352,16 @@ Configure an accounting server and enable accounting with: set vpn openconnect accounting radius server 172.20.20.10 port 1813 set vpn openconnect accounting radius server 172.20.20.10 key your_radius_secret +.. start_vyoslinter + .. warning:: The RADIUS accounting feature must be used with the OpenConnect authentication mode RADIUS. It cannot be used with local authentication. You must configure the OpenConnect authentication mode to "radius". An example of the data captured by a FREERADIUS server with sql accounting: +.. stop_vyoslinter + .. code-block:: none mysql> SELECT username, nasipaddress, acctstarttime, acctstoptime, acctinputoctets, acctoutputoctets, callingstationid, framedipaddress, connectinfo_start FROM radacct; @@ -334,3 +370,5 @@ An example of the data captured by a FREERADIUS server with sql accounting: +----------+---------------+---------------------+---------------------+-----------------+------------------+-------------------+-----------------+-----------------------------------+ | test | 198.51.100.15 | 2023-01-13 00:59:15 | 2023-01-13 00:59:21 | 10606 | 152 | 192.168.6.1 | 172.20.20.198 | Open AnyConnect VPN Agent v8.05-1 | +----------+---------------+---------------------+---------------------+-----------------+------------------+-------------------+-----------------+-----------------------------------+ + +.. start_vyoslinter diff --git a/docs/configuration/vpn/rsa-keys.rst b/docs/configuration/vpn/rsa-keys.rst index ce9aa720..e7584563 100644 --- a/docs/configuration/vpn/rsa-keys.rst +++ b/docs/configuration/vpn/rsa-keys.rst @@ -13,6 +13,8 @@ RSA keys for authentication. They are very fast and easy to setup. First, on both routers run the operational command "generate pki key-pair install >". You may choose different length than 2048 of course. +.. stop_vyoslinter + .. code-block:: none vyos@left# run generate pki key-pair install ipsec-LEFT @@ -27,6 +29,8 @@ install >". You may choose different length than 2048 of course. set pki key-pair ipsec-LEFT private key 'MIIEvgIBADAN...' [edit] +.. start_vyoslinter + Configuration commands will display. Note the command with the public key (set pki key-pair ipsec-LEFT public key 'MIIBIjANBgkqh...'). @@ -66,6 +70,8 @@ Now you are ready to setup IPsec. The key points: On the LEFT (static address): +.. stop_vyoslinter + .. code-block:: none set vpn ipsec interface eth0 @@ -113,3 +119,5 @@ On the RIGHT (dynamic address): set vpn ipsec site-to-site peer 192.0.2.10 local-address any set vpn ipsec site-to-site peer 192.0.2.10 tunnel 1 local prefix 192.168.99.2/32 # Additional loopback address on the local set vpn ipsec site-to-site peer 192.0.2.10 tunnel 1 remote prefix 192.168.99.1/32 # Additional loopback address on the remote + +.. start_vyoslinter diff --git a/docs/installation/cloud/oracle.rst b/docs/installation/cloud/oracle.rst index f5e03329..d71d8039 100644 --- a/docs/installation/cloud/oracle.rst +++ b/docs/installation/cloud/oracle.rst @@ -4,11 +4,9 @@ Oracle ###### -.. note:: This page is a stub and needs expansion. - Contributions welcome via the - VyOS `documentation repository`_. - -.. _documentation repository: https://github.com/vyos/vyos-documentation +.. note:: This page is a stub and needs expansion. Contributions + welcome via the `VyOS documentation repository + `_. .. stop_vyoslinter References diff --git a/docs/installation/virtual/eve-ng.rst b/docs/installation/virtual/eve-ng.rst index 0dd07db8..f3db28fe 100644 --- a/docs/installation/virtual/eve-ng.rst +++ b/docs/installation/virtual/eve-ng.rst @@ -4,11 +4,9 @@ EVE-NG ###### -.. note:: This page is a stub and needs expansion. - Contributions welcome via the - VyOS `documentation repository`_. - -.. _documentation repository: https://github.com/vyos/vyos-documentation +.. note:: This page is a stub and needs expansion. Contributions + welcome via the `VyOS documentation repository + `_. References ========== diff --git a/docs/operation/information.rst b/docs/operation/information.rst index fbff53a3..1b3d876a 100644 --- a/docs/operation/information.rst +++ b/docs/operation/information.rst @@ -2,9 +2,9 @@ .. _information: -****************** +################## System Information -****************** +################## VyOS features a rich set of operational level commands to retrieve arbitrary information about your running system. For more information on the VyOS command @@ -42,6 +42,8 @@ recent Linux distributions. .. note:: If a device is unplugged and plugged in again, it is assigned a new ``Port``, ``Dev``, and ``If``. +.. stop_vyoslinter + .. code-block:: none vyos@vyos:~$ show hardware usb @@ -70,6 +72,8 @@ recent Linux distributions. |__ Port 4: Dev 7, If 2, Class=Vendor Specific Class, Driver=ftdi_sio, 480M |__ Port 4: Dev 7, If 0, Class=Vendor Specific Class, Driver=ftdi_sio, 480M +.. start_vyoslinter + .. opcmd:: show hardware usb serial @@ -77,6 +81,8 @@ recent Linux distributions. device name displayed, (for example ``usb0b2.4p1.0``), can be used directly when accessing the serial console as console-server device. +.. stop_vyoslinter + .. code-block:: none vyos@vyos$ show hardware usb serial @@ -99,6 +105,8 @@ recent Linux distributions. usb0b2.4p1.2 Quad_RS232-HS Future Technology Devices International, Ltd usb0b2.4p1.3 Quad_RS232-HS Future Technology Devices International, Ltd +.. start_vyoslinter + .. _information_version: ######## @@ -107,8 +115,9 @@ Version .. opcmd:: show version - Return the currently running VyOS version and build information. This includes - the name of the release train, e.g., ``sagitta`` on VyOS 1.4, and ``circinus`` on VyOS 1.5. + Return the currently running VyOS version and build information. This + includes the name of the release train, e.g., ``sagitta`` on VyOS 1.4, + and ``circinus`` on VyOS 1.5. .. code-block:: none diff --git a/docs/vpp/configuration/ipfix.rst b/docs/vpp/configuration/ipfix.rst index 2085740a..92c734be 100644 --- a/docs/vpp/configuration/ipfix.rst +++ b/docs/vpp/configuration/ipfix.rst @@ -1,5 +1,6 @@ +####################### VPP IPFIX Configuration -======================= +####################### VPP IPFIX in VyOS allows monitoring and exporting network traffic flows for analytics, security, and accounting. IPFIX works with the VPP @@ -18,7 +19,8 @@ Key IPFIX Concepts - **Active timeout**: Maximum time a flow is kept active before export. - **Inactive timeout**: Maximum time an idle flow is kept before export. - **Collector**: The remote host and port to which flow records are sent. -- **Flow layers**: Determines which layer information is included (`l2`, `l3`, `l4`). +- **Flow layers**: Determines which layer information is included + (``l2``, ``l3``, ``l4``). - **Interfaces**: Physical or virtual interfaces to monitor. - **Direction**: Which traffic to monitor (`rx`, `tx`, `both`). - **Flow variant**: Optional filter for IPv4 or IPv6 flows. @@ -26,12 +28,16 @@ Key IPFIX Concepts Configuration Options --------------------- -- **active-timeout**: Duration (in seconds) after which active flows are exported. -- **inactive-timeout**: Duration (in seconds) after which idle flows are exported. +- **active-timeout**: Duration (in seconds) after which active flows + are exported. +- **inactive-timeout**: Duration (in seconds) after which idle flows + are exported. - **collector `` port ``**: IP and UDP port of the IPFIX collector. - **collector `` source-address ``**: Source address for flow export. - **flowprobe-record ``**: Layers to include in flow records. -- **interface `` [direction ``] [flow-variant ``]**: Interfaces to monitor, direction of traffic, and optional flow variant filter. +- **interface** ```` **[direction** ````\ **]** + **[flow-variant** ````\ **]**: Interfaces to monitor, + direction of traffic, and optional flow variant filter. Example Configuration --------------------- -- cgit v1.2.3