Index

Symbols

$ docker run -d --name vcgnat -e CLAB_INTFS=1 --privileged <image_name> --username admin --password admin --hostname vcgnat --connection-mode tc --trace $ export pid="$(docker inspect -f '{{.State.Pid}}' vcgnat)" $ modprobe kvm kvm_intel $ sudo brctl addif br-vcgnat eth101 $ sudo ip a add 10.0.100.1/24 dev br-vcgnat $ sudo ip link add br-vcgnat type bridge $ sudo ip link add eth101 type veth peer eth1 netns vcgnat $ sudo ip link set eth101 up $ sudo ip link set up br-vcgnat $ sudo ip netns exec vcgnat ip link set eth1 up $ sudo ln -sf /proc/$pid/ns/net "/var/run/netns/vcgnat" ... | include REGEX... <ip|ipv6> dp-access-list NAME <inside|outside> <ip|ipv6> neighbor <A.B.C.D|X:X::X:X> interface NAME mac X:X:X:X:X:X <nat|nat64> filtering <endpoint-independent|address-dependent|address-and-port-dependent> [vrf NAME] <nat|nat64> inspection dns enable [{control-port (1-65535)|vrf NAME}] <nat|nat64> inspection ftp enable [{control-port (1-65535)|vrf NAME}] <nat|nat64> inspection pptp enable [{control-port (1-65535)|vrf NAME}] <nat|nat64> inspection rtsp enable [{control-port (1-65535)|vrf NAME}] <nat|nat64> inspection sip enable [{control-port (1-65535)|vrf NAME}] <nat|nat64> inspection tftp enable [{control-port (1-65535)|vrf NAME}] <nat|nat64> pcp enable [vrf NAME] <nat|nat64> pcp map disable [vrf NAME] <nat|nat64> pcp peer disable [vrf NAME] <nat|nat64> pcp third-party enable [vrf NAME] <nat|nat64> service hairpinning enable [vrf NAME] <nat|nat64> service inbound-refresh enable [vrf NAME] <nat|nat64> sync timeout-delay (1-604800000) <nat|nat64> timeout esp (1-604800) [vrf NAME] <nat|nat64> timeout gre (1-604800) [vrf NAME] <nat|nat64> timeout icmp (1-604800) [vrf NAME] <nat|nat64> timeout tcp established (1-604800) [vrf NAME] <nat|nat64> timeout tcp fin-wait (1-604800) [vrf NAME] <nat|nat64> timeout tcp opening (1-604800) [vrf NAME] <nat|nat64> timeout tcp stateless (1-604800) [vrf NAME] <nat|nat64> timeout tcp transitory (1-604800) [vrf NAME] <nat|nat64> timeout udp (1-604800) [vrf NAME]

A

aaa accounting <console|ssh> {local|radius|tacacs+} aaa authentication <console|ssh> {local|radius|tacacs+} aaa authorization <console|ssh> {local|radius|tacacs+} aaa radius id (0-99) A.B.C.D auth-port (1-65535) acct-port (1-65535) secret SECRET aaa server <radius|tacacs+> id (0-99) set-id (0-99) aaa tacacs+ id (0-99) HOST port (1-65535) secret SECRET action ID cli COMMAND action ID script PATH

B

bond IFNAME

C

clear <ip|ipv6> dp-access-list clear <ip|ipv6> dp-access-list NAME clear <nat|nat64> counters [vrf NAME] alg dns clear <nat|nat64> counters [vrf NAME] alg ftp clear <nat|nat64> counters [vrf NAME] alg pptp clear <nat|nat64> counters [vrf NAME] alg rtsp clear <nat|nat64> counters [vrf NAME] alg sip clear <nat|nat64> counters [vrf NAME] alg tftp clear <nat|nat64> counters [vrf NAME] overall clear <nat|nat64> counters [vrf NAME] protocols clear <nat|nat64> counters [vrf NAME] sync clear <nat|nat64> sessions [FILTER] clear <nat|nat64> sessions [vrf NAME] STRING... clear aaa session SESSION_ID clear cli sessions (1-4294967295) clear interface IFNAME clear memory dataplane pools clear nat log counters clear nat pool NAME counters clear nat sessions proto <icmp|tcp [{syn-received|established|fin-received|closing|transitory|stateless}]|udp|gre|esp> [{int-ip A.B.C.D|int-port (1-65535)|ext-ip A.B.C.D|ext-port (1-65535)|rem-ip A.B.C.D|rem-port (1-65535)|pool NAME|vrf NAME}] clear nat sync clear nat64 sessions proto <icmp|tcp [{syn-received|established|fin-received|closing|transitory|stateless}]|udp|gre|esp> [{int-ip X:X::X:X|int-port (1-65535)|ext-ip A.B.C.D|ext-port (1-65535)|rem-ip A.B.C.D|rem-port (1-65535)|pool NAME|vrf NAME}] clear overruns clear vrf NAME counters [<ip|ipv6>] clear vrrp (1-255) counters [ip|ipv6] clock time (0-23) (0-59) (0-59) (1-31) (1-12) (1971-2099) clock timezone TIMEZONE configure [terminal] copy backup-config startup-config copy FILENAME startup-config copy running-config FILENAME copy running-config startup-config copy startup-config FILENAME

D

debug packet-tracer <ip|ipv6> counter <hairpinning_loop_drops|hairpinning_drops| unsupported_l4_proto_drops|no_nat_rule_drops|no_mapping_drops|ttl_drops> max-packets (2-1048576) [payload-length (16-65535) [<vrf NAME|vrf-all>]] debug packet-tracer <ip|ipv6> dp-access-list NAME max-packets (2-1048576) [payload-length (16-65535) [<vrf NAME|vrf-all>]] debug packet-tracer <ip|ipv6> pcap-dump file FILENAME debug packet-tracer burst-size (1-65535) description LINE... disable

E

enable, [1] enable encryption <md5|sha-256|sha-512> password PASSWORD enable password PASSWORD_HASH end event track ID state negative|positive exit

F

find REGEX...

H

hostname NAME

I

interface IFNAME interface management interim log enable interim log period (1-44640) ip address A.B.C.D/M ip default-gateway A.B.C.D ip dns <primary|secondary> A.B.C.D ip dns domain DOMAIN ip dp-access-list NAME SEQ ACTION <any|udp|tcp|icmp|gre|esp> src-ip <any|A.B.C.D/M> dst-ip <any|A.B.C.D/M> ip dp-access-list NAME SEQ ACTION <any|udp|tcp|icmp|gre|esp> src-ip <any|A.B.C.D/M> dst-ip <any|A.B.C.D/M> [dscp (0-63)] ip dp-access-list NAME SEQ ACTION <udp|tcp> src-ip <any|A.B.C.D/M> dst-ip <any|A.B.C.D/M> src-port (0-65535) (0-65535) dst-port (0-65535) (0-65535) [dscp (0-63)] ip dp-access-list NAME SEQ ACTION icmp src-ip <any|A.B.C.D/M> dst-ip <any|A.B.C.D/M> icmp-type (0-255) (0-255) icmp-code (0-255) (0-255) [dscp (0-63)] ip mtu (68-9216) ip nat <inside|outside> ip neighbor timeout reachable (1-604800000) ip neighbor timeout retransmit (1-604800000) ip neighbor timeout stale (1-604800000) ip route ipv6 address X:X::X:X/M ipv6 dp-access-list NAME SEQ ACTION <any|udp|tcp|icmp|gre|esp> src-ip <any|X:X::X:X/M> dst-ip <any|X:X::X:X/M> ipv6 dp-access-list NAME SEQ ACTION <any|udp|tcp|icmp|gre|esp> src-ip <any|X:X::X:X/M> dst-ip <any|X:X::X:X/M> [{dscp (0-63)|flow-label (0-1048575)}] ipv6 dp-access-list NAME SEQ ACTION <udp|tcp> src-ip <any|X:X::X:X/M> dst-ip <any|X:X::X:X/M> src-port (0-65535) (0-65535) dst-port (0-65535) (0-65535) [{dscp (0-63)|flow-label (0-1048575)}] ipv6 dp-access-list NAME SEQ ACTION icmp src-ip <any|X:X::X:X/M> dst-ip <any|X:X::X:X/M> icmp-type (0-255) (0-255) icmp-code (0-255) (0-255) [{dscp (0-63)|flow-label (0-1048575)}] ipv6 mtu (1280-9216) ipv6 nat <inside|outside>

L

lacp min-links (1-64) lacp timeout <fast|slow> limits port-block-entries (1-536870911) limits port-map-entries (1-536870911) limits session-entries (1-536870911) list [permutations] lldp description DESCRIPTION... lldp enable lldp hold-multiplier (2-10) lldp hostname HOSTNAME... lldp portidsubtype <mac|name> lldp tx-interval (1-3600) lldp update log facility [<kern|user|mail|daemon|auth|syslog|lpr|news|uucp|cron|local0|local1|local2|local3|local4|local5|local6|local7>] log server <tcp|udp> A.B.C.D (1-65535) log syslog [<emergencies|alerts|critical|errors|warnings|notifications|informational|debugging>] ls

M

mac X:X:X:X:X:X mtu (68-9216)

N

nano FILENAME nat log enable nat log group N nat log server (0-62) type <netflow|ipfix> template-resend-pkts (1-1440) nat log server (0-62) type <netflow|ipfix> template-resend-timeout (1-1440) nat log server (0-62) type <syslog|netflow|ipfix|radius> ip A.B.C.D port (1-65535) [{vrf NAME|source-ip A.B.C.D}] nat log server (0-62) type radius secret SECRET (0-62), [1], [2], [3] nat log type <address-map|port-map|session|port-block> enable nat pool NAME nat rule subnet A.B.C.D/M passthrough [vrf NAME] nat rule subnet A.B.C.D/M subscriber-group NAME [vrf NAME] nat static int-ip A.B.C.D ext-ip A.B.C.D nat static proto <tcp|udp> int-ip A.B.C.D int-port 1-65535 ext-ip A.B.C.D ext-port 1-65535 nat subscriber-group NAME nat sync destination-ip A.B.C.D port (1-65535) [{vrf NAME|source-ip A.B.C.D}] nat sync start nat sync start-delay (1-3600) nat64 rule subnet X:X::X:X/M passthrough [vrf NAME] nat64 rule subnet X:X::X:X/M subscriber-group NAME [vrf NAME] no <nat|nat64> sync timeout-delay (1-604800000) [vrf NAME] no aaa <radius|tacacs+> [id (0-99)] no aaa accounting <console|ssh> no aaa authentication <console|ssh> no aaa authorization <console|ssh> no action ID no debug packet-tracer <ip|ipv6> [<vrf NAME|vrf-all>] no debug packet-tracer <ip|ipv6> pcap-dump [file FILENAME] no interim log enable no interim log period no nat group N no nat log server (0-62) no nat log type <address-map|port-map|session|port-block> enable no nat sync no nat sync start-delay no track ID no vrf NAME ip hash-type no vrf NAME ip hash-type <src-dst-ip|src-ip|src-ip-port|dst-ip|dst-ip-port> no vrf NAME ip resilient-hash enable no vrf NAME ip resilient-hash mode

P

ping management WORD ping WORD [vrf NAME] pool NAME [secondary NAME] pooling (arbitrary|paired) poweroff

Q

quit

R

range A.B.C.D A.B.C.D ratio (1-65535) reboot RFC RFC 2326 Section 10.4 RFC 2474, [1], [2] RFC 2637 Section 2.12 RFC 2637 Section 2.13 RFC 2637 Section 2.7 RFC 2637 Section 2.8 RFC 2784 RFC 2863 RFC 2865 RFC 2865 Section 3 RFC 2866 RFC 3715 RFC 3947 RFC 3954 RFC 3954 Section 5 RFC 4787, [1], [2], [3], [4], [5] RFC 4787 Section 4.3 RFC 4861 Section 7.2.5 RFC 4861 Section 7.3.2 RFC 5128 RFC 5382 RFC 5382 Section 5 RFC 5424, [1] RFC 5424 Section 6 RFC 5508 RFC 5508 Section 3.2 RFC 5798 RFC 6146 RFC 6146 Section 5.4 RFC 6147 RFC 6314 RFC 6437, [1], [2] RFC 6887 RFC 6888 RFC 7011 RFC 7011 Section 3 RFC 7422 RFC 7604 RFC 7659, [1], [2], [3] RFC 7659 Section 3.1.4 RFC 7825 RFC 7857 RFC 7857 Section 2 RFC 793 rm FILENAME rtm cli-policy ID

S

scp FROM TO service ntp enable service ntp server <HOSTNAME|A.B.C.D> service snmp community COMMUNITY service snmp enable service snmp host A.B.C.D COMMUNITY (1-65535) service ssh enable show <ip|ipv6> dp-access-list show <ip|ipv6> dp-access-list NAME show <ip|ipv6> neighbor show <ip|ipv6> route show <ip|ipv6> route fib [summary] [vrf NAME] show <nat|nat64> counters [vrf NAME] show <nat|nat64> counters [vrf NAME] alg dns show <nat|nat64> counters [vrf NAME] alg ftp show <nat|nat64> counters [vrf NAME] alg pptp show <nat|nat64> counters [vrf NAME] alg rtsp show <nat|nat64> counters [vrf NAME] alg sip show <nat|nat64> counters [vrf NAME] alg tftp show <nat|nat64> counters [vrf NAME] overall show <nat|nat64> counters [vrf NAME] protocols show <nat|nat64> counters [vrf NAME] rate show <nat|nat64> counters [vrf NAME] sync show <nat|nat64> mappings [FILTER] show <nat|nat64> sessions [FILTER] show <nat|nat64> sessions [vrf NAME] STRING... show <nat|nat64> static show <nat|nat64> subscribers [vrf NAME] show <nat|nat64> timeout [vrf NAME] show aaa server debug show aaa server radius show aaa server tacacs+ show aaa sessions show aaa sessions username [USERNAME] show backup-config show bond IFNAME show cli sessions show clock show cpu show cpu debug show cpu task show debugging nat-hash-stats show debugging packet-tracer <ip|ipv6> stats [<vrf NAME|vrf-all>] show debugging packet-tracer <ip|ipv6> traces [clear] show debugging packets-pool show debugging queues-internal show interface [KEYS] show license host-id show license limits [FILENAME] show lldp interfaces [{interface IFNAME|view <detailed|summary>}] show lldp neighbors [{interface IFNAME|view <detailed|summary>}] show lldp statistics [<interface IFNAME|summary>] show logging show memory dataplane, [1] show memory dataplane debug NAME... show memory dataplane pools, [1] show nat fragment [{src-ip A.B.C.D | dst-ip A.B.C.D | vrf NAME}] show nat log counters show nat log queues show nat log servers show nat mappings [{proto <icmp|udp|tcp|gre>|int-ip A.B.C.D|int-port (1-65535)|rem-ip A.B.C.D|rem-port (1-65535)|vrf NAME}] show nat pool show nat pool NAME show nat pool NAME counters show nat pool NAME ip show nat pool NAME ip A.B.C.D show nat pool NAME paired show nat rule subnet A.B.C.D/M [vrf NAME] show nat sessions proto <icmp|tcp [{syn-received|established|fin-received|closing|transitory|stateless}]|udp|gre|esp> [{int-ip A.B.C.D|int-port (1-65535)|ext-ip A.B.C.D|ext-port (1-65535)|rem-ip A.B.C.D|rem-port (1-65535)|pool NAME|vrf NAME}] show nat subscriber-group NAME <ip|ipv6> dp-access-list <inside|outside> show nat subscribers A.B.C.D [{counters|vrf NAME}] show nat sync show nat64 fragment [{src-ip X:X::X:X | dst-ip X:X::X:X | vrf NAME}] show nat64 mappings [{proto <icmp|udp|tcp|gre>|int-ip X:X::X:X|int-port (1-65535)|rem-ip X:X::X:X|rem-port (1-65535)|vrf NAME}] show nat64 rule subnet X:X::X:X/M [vrf NAME] show nat64 sessions proto <icmp|tcp [{syn-received|established|fin-received|closing|transitory|stateless}]|udp|gre|esp> [{int-ip X:X::X:X|int-port (1-65535)|ext-ip A.B.C.D|ext-port (1-65535)|rem-ip A.B.C.D|rem-port (1-65535)|pool NAME|vrf NAME}] show nat64 subscribers X:X::X:X [{counters|vrf NAME}] show ntp show overruns show platform settings show port [(0-255)] show running-config show startup-config show vrf NAME show vrf NAME counters [<ip|ipv6>] show vrrp (1-255) (1-255) shutdown ssh WORD start-shell [{bash|zsh}] stateless stateless disable-nat-logging

T

tcpdump IFNAME telnet WORD [PORT] terminal paginate thresholds high (0-100) thresholds low (0-100) thresholds notification-interval <1-3600> traceroute management WORD traceroute WORD [vrf NAME] track ID <ip|ipv6> route IP/MASK ecmp-number <equal|greater-equal|less-equal> N [vrf NAME] track ID vrrp VRID interface NAME ip[v6] state <backup|master> type <nat|napt|port-block-allocation block-size (64-64512)|deterministic block-size (64-64512)>

U

user USERNAME group <guest|operator|admin> user USERNAME group <guest|operator|admin> encryption <md5|sha-256|sha-512> password PASSWORD user USERNAME group <guest|operator|admin> password PASSWORD_HASH

V

vim FILENAME vrf NAME, [1] vrf NAME ip hash seed (0-4294967295) vrf NAME ip hash-type <5-tuple|src-dst-ip|src-ip|src-ip-port|dst-ip|dst-ip-port> vrf NAME ip resilient-hash enable vrf NAME ip resilient-hash mode <normal|ordered> vrf VRFNAME vrrp (1-255)

W

write