3.2. Command Reference

• 3.2.1. cmd
  • cmd banner
    • Input Parameters
  • cmd reboot
    • Input Parameters
  • cmd poweroff
    • Input Parameters
  • cmd ping
    • Input Parameters
  • cmd traceroute
    • Input Parameters
  • cmd traffic-capture
    • Input Parameters
  • cmd traffic-capture new
    • Input Parameters
  • cmd traffic-capture list
  • cmd traffic-capture read
    • Input Parameters
  • cmd traffic-capture export
    • Input Parameters
  • cmd traffic-capture flush
  • cmd traffic-capture delete
    • Input Parameters
  • cmd identify-port
    • Input Parameters
  • cmd certificate cmp enroll
    • Input Parameters
  • cmd certificate cmp update
    • Input Parameters
  • cmd system-image
    • Input Parameters
  • cmd backup
    • Input Parameters
  • cmd set-next-boot-params
    • Input Parameters
  • cmd license certificate
    • Input Parameters
  • cmd license file
    • Input Parameters
  • cmd license refresh
  • cmd troubleshooting-report
    • Input Parameters
  • cmd dns proxy clear-cache
    • Input Parameters
  • cmd dhcp-client renew-lease
    • Input Parameters
  • cmd bgp rpki ssh-key create
    • Input Parameters
  • cmd bgp rpki ssh-key list
    • Input Parameters
  • cmd bgp rpki ssh-key delete
    • Input Parameters
  • cmd bgp rpki ssh-host add
    • Input Parameters
  • cmd bgp rpki ssh-host delete
    • Input Parameters
  • cmd certificate import
    • Input Parameters
  • cmd certificate export
    • Input Parameters
  • cmd certificate add
    • Input Parameters
  • cmd certificate delete
    • Input Parameters
  • cmd compress-alarm
    • Input Parameters
    • Output Data
• 3.2.2. show
  • show vrfs
    • Output Data
  • show summary
  • show interface
    • Input Parameters
  • show interface throughput
    • Input Parameters
  • show ipv4-routes
    • Input Parameters
  • show ipv6-routes
    • Input Parameters
  • show mpls table
    • Input Parameters
  • show disk
    • Output Data
  • show bgp
    • Input Parameters
  • show bgp bmp
    • Input Parameters
    • Output Data
  • show bgp rpki cache-connection
    • Input Parameters
  • show bgp rpki cache-server
    • Input Parameters
  • show bgp rpki prefix-table
    • Input Parameters
  • show isis
    • Input Parameters
  • show evpn
    • Input Parameters
  • show ospf
    • Input Parameters
  • show rip
    • Input Parameters
  • show ospf6
    • Input Parameters
  • show ripng
    • Input Parameters
  • show mpls ldp
    • Input Parameters
  • show bfd
    • Input Parameters
  • show path-monitoring
    • Input Parameters
  • show nhrp
    • Input Parameters
  • show nhrp6
    • Input Parameters
  • show pim
    • Input Parameters
  • show pbr
    • Input Parameters
    • Output Data
  • show segment-routing te-policies
    • Input Parameters
  • show segment-routing te-database
    • Input Parameters
  • show license
  • show boot-params
    • Output Data
  • show log
    • Input Parameters
  • show ntp
    • Input Parameters
    • Output Data
  • show ntp clients
    • Input Parameters
    • Output Data
  • show dhcp-relay
    • Input Parameters
    • Output Data
  • show dhcp-server
    • Input Parameters
  • show neighbors
    • Input Parameters
    • Output Data
  • show conntracks
    • Input Parameters
  • show product
    • Input Parameters
  • show fast-path cpu-usage
  • show fast-path table-usage
  • show fast-path statistics
    • Input Parameters
    • Output Data
  • show ike
    • Input Parameters
  • show cg-nat pool-usage
    • Input Parameters
  • show cg-nat port-usage
    • Input Parameters
  • show cg-nat user
    • Input Parameters
  • show cg-nat blocks
    • Input Parameters
  • show cg-nat conntracks
    • Input Parameters
  • show cg-nat conntrack-statistics
    • Input Parameters
  • show cg-nat port-statistics
    • Input Parameters
  • show cg-nat block-statistics
    • Input Parameters
  • show cg-nat hash-table-statistics
  • show cg-nat mempool-usage
  • show cg-nat statistics
  • show ha-neighbor
    • Input Parameters
  • show ha-conntrack
    • Input Parameters
  • show vxlan fdb
    • Input Parameters
    • Output Data
  • show bridge fdb
    • Input Parameters
    • Output Data
  • show dns-server
    • Input Parameters
    • Output Data
  • show certificate list
  • show certificate
    • Input Parameters
  • show certificate key
    • Input Parameters
  • show alarm list
    • Output Data
  • show alarm inventory
    • Output Data
  • show alarm summary
    • Output Data
• 3.2.3. flush
  • flush bgp
    • Input Parameters
  • flush isis
    • Input Parameters
  • flush ospf
    • Input Parameters
  • flush ospf6
    • Input Parameters
  • flush nhrp
    • Input Parameters
  • flush nhrp6
    • Input Parameters
  • flush pim
    • Input Parameters
  • flush ike ike-sa
    • Input Parameters
  • flush ike child-sa
    • Input Parameters
  • flush cg-nat statistics
  • flush cg-nat user
    • Input Parameters
  • flush cg-nat user-statistics
    • Input Parameters
  • flush fast-path statistics
  • flush vxlan fdb
    • Input Parameters
  • flush bridge fdb
    • Input Parameters
  • flush alarm
    • Input Parameters
    • Output Data
• 3.2.4. system
  • hostname
  • cp-mask
  • timezone
  • date (state only)
  • troubleshooting-report (state only)
  • traffic-capture (state only)
  • network-stack
    • bridge
      • call-ipv4-filtering
      • call-ipv6-filtering
    • icmp
      • ignore-icmp-echo-broadcast
      • rate-limit-icmp
      • rate-mask-icmp
    • ipv4
      • forwarding
      • send-redirects
      • accept-redirects
      • accept-source-route
      • arp-announce
      • arp-filter
      • arp-ignore
      • arp-proxy
      • log-invalid-addresses
    • ipv6
      • forwarding
      • autoconfiguration
      • accept-router-advert
      • accept-redirects
      • accept-source-route
      • router-solicitations
      • use-temporary-addresses
    • neighbor
      • ipv4-max-entries
      • ipv6-max-entries
      • ipv4-base-reachable-time
      • ipv6-base-reachable-time
    • conntrack
      • max-entries
      • tcp-timeout-close
      • tcp-timeout-close-wait
      • tcp-timeout-established
      • tcp-timeout-fin-wait
      • tcp-timeout-last-ack
      • tcp-timeout-max-retrans
      • tcp-timeout-syn-recv
      • tcp-timeout-syn-sent
      • tcp-timeout-time-wait
      • tcp-timeout-unacknowledged
      • udp-timeout
      • udp-timeout-stream
  • installed-image (state only)
    • version (state only)
    • current (state only)
    • default (state only)
    • next (state only)
• 3.2.5. cloud-init
  • enabled
  • datasource (state only)
• 3.2.6. license
  • enabled (pushed)
  • snmp
  • valid (state only) (pushed)
  • state (state only)
  • activation-type (state only)
  • license-type (state only)
  • short-license-type (state only)
  • subscription-end-date (state only)
  • support-type (state only)
  • support-end-date (state only) (pushed)
  • online
    • serial (mandatory)
    • vrf
    • proxy-host
    • proxy-port
    • proxy-user
    • proxy-password
    • export-analytics
    • use-ipv6-dns
    • source-ip
    • connected (state only) (pushed)
    • last-healthcheck-date (state only) (pushed)
    • lease-end-date (state only) (pushed)
    • current-activations (state only)
    • allowed-activations (state only)
    • computer-id (state only)
  • offline-certificate
    • serial (mandatory)
    • computer-id (state only)
    • license-certificate (state only)
  • offline
    • serial (mandatory)
    • license-file (state only)
  • throughput (state only)
    • allowed (state only) (pushed)
    • used (state only) (pushed)
  • cgnat-conntracks (state only)
    • allowed (state only) (pushed)
    • used (state only) (pushed)
  • ipsec-tunnels (state only)
    • allowed (state only) (pushed)
    • used (state only) (pushed)
• 3.2.7. auth
  • user
    • role (mandatory)
    • password
    • authorized-key
• 3.2.8. aaa
  • tacacs
    • address (mandatory)
    • port
    • secret (mandatory)
    • timeout
    • vrf
  • radius
    • address (mandatory)
    • port
    • secret (mandatory)
    • timeout
    • source
    • vrf
• 3.2.9. alarm
  • enabled
  • max-alarm-status-changes
  • notify-status-changes
  • notify-severity-level
  • alarm-inventory (state only)
    • alarm-type (state only)
      • resource (state only)
      • will-clear (state only)
      • severity-level (state only)
      • description (state only)
  • alarm-list (state only)
    • number-of-alarms (state only)
    • last-changed (state only)
    • alarm (state only)
      • alt-resource (state only)
      • time-created (state only)
      • is-cleared (state only)
      • last-raised (state only)
      • last-changed (state only)
      • perceived-severity (state only)
      • alarm-text (state only)
• 3.2.10. vrf
  • l3vrf
    • table-id (mandatory)
• 3.2.11. ssh-server
  • enabled (pushed)
  • address
  • port
  • permit-root-login
• 3.2.12. netconf-server
  • enabled (pushed)
  • idle-timeout
  • address
    • port
    • description
• 3.2.13. dns
  • search
  • server
  • proxy
    • enabled
    • listen-to
    • forward
      • server
      • local
    • dns64
      • client
      • exclude
      • mapped
        • not
        • PREFIX
• 3.2.14. dns-server
  • enabled (pushed)
  • use-system-servers
  • bind
  • record
    • IP
  • logging
    • enabled
  • server
    • source
• 3.2.15. ipv6-autoconf
  • enabled (pushed)
  • interface
    • max-advertisement-interval
    • min-advertisement-interval
    • managed
    • other-config
    • link-mtu
    • reachable-time
    • retransmit-timer
    • default-lifetime
    • prefix
      • send-interface-address
      • on-link
      • valid-lifetime
      • preferred-lifetime
      • autonomous
      • base6-interface
      • base6to4-interface
• 3.2.16. lldp
  • enabled (pushed)
  • hello-timer
  • system-name
  • system-description
  • management-address
  • chassis-id (state only)
  • chassis-id-type (state only)
  • interface
    • enabled
    • counters (state only)
      • frame-in (state only)
      • frame-out (state only)
      • frame-discard (state only)
      • tlv-discard (state only)
    • neighbor (state only)
      • port-id (state only)
      • port-id-type (state only)
      • port-description (state only)
      • management-address (state only)
      • system-name (state only)
      • system-description (state only)
      • chassis-id (state only)
      • chassis-id-type (state only)
      • capability (state only)
        • enabled (state only)
  • counters (state only)
    • frame-in (state only)
    • frame-out (state only)
    • frame-discard (state only)
    • tlv-discard (state only)
    • tlv-accepted (state only)
    • entries-aged-out (state only)
• 3.2.17. kpi
  • interface
• 3.2.18. telegraf
  • enabled (pushed)
  • interval
  • influxdb-output
    • database (mandatory)
    • username
    • password
    • insecure-skip-verify
  • influxdbv2-output
    • token (mandatory)
    • organization (mandatory)
    • bucket (mandatory)
    • insecure-skip-verify
  • kafka-output
    • topic
• 3.2.19. tracker
  • bfd
    • type
    • source
    • address (mandatory)
    • interface
    • vrf (mandatory)
    • echo-mode
    • detection-multiplier
    • desired-transmission-interval
    • required-receive-interval
    • desired-echo-transmission-interval
    • discriminator (state only)
    • state (state only)
    • diagnostic (state only)
    • last-down-time (state only)
    • last-up-time (state only)
    • session-down-count (state only)
    • session-up-count (state only)
    • control-packet-input-count (state only)
    • control-packet-output-count (state only)
    • echo-packet-input-count (state only)
    • echo-packet-output-count (state only)
    • zebra-notification-count (state only)
    • remote (state only)
      • discriminator (state only)
      • diagnostic (state only)
      • multiplier (state only)
    • negociated (state only)
      • transmission-interval (state only)
      • receive-interval (state only)
      • echo-transmission-interval (state only)
  • icmp
    • address
    • vrf (mandatory)
    • source
    • interface
    • dhcp-interface
    • gateway
    • period
    • threshold
    • total
    • packet-size
    • packet-tos
    • timeout
    • state (state only)
    • diagnostic (state only)
• 3.2.20. nat
  • source-rule
    • description
    • protocol
      • not
      • VALUE (mandatory)
    • destination
      • address
        • not
        • VALUE (mandatory)
      • port
        • not
        • VALUE (mandatory)
      • port-range
        • not
        • VALUE (mandatory)
      • group
        • not
        • <string> (mandatory)
    • source
      • address
        • not
        • VALUE (mandatory)
      • port
        • not
        • VALUE (mandatory)
      • port-range
        • not
        • VALUE (mandatory)
      • group
        • not
        • <string> (mandatory)
    • mark
      • not
      • <0x0-0xffffffff> (mandatory)
      • mask
    • outbound-interface
      • not
      • <string> (mandatory)
    • translate-to
      • map
      • output-address
      • address
        • VALUE (mandatory)
        • port
        • port-range
          • START (mandatory)
          • END (mandatory)
      • address-range
        • START (mandatory)
        • END (mandatory)
        • port
        • port-range
          • START (mandatory)
          • END (mandatory)
    • counters (state only)
      • packets (state only)
      • bytes (state only)
  • destination-rule
    • description
    • protocol
      • not
      • VALUE (mandatory)
    • destination
      • address
        • not
        • VALUE (mandatory)
      • port
        • not
        • VALUE (mandatory)
      • port-range
        • not
        • VALUE (mandatory)
      • group
        • not
        • <string> (mandatory)
    • source
      • address
        • not
        • VALUE (mandatory)
      • port
        • not
        • VALUE (mandatory)
      • port-range
        • not
        • VALUE (mandatory)
      • group
        • not
        • <string> (mandatory)
    • mark
      • not
      • <0x0-0xffffffff> (mandatory)
      • mask
    • inbound-interface
      • not
      • <string> (mandatory)
    • translate-to
      • map
      • address
        • VALUE (mandatory)
        • port
        • port-range
          • START (mandatory)
          • END (mandatory)
      • address-range
        • START (mandatory)
        • END (mandatory)
        • port
        • port-range
          • START (mandatory)
          • END (mandatory)
    • counters (state only)
      • packets (state only)
      • bytes (state only)
• 3.2.21. cg-nat
  • enabled
  • alg
  • pool
    • address
    • block-allocation-mode
    • block-size
    • port-range
      • START
      • END
  • rule
    • deterministic-snat44
      • match
        • outbound-interface (mandatory)
        • source
          • ipv4-address
      • translate-to
        • pool-name (mandatory)
        • max-conntracks-per-user
        • port-algo
        • endpoint-mapping
        • endpoint-filtering
        • hairpinning
        • address-pooling
    • deterministic-snat64
      • match
        • outbound-interface (mandatory)
        • source
          • ipv6-address
      • translate-to
        • pool-name (mandatory)
        • max-conntracks-per-user
        • port-algo
        • endpoint-mapping
        • endpoint-filtering
        • hairpinning
        • address-pooling
        • destination-prefix
    • dynamic-snat44
      • match
        • outbound-interface (mandatory)
        • source
          • ipv4-address
      • translate-to
        • pool-name (mandatory)
        • max-blocks-per-user
        • active-block-timeout
        • user-timeout
        • max-conntracks-per-user
        • port-algo
        • endpoint-mapping
        • endpoint-filtering
        • hairpinning
        • address-pooling
    • dynamic-snat64
      • match
        • outbound-interface (mandatory)
        • source
          • ipv6-address
      • translate-to
        • pool-name (mandatory)
        • max-blocks-per-user
        • active-block-timeout
        • user-timeout
        • max-conntracks-per-user
        • port-algo
        • endpoint-mapping
        • endpoint-filtering
        • hairpinning
        • address-pooling
        • destination-prefix
    • static-dnat44
      • match
        • inbound-interface (mandatory)
        • destination
          • ipv4-address
      • translate-to
        • ipv4-address (mandatory)
    • static-dnat46
      • match
        • inbound-interface (mandatory)
        • destination
          • ipv4-address
      • translate-to
        • ipv6-address (mandatory)
        • source-prefix
    • static-snat44
      • match
        • outbound-interface (mandatory)
        • source
          • ipv4-address
      • translate-to
        • ipv4-address (mandatory)
    • static-snat64
      • match
        • outbound-interface (mandatory)
        • source
          • ipv6-address
      • translate-to
        • ipv4-address (mandatory)
        • destination-prefix
  • conntrack
    • behavior
      • enabled (mandatory)
    • timeouts
      • icmp
        • <uint32> (mandatory)
      • udp
        • <uint32> (mandatory)
      • gre-pptp
        • <uint32> (mandatory)
      • tcp
        • <uint32> (mandatory)
    • nat64
      • option
        • true|false (mandatory)
      • mtu
        • <uint16> (mandatory)
  • logging
    • enabled
• 3.2.22. ntp
  • enabled (pushed)
  • ntp-source-address
  • auth-key
    • key-value
  • server-subnet
    • allow
    • deny
  • server
    • version
    • association-type
    • iburst
    • prefer
    • auth-key-id
    • stratum (state only)
    • root-delay (state only)
    • root-dispersion (state only)
    • offset (state only)
    • poll-interval (state only)
    • synchronized (state only)
    • state (state only)
  • time-sources
    • makestep
      • threshold
      • limit
    • server
      • version
      • association-type
      • iburst
      • prefer
      • auth-key-id
      • stratum (state only)
      • root-delay (state only)
      • root-dispersion (state only)
      • offset (state only)
      • poll-interval (state only)
      • synchronized (state only)
      • state (state only)
• 3.2.23. firewall
  • ipv4 filter
    • input
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • reject
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • forward
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • reject
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • output
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • reject
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • chain
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • outbound-interface
          • not
          • <string> (mandatory)
        • rpfilter
          • invert
        • action
          • STANDARD
          • chain
          • dscp
          • reject
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
          • tos
            • <0x0-0xff> (mandatory)
            • mask
        • counters (state only)
          • packets (state only)
          • bytes (state only)
  • ipv4 mangle
    • prerouting
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • rpfilter
          • invert
        • action
          • STANDARD
          • chain
          • dscp
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
          • tos
            • <0x0-0xff> (mandatory)
            • mask
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • input
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • dscp
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
          • tos
            • <0x0-0xff> (mandatory)
            • mask
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • forward
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • dscp
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
          • tos
            • <0x0-0xff> (mandatory)
            • mask
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • output
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • dscp
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
          • tos
            • <0x0-0xff> (mandatory)
            • mask
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • postrouting
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • dscp
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
          • tos
            • <0x0-0xff> (mandatory)
            • mask
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • chain
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • outbound-interface
          • not
          • <string> (mandatory)
        • rpfilter
          • invert
        • action
          • STANDARD
          • chain
          • dscp
          • reject
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
          • tos
            • <0x0-0xff> (mandatory)
            • mask
        • counters (state only)
          • packets (state only)
          • bytes (state only)
  • ipv4 raw
    • prerouting
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • rpfilter
          • invert
        • action
          • STANDARD
          • chain
          • notrack
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • output
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • notrack
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • chain
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • ipv4
          • not
          • fragment (mandatory)
        • icmp-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • outbound-interface
          • not
          • <string> (mandatory)
        • rpfilter
          • invert
        • action
          • STANDARD
          • chain
          • dscp
          • reject
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
          • tos
            • <0x0-0xff> (mandatory)
            • mask
        • counters (state only)
          • packets (state only)
          • bytes (state only)
  • ipv6 filter
    • input
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • reject
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • forward
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • reject
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • output
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • reject
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • chain
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • outbound-interface
          • not
          • <string> (mandatory)
        • rpfilter
          • invert
        • action
          • STANDARD
          • chain
          • reject
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
  • ipv6 mangle
    • prerouting
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • rpfilter
          • invert
        • action
          • STANDARD
          • chain
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • input
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • dscp
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
          • tos
            • <0x0-0xff> (mandatory)
            • mask
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • forward
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • output
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • dscp
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
          • tos
            • <0x0-0xff> (mandatory)
            • mask
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • postrouting
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • chain
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • outbound-interface
          • not
          • <string> (mandatory)
        • rpfilter
          • invert
        • action
          • STANDARD
          • chain
          • reject
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
  • ipv6 raw
    • prerouting
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • rpfilter
          • invert
        • action
          • STANDARD
          • chain
          • notrack
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • output
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • outbound-interface
          • not
          • <string> (mandatory)
        • action
          • STANDARD
          • chain
          • notrack
          • set-priority
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
    • chain
      • policy
      • packets (state only)
      • bytes (state only)
      • rule
        • description
        • protocol
          • not
          • VALUE (mandatory)
        • destination
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • source
          • address
            • not
            • VALUE (mandatory)
          • port
            • not
            • VALUE (mandatory)
          • port-range
            • not
            • VALUE (mandatory)
          • group
            • not
            • <string> (mandatory)
        • icmpv6-type
          • not
          • VALUE (mandatory)
        • tcp-flags
          • not
          • set
          • examined
        • conntrack
          • status
            • not
            • VALUE
          • state
            • not
            • VALUE
        • connmark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • limit
          • burst
          • rate
            • <uint32> (mandatory)
            • UNIT
        • dscp
          • not
          • VALUE (mandatory)
        • tos
          • not
          • <0x0-0xff> (mandatory)
          • mask
        • mark
          • not
          • <0x0-0xffffffff> (mandatory)
          • mask
        • sctp-chunk-types
          • not
          • SCOPE (mandatory)
          • init
          • init-ack
          • sack
          • heartbeat
          • heartbeat-ack
          • shutdown
          • shutdown-ack
          • error
          • cookie-echo
          • cookie-ack
          • ecn-ecne
          • ecn-cwr
          • asconf
          • asconf-ack
          • forward-tsn
          • data
            • examined
            • set
          • abort
            • examined
            • set
          • shutdown-complete
            • examined
            • set
        • inbound-interface
          • not
          • <string> (mandatory)
        • outbound-interface
          • not
          • <string> (mandatory)
        • rpfilter
          • invert
        • action
          • STANDARD
          • chain
          • reject
          • connmark
            • set-xmark
              • <0x0-0xffffffff> (mandatory)
              • mask
            • save-mark
              • nfmask
              • ctmask
            • restore-mark
              • nfmask
              • ctmask
          • log
            • level
            • prefix
            • additional-infos
          • mark
            • <0x0-0xffffffff> (mandatory)
            • mask
          • tcpmss
            • set-mss
            • clamp-mss-to-pmtu
        • counters (state only)
          • packets (state only)
          • bytes (state only)
• 3.2.24. network-port (state only)
  • pci-bus-addr (state only)
  • bus-addr (state only)
  • device-tree-alias (state only)
  • device-tree-compatible (state only)
  • vendor (state only)
  • model (state only)
  • device-port (state only)
  • mac-address (state only)
  • interface (state only)
• 3.2.25. interface
  • bridge
    • mtu
    • promiscuous
    • enabled (pushed)
    • description
    • ageing-time
    • ifindex (state only)
    • admin-status (state only)
    • oper-status (state only)
    • last-change (state only)
    • ipv4
      • enabled
      • address
        • peer
        • origin (state only)
      • neighbor
        • link-layer-address (mandatory)
        • state (state only)
      • dhcp
        • enabled
        • timeout
        • retry
        • select-timeout
        • reboot
        • initial-interval
        • dhcp-lease-time
        • dhcp-client-identifier-ascii
        • dhcp-client-identifier-hexa
        • host-name
        • request
        • current-lease (state only)
          • fixed-address (state only)
          • renew (state only)
          • rebind (state only)
          • expire (state only)
    • ethernet
      • mac-address
    • ipv6
      • enabled
      • address
        • peer
        • origin (state only)
        • status (state only)
      • neighbor
        • link-layer-address (mandatory)
        • router (state only)
        • state (state only)
    • network-stack
      • ipv4
        • send-redirects
        • accept-redirects
        • accept-source-route
        • arp-announce
        • arp-filter
        • arp-ignore
        • arp-proxy
        • log-invalid-addresses
      • ipv6
        • autoconfiguration
        • accept-router-advert
        • accept-redirects
        • accept-source-route
        • router-solicitations
        • use-temporary-addresses
    • stp
      • enabled
      • priority
      • forward-delay
      • max-age
      • hello-time
    • link-interface
      • learning
    • qos
      • ingress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
      • egress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
    • counters (state only)
      • in-octets (state only)
      • in-unicast-pkts (state only)
      • in-discards (state only)
      • in-errors (state only)
      • out-octets (state only)
      • out-unicast-pkts (state only)
      • out-discards (state only)
      • out-errors (state only)
  • gre
    • mtu
    • promiscuous
    • enabled (pushed)
    • description
    • ttl
    • tos
    • link-interface
    • link-vrf
    • local (mandatory)
    • remote
    • checksum
    • sequence-number
    • ifindex (state only)
    • admin-status (state only)
    • oper-status (state only)
    • last-change (state only)
    • ipv4
      • enabled
      • address
        • peer
        • origin (state only)
      • neighbor
        • link-layer-address (mandatory)
        • state (state only)
    • ipv6
      • enabled
      • address
        • peer
        • origin (state only)
        • status (state only)
      • neighbor
        • link-layer-address (mandatory)
        • state (state only)
    • network-stack
      • ipv4
        • send-redirects
        • accept-redirects
        • accept-source-route
        • arp-announce
        • arp-filter
        • arp-ignore
        • arp-proxy
        • log-invalid-addresses
      • ipv6
        • autoconfiguration
        • accept-router-advert
        • accept-redirects
        • accept-source-route
        • router-solicitations
        • use-temporary-addresses
    • key
      • input
      • output
      • both
    • qos
      • ingress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
      • egress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
    • counters (state only)
      • in-octets (state only)
      • in-unicast-pkts (state only)
      • in-discards (state only)
      • in-errors (state only)
      • out-octets (state only)
      • out-unicast-pkts (state only)
      • out-discards (state only)
      • out-errors (state only)
  • ipip
    • mtu
    • promiscuous
    • enabled (pushed)
    • description
    • local (mandatory)
    • remote (mandatory)
    • ttl
    • tos
    • link-interface
    • link-vrf
    • ifindex (state only)
    • admin-status (state only)
    • oper-status (state only)
    • last-change (state only)
    • ipv4
      • enabled
      • address
        • peer
        • origin (state only)
    • ipv6
      • enabled
      • address
        • peer
        • origin (state only)
        • status (state only)
    • network-stack
      • ipv4
        • send-redirects
        • accept-redirects
        • accept-source-route
        • arp-announce
        • arp-filter
        • arp-ignore
        • arp-proxy
        • log-invalid-addresses
      • ipv6
        • autoconfiguration
        • accept-router-advert
        • accept-redirects
        • accept-source-route
        • router-solicitations
        • use-temporary-addresses
    • qos
      • ingress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
      • egress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
    • counters (state only)
      • in-octets (state only)
      • in-unicast-pkts (state only)
      • in-discards (state only)
      • in-errors (state only)
      • out-octets (state only)
      • out-unicast-pkts (state only)
      • out-discards (state only)
      • out-errors (state only)
  • lag
    • mtu
    • promiscuous
    • enabled (pushed)
    • description
    • mode (mandatory)
    • xmit-hash-policy
    • lacp-rate
    • mii-link-monitoring
    • arp-interval
    • arp-ip-target
    • ifindex (state only)
    • admin-status (state only)
    • oper-status (state only)
    • last-change (state only)
    • ipv4
      • enabled
      • address
        • peer
        • origin (state only)
      • neighbor
        • link-layer-address (mandatory)
        • state (state only)
      • dhcp
        • enabled
        • timeout
        • retry
        • select-timeout
        • reboot
        • initial-interval
        • dhcp-lease-time
        • dhcp-client-identifier-ascii
        • dhcp-client-identifier-hexa
        • host-name
        • request
        • current-lease (state only)
          • fixed-address (state only)
          • renew (state only)
          • rebind (state only)
          • expire (state only)
    • ethernet
      • mac-address
    • ipv6
      • enabled
      • address
        • peer
        • origin (state only)
        • status (state only)
      • neighbor
        • link-layer-address (mandatory)
        • router (state only)
        • state (state only)
    • network-stack
      • ipv4
        • send-redirects
        • accept-redirects
        • accept-source-route
        • arp-announce
        • arp-filter
        • arp-ignore
        • arp-proxy
        • log-invalid-addresses
      • ipv6
        • autoconfiguration
        • accept-router-advert
        • accept-redirects
        • accept-source-route
        • router-solicitations
        • use-temporary-addresses
    • link-interface
      • state (state only)
      • link (state only)
      • failure-count (state only)
    • primary
      • interface (mandatory)
      • reselect-policy
    • qos
      • ingress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
      • egress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
    • counters (state only)
      • in-octets (state only)
      • in-unicast-pkts (state only)
      • in-discards (state only)
      • in-errors (state only)
      • out-octets (state only)
      • out-unicast-pkts (state only)
      • out-discards (state only)
      • out-errors (state only)
  • loopback
    • mtu
    • promiscuous
    • enabled (pushed)
    • description
    • ifindex (state only)
    • admin-status (state only)
    • oper-status (state only)
    • last-change (state only)
    • ipv4
      • enabled
      • address
        • peer
        • origin (state only)
      • neighbor
        • link-layer-address (mandatory)
        • state (state only)
      • dhcp
        • enabled
        • timeout
        • retry
        • select-timeout
        • reboot
        • initial-interval
        • dhcp-lease-time
        • dhcp-client-identifier-ascii
        • dhcp-client-identifier-hexa
        • host-name
        • request
        • current-lease (state only)
          • fixed-address (state only)
          • renew (state only)
          • rebind (state only)
          • expire (state only)
    • ipv6
      • enabled
      • address
        • peer
        • origin (state only)
        • status (state only)
      • neighbor
        • link-layer-address (mandatory)
        • router (state only)
        • state (state only)
    • network-stack
      • ipv4
        • send-redirects
        • accept-redirects
        • accept-source-route
        • arp-announce
        • arp-filter
        • arp-ignore
        • arp-proxy
        • log-invalid-addresses
      • ipv6
        • autoconfiguration
        • accept-router-advert
        • accept-redirects
        • accept-source-route
        • router-solicitations
        • use-temporary-addresses
    • ethernet
      • mac-address
    • qos
      • ingress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
      • egress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
    • counters (state only)
      • in-octets (state only)
      • in-unicast-pkts (state only)
      • in-discards (state only)
      • in-errors (state only)
      • out-octets (state only)
      • out-unicast-pkts (state only)
      • out-discards (state only)
      • out-errors (state only)
  • physical
    • mtu
    • promiscuous
    • enabled (pushed)
    • description
    • port (mandatory)
    • rx-cp-protection
    • tx-cp-protection
    • ifindex (state only)
    • admin-status (state only)
    • oper-status (state only)
    • last-change (state only)
    • ipv4
      • enabled
      • address
        • peer
        • origin (state only)
      • neighbor
        • link-layer-address (mandatory)
        • state (state only)
      • dhcp
        • enabled
        • timeout
        • retry
        • select-timeout
        • reboot
        • initial-interval
        • dhcp-lease-time
        • dhcp-client-identifier-ascii
        • dhcp-client-identifier-hexa
        • host-name
        • request
        • current-lease (state only)
          • fixed-address (state only)
          • renew (state only)
          • rebind (state only)
          • expire (state only)
    • ipv6
      • enabled
      • address
        • peer
        • origin (state only)
        • status (state only)
      • neighbor
        • link-layer-address (mandatory)
        • router (state only)
        • state (state only)
    • network-stack
      • ipv4
        • send-redirects
        • accept-redirects
        • accept-source-route
        • arp-announce
        • arp-filter
        • arp-ignore
        • arp-proxy
        • log-invalid-addresses
      • ipv6
        • autoconfiguration
        • accept-router-advert
        • accept-redirects
        • accept-source-route
        • router-solicitations
        • use-temporary-addresses
    • ethernet
      • mac-address
      • auto-negotiate
      • duplex-mode
      • port-speed
      • flow-control-rx
      • flow-control-tx
    • qos
      • ingress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
      • egress
        • scheduler (config only)
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • shaper (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
          • shaper (state only)
            • bandwidth (state only)
            • burst (state only)
            • layer1-overhead (state only)
            • queue-size (state only)
            • stats (state only)
              • pass-packets (state only)
              • drop-packets (state only)
        • scheduler (state only)
          • is-root (state only)
          • core (deprecated) (state only)
          • pq (state only)
            • nb-queue (state only)
            • queue (state only)
              • size (state only)
              • child-scheduler-id (state only)
              • priority (state only)
              • policer (state only)
                • bandwidth (state only)
                • burst (state only)
                • excess-bandwidth (state only)
                • excess-burst (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • pass-bytes (state only)
                  • pass-excess-packets (state only)
                  • pass-excess-bytes (state only)
                  • drop-packets (state only)
                  • drop-bytes (state only)
              • shaper (state only)
                • bandwidth (state only)
                • burst (state only)
                • layer1-overhead (state only)
                • queue-size (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • drop-packets (state only)
              • class (state only)
                • stats (state only)
                  • match-packets (state only)
              • stats (state only)
                • enqueue-packets (state only)
                • xmit-packets (state only)
                • drop-queue-full (state only)
            • stats (state only)
              • enqueue-packets (state only)
              • xmit-packets (state only)
              • drop-queue-full (state only)
          • pb-dwrr (state only)
            • nb-queue (state only)
            • queue (state only)
              • size (state only)
              • child-scheduler-id (state only)
              • quantum (state only)
              • priority (state only)
              • policer (state only)
                • bandwidth (state only)
                • burst (state only)
                • excess-bandwidth (state only)
                • excess-burst (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • pass-bytes (state only)
                  • pass-excess-packets (state only)
                  • pass-excess-bytes (state only)
                  • drop-packets (state only)
                  • drop-bytes (state only)
              • shaper (state only)
                • bandwidth (state only)
                • burst (state only)
                • layer1-overhead (state only)
                • queue-size (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • drop-packets (state only)
              • class (state only)
                • stats (state only)
                  • match-packets (state only)
              • stats (state only)
                • enqueue-packets (state only)
                • xmit-packets (state only)
                • drop-queue-full (state only)
            • stats (state only)
              • enqueue-packets (state only)
              • xmit-packets (state only)
              • drop-queue-full (state only)
          • htb (state only)
            • nb-queue (state only)
            • divisor (state only)
            • queue (state only)
              • size (state only)
              • child-scheduler-id (state only)
              • bandwidth (state only)
              • burst (state only)
              • ceiling (state only)
              • ceiling-burst (state only)
              • quantum (state only)
              • priority (state only)
              • child-queue (state only)
              • policer (state only)
                • bandwidth (state only)
                • burst (state only)
                • excess-bandwidth (state only)
                • excess-burst (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • pass-bytes (state only)
                  • pass-excess-packets (state only)
                  • pass-excess-bytes (state only)
                  • drop-packets (state only)
                  • drop-bytes (state only)
              • shaper (state only)
                • bandwidth (state only)
                • burst (state only)
                • layer1-overhead (state only)
                • queue-size (state only)
                • stats (state only)
                  • pass-packets (state only)
                  • drop-packets (state only)
              • class (state only)
                • stats (state only)
                  • match-packets (state only)
              • stats (state only)
                • enqueue-packets (state only)
                • xmit-packets (state only)
                • drop-queue-full (state only)
            • stats (state only)
              • enqueue-packets (state only)
              • xmit-packets (state only)
              • drop-queue-full (state only)
          • sfq (state only)
            • flows (state only)
            • quantum (state only)
            • limit (state only)
            • stats (state only)
              • enqueue-packets (state only)
              • xmit-packets (state only)
              • drop-queue-full (state only)
    • counters (state only)
      • in-octets (state only)
      • in-unicast-pkts (state only)
      • in-discards (state only)
      • in-errors (state only)
      • out-octets (state only)
      • out-unicast-pkts (state only)
      • out-discards (state only)
      • out-errors (state only)
  • pimreg (state only)
    • mtu (state only)
    • promiscuous (state only)
    • enabled (state only) (pushed)
    • description (state only)
    • ifindex (state only)
    • admin-status (state only)
    • oper-status (state only)
    • last-change (state only)
    • ipv4 (state only)
      • enabled (state only)
      • address (state only)
        • peer (state only)
        • origin (state only)
      • neighbor (state only)
        • link-layer-address (state only)
        • state (state only)
      • dhcp (state only)
        • enabled (state only)
        • timeout (state only)
        • retry (state only)
        • select-timeout (state only)
        • reboot (state only)
        • initial-interval (state only)
        • dhcp-lease-time (state only)
        • dhcp-client-identifier-ascii (state only)
        • dhcp-client-identifier-hexa (state only)
        • host-name (state only)
        • request (state only)
        • current-lease (state only)
          • fixed-address (state only)
          • renew (state only)
          • rebind (state only)
          • expire (state only)
    • ipv6 (state only)
      • enabled (state only)
      • address (state only)
        • peer (state only)
        • origin (state only)
        • status (state only)
      • neighbor (state only)
        • link-layer-address (state only)
        • router (state only)
        • state (state only)
    • counters (state only)
      • in-octets (state only)
      • in-unicast-pkts (state only)
      • in-discards (state only)
      • in-errors (state only)
      • out-octets (state only)
      • out-unicast-pkts (state only)
      • out-discards (state only)
      • out-errors (state only)
    • network-stack (state only)
      • ipv4 (state only)
        • send-redirects (state only)
        • accept-redirects (state only)
        • accept-source-route (state only)
        • arp-announce (state only)
        • arp-filter (state only)
        • arp-ignore (state only)
        • arp-proxy (state only)
        • log-invalid-addresses (state only)
      • ipv6 (state only)
        • autoconfiguration (state only)
        • accept-router-advert (state only)
        • accept-redirects (state only)
        • accept-source-route (state only)
        • router-solicitations (state only)
        • use-temporary-addresses (state only)
  • pppoe
    • enabled
    • link-interface (mandatory)
    • service-name
    • ac-name
    • remote-mac-address
    • mtu
    • mru
    • request
    • link-status (state only)
    • session (state only)
    • rpf (state only)
    • qos
      • ingress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
      • egress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
    • auth
      • reply
      • user (mandatory)
      • secret (mandatory)
    • ipcp
      • enabled
      • local-address
      • remote-address
    • ipv6cp
      • enabled
      • local-ifid
      • remote-ifid
    • lcp
      • echo-interval
      • echo-failure
    • logging
      • enabled
  • svti
    • mtu
    • promiscuous
    • enabled (pushed)
    • description
    • svti-id (mandatory)
    • link-vrf
    • ifindex (state only)
    • admin-status (state only)
    • oper-status (state only)
    • last-change (state only)
    • link-interface (state only)
    • ipv4
      • enabled
      • address
        • peer
        • origin (state only)
      • neighbor
        • link-layer-address (mandatory)
        • state (state only)
      • dhcp
        • enabled
        • timeout
        • retry
        • select-timeout
        • reboot
        • initial-interval
        • dhcp-lease-time
        • dhcp-client-identifier-ascii
        • dhcp-client-identifier-hexa
        • host-name
        • request
        • current-lease (state only)
          • fixed-address (state only)
          • renew (state only)
          • rebind (state only)
          • expire (state only)
    • ethernet
      • mac-address
    • ipv6
      • enabled
      • address
        • peer
        • origin (state only)
        • status (state only)
      • neighbor
        • link-layer-address (mandatory)
        • router (state only)
        • state (state only)
    • network-stack
      • ipv4
        • send-redirects
        • accept-redirects
        • accept-source-route
        • arp-announce
        • arp-filter
        • arp-ignore
        • arp-proxy
        • log-invalid-addresses
      • ipv6
        • autoconfiguration
        • accept-router-advert
        • accept-redirects
        • accept-source-route
        • router-solicitations
        • use-temporary-addresses
    • qos
      • ingress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
      • egress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
    • counters (state only)
      • in-octets (state only)
      • in-unicast-pkts (state only)
      • in-discards (state only)
      • in-errors (state only)
      • out-octets (state only)
      • out-unicast-pkts (state only)
      • out-discards (state only)
      • out-errors (state only)
  • svti-template (config only)
    • mtu (config only)
    • install-routes-to (config only)
  • system-loopback (state only)
    • mtu (state only)
    • promiscuous (state only)
    • enabled (state only) (pushed)
    • description (state only)
    • ifindex (state only)
    • admin-status (state only)
    • oper-status (state only)
    • last-change (state only)
    • ipv4 (state only)
      • enabled (state only)
      • address (state only)
        • peer (state only)
        • origin (state only)
      • neighbor (state only)
        • link-layer-address (state only)
        • state (state only)
      • dhcp (state only)
        • enabled (state only)
        • timeout (state only)
        • retry (state only)
        • select-timeout (state only)
        • reboot (state only)
        • initial-interval (state only)
        • dhcp-lease-time (state only)
        • dhcp-client-identifier-ascii (state only)
        • dhcp-client-identifier-hexa (state only)
        • host-name (state only)
        • request (state only)
        • current-lease (state only)
          • fixed-address (state only)
          • renew (state only)
          • rebind (state only)
          • expire (state only)
    • ipv6 (state only)
      • enabled (state only)
      • address (state only)
        • peer (state only)
        • origin (state only)
        • status (state only)
      • neighbor (state only)
        • link-layer-address (state only)
        • router (state only)
        • state (state only)
    • counters (state only)
      • in-octets (state only)
      • in-unicast-pkts (state only)
      • in-discards (state only)
      • in-errors (state only)
      • out-octets (state only)
      • out-unicast-pkts (state only)
      • out-discards (state only)
      • out-errors (state only)
  • veth
    • mtu
    • promiscuous
    • enabled (pushed)
    • description
    • link-interface (mandatory)
    • link-vrf (mandatory)
    • ifindex (state only)
    • admin-status (state only)
    • oper-status (state only)
    • last-change (state only)
    • ipv4
      • enabled
      • address
        • peer
        • origin (state only)
      • neighbor
        • link-layer-address (mandatory)
        • state (state only)
      • dhcp
        • enabled
        • timeout
        • retry
        • select-timeout
        • reboot
        • initial-interval
        • dhcp-lease-time
        • dhcp-client-identifier-ascii
        • dhcp-client-identifier-hexa
        • host-name
        • request
        • current-lease (state only)
          • fixed-address (state only)
          • renew (state only)
          • rebind (state only)
          • expire (state only)
    • ipv6
      • enabled
      • address
        • peer
        • origin (state only)
        • status (state only)
      • neighbor
        • link-layer-address (mandatory)
        • router (state only)
        • state (state only)
    • network-stack
      • ipv4
        • send-redirects
        • accept-redirects
        • accept-source-route
        • arp-announce
        • arp-filter
        • arp-ignore
        • arp-proxy
        • log-invalid-addresses
      • ipv6
        • autoconfiguration
        • accept-router-advert
        • accept-redirects
        • accept-source-route
        • router-solicitations
        • use-temporary-addresses
    • ethernet
      • mac-address
    • qos
      • ingress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
      • egress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
    • counters (state only)
      • in-octets (state only)
      • in-unicast-pkts (state only)
      • in-discards (state only)
      • in-errors (state only)
      • out-octets (state only)
      • out-unicast-pkts (state only)
      • out-discards (state only)
      • out-errors (state only)
  • vlan
    • mtu
    • promiscuous
    • enabled (pushed)
    • description
    • vlan-id (mandatory)
    • link-interface (mandatory)
    • protocol
    • link-vrf
    • ifindex (state only)
    • admin-status (state only)
    • oper-status (state only)
    • last-change (state only)
    • ipv4
      • enabled
      • address
        • peer
        • origin (state only)
      • neighbor
        • link-layer-address (mandatory)
        • state (state only)
      • dhcp
        • enabled
        • timeout
        • retry
        • select-timeout
        • reboot
        • initial-interval
        • dhcp-lease-time
        • dhcp-client-identifier-ascii
        • dhcp-client-identifier-hexa
        • host-name
        • request
        • current-lease (state only)
          • fixed-address (state only)
          • renew (state only)
          • rebind (state only)
          • expire (state only)
    • ethernet
      • mac-address
    • ipv6
      • enabled
      • address
        • peer
        • origin (state only)
        • status (state only)
      • neighbor
        • link-layer-address (mandatory)
        • router (state only)
        • state (state only)
    • network-stack
      • ipv4
        • send-redirects
        • accept-redirects
        • accept-source-route
        • arp-announce
        • arp-filter
        • arp-ignore
        • arp-proxy
        • log-invalid-addresses
      • ipv6
        • autoconfiguration
        • accept-router-advert
        • accept-redirects
        • accept-source-route
        • router-solicitations
        • use-temporary-addresses
    • egress-priority-mapping
      • to
    • ingress-priority-mapping
      • to
    • qos
      • ingress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
      • egress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
    • counters (state only)
      • in-octets (state only)
      • in-unicast-pkts (state only)
      • in-discards (state only)
      • in-errors (state only)
      • out-octets (state only)
      • out-unicast-pkts (state only)
      • out-discards (state only)
      • out-errors (state only)
  • vxlan
    • mtu
    • promiscuous
    • enabled (pushed)
    • description
    • vni (mandatory)
    • group
    • remote
    • local
    • ttl
    • tos
    • link-interface
    • link-vrf
    • learning
    • gbp
    • dst
    • ifindex (state only)
    • admin-status (state only)
    • oper-status (state only)
    • last-change (state only)
    • ipv4
      • enabled
      • address
        • peer
        • origin (state only)
      • neighbor
        • link-layer-address (mandatory)
        • state (state only)
      • dhcp
        • enabled
        • timeout
        • retry
        • select-timeout
        • reboot
        • initial-interval
        • dhcp-lease-time
        • dhcp-client-identifier-ascii
        • dhcp-client-identifier-hexa
        • host-name
        • request
        • current-lease (state only)
          • fixed-address (state only)
          • renew (state only)
          • rebind (state only)
          • expire (state only)
      • fdb
        • link-interface
        • port
        • vni
        • state (state only)
    • ethernet
      • mac-address
    • ipv6
      • enabled
      • address
        • peer
        • origin (state only)
        • status (state only)
      • neighbor
        • link-layer-address (mandatory)
        • router (state only)
        • state (state only)
      • fdb
        • link-interface
        • port
        • vni
        • state (state only)
    • network-stack
      • ipv4
        • send-redirects
        • accept-redirects
        • accept-source-route
        • arp-announce
        • arp-filter
        • arp-ignore
        • arp-proxy
        • log-invalid-addresses
      • ipv6
        • autoconfiguration
        • accept-router-advert
        • accept-redirects
        • accept-source-route
        • router-solicitations
        • use-temporary-addresses
    • src-range
      • <uint16>
      • <uint16>
    • qos
      • ingress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
      • egress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
    • counters (state only)
      • in-octets (state only)
      • in-unicast-pkts (state only)
      • in-discards (state only)
      • in-errors (state only)
      • out-octets (state only)
      • out-unicast-pkts (state only)
      • out-discards (state only)
      • out-errors (state only)
  • xvrf
    • mtu
    • promiscuous
    • enabled (pushed)
    • description
    • link-interface (mandatory)
    • link-vrf (mandatory)
    • ifindex (state only)
    • admin-status (state only)
    • oper-status (state only)
    • last-change (state only)
    • qos
      • ingress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
      • egress
        • rate-limit
          • policer (config only)
          • shared-policer (config only)
          • policer (state only)
            • bandwidth (state only)
            • burst (state only)
            • excess-bandwidth (state only)
            • excess-burst (state only)
            • shared-policer (state only)
            • stats (state only)
              • pass-packets (state only)
              • pass-bytes (state only)
              • pass-excess-packets (state only)
              • pass-excess-bytes (state only)
              • drop-packets (state only)
              • drop-bytes (state only)
    • counters (state only)
      • in-octets (state only)
      • in-unicast-pkts (state only)
      • in-discards (state only)
      • in-errors (state only)
      • out-octets (state only)
      • out-unicast-pkts (state only)
      • out-discards (state only)
      • out-errors (state only)
• 3.2.26. qos
  • class-mask (config only)
  • policer (config only)
    • description (config only)
    • bandwidth (config only) (mandatory)
    • burst (config only)
    • excess-bandwidth (config only)
    • excess-burst (config only)
  • shared-policer
    • description (config only)
    • policer (config only)
    • bandwidth (state only)
    • burst (state only)
    • excess-bandwidth (state only)
    • excess-burst (state only)
    • stats (state only)
      • pass-packets (state only)
      • pass-bytes (state only)
      • pass-excess-packets (state only)
      • pass-excess-bytes (state only)
      • drop-packets (state only)
      • drop-bytes (state only)
  • shaper (config only)
    • description (config only)
    • bandwidth (config only) (mandatory)
    • burst (config only)
    • layer1-overhead (config only)
    • queue-size (config only)
  • scheduler (config only)
    • description (config only)
    • core (deprecated) (config only)
    • pq (config only)
      • nb-queue (config only) (mandatory)
      • queue (config only)
        • size (config only)
        • policer (config only)
        • shaper (config only)
        • child-scheduler (config only)
        • priority (config only)
        • class (config only)
    • pb-dwrr (config only)
      • nb-queue (config only) (mandatory)
      • queue (config only)
        • size (config only)
        • policer (config only)
        • shaper (config only)
        • child-scheduler (config only)
        • quantum (config only)
        • priority (config only)
        • class (config only)
    • htb (config only)
      • description (config only)
      • divisor (config only)
      • queue (config only)
        • description (config only)
        • bandwidth (config only) (mandatory)
        • burst (config only)
        • ceiling (config only)
        • ceiling-burst (config only)
        • quantum (config only)
        • size (config only)
        • priority (config only)
        • policer (config only)
        • child-queue (config only)
        • child-scheduler (config only)
        • class (config only)
    • sfq (config only)
      • description (config only)
      • flows (config only)
      • quantum (config only)
      • limit (config only)
  • class (config only)
    • description (config only)
    • mark (config only)
    • cp (config only)
• 3.2.27. vrrp
  • global
    • enabled (pushed)
    • router-id
    • traps-enabled
    • vrrp-startup-delay
    • group
      • instance
      • notify-ha-group
      • state (state only)
      • track-group
        • priority-penalty
  • interface
    • mtu
    • promiscuous
    • enabled (pushed)
    • description
    • version
    • link-interface (mandatory)
    • garp-delay
    • use-vmac
    • vmac-xmit-base
    • vrid (mandatory)
    • priority
    • init-state
    • preempt
    • preempt-delay
    • advertisement-interval
    • track-link-interface
    • track-interface
    • track
    • track-fast-path
    • notify-ha-group
    • ifindex (state only)
    • admin-status (state only)
    • oper-status (state only)
    • last-change (state only)
    • state (state only)
    • network-stack
      • ipv4
        • send-redirects
        • accept-redirects
        • accept-source-route
        • arp-announce
        • arp-filter
        • arp-ignore
        • arp-proxy
        • log-invalid-addresses
      • ipv6
        • autoconfiguration
        • accept-router-advert
        • accept-redirects
        • accept-source-route
        • router-solicitations
        • use-temporary-addresses
    • authentication
      • auth-type
      • auth-pass
    • unicast-peer
    • virtual-address
    • virtual-route
      • interface
      • gw
    • counters (state only)
      • in-octets (state only)
      • in-unicast-pkts (state only)
      • in-discards (state only)
      • in-errors (state only)
      • out-octets (state only)
      • out-unicast-pkts (state only)
      • out-discards (state only)
      • out-errors (state only)
    • ipv4 (state only)
      • enabled (state only)
      • address (state only)
        • peer (state only)
        • origin (state only)
      • neighbor (state only)
        • link-layer-address (state only)
        • state (state only)
      • dhcp (state only)
        • enabled (state only)
        • timeout (state only)
        • retry (state only)
        • select-timeout (state only)
        • reboot (state only)
        • initial-interval (state only)
        • dhcp-lease-time (state only)
        • dhcp-client-identifier-ascii (state only)
        • dhcp-client-identifier-hexa (state only)
        • host-name (state only)
        • request (state only)
        • current-lease (state only)
          • fixed-address (state only)
          • renew (state only)
          • rebind (state only)
          • expire (state only)
    • ipv6 (state only)
      • enabled (state only)
      • address (state only)
        • peer (state only)
        • origin (state only)
        • status (state only)
      • neighbor (state only)
        • link-layer-address (state only)
        • router (state only)
        • state (state only)
    • ethernet (state only)
      • mac-address (state only)
• 3.2.28. ike
  • enabled (pushed)
  • pool
    • address (mandatory)
    • dns
    • nbns
    • dhcp
    • subnet
  • certificate
    • certificate (mandatory)
    • private-key (mandatory)
  • certificate-authority
    • certificate (mandatory)
    • crl
    • crl-uri
  • pre-shared-key
    • id
    • secret (mandatory)
  • eap-key
    • id
    • secret (mandatory)
  • eap-radius
    • nas-identifier
    • auth-port
    • sockets
    • retransmit-tries
    • retransmit-timeout
    • retransmit-base
    • server
      • address (mandatory)
      • vrf
      • secret (mandatory)
      • nas-identifier
      • auth-port
      • sockets
      • retransmit-tries
      • retransmit-timeout
      • retransmit-base
  • logging
    • daemon
      • default
      • asn1
      • config
      • child
      • daemon
      • encoding
      • ipsec
      • ike
      • job
      • kernel
      • library
      • manager
      • network
    • authpriv
      • default
      • asn1
      • config
      • child
      • daemon
      • encoding
      • ipsec
      • ike
      • job
      • kernel
      • library
      • manager
      • network
  • global-options
    • threads
    • acquire-timeout
    • sa-table-size
    • sa-table-segments
    • install-routes
    • routing-table
    • routing-table-prio
    • retransmit-tries
    • retransmit-timeout
    • retransmit-base
    • delete-rekeyed
    • delete-rekeyed-delay
    • make-before-break
    • interface-use
    • interface-ignore
    • snmp
    • mobike-prefer-best-path
    • install-vip
    • install-vip-on
    • retry-initiate-interval
    • dos-protection
      • cookie-threshold
      • block-threshold
      • init-limit-half-open
    • sp-hash-ipv4
      • local
      • remote
    • sp-hash-ipv6
      • local
      • remote
  • ha
    • enabled
    • listen-ha-group (mandatory)
    • node-id (mandatory)
    • interface (mandatory)
    • local-address (mandatory)
    • remote-address (mandatory)
    • seqnum-sync
      • oseq-shift
      • sync-period-time
      • sync-period-packets
    • pool
      • address (mandatory)
  • ike-policy-template (config only)
    • local-auth-method (config only)
    • remote-auth-method (config only)
    • keying-tries (config only)
    • unique-sa (config only)
    • reauth-time (config only)
    • rekey-time (config only)
    • dpd-delay (config only)
    • aggressive (config only)
    • udp-encap (config only)
    • mobike (config only)
    • ike-proposal (config only)
      • enc-alg (config only)
      • auth-alg (config only)
      • aead-alg (config only)
      • prf-alg (config only)
      • dh-group (config only)
  • ipsec-policy-template (config only)
    • start-action (config only)
    • close-action (config only)
    • dpd-action (config only)
    • replay-window (config only)
    • rekey-time (config only)
    • inactivity (config only)
    • life-time (config only)
    • rand-time (config only)
    • rekey-bytes (config only)
    • life-bytes (config only)
    • rand-bytes (config only)
    • rekey-packets (config only)
    • life-packets (config only)
    • rand-packets (config only)
    • encap-copy-dscp (config only)
    • decap-copy-dscp (config only)
    • encap-copy-df (config only)
    • esp-proposal (config only)
      • enc-alg (config only)
      • auth-alg (config only)
      • aead-alg (config only)
      • dh-group (config only)
      • esn (config only)
    • ah-proposal (config only)
      • auth-alg (config only)
      • dh-group (config only)
      • esn (config only)
  • vpn
    • description
    • version
    • local-address
    • remote-address
    • local-id
    • remote-id
    • local-eap-id
    • remote-eap-id
    • certificate
    • remote-ca-certificate
    • vip-request
    • vip-pool
    • dynamic-svti (config only)
      • svti-template (config only) (mandatory)
      • vrf (config only)
    • ike-policy
      • template (config only) (mandatory)
      • local-auth-method
      • remote-auth-method
      • keying-tries
      • unique-sa
      • reauth-time
      • rekey-time
      • dpd-delay
      • aggressive
      • udp-encap
      • mobike
      • ike-proposal
        • enc-alg
        • auth-alg
        • aead-alg
        • prf-alg
        • dh-group
    • ipsec-policy
      • template (config only) (mandatory)
      • start-action
      • close-action
      • dpd-action
      • replay-window
      • rekey-time
      • inactivity
      • life-time
      • rand-time
      • rekey-bytes
      • life-bytes
      • rand-bytes
      • rekey-packets
      • life-packets
      • rand-packets
      • encap-copy-dscp
      • decap-copy-dscp
      • encap-copy-df
      • esp-proposal
        • enc-alg
        • auth-alg
        • aead-alg
        • dh-group
        • esn
      • ah-proposal
        • auth-alg
        • dh-group
        • esn
    • security-policy
      • svti-id-in
      • svti-id-out
      • action
      • mode
      • priority
      • local-ts
        • subnet
        • protocol
        • port
      • remote-ts
        • subnet
        • protocol
        • port
  • ike-sas (state only)
    • total (state only)
    • half-open (state only)
  • task-processing (state only)
    • worker-threads (state only)
      • total (state only)
      • idle (state only)
      • critical (state only)
      • high (state only)
      • medium (state only)
      • low (state only)
    • task-queues (state only)
      • critical (state only)
      • high (state only)
      • medium (state only)
      • low (state only)
      • scheduled (state only)
  • counters (state only)
    • ike-rekey-init (state only)
    • ike-rekey-resp (state only)
    • child-rekey (state only)
    • invalid (state only)
    • invalid-spi (state only)
    • ike-init-in-req (state only)
    • ike-init-in-resp (state only)
    • ike-init-out-req (state only)
    • ike-init-out-resp (state only)
    • ike-auth-in-req (state only)
    • ike-auth-in-resp (state only)
    • ike-auth-out-req (state only)
    • ike-auth-out-resp (state only)
    • create-child-in-req (state only)
    • create-child-in-resp (state only)
    • create-child-out-req (state only)
    • create-child-out-resp (state only)
    • info-in-req (state only)
    • info-in-resp (state only)
    • info-out-req (state only)
    • info-out-resp (state only)
  • vpn-counters (state only)
    • ike-rekey-init (state only)
    • ike-rekey-resp (state only)
    • child-rekey (state only)
    • invalid (state only)
    • invalid-spi (state only)
    • ike-init-in-req (state only)
    • ike-init-in-resp (state only)
    • ike-init-out-req (state only)
    • ike-init-out-resp (state only)
    • ike-auth-in-req (state only)
    • ike-auth-in-resp (state only)
    • ike-auth-out-req (state only)
    • ike-auth-out-resp (state only)
    • create-child-in-req (state only)
    • create-child-in-resp (state only)
    • create-child-out-req (state only)
    • create-child-out-resp (state only)
    • info-in-req (state only)
    • info-in-resp (state only)
    • info-out-req (state only)
    • info-out-resp (state only)
  • ike-sa (state only)
    • name (state only)
    • version (state only)
    • state (state only)
    • local-address (state only)
    • remote-address (state only)
    • local-port (state only)
    • remote-port (state only)
    • local-id (state only)
    • remote-id (state only)
    • remote-eap-id (state only)
    • initiator-spi (state only)
    • responder-spi (state only)
    • enc-alg (state only)
    • auth-alg (state only)
    • aead-alg (state only)
    • prf-alg (state only)
    • dh-group (state only)
    • established-time (state only)
    • rekey-time (state only)
    • reauth-time (state only)
    • udp-encap (state only)
    • mobike (state only)
    • local-vip (state only)
    • remote-vip (state only)
    • child-sa (state only)
      • name (state only)
      • state (state only)
      • reqid (state only)
      • protocol (state only)
      • udp-encap (state only)
      • mobike (state only)
      • spi-in (state only)
      • spi-out (state only)
      • svti-id-in (state only)
      • svti-id-out (state only)
      • enc-alg (state only)
      • auth-alg (state only)
      • aead-alg (state only)
      • dh-group (state only)
      • esn (state only)
      • bytes-in (state only)
      • packets-in (state only)
      • bytes-out (state only)
      • packets-out (state only)
      • installed-time (state only)
      • rekey-time (state only)
      • life-time (state only)
      • mode (state only)
      • local-ts (state only)
        • subnet (state only)
        • protocol (state only)
        • port (state only)
        • unsupported (state only)
      • remote-ts (state only)
        • subnet (state only)
        • protocol (state only)
        • port (state only)
        • unsupported (state only)
  • pool-lease (state only)
    • address (state only)
    • size (state only)
    • online (state only)
    • offline (state only)
• 3.2.29. sflow
  • enabled (pushed)
  • agent-interface
  • polling
  • sflow-port
  • if-error
  • if-unknown
  • sflow-collector
    • port
    • source-ip
  • sflow-interface
  • sflow-sampling
    • rate
• 3.2.30. ipfix
  • enabled (pushed)
  • ipfix-collector
    • address
    • port
    • protocol
    • scan-interval-seconds
    • frag-flow-lifetime-seconds
    • active-flow-lifetime-interval-seconds
    • idle-flow-lifetime-interval-seconds
  • ipfix-probe
    • enabled
    • collector
• 3.2.31. snmp
  • enabled (pushed)
  • listen
    • protocols
    • port
  • static-info
    • location
    • contact
    • name
    • services
    • description
    • object-id
  • view
    • subtree
      • included
  • community
    • authorization (mandatory)
    • source
    • view
  • monitored-vrf
    • identifier
      • authorization (mandatory)
      • source
      • view
    • traps
      • destination
        • community (mandatory)
  • access-control
    • user
      • auth-password (mandatory)
      • auth-method
      • priv-password
      • priv-protocol
    • group
      • user
      • security-level (mandatory)
      • view
      • authorization
  • traps
    • destination
      • port
      • protocol
      • notification-type (mandatory)
      • community (mandatory)
    • authfail-check
      • enabled
    • link-status-check
      • frequency
      • enabled
    • process-check
      • frequency
      • enabled
    • disk-space-check
      • threshold (mandatory)
      • frequency
      • enabled
    • load-check
      • threshold (mandatory)
      • enabled
• 3.2.32. routing
  • global
    • ipv4-access-list
      • remark
      • seq
        • permit
          • exact-match
        • deny
          • exact-match
    • ipv6-access-list
      • remark
      • seq
        • permit
          • exact-match
        • deny
          • exact-match
    • logging
      • enabled
      • level
      • mpls
        • ldp
          • enabled
          • discovery-hello
          • errors
          • events
          • labels
          • zebra
          • message
            • direction
            • detail
      • base
        • enabled
        • events
          • enabled
        • kernel
          • enabled
          • msgdump-recv
          • msgdump-send
        • nexthop-tracking
          • enabled
          • details
        • rib
          • enabled
          • details
      • route-map
        • enabled
      • bgp
        • enabled
        • allow-martians
        • as-4bytes
        • as-4bytes-segment
        • bestpath
        • nexthop-tracking
        • flowspec
        • keepalives
        • neighbor-events
        • update-groups
        • zebra
        • rpki
        • pbr
          • detail
        • updates
          • enabled
          • in
          • out
          • prefix
        • vpn
          • label
          • leak-vrf
          • route-map-event
      • rip
        • enabled
        • events
        • packet
        • zebra
      • ripng
        • enabled
        • events
        • packet
        • zebra
      • ospf
        • enabled
        • events
        • ism
        • lsa
        • nsm
        • nssa
        • zebra
        • message
          • direction
          • detail
      • ospf6
        • enabled
        • abr
        • asbr
        • events
        • flooding
        • interface
        • neighbor
        • route
        • spf
        • zebra
        • border-routers
          • summary
          • area-id
          • router-id
        • lsa
          • level
        • message
          • direction
      • isis
        • enabled
        • adj-packets
        • bfd
        • events
        • flooding
        • ldp-sync
        • lfa
        • lsp-gen
        • lsp-sched
        • packet-dump
        • route-events
        • snp-packets
        • spf-events
        • sr-events
        • tx-queue
        • update-packets
    • traffic-engineering
      • affinity-map
        • bit-position (mandatory)
    • ipv4-prefix-list
      • seq
        • address
        • policy (mandatory)
        • ge
        • le
    • ipv6-prefix-list
      • seq
        • address
        • policy (mandatory)
        • ge
        • le
    • route-map
      • seq
        • policy (mandatory)
        • description
        • call
        • on-match
        • match
          • as-path
          • interface
          • local-preference
          • mac-address
          • metric
          • origin
          • peer
          • probability
          • source-instance
          • source-protocol
          • tag
          • extcommunity
          • rpki
          • evpn
            • default-route
            • route-type
            • vni
            • route-distinguisher
          • ip
            • address
              • access-list
              • prefix-list
              • prefix-len
            • next-hop
              • access-list
              • prefix-list
              • prefix-len
            • route-source
              • access-list
              • prefix-list
          • ipv6
            • address
              • access-list
              • prefix-list
              • prefix-len
            • next-hop
              • address
          • community
            • id (mandatory)
            • exact-match
          • large-community
            • id (mandatory)
            • exact-match
        • set
          • table
          • atomic-aggregate
          • label-index
          • local-preference
          • metric
          • metric-type
          • origin
          • originator-id
          • src
          • tag
          • weight
          • comm-list-delete
          • large-comm-list-delete
          • aggregator
            • as (mandatory)
            • address (mandatory)
          • as-path
            • exclude
            • prepend
              • last-as
              • asn
                • <uint32> (mandatory)
          • ip
            • next-hop
          • ipv4
            • vpn
              • next-hop
          • ipv6
            • next-hop
              • global
              • local
              • peer-address
              • prefer-global
            • vpn
              • next-hop
          • l3vpn
            • next-hop
              • encapsulation
          • community
            • none
            • attribute (deprecated)
            • replace-by
              • ATTRIBUTE
            • add
              • ATTRIBUTE
          • large-community
            • none
            • attribute (deprecated)
            • replace-by
              • ATTRIBUTE
            • add
              • ATTRIBUTE
          • extcommunity
            • rt
            • soo
    • bgp
      • route-map-delay
      • rpki-ssh-key (state only)
      • community-list
        • policy
          • POLICY (mandatory)
          • COMMUNITY
      • community-list-expanded
        • policy
          • POLICY (mandatory)
          • COMMUNITY
      • extcommunity-list
        • policy
          • POLICY (mandatory)
          • rt
          • soo
      • extcommunity-list-expanded
        • policy
          • POLICY (mandatory)
          • <string>
      • large-community-list
        • policy
          • POLICY (mandatory)
          • LARGE-COMMUNITY
      • large-community-list-expanded
        • policy
          • POLICY (mandatory)
          • <string>
      • as-path-access-list
        • policy
          • POLICY (mandatory)
          • <string>
  • static
    • ipv4-route
      • next-hop
        • dhcp-port
        • distance
        • label
        • nexthop-l3vrf
        • nexthop-vrf (deprecated)
        • tag
        • track
    • ipv6-route
      • next-hop
        • distance
        • label
        • nexthop-l3vrf
        • nexthop-vrf (deprecated)
        • tag
        • track
    • table
      • ipv4-route
        • next-hop
          • dhcp-port
          • distance
          • label
          • nexthop-l3vrf
          • nexthop-vrf (deprecated)
          • tag
          • track
      • ipv6-route
        • next-hop
          • distance
          • label
          • nexthop-l3vrf
          • nexthop-vrf (deprecated)
          • tag
          • track
    • l3vrf (state only)
      • ipv4-route (state only)
        • next-hop (state only)
          • dhcp-port (state only)
          • distance (state only)
          • label (state only)
          • nexthop-l3vrf (state only)
          • nexthop-vrf (deprecated) (state only)
          • tag (state only)
          • track (state only)
      • ipv6-route (state only)
        • next-hop (state only)
          • distance (state only)
          • label (state only)
          • nexthop-l3vrf (state only)
          • nexthop-vrf (deprecated) (state only)
          • tag (state only)
          • track (state only)
  • interface
    • isis
      • area-tag (mandatory)
      • ipv4-routing
      • ipv6-routing
      • circuit-type
      • csnp-interval
      • psnp-interval
      • priority
      • disable-three-way-handshake
      • network-point-to-point
      • passive
      • password
        • password (mandatory)
        • password-type (mandatory)
      • hello
        • padding
        • interval
          • level-1
          • level-2
        • multiplier
          • level-1
          • level-2
      • fast-reroute
        • lfa
          • enabled
          • exclude-interface
        • ti-lfa
          • enabled
          • node-protection
          • link-fallback
      • metric
        • level-1
        • level-2
      • multi-topology
        • ipv4-unicast
        • ipv4-multicast
        • ipv4-management
        • ipv6-unicast
        • ipv6-multicast
        • ipv6-management
        • ipv6-dstsrc
    • ip nhrp
      • enabled
      • registration-no-unique
      • shortcut
      • redirect
      • shortcut-keep-sa
      • network-id
      • holdtime
      • ip-nhrp-mtu
      • nhrp-map
        • nbma
      • nhrp-nhs
        • nbma (mandatory)
    • ipv6 nhrp
      • enabled
      • registration-no-unique
      • shortcut
      • redirect
      • shortcut-keep-sa
      • network-id
      • holdtime
      • nhrp-map
        • nbma (mandatory)
      • nhrp-nhs
        • nbma (mandatory)
    • ip ospf
      • area
      • authentication
      • authentication-key
      • cost
      • hello-interval
      • mtu-ignore
      • priority
      • retransmit-interval
      • transmit-delay
      • network
      • message-digest-key
        • md5 (mandatory)
      • dead-interval
        • seconds
        • minimal
          • hello-multiplier (mandatory)
      • address
        • area
        • authentication
        • authentication-key
        • cost
        • hello-interval
        • mtu-ignore
        • priority
        • retransmit-interval
        • transmit-delay
        • message-digest-key
          • md5 (mandatory)
        • dead-interval
          • seconds
          • minimal
            • hello-multiplier (mandatory)
    • ipv6 ospf6
      • cost
      • dead-interval
      • hello-interval
      • ifmtu
      • instance-id
      • mtu-ignore
      • network
      • passive
      • priority
      • retransmit-interval
      • transmit-delay
      • advertise
        • prefix-list (mandatory)
    • ip rip
      • v2-broadcast
      • split-horizon
      • version
        • receive
        • send
      • authentication
        • mode
        • md5-auth-length
        • password
        • key-chain
    • ipv6 ripng
      • split-horizon
    • ip pim
      • enabled
      • version
      • query-interval
      • query-max-response-time
      • last-member-query-count
      • last-member-query-interval
      • static-group
    • ip pim
      • enabled
      • hello-interval
      • hello-holdtime
      • bsm
      • unicast-bsm
      • dr-priority
      • use-source
    • traffic-engineering
      • metric
      • affinity-map
      • delay
        • average
        • minimum
        • maximum
  • evpn (state only)
    • vni (state only)
      • type (state only)
      • vxlan (state only)
      • num-mac (state only)
      • num-arp-nd (state only)
      • local-vtep-ip (state only)
      • advertise-gateway-mac-ip (state only)
      • state (state only)
      • router-mac (state only)
      • l2-vni (state only)
      • arp-neighbor-discovery (state only)
        • state (state only)
        • default-gateway (state only)
        • mac (state only)
        • type (state only)
        • remote-vtep-ip (state only)
      • mac (state only)
        • vlan-id (state only)
        • type (state only)
        • remote-vtep-ip (state only)
  • bgp
    • enabled (pushed)
    • as (mandatory)
    • always-compare-med
    • l3vni
    • cluster-id
    • coalesce-time
    • deterministic-med
    • ebgp-connected-route-check
    • fast-external-failover
    • graceful-shutdown
    • log-neighbor-changes
    • network-import-check
    • route-reflector-allow-outbound-policy
    • reject-as-sets
    • router-id
    • ebgp-requires-policy
    • neighbor-total-count (state only)
    • bestpath
      • compare-routerid
      • med
      • as-path
        • confederation
        • ignore
        • multipath-relax
    • client-to-client
      • reflection
    • confederation
      • identifier
      • peers
    • graceful-restart
      • preserve-fw-state
      • restart-time
      • stalepath-time
    • listen
      • limit
      • neighbor-range
        • neighbor-group (mandatory)
    • max-med
      • administrative
      • on-startup
        • period (mandatory)
        • max-med
    • packet-rw-quantum
      • read
      • write
    • tcp-keepalive
      • idle
      • keepalive
      • probes
    • update-delay
      • delay
      • established-wait
    • address-family
      • ipv4-unicast
        • table-map
        • enabled
        • rib-count (state only)
        • neighbor-count (state only)
        • dynamic-neighbor-count (state only)
        • network
          • route-map
          • backdoor
          • label-index
          • route (state only)
            • status (state only)
            • stale (state only)
            • suppressed (state only)
            • history (state only)
            • damped (state only)
            • bestpath (state only)
            • multipath (state only)
            • validity (state only)
            • route-type (state only)
            • prefix (state only)
            • prefix-length (state only)
            • metric (state only)
            • origin (state only)
            • network (state only)
            • local-preference (state only)
            • weight (state only)
            • packet-length (state only)
            • path (state only)
            • nexthop (state only)
              • address-family (state only)
              • used (state only)
        • redistribute
          • id
          • metric
          • route-map
        • route-target
          • redirect-import
        • l3vpn
          • export
            • vpn
            • label
            • route-target
            • route-distinguisher
            • nexthop
            • route-map
          • import
            • vpn
            • route-target
            • route-map
        • maximum-path
          • ebgp
          • ibgp
          • equal-cluster-length
        • aggregate-address
          • as-set
          • summary-only
          • route-map
        • administrative-distance
          • distance (mandatory)
          • access-list
        • bgp-distance
          • external-routes
          • internal-routes
          • local-routes
        • route-flap-dampening
          • enabled
          • reach-decay
          • reuse-above
          • suppress-above
          • unreach-decay
      • ipv4-multicast
        • table-map
        • enabled
        • rib-count (state only)
        • neighbor-count (state only)
        • dynamic-neighbor-count (state only)
        • network
          • route-map
          • backdoor
          • label-index
          • route (state only)
            • status (state only)
            • stale (state only)
            • suppressed (state only)
            • history (state only)
            • damped (state only)
            • bestpath (state only)
            • multipath (state only)
            • validity (state only)
            • route-type (state only)
            • prefix (state only)
            • prefix-length (state only)
            • metric (state only)
            • origin (state only)
            • network (state only)
            • local-preference (state only)
            • weight (state only)
            • packet-length (state only)
            • path (state only)
            • nexthop (state only)
              • address-family (state only)
              • used (state only)
        • aggregate-address
          • as-set
          • summary-only
          • route-map
        • administrative-distance
          • distance (mandatory)
          • access-list
        • bgp-distance
          • external-routes
          • internal-routes
          • local-routes
        • route-flap-dampening
          • enabled
          • reach-decay
          • reuse-above