To set the priority 1 value, use the ptp priority1 command. Lower values take precedence.
switch(config)# ptp priority1 120
switch(config)#To set the priority 2 value for the clock, use the ptp priority2 command.
This command configures the priority 2 value of 128.
switch(config)# ptp priority2 128
switch(config)#To set the source IP address for all PTP packets, use the ptp source command.
Example
10.0.2.1 for all PTP
packets.switch(config)# ptp source ip 10.0.2.1
switch(config)#2001:db8:ac10:fe01:: for
all PTP
packets.switch(config)# ptp source ip 2001:db8:ac10:fe01::
switch(config)#The Aboot shell is an interactive command-line interface used to manually boot a switch, restore the internal flash to its factory-default state, run hardware diagnostics, and manage files. The Aboot shell resembles the Linux Bourne Again Shell (Bash).
When the switch is powered on or rebooted, Aboot reads its configuration from boot-config on the internal flash and attempts to boot a configured EOS software image (with the extension .swi).
You can monitor the automatic boot process or enter the Aboot shell only from the console port. You can connect a PC or terminal directly to the port and run a terminal emulator to interact with the serial port or access it through a serial concentrator device.
The boot-config stores the console settings; the factory-default settings for Arista switches are 9600 baud, no parity, 8 character bits, and 1 stop bit. If you do not know the current settings, perform a full flash recovery to restore the factory default settings.When the console port is connected and the configured terminal settings are proper, the terminal displays a message similar to the following a few seconds after powering up the switch:
Aboot 1.0.0
Press Control-C now to enter the Aboot shellTo abort the automatic boot process and enter the Aboot shell, select Ctrl-C (ASCII 3 in the terminal emulator) after the Press Control-C now to enter Aboot shell message appears. Pressing Ctrl-C can interrupt the boot process up through the starting of the new kernel.
If the boot-config file does not contain a password command, the Aboot shell starts immediately. Otherwise, you must enter the password using the password prompt to start the shell. If you enter the wrong password three times, Aboot displays this message:
Type "fullrecover" and press Enter to revert /mnt/flash to factory default
state, or just press Enter to reboot:The Aboot shell starts by printing:
Welcome to Aboot.Aboot then displays the Aboot# prompt.
Aboot reads its configuration from boot-config on the internal flash.
This procedure accesses the Aboot Shell.
When you enter the Aboot CLI, the current working directory is the root directory on the switch. Switch image and configuration files are at /mnt/flash. When exiting the Aboot shell, only /mnt/flash preserves the contents. The /mnt directory contains the file systems of storage devices. Aboot mounts the internal flash device at /mnt/flash.
When you insert a USB flash drive in one of the flash ports, Aboot mounts its file system on /mnt/usb1. The file system is unmounted when you remove the USB flash drive from the port. Most USB drives contain an LED that flashes when the system is accessing it; wait to remove the drive from the flash port until the LED stops flashing.
Aboot boots the EOS software image (with the extension .swi), which is available in boot-config automatically if you take no action during the boot process. Suppose the boot process fails for any reason, such as an incorrectly configured software image. In that case, Aboot enters the shell, allowing you to manually correct the configuration or boot a software image. The boot command loads and boots an EOS software image file.
The boot command syntax is
boot SWI
It accepts the same commands as the SWI variable in the boot-config file. See boot-config Command Line Content for a list of boot command formats.
Suppose the boot-config does not have a specified image or booting the image results in an error condition (for example, an incorrect path or unavailable HTTP server). In that case, Aboot halts the boot process and drops into the shell.
boot flash:EOS.swiboot /mnt/flash/EOS.swiSecure boot provides a security feature in Aboot, Arista bootloader, that verifies the cryptographic signature of the EOS software image before booting up the switch. Aboot embeds certificates that allow it to recognize and validate official EOS releases from Arista. If a successful signature verification occurs, the secure boot check passes and Aboot proceeds to boot the software image. If the signature verification fails, the switch aborts booting the software.
In addition to the verification of Arista signed images, secure boot can also validate images using a user-configured root certificate. This mechanism allows you to sign your SWI images and have them recognized by secure boot. It is also possible to configure secure boot to only accept SWI images signed by the user certificate.
Secure boot prevents and detects unauthorized modifications to the software image by anyone with access to EOS. To provide this guarantee, it must not be possible for anyone, including a system administrator, to disable any of the secure boot configuration or firmware components from EOS. That includes disabling secure boot, changing the certificates used to validate the software image signature, or unauthorized modifications to the BIOS or Aboot firmware.
When properly configured with secure boot enabled, EOS locks both hardware components before running the software image. This ensures that no component of secure boot can be tampered with from EOS.
The switch embeds the bootloader Aboot in the BIOS firmware and stores the complete firmware image, BIOS plus Aboot, in the BIOS SPI flash. The flash also stores certificates used by secure boot to validate the image signature. Configure the BIOS SPI flash as write-protected by Aboot to prevent unauthorized modifications to the BIOS, Aboot, or secure boot certificates from EOS.
The TPM NVRAM stores critical configuration parameters for secure boot. The NVRAM indexes that store secure boot data in the TPM can only be overwritten by using the highest level of privilege on the TPM. Aboot unconditionally locks the highest level of privilege on the TPM prior to transferring execution to EOS, and ensures that NVRAM sections storing the secure boot level configuration cannot undergo modification.
Use the following commands to enable, disable, or display secure boot:
Aboot# securebootctl secureboot -enable
Aboot# securebootctl secureboot -display
Secure Boot enabledAboot# securebootctl secureboot -disable
Aboot# securebootctl secureboot -display
Secure Boot disabledUse the following command to add a certificate path, /mnt/flash/user-test.crt, for secure boot:
Aboot# secureboot cert -add /mnt/flash/user-test.crt
Added the following user certificate:
DC=com, DC=test, CN=User Test CertUse the following command to display certificate information:
Aboot# securebootctl cert -display
Arista: DC=com, DC=mycompany, CN=MyCompany Issuing Cert AuthorityUse the following commands to configure Arista Certificates to verify software images:
Aboot# securebootctl aristacert -enable
Aboot# securebootctl aristacert -display
Arista certificate used
Aboot# securebootctl cert -display
Arista: DC=com, DC=aristanetworks, CN=AristaIT-ICA ECDSA Issuing Cert AuthorityUse the following command to disable Arista certificates for secure boot:
Aboot# securebootctl aristacert -disable
Aboot# securebootctl aristacert -display
Arista certificate ignored
Aboot# securebootctl cert -display
Arista: ignored
User: No certificate is configuredIf you enable secure boot, disable Arista certificates, and no user certificate configured, the switch does not boot because it cannot find a valid certificate to verify the software image. The following message displays on the switch:
=== WARNING ===
Invalid configuration detected:
- Arista certificate ignored
- no user certificate inserted
- Secure Boot is enabled
Boot is not going to be allowed until one of those is addressed.
Please insert a user certificate, enable the Arista certificate or disable Secure Boot to proceed to EOS.Using an Aboot Password
Secure boot compatible Aboot images support storing an Aboot password in the TPM as a more secure option than storing the password in /mnt/flash. You can only configure the password in the Aboot mode. Once you set the password, EOS can no longer set the Aboot password.
Use the following command to display the Aboot password status:
Aboot# securebootctl abootpassword -display
Password status: disabledEOS disables the password by default.
Use the following commands to enable the password, and then display password information:
Aboot# securebootctl abootpassword -enable
Enter password:
Confirm password:
Aboot# securebootctl abootpassword -display
Password status: enabled
Password value: $6$poC4fj2Bk4aAPKga$hOl92bbCeyU9UM3sv3hfesRamMaQwLH5Yi01LhW/hw2BtNyQ8UmvhreMFSrDoQ6ji9WB1l5e/.KDWhtP4zMLW0Displaying Boot Information
The show boot command displays the following information on platforms that support secure boot:
switch# show boot
Software image: flash:/EOS.swi
Console speed: (not set)
Aboot password (encrypted): (not set)
Memory test iterations: (not set)
Secure boot: enabled
SPI flash protection: enabled
Password storage: tpm
Arista certificate: enabled
Extra certificate:
-----BEGIN CERTIFICATE-----
MIIDVzCCAj+gAwIBAgIJAMoGOI8anKHzMA0GCSqGSIb3DQEBCwUAMEIxCzAJBgNV
[ … ]
LTwkN1KGUMiP8OWtooCNmqW+pdp/VGexIV/e0Xj8wGoffSczfY1XAAsD4PsbWnQ9
kn5CQrzU3DSoeWkQbK24an+EAqEX4ZUl5WDi7de5pzt343lfUXZB9Gd1BA==
-----END CERTIFICATE-----Measured boot provides a tamper-detection mechanism that records the system boot process. It calculates the cryptographic hashes of system components and configurations, and then securely stores them in the Platform Configuration Registers PCRs) of a Trusted Platform Module (TPM) chip. This process creates a hash chain of the boot sequence. After the system starts, the TPM Quote operation, along with the extension records, verify the PCR values and confirms that the system components haven't changed and has trusted software.
switch# show management security
[...]
Security Chip: IFX SLB9670 TPM 1.2 (6.43.243.0)
[...]The output displays TPM Version 1.2.
switch# show management security
[...]
STM ST33TPHF2X TPM 2.0 (1.512))
[...]EOS stores the Secure Boot configuration, including the measured boot configuration,
in the TPM NVRAM. The NVRAM indexes storing the secure boot data can only be
configured as writable with the highest privilege level on the TPM, platform
authorization for TPM 2.0 or physical presence for TPM
1.2.
Aboot unconditionally locks the highest level of privilege on the TPM before transferring execution to EOS. You can only configure measured boot in Aboot mode.
Use the following command to enable measured boot:
Aboot# securebootctl measuredboot -enable
Aboot# securebootctl measuredboot - display
Measure Boot enabledUse the following commands to disable measured boot and display the measured boot status:
Aboot# securebootctl measuredboot -disable
Aboot# securebootctl measuredboot - display
Measure Boot disabledDisplaying Measured Boot Status
Use the following command to display measured boot status:
switch# show boot
[...]
Measured boot: enabled
[...]To list the contents of the internal flash, enter ls /mnt/flash at the Aboot# prompt.
Aboot# ls /mnt/flash
EOS.swi boot-config startup-configAboot can access networks through the Ethernet management ports. Aboot provides network interfaces mgmt1 and mgmt2 unconfigured by default; you can configure management port settings using Aboot shell commands like ifconfig and udhcpc. After configuring a management interface, use wget to transfer files from an HTTP or FTP server, tftp to transfer files from a TFTP server, or mount to mount an NFS filesystem.
The CONSOLESPEED command in the boot-config file specifies the console baud rate when the switch is booted. The connected terminal must match the specified rate to communicate with the switch. Baud rate options include 1200, 2400, 4800, 9600, 19200, 38400, 57600, and 115200.
The default baud rate is 9600.
Command Syntax
CONSOLESPEED= baud_rate
Parameters
baud_rate specifies the console speed. Values include 1200, 2400, 4800, 9600, 19200, 38400, 57600, and 115200.
Example
CONSOLESPEED=2400Aboot uses NET commands in the boot-config file during switch booting to configure the network interface used for switch configuration. You can enter these commands manually in Aboot.
NETDEV indicates the configured network interface. If boot-config does not contain a NETDEV command, the booting process does not attempt to configure a network interface. Other NET commands specify settings that Aboot uses to configure the interface.
Command Syntax
NETDEV=device_interface
NETAUTO=auto_setting
NETIP=interface_address
NETMASK=interface_mask
NETGW=gateway_address
NETDOMAIN=domain_name
NETDNS=dns_address
NETDEV=ma1NETAUTO=dhcpNETIP=10.12.15.10
NETMASK=255.255.255.0
NETGW=10.12.15.24
NETDOMAIN=mycompany.com
NETDNS=10.12.15.13install bios source command is used to install an Aboot Update File (AUF) to upgrade Aboot firmware.
install bios source indicates the location of the source file and the actions taken.
Command Syntax
install bios source SOURCE [active | standby] [reload | now]
Parameters
SOURCE the file location.
switch# install bios source flash:/update.aufswitch# install bios source flash:/update.auf reloadswitch# install bios source flash:/update.auf nowswitch# install bios source flash:/update.auf standbyPASSWORD specifies the Aboot password, as described in Accessing the Aboot Shell. The Aboot shell does not require a password when boot-config does not contain a PASSWORD command.
The boot-config file stores the password as an MD5-encrypted string generated from a clear-text seed by the UNIX password program or the crypt library function. When entering the Aboot password, the user types the clear-text seed.
There is no method of recovering the password from the encrypted string. If the clear-text password is lost, delete the corresponding PASSWORD command line from the boot-config file.
The EOS boot secret command adds or modifies the PASSWORD configuration line.
Command Syntax
PASSWORD = encrypted_string
Parameters
encrypted_string, the encrypted string that corresponds to the clear-text Aboot password.
Example
PASSWORD=$1$CdWp5wfe$pzNtE3ujBoFEL8vjcq7jo/SWI specifies the location and file name of the EOS image file that Aboot loads when booting, using the same format as boot-config to designate a local or network path.
Command Syntax
SWI = SWI_PATH
Parameters
SWI=flash:EOS.swiSWI=http://foo.com/images/EOS.swiThe boot console command configures terminal settings for serial devices connecting to the console port. The only console setting specified from boot-config is speed.
The factory-default console settings are 9600 baud, no parity, 8 character bits, and 1 stop bit. If you do not know the current settings, restore the factory default settings described in Restoring the Factory Default EOS Image and Startup Configuration.
The no boot console and default boot console commands restore the factory default settings on the switch and remove the corresponding CONSOLESPEED command from the boot-config file.
Command Mode
Global Configuration
Command Syntax
boot console speed baud_rate
Parameters
baud_rate console baud rate. Options include 1200, 2400, 4800, 9600, 19200, 38400, 57600, and 115200.
switch(config)# boot console speed 57600
switch(config)#switch(config)# show boot-config
Software image: flash:/EOS.swi
Console speed: 57600
Aboot password (encrypted): (not set)
switch(config)#The above boot console command adds the following line to boot-config.
CONSOLESPEED=57600The boot secret command creates or edits the Aboot shell password and stores the encrypted string in the PASSWORD command line of the boot-config file.
The no boot secret and default boot secret commands remove the Aboot password from the boot-config file. When the Aboot password does not exist, no password is required to enter the Aboot shell.
Command Mode
Global Configuration
Command Syntax
boot secret [ENCRYPT_TYPE] password
no boot secret
default boot secret
Restrictions
The sha512 encryption option is not available on Trident platform switches.
switch(config)# boot secret xr19v
switch(config)#switch(config)# boot secret 0 xr19v
switch(config)#This command displays the result:
switch(config)# show boot-config
Software image: flash:/EOS.swi
Console speed: (not set)
Aboot password (encrypted): $1$k9YHFW8D$cgM8DSN.e/yY0p3k3RUvk.
switch(config)#The boot secret commands earlier add this line to boot-config:
PASSWORD=$1$k9YHFW8D$cgM8DSN.e/yY0p3k3RUvk.The user must enter xr19v at the login prompt to access the Aboot shell.
switch(config)# boot secret 5 $1$QfbYkVWb$PIXG0udEquW0wOSiZBN3D/
switch(config)# show boot-config
Software image: flash:/EOS.swi
Console speed: (not set)
Aboot password (encrypted): $1$QfbYkVWb$PIXG0udEquW0wOSiZBN3D/
switch(config)#The boot secret command above adds this line to boot-config:
PASSWORD=$1$QfbYkVWb$PIXG0udEquW0wOSiZBN3D/The user must enter xr123 at the login prompt to access the Aboot shell.
switch(config)# no boot secret
switch(config)#The boot system command specifies the location of the EOS software image that Aboot loads when the switch boots. The command can refer to files on Flash or a module in the USB flash port.
Command Mode
Global Configuration
Command Syntax
boot system device file_path
switch(config)# boot system usb1:EOS1.swi
switch(config)#The boot system command earlier adds this line to boot-config.
SWI=usb1:/EOS1.swiswitch(config)# boot system flash:EOS.swi
switch(config)#The boot system command earlier adds this line to boot-config:
sThe delete startup-config command erases or deletes the startup-config file.
Command Mode
Privileged EXEC
Command Syntax
delete startup-config [CONFIRMATION]Parameters
switch# delete startup-config
Proceed with erasing startup configuration? [confirm] y
switch#switch# delete startup-config now
switch#The protocol command configures how the supervisors on a modular switch will handle switchover events. By default, the switch is set to route processor redundancy (RPR), which synchronizes startup-config files between the supervisor modules and partially boots the standby supervisor. You can set the mode to simplex (manual switchover only) or to stateful switchover (SSO), which synchronizes both startup-config and running-config files between the supervisor modules, fully boots the standby module to speed the switchover process, and minimizes packet loss. SSO synchronizes the L2 state between the supervisors, but the L3 state is not synchronized. This can result in traffic loss for traffic forwarded on routes learned by a dynamic routing protocol. Enabling nonstop forwarding can eliminate most packet loss for BGP and OSPF.
The no protocol and default protocol commands set the redundancy protocol to the default value (rpr) by removing the protocol command from running-config.
Command Mode
Redundancy Configuration
Command Syntax
protocol {rpr | simplex | sso}
no protocol
default protocol
Related Commands
redundancy places switch in redundancy configuration mode.
Example
switch(config)# redundancy
switch(config-redundancy)# protocol sso
switch(config-redundancy)#The redundancy command places the switch in redundancy configuration mode.
Command Mode
Global Configuration
Command Syntax
redundancy
Commands Available in Redundancy Configuration Mode
Related Commands
redundancy manual switchover manually initiates a switchover.
Example
switch(config)# redundancy
switch(config-redundancy)# protocol sso
switch(config-redundancy)#The redundancy manual switchover command immediately switches control of the switch to the standby supervisor. If the redundancy mode is set to simplex or the standby supervisor is unavailable for any other reason, this command will not function.
Command Mode
Privileged EXEC
Command Syntax
redundancy manual switchover
Related Command
redundancy places the switch in redundancy configuration mode.
Example
switch# redundancy manual switchover
This supervisor will be restarted.
switch#The reload command power cycles the switch and resets it under Aboot control. The hard reset clears the switch, including memory states and other hardware logic.
Command Mode
Privileged EXEC
Command Syntax
reload [TARGET] [CONFIRMATION]
switch# reload
switch#When the reload command is entered, the switch sends a message prompting the user to save the configuration if it contains unsaved modifications, then asks the user to confirm the reload request. In this example, the user does not save modifications to the system before reloading.
System configuration has been modified. Save? [yes/no/cancel/diff]:n
Proceed with reload? [confirm]yThe switch responds by broadcasting messages, including a notification about the system rebooted to all open CLI instances. The reload pauses to provide an option for the user to enter Aboot shell; the Aboot shell supports commands that restore the state of the internal flash to factory defaults or create a customized default state.
Broadcast message from root@mainStopping sshd: [ OK ]
SysRq : Remount R/O
Restarting system
Aboot 1.9.0-52504.EOS2.0
Press Control-C now to enter Aboot shellNo action is required to continue the reset process. The switch displays messages to indicate the completion of individual tasks. The reboot is complete when the CLI displays a login prompt.
Booting flash:/EOS.swi
Unpacking new kernel
Starting new kernel
Switching to rooWelcome to Arista Networks EOS 4.4.0
Mounting filesystems: [ OK ]
Entering non-interactive startup
Starting EOS initialization stage 1: [ OK ]
ip6tables: Applying firewall rules: [ OK ]
iptables: Applying firewall rules: [ OK ]
iptables: Loading additional modules: nf_conntrack_tftp [ OK ]
Starting system logger: [ OK ]
Starting system message bus: [ OK ]
Starting NorCal initialization: [ OK ]
Starting EOS initialization stage 2: [ OK ]
Starting ProcMgr: [ OK ]
Completing EOS initialization: [ OK ]
Starting Power On Self Test (POST): [ OK ]
Generating SSH2 RSA host key: [ OK ]
Starting isshd: [ OK ]
Starting sshd: [ OK ]
Starting xinetd: [ OK ]
[ OK ] crond: [ OK ]
switch login:The reload (scheduled) command configures the switch to reset at a specified time or after a specified interval. Refer to reload for the functional details of the reset operation.
The switch prompts to save the configuration and confirm the reload request. Once the request is confirmed, the switch resumes normal operation until the reload initiates.
The reload cancel, no reload, and default reload commands cancel the pending reload operation.
Command Mode
Privileged EXEC
Command Syntax
reload [all | power | peer] {at hh:mm [month | day] | in hh:mm} [force | reason]
reload cancel
no reload
default reload
switch# reload in 12:00
System configuration has been modified. Save? [yes/no/cancel/diff]:y
Proceed with reload? [confirm]
Reload scheduled for Tue Mar 27 05:57:25 2012 (in 11 hours 59 minutes)
switch#switch# no reload
Scheduled reload has been cancelled
switch#switch# reload power in 12:00
Reload scheduled for Thu Feb 13 18:56:01 2020 (in 11 hours 59 minutes)
switch#The securebootctl command in the Privileged EXEC Mode manages and displays the status of Secure Boot on Arista switches. Secure Boot ensures the integrity of the boot process by validating the cryptographic signature of the EOS software image before execution.
Command Mode
EXEC
Command Syntax
securebootctl secureboot [-enable | -disable | -display]
securebootctl cert [[-add path] -delete | -display]
securebootctl aristacert [-disable | -enable | -display]
securebootctl abootpassword [-disable | -enable | -display]
Parameters
Examples
Use the following command to enable secure boot:
Aboot# securebootctl secureboot -enable
Aboot#Use the following command to add the path, /mnt/flash, to a certificate on the switch:
Aboot# securebootctl cert -add /mnt/flash
Aboot#Use the following command to enable an Arista certificate on the switch:
Aboot# securebootctl aristacert -enable
Aboot#Use the following command to enable a password for secure boot on the switch:
Aboot# securebootctl abootpassword -enable
Enter password:
Confirm password:The show platform bios [history | detail] command displays the BIOS versions on the switch.
Command Mode
EXEC
Command Syntax
show platform bios
switch# show platform bios
FixedSystem BIOS versions
Location Version
---------- ----------------------------------
Running Aboot-norcal9-9.0.5-13882759
Programmed Aboot-norcal9-9.0.3-4core-13882759
Fallback Aboot-norcal9-9.0.3-4core-13882759
switch#switch# show platform bios history
Supervisor-1 BIOS version history
Timestamp Version
------------------- ----------------------------------
2020-04-07 04:20:22 Aboot-norcal9-9.0.5-13882759
2020-04-05 08:32:03 Aboot-norcal9-9.0.3-4core-13882759
Supervisor-2 BIOS version history
Last update failed on 2020-04-15: Compatibility check failed.
Timestamp Version
------------------- ----------------------------------
2020-04-05 08:32:09 Aboot-norcal9-9.0.5-13882759
switch#switch# show platform bios history detail
Supervisor-1 BIOS version history
Timestamp Version Checksum
------------------- ---------------------------------- ---------
2020-04-07 04:20:22 Aboot-norcal9-9.0.5-13882759 3fa8...
2020-04-05 08:32:03 Aboot-norcal9-9.0.3-4core-13882759 bb39...
Supervisor-2 BIOS version history
Last update failed on 2020-04-15: Compatibility check failed.
Timestamp Version Checksum
------------------- ---------------------------------- ---------
2020-04-05 08:32:09 Aboot-norcal9-9.0.3-13882759 3fa8...
switch#The show redundancy file-replication command displays the status and last synchronization date of file replication between the supervisors on the switch.
Command Mode
EXEC
Command Syntax
show redundancy file-replication
Example
switch# show redundancy file-replication
0 files unsynchronized, 2 files synchronized, 0 files failed, 2 files total.
File Status Last Synchronized
---------------------- -------------- -----------------------
file:persist/sys Synchronized 25 days, 19:48:26 ago
flash:startup-config Synchronized 25 days, 19:48:26 ago
switch#The show redundancy status command displays the current status (active or standby) and the configured redundancy protocol of both supervisors, and summary information about the latest switchover event.
Command Mode
EXEC
Command Syntax
show redundancy status
Example
switch# show redundancy status
my state = ACTIVE
peer state = STANDBY WARM
Unit = Primary
Unit ID = 1
Redundancy Protocol (Operational) = Route Processor Redundancy
Redundancy Protocol (Configured) = Route Processor Redundancy
Communications = Up
Ready for switchover
Last operational redundancy mode change time = 2:17:51 ago
Last operational redundancy mode change reason = Supervisor has control of the active supervisor lock
Last peer switchover time = never
Last peer switchover cause = NoneThe show redundancy switchover sso command displays the number of stateful switchovers since the last reload and a log of the events in the latest stateful switchover.
Command Mode
EXEC
Command Syntax
show redundancy switchover sso
Example
switch# show redundancy switchover sso
Total number of Stateful Switchover completed since reload: 4
Latest Stateful Switchover occured 29 days, 12:48:22 ago @ 2012-06-09 19:47:50
(completed)
0.000000: switchover started
0.000235: stage PCIEAcquired started
0.000349: event PCIEAcquired:__dummyInternal1__ completed
0.000394: event PCIEAcquired:PlxPcie-system started
0.027738: event PCIEAcquired:PlxPcie-system completed
0.027829: stage PCIEAcquired is complete
0.027935: stage DmaReady started
0.028042: event DmaReady:ForwardingAgent started
0.079620: event DmaReady:ForwardingAgent completed
0.079699: stage DmaReady is complete
0.079781: stage TimeCriticalServices started
0.079887: event TimeCriticalServices:__dummyInternal1__ completed
0.079928: event TimeCriticalServices:Stp started
0.208035: event TimeCriticalServices:Stp completed
0.208120: stage TimeCriticalServices is complete
<-------OUTPUT OMITTED FROM EXAMPLE------->
39.675076: stage NonCriticalServices started
39.675145: event NonCriticalServices:__dummyInternal1__ completed
39.675183: stage NonCriticalServices is complete
39.675399: switchover is complete
switch#The show reload command displays the time and reason for any pending reload operation. The reload (scheduled) command schedules a reload operation and can be used to cancel a pending reload.
Command Mode
EXEC
Command Syntax
show reload
Example
switch# reload at 14:45
Proceed with reload? [confirm]
Reload scheduled for Tue Mar 27 14:45:00 2012 ( in 4 hours 11 minutes )
switch# show reload
Reload scheduled for Tue Mar 27 14:45:00 2012 ( in 4 hours 11 minutes )
switch# reload cancel
Scheduled reload has been cancelled
switch#The show reload cause command displays the reason for the most recent reload operation. The command displays recommended actions and debug information related to the executed reload.
Command Mode
EXEC
Command Syntax
show reload cause
Example
switch# show reload cause
Reload Cause 1:
-------------------
Reload requested by the user.
Recommended Action:
-------------------
No action necessary.
Debugging Information:
----------------------
None available.
switch#The show reload fast-boot command verifies that the switch configuration is valid for Smart System Upgrade (SSU).
Command Mode
EXEC
Command Syntax
show reload fast-boot
Example
switch# show reload fast-boot
'reload fast-boot' cannot proceed due to the following:
Spanning-tree portfast is not enabled for one or more ports
Spanning-tree BPDU guard is not enabled for one or more ports
switch#The switch always enables the console and SSH. By default, EOS disables Telnet.
Management commands place the switch in a configuration mode to change session connection parameters.
switch(config)#management console
switch(config-mgmt-console)#switch(config)#management ssh
switch(config-mgmt-ssh)#switch(config)#management telnet
switch(config-mgmt-telnet)#switch(config-mgmt-ssh)#exit
switch(config)#The idle-timeout commands shown in the following examples configure the idle timeout period for the configured connection type. The idle timeout defines the wait for a connection after a recent command before shutting down the connection. Setting the idle timeout to zero automatically disables the connection timeout, the default setting.
switch(config)# management ssh
switch(config-mgmt-ssh)# idle-timeout 180switch(config)# management telnet
switch(config-mgmt-telnet)# idle-timeout 0switch(config)# management telnet
switch(config-mgmt-telnet)# no shutdownswitch(config)# management telnet
switch(config-mgmt-telnet)# shutdownThe Secure Erase feature completely wipes all data from the flash and optional SSD
storage devices. It targets partitions mounted at /mnt/crash, /mnt/flash, and /mnt/drive
(if present), securely erasing them. After erasing the data, it restores the original
partition structure, destroys the Master Boot Record (MBR), and recreates the file
systems, labels, and mount points with the same options. The
EOS.swi and the boot-config files
must be manually reinstalled afterwards, followed by a reboot using Aboot or the full
recovery process.
All secure erasing is best effort. Use firmware-based secure erase when available and a software-based mechanism when the firmware mechanism might fail or be insufficient such as writing random data after sending an ATA Secure Erase command or does not exist. Unfortunately, no non-physically destructive mechanism can guarantee the destruction of all data on a storage device.
Always connect to the switch or supervisor through the serial console before
executing the reset system storage secure command. This
command leaves the switch in Aboot mode, which is only accessible via the serial
console. If the system has dual supervisors, Secure Erase can only be run on the
standby supervisor or when redundancy is disabled (Simplex redundancy) or the
command will fail. After execution, access the switch through the serial console to
complete the recovery process.
standby preparatory to initiating the secure
erase:switch# show redundancy status
my state = ACTIVE
peer state = STANDBY WARM
Unit = Primary
Unit ID = 1
Redundancy Protocol (Operational) = Route Processor Redundancy
Redundancy Protocol (Configured) = Route Processor Redundancy
Communications = Up
Ready for switchover
Last operational redundancy mode change time = 2:17:51 ago
Last operational redundancy mode change reason = Supervisor has control of the active supervisor lock
Last peer switchover time = never
Last peer switchover cause = None
switch#
switch# redundancy manual switchover
This supervisor will be restarted.switch# reset system storage secure
! ERROR! Cannot reset system storage
on the active supervisor while another
supervisor is on standby.EOS.swi and boot-config
files.switch#reset system storage secure
WARNING! This will destroy all
data and will NOT be recoverable.
Device will reboot into Aboot, and
execution may take up to one hour.
Would you like to proceed? [y/N] y
Aboot# pwd
/mnt/flash
Aboot# ls -l
drwxrwxr-x 3 root eosadmin 4096 Jul 21 10:23 aboot
drwxrwx--- 2 root eosadmin 16384 Jul 21 10:21 lost+found
drwxr-xr-x 2 root root 4096 Jul 21 10:01 secure_erase_log
drwxr-xr-x 2 root eosadmin 4096 Jul 21 10:23 tpm-data The configure session command creates a configuration session for CLI commands and ends it after issuing the commit command. Each configure session has a unique name. You can enter, modify, and exit the session anytime without impacting the currently running system configuration.
While in the commit stage of a session, the running-config command creates copies of the modified configuration of the session, overwriting any other configuration changes made since creating the session. A session can be aborted or removed, which removes the session completely and frees up memory used by the session. You must explicitly request the changes in a deferred session to the switch configuration by entering a commit command and exiting the mode. Alternatively, abandon the changes by entering an abort command. The switch discards an uncommitted configuration session if the switch reboots and the session times out after 24 hours.
Configuration sessions implement the changes after verifying that no configuration errors occur. Configuration sessions allow the administrator to pre-provision a group of CLI commands in a named session and execute each configuration session at specified times.
The command configure replace URL replaces the current running-config with the configuration saved in a URL. By default, the configuration in the configure replace URL replaces running-config only if the configuration in the URL loads without errors. The command configure replace URL ignore-errors force the operation even if there are errors.
The normal workflow uses a configuration session to perform the configure replace.
In the CLI, execute the following configuration steps to create a configuration session.
The first three procedures require Aboot Shell access through the console port. If the console port becomes inaccessible, use the last procedure in the list to replace the configuration file through the USB Flash Drive.
The Removing the Enable Password from the Startup Configuration section describes the switch booting process and includes descriptions of the Aboot shell, Aboot boot loader, and required configuration files.
The enable password controls access to Privileged EXEC mode. The switch stores the enable password as an encrypted string generated from the clear-text password to prevent unauthorized disclosure. When using local switch authentication mode and a configured enable password, the CLI prompts to enter the clear-text password after entering the enable command at the EXEC prompt.
The startup-config file stores the encrypted enable password to ensure the switch loads it when rebooting. If the text version of the enable password is lost or forgotten, restore access to enable mode by removing the encrypted enable password from the startup configuration file.
This procedure restores access to enable mode without changing any other configuration settings.
The startup-config file contains configuration parameters that the switch uses during a boot. Parameters that do not appear in the startup-configset to factory defaults when the switch reloads. The process requires the Aboot password if Aboot is password protected.
This procedure reverts EOS configuration settings to default by bypassing the startup-config file during a switch boot.
A fullrecover command removes all internal flash contents including configuration files, EOS image files, and user files, and then restores the factory default EOS image and startup-config. When the default image becomes outdated, the switch requires a subsequent installation of the current EOS image. This process requires Aboot shell access through the console port.
This procedure restores the factory default EOS image and startup configuration.
Use Arista’s Zero Touch Provisioning to configure a switch without user intervention. The USB adds another way to provide the bootstrap name and verify the authenticity of the file server.
Plug in a USB flash drive containing a yaml configuration file into the Arista EOS switch before powering it on.
"bootstrapUrl"
"serverCaCertificate"
"enrollmentToken"
"version": "1.0" "bootstrapUrl""serverCaCertificate""enrollmentToken""version": "1.0""bootstrapUrl"
"serverCaCertificate"
"enrollmentToken"
"version": "1.0""bootstrapUrl"
"serverCaCertificate"
"enrollmentToken"
"version": "1.0"The USB flash drive port restores an original configuration when you cannot establish a connection to the console port. This process removes the contents of the internal flash drive, restores the factory default configuration, and installs a new EOS image from the USB flash drive.
This procedure restores the factory default configuration and installs an EOS image stored on a USB flash drive.
The commit timer command can automatically roll back changes performed during a configuration session if you haven't confirmed them within a preset time interval. This feature can prevent a user from committing configuration changes that could cause a network disruption. The no commit timer command deletes the session.
Command Mode
Configure Session Configuration Mode
Command Syntax
commit timer hh:mm:ss
Parameters
hh:mm:ss - Specify the time interval for the commit session.
Example
switch(config-s-MySession)# commit timer 01:00:00
switch#The configure replace command replaces the current configuration with a new configuration from the specified source.
Command Mode
Privileged EXEC
Command Syntax
configure replace source_file_path:source_file_name [ignore-errors] [md5 md5sum] [skip-checkpoint] [vrf instance_name]
Example
switch(config)# configure replace start-config
! Preserving static routes. Use 'no ip routing delete-static-routes' to clear them.
switch#The configure session command allows a series of temporary configuration changes and commits to running-config later by issuing the commit command. EOS discards an uncommitted configuration session if the switch reboots and times out after 24 hours.
The no configure session session_name and default configure session session_name commands delete the specified configuration session.
Command Mode
Privileged EXEC
Command Syntax
configure session [session_name] [abort | commit | [description description]]
no configure session session_name
default configure session
Parameter
Guidelines
Example
switch(config)#configure session
switch(config-s-sess-1)#aaa authentication dot1x default group radius
switch(config-s-sess-1)#dot1x system-auth-control
switch(config-s-sess-1)#commit
switch(config-s-sess-1)#The idle-timeout (Console Management) command configures the idle-timeout period for console connection sessions. The idle timeout refers to the length of time that a connection waits after a user's most recent command before shutting down the connection. By default, setting the idle timeout to zero disables the connection timeout automatically.
The no idle-timeout and default idle-timeout commands disable the automatic connection timeout by removing the idle-timeout statement from running-config.
Command Mode
ManagementConsole Configuration
Command Syntax
idle-timeout idle_period
no idle-timeout
default idle-timeout
Parameters
switch(config)# management console
switch(config-mgmt-console)# idle-timeout 180
switch(config-mgmt-console)# exit
switch(config)#switch(config)# management console
switch(config-mgmt-console)# idle-timeout 0
switch(config-mgmt-console)#The idle-timeout (SSH Management) command configures the idle-timeout period for SSH connection sessions. The idle timeout refers to the length of time that a connection waits after a user's most recent command before shutting down the connection. Setting the idle timeout to zero disables the connection timeout automatically.
The no idle-timeout and default idle-timeout commands disable the automatic connection timeout by removing the idle-timeout statement from running-config.
Command Mode
Management SSH Configuration
Command Syntax
idle-timeout idle_period
no idle-timeout
default idle-timeout
Parameters
switch(config)# management ssh
switch(config-mgmt-ssh)# idle-timeout 180
switch(config-mgmt-ssh)# exit
switch(config)#switch(config)# management ssh
switch(config-mgmt-ssh)# idle-timeout 0
switch(config-mgmt-ssh)#The idle-timeout (Telnet Management) command in the Telenet Management Configuration Mode configures the idle-timeout period for Telnet connection sessions. The idle timeout refers to the length of time that a connection waits after a user's most recent command before shutting down the connection. Setting the idle timeout to zero disables the connection timeout automatically.
The no idle-timeout and default idle-timeout commands disable the automatic connection timeout by removing the idle-timeout statement from running-config.
Command Mode
ManagementTelnet
Command Syntax
idle-timeout idle_period
no idle-timeout
default idle-timeout
Parameters
switch(config)# management telnet
switch(config-mgmt-telnet)# idle-timeout 180
switch(config-mgmt-telnet)# exit
switch(config)#switch(config)# management telnet
switch(config-mgmt-telnet)# idle-timeout 0
switch(config-mgmt-telnet)#The management accounts command enters the Accounts Management Configuration Mode and allows the creation of user accounts on the switch.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
Global Configuration
Accounts Management Configuration
Command Syntax
management accounts
[no | default] management accounts
Parameters
Example
Use the following commands to enter Accounts Management Configuration Mode and add a user tech_support1 with a session limit of 10:
switch(config)# management accounts
switch(config-mgmt-accounts)# account tech_support1
switch(config-mgmt-acct-tech_support1)# session limit 10The management api eos-sdk-rpc command places the switch in EOS SDK RPC API management configuration mode.
The no management api eos-sdk-rpc and default management api eos-sdk-rpc commands delete the mgmt-api-eos-sdk-rpc configuration mode statements from running-config.
EOS SDK RPC API management configuration mode is not a group change mode; running-config is changed immediately upon entering commands. Exiting the EOS SDK RPC API management configuration mode does not affect the running-config. The exit command returns the switch to global configuration mode.
Command Mode
Global Configuration
Command Syntax
management api eos-sdk-rpc
no management api eos-sdk-rpc
default management api eos-sdk-rpc
switch(config)# management api eos-sdk-rpc
switch(config-mgmt-api-eos-sdk-rpc)#switch(config-mgmt-api-eos-sdk-rpc)# exit
switch(config)#The management api external-services command places the switch in External Services API configuration mode.
The no management api external-services and default management api external-services commands delete the mgmt-api-external-services configuration mode statements from running-config.
External Services API configuration mode is not a group change mode; running-config is changed immediately upon entering commands. Exiting the External Services API configuration mode does not affect the running-config. The exit command returns the switch to global configuration mode.
Command Mode
Global Configuration
Command Syntax
management api external-services
no management api external-services
default management api external-services
switch(config)# management api external-services
switch(config-mgmt-api-external-services)#switch(config-mgmt-api-external-services)# exit
switch(config)#The management api gnmi command places the switch in GNMI API Management configuration mode.
The no management api gnmi and default management api gnmi commands delete the mgmt-api-gnmi configuration mode statements from running-config.
GNMI API Management configuration mode is not a group change mode; running-config is changed immediately upon entering commands. Exiting the GNMI API Management configuration mode does not affect running-config. The exit command returns the switch to global configuration mode.
Command Mode
Global Configuration
Command Syntax
management api gnmi
no management api gnmi
default management api gnmi
switch(config)# management api gnmi
switch(config-mgmt-api-gnmi)#switch(config-mgmt-api-gnmi)# exit
switch(config)#The management api gnsi command places the switch in GNSI API management configuration mode.
The no management api gnsi and default management api gnsi commands delete the mgmt-api-gnsi configuration mode statements from running-config.
GNSI API Management configuration mode is not a group change mode; running-config is changed immediately upon entering commands. Exiting the GNSI API Management configuration mode does not affect running-config. The exit command returns the switch to global configuration mode.
Command Mode
Global Configuration
Command Syntax
management api gnsi
no management api gnsi
default management api gnsi
switch(config)# management api gnsi
switch(config-mgmt-api-gnsi)#switch(config-mgmt-api-gnsi)# exit
switch(config)#The management api gribi command places the switch in gRIBI API Management configuration mode.
The no management api gribi and default management api gribi commands delete the mgmt-api-gribi configuration mode statements from running-config.
gRIBI API Management configuration mode is not a group change mode; running-config changes immediately upon entering commands. Exiting the gRIBI API Management configuration mode does not affect running-config. The exit command returns the switch to global configuration mode.
Command Mode
Global Configuration
Command Syntax
management api gribi
no management api gribi
default management api gribi
switch(config)# management api gribi
switch(config-mgmt-api-gribi)#switch(config-mgmt-api-gribi)# exit
switch(config)#The management api http-commands command places the switch in HTTP Commands API Management Configuration Mode.
The no management api http-commands and default management api http-commands commands delete the HTTP Commands API Management Configuration Mode statements from running-config.
HTTP Commands API Management Configuration Mode is not a group change mode. The running-config changes immediately upon entering commands. Exiting HTTP Commands API Management configuration mode does not affect running-config. The exit command returns the switch to global configuration mode.
Command Mode
Global Configuration
Command Syntax
management api http-commands
no management api http-commands
default management api http-commands
switch(config)# management api http-commands
switch(config-mgmt-api-http-cmds)#switch(config-mgmt-api-http-cmds)# exit
switch(config)#The management api models command places the switch in Models API Management configuration mode.
The no management api models and default management api models commands delete the mgmt-api-models configuration mode statements from running-config.
Models API Management configuration mode is not a group change mode; running-config is changed immediately upon entering commands. Exiting Models API Management configuration mode does not affect running-config. The exit command returns the switch to global configuration mode.
Command Mode
Global Configuration
Command Syntax
management api models
no management api models
default management api models
switch(config)# management api models
switch(config-mgmt-api-models)#switch(config-mgmt-api-models)# exit
switch(config)#The management api netconf command places the switch in Netconf API Management configuration mode.
The no management api netconf and default management api netconf commands delete the mgmt-api-netconf configuration mode statements from running-config.
Netconf API Management configuration mode is not a group change mode; running-config is changed immediately upon entering commands. Exiting Netconf API Management configuration mode does not affect running-config. The exit command returns the switch to global configuration mode.
Command Mode
Global Configuration
Command Syntax
management api netconf
no management api netconf
default management api netconf
switch(config)# management api netconf
switch(config-mgmt-api-netconf)#switch(config-mgmt-api-netconf)# exit
switch(config)#The management api restconf command places the switch in Restconf API Management configuration mode.
The no management api restconf and default management api restconf commands delete the mgmt-api-restconf configuration mode statements from running-config.
Restconf API Management configuration mode is not a group change mode; running-config is changed immediately upon entering commands. Exiting Restconf API Management configuration mode does not affect running-config. The exit command returns the switch to global configuration mode.
Command Mode
Global Configuration
Command Syntax
management api restconf
no management api restconf
default management api restconf
switch(config)# management api restconf
switch(config-mgmt-api-restconf)#switch(config-mgmt-api-restconf)# exit
switch(config)#The management archive command enters the Archive Management Configuration Mode and allows you to manage log archives and archive space.
Command Mode
Global Configuration
Archive Management Configuration
Command Syntax
management archive [destination flash:] [quotapct percentage] shutdown
Parameters
Example
Use the following commands to configure the quota percentage as 50:
switch(config)# management archive
switch(config-mgmt-archive)# quotapct 50
switch(config-mgmt-archive)#The management cli command places the switch in CLI Management Configuration Mode and allows you to configure command line options.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
Global Configuration
CLI Management Configuration
Command Syntax
management cli command deprecated log
[no | default] management cli command deprecated log
Parameters
Example
Use the following commands to create a syslog message when executing a deprecated command:
switch(config)# management cli
switch(config-mgmt-cli)# command deprecated log
switch(config-mgmt-cli)#The management client command enters the Client Management Configuration Mode and configures remote applications or scripts that utilize the switch powerful eAPI (EOS API) to programmatically send configuration and show commands.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
Global Configuration
Client Management Configuration
Command Syntax
management client api gnmi [group group_name member server_name] [server server_name]
[no | default] management client api gnmi
Parameters
Example
Use the following commands to add the group, gnmi_group, and the member, gnmi_server1 to the client configuration:
switch(config)# management client api gnmi
switch(config-mgmt-client-api-gnmi)# group gnmi_group member gnmi_server1
switch(config-mgmt-client-api-gnmi)#The management console command places the switch in Console Management Configuration Mode to adjust the idle-timeout period for console connection sessions. The idle-timeout period determines the inactivity interval that terminates a connection session.
The no management console and default management console commands delete the Console Management Configuration Mode statements from running-config.
The Console Management Configuration Mode is not a group change mode. The running-config changes immediately upon entering commands. Exiting the mgmt-console configuration mode does not affect running-config. The exit command returns the switch to Global Configuration Mode.
Command Mode
Global Configuration
Command Syntax
management console
no management console
default management console
Parameters
switch(config)# management console
switch(config-mgmt-console)#switch(config-mgmt-console)# exit
switch(config)#The management data source command enters the Data Source Management Configuration Mode and allows defining the rules and actions taken on specific data streams.
Command Mode
Global Configuration
Data Source Management Configuration
Command Syntax
management data source [disable] [sensor sensor_name [disabled | ip address ip_address port port] [traffic-policies [disabled] [field-set [ipv4 prefix source_name] [ [ipv6 prefix source_name] [ service source_name]]
Parameters
Example
Use the following commands to configure a sensor, sensor_db, with the IPv4 address, 192.168.92.157, and port 443:
switch(config)# managment data source
switch(config-mgmt-ds)# sensor sensor_db
switch(config-mgmt-ds-sensor-sensor_db)# ip 192.168.96.157 port 443
switch(config-mgmt-ds-sensor-sensor_db)#The management defaults command enters the Defaults Management Configuration Mode and configures storing secrets on the switch.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
Global Configuration
Defaults Management Configuration
Command Syntax
management defaults secret hash [md5 | scrypt | sha-512 | yescrypt]
[no | default] management defaults
Parameters
Example
Use the following commands to add MD5 as the secret hash:
switch(config)# managment defaults
switch(config-mgmt-defaults)# secret hash md5The management dmf command in the DANZ Monitoring Fabric (DMF) Configuration Mode allows the configuration of up to two DMF controllers on the network.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
Global Configuration
DANZ Monitoring Fabric (DMF) Configuration
Command Syntax
managment dmf [disabled] [controller address ip_address1 controller address ip_address2
[no | default]> managment dmf
Parameters
Example
Use the following commands to add a DMF controller, 172.16.23.47, to the switch:
switch(config)# manangement dmf
switch(config-mgmt-dmf)# controller 172.16.21.47
switch(config-mgmt-dmf)#The management file-systems command in the File Systems Management Configuration Mode allows the configuration and management of the file system on the switch.
Command Mode
Global Configuration
File Systems Management Configuration
Command Syntax
management file-systems nfs [crash: directory_name] [file: directory_name] [flash: directory_name]
Parameters
Example
Use the following commands to manage the crash files:
switch(config)# management file-systems
switch(config-mgmt-file-systems)# nfs crash:The management http-server command enters the HTTP Management Configuration Mode of the switch to allow Application Programming Interface (API) access to the switch for programmatic commands.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
Global Configuration
HTTP Management Configuration
Command Syntax
management http-server [cors allowed-origin origin server_address | all | *]
management http-server default-services
management http-server header csp frame-ancestors uri
management http-server log-level [alert | crit | debug | emerg | error | info | notice | warn]
management http-server protocol [http [localhost | port port_number]] [https [port port_number | ssl profile_name]] [unix-socket]
management http-server qos dscp dscp_value
management http-server vrf [default | vrf_name
Parameters
Example
Use the following commands to specify using the default services for the HTTP Server:
switch(config)# management http-server
switch(config-mgmt-http-server)# default-services
switch(config-mgmt-http-server)#The management ldap command in the Global Configuration mode enters the switch into LDAP Management Configuration Mode and allows the configuration of an LDAP group and server. This allows the switch to authenticate and authorize users against an external Lightweight Directory Access Protocol (LDAP) server and centralizes user management.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
Global Configuration
LDAP Management Configuration
Command Syntax
management ldap [group policy policy_name group group_name rolerole_name [after | before] group_name [privilege level]
Parameters
Example
Use the following commands to add the policy, policy1, to group, ldap_group, with the role of manager, and privilege level 10:
switch(config)# management ldap
switch(config-mgmt-ldap)# group policy policy1
switch(config-mgmt-ldap-gp-policy1)# group ldap_group role manager privilege 10
switch(config-mgmt-ldap-gp-policy1)#The management ldap server command enters the LDAP Management Configuration Mode and allows the configuration of an LDAP server for authentication on the switch.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
Global Configuration
LDAP Management Configuration
Command Syntax
management ldap server [defaults [authorization group policy policy_name] [base-dn domain_name] [rdn attribute user attr_name] [search username username password password] [ssl-profile profile_name] [timeout seconds]] [host host_name portport_number vrfvrf_name]
[no | default] management ldap server
Parameters
Example
Use the following commands to use arista.com as the base Domain Name:
switch(config)# management ldap
switch(config-mgmt-ldap)# server defaults
switch(config-ldap-defaults)# base-dn arista.com
switch(config-ldap-defaults)#The management nic profiles command enters the Network Interface Card (NIC) Profile Configuration Mode and allow configuration of an interface for an internal service client such as ZTP or an internal monitoring process that needs to reach a provisioning server.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
Global Configuration
Network Interface Card (NIC) Profile Configuration
Command Syntax
management nic profiles profile profile_name [connection [ssl profile profile_name] [timeout seconds ]] [job job_name metric path path_name] [port port_number] [system auto-discovered]] [polling interval interval
[no | default] management nic profiles profile profile_name
Parameters
Example
Use the following commands to add an SSL profile, secure_1, to the NIC profile, nic_mgmt:
switch(config)# management nic profiles profile nic_mgmt
switch(config-mgmt-nic-profile-nic_mgmt)# connection ssl profile secure_1
switch(config-mgmt-nic-profile-nic_mgmt)# The management package command in the Package Management Configuration Mode configures a remote source for downloading optional software extension packages.
Command Mode
Global Configuration
Package Management Configuration
Command Syntax
management package repository repo_name [description description] [type description] [url url]
Parameters
show commands.Example
Use the following commands to create a repository, prod_ext, with the URL, https://10.11.10.27/arista/extensions/:
switch(config)# management package
switch(config-mgmt-package)# management package repository pProd-Ext type url https://10.11.10.27/arista/extensions/The management security auto-certificate command enters the Auto-Certificate Security Management Configuration Mode and automates the management and renewal of the digital certificates used by the switch for various secure management services such HTTPS for APIs.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
Global Configuration
Auto-Certificate Security Management Configuration
Command Syntax
management security auto-certificate [profile profile_name [digest [sha256 | sha384 | sha512]] [key key_name ] [ parameters [distinguished-name [common-name name] [country name [email email ] [locality locality] [organizationorganization] [organization-unit unit] [serial-number number ] [state state]] [subject-alternative-name [dns dns_name] [email email] [ip ip_address] [uri uri] ] [protocol instance instance_name] [renewal seconds seconds]]
management security auto-certificate [protocol est profile_name [connection retry [count num_retries] [interval seconds seconds]] [credentials enroll [secret [0 | 7 | 8a] secret] [token [0 | 7 | 8a] token] [username username ]] [disabled] [server [ssl profile profile_name] [url url ] [vrf vrf_name
Parameters
The management security entropy command manages the source of cryptographic entropy (randomness) and provides high quality randomness for SSH keys, SSL/TLS certificates, and random session identifiers.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
Global Configuration
Security Management Configuration
Command Syntax
management security entropy source [cpu jitter] [hardware exclusive] [haveged]
[no | default] management security entropy
Parameters
Example
Use the following command to use cpu jitter for security entropy:
switch(config)# managment security
switch(config-mgmt-security)# entropy cpu jitter
switch(config-mgmt-security)#
The management security network command enters the Security Management Configuration mode and then configures security policies that govern the access and behavior of various management applications on the switch. It defines rules to protect the control plane from unauthorized or malicious network activity.
The [no | default] versions of the command return the feature to its default settings.
Command Mode
Global Configuration
Security Management Configuration
Command Syntax
management security network client protocol [ftp | http | tftp] disabled
[no | default] management security network client protocol
Parameters
Example
Use the following commands to disable FTP client traffic:
switch(config)# management security
switch(config-mgmt-security)# network client protocol ftp disabled
switch(config-mgmt-security)#The management security ocsp command enters the Security Online Certificate Status Protocol (OCSP) Configuration Mode and quickly checks the revocations status of digital certificates used by management services such as HTTP or LDAP over TLS.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
Global Configuration
Security Management Configuration
Command Syntax
management security ocsp profile profile_name [chain certificate requirement responder [all | leaf | none]] [extension nonce request [disabled | response]] [response validity-time extended-by seconds] [timeout seconds] [url url] [vrf vrf]
[no | default] management security ocsp profile profile_name
Parameters
Example
Use the following commands to add the profile, OCSP_1, with an extension nonce request of disabled
switch(config)# management security
switch(config-mgmt-security)# ocsp profile OCSP_1
switch(config-mgmt-sec-ocsp-profile-OCSP_1)# extension nonce request disabled
switch(config-mgmt-sec-ocsp-profile-OCSP_1)#The management security password command enters the Security Management Configuration Mode and configures robust password policies for all local user accounts.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
Global Configuration
Security Management Configuration
Command Syntax
management security password [encryption reversible aes-256-gcm] [encryption-key common custom key] [minimum length num_char] [policy policy_name [deny last pw_count] [ maximum repetitive num_char sequential num_char] [ minimum [changed num_char] [digits num_char] [length num_char] [lower num_char] [ num_char] [uppernum_char]]
[no | default] management security password
Parameters
!"#$%&\'()*+,-./:;<=>?@[^]_`{|}~,
required for the password from 0 to 65535Example
Use the following commands to create a password policy, ldap_access,
with the minimum length of 15 characters:
switch(config)# management security
switch(config-mgmt-security)# policy ldap_access
switch(config-pwd-policy-ldap_access)# minimum length 15
switch(config-pwd-policy-ldap_access)#The management security session command enters the Security Management Configuration Mode and configures the session parameters that govern the behavior, timeouts, and security of interactive management sessions.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
Global Configuration
Security Management Configuration
Command Syntax
management security session shared-secret profile profile_name secret secret_name [0 | 7 | 8a]password [infinite] [ mm/dd/yyyy hh:mm:ss [infinite | datelocal-time] [receive-lifetime mm/dd/yyyy hh:mm:ss [infinite |date local-time]] [transmit-lifetime [infinite mm/dd/yyyy hh:mm:ss date local-time]]
Parameters
Example
Use the following commands to configure a session to use the profile,
mySession, with the secret name, mySecret, and the
secret, qwerty, with an infinite receive-lifetime and
transmit-lifetime, with the default local-time:
switch(config)# management security
switch(config-mgmt-security)# session shared-secret profile mySession
switch(config-mgmt-sec-sh-sec-profile-mySession)# secret mySecret 0 qwerty receive-lifetime infinite
transmit-lifetime infinite local-time
switch(config-mgmt-sec-sh-sec-profile-mySession)#The management security signature-verification command enters the Security Management Configuration Mode and apply a named SSL profile that dictates the policies for verifying the integrity of the system files related to secure TLS/SSL communications.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
Global Configuration
Security Management Configuration
Command Syntax
management security signature-verification extension ssl profile profile_name
[no | default] management security signature-verification
Parameters
Example
Use the following commands to verify SWIX signatures using the SSL profile,
swix_ca:
switch(config)# management security
switch(config-mgmt-security)# signature-verification extension ssl profile swix_ca
switch(config-mgmt-security)#The management security ssl command enters the SSL Security Management Configuration mode to configure and manage the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) parameters for all secure management services on the switch.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
Global Configuration
SSL Security Management Configuration
Command Syntax
management security ssl [monitor expiry time [days | hours] [log interval time [days | hours]]
management security ssl [profile profile_name [certificate cert_name [auto-certificate cert_name] [common-name [key key_name] [username regexp regex]] [local cert_name key cert_name] [policy [expiry-date ignore] [key key_name]] [requirement extended-key-usage [hostname match] [key key_name]] [chain [certificate cert_name] [local cert_name] [policy [expiry-date ignore]] [requirement [basic-constraint ca true] [include root-ca]] [cipher [v1.0 cipher_list] [v1.3 cipher_list] [diffie-hellman parameters [ffdhe2048 | ffdhe3072 | ffdhe4096 | generated]] [dtls version [1.0 | 1.2 | add | remove]] [fips restrictions] [key-establishment-group group_names] [peer certificate [format ip-address exact] [requirement [hostname match subject-alternative-name [common-name]]] [revocation [crl [name crl_name] [policy expiry-date ignore]] [ocsp profile profile_name]] [signature algorithm alg_list] [tls versions [1.0 | 1.1 | 1.2 | 1.3 | add | remove]] [trust [certificate cert_name] [policy expiry-date ignore]] [requirement [basic-constraint ca true] [hostname fqdn]] [system]
[no | default] management security ssl monitor
[no | default] management security ssl profile
Parameters
Example
Use the following commands to set the SSL monitoring of certificates to log warning for certificate expiration to 10 days and log the warning to syslog every 8 hours:
switch(config)# management security
switch(config-mgmt-security)# ssl monitor expiry 10 days log interval 8 hours
switch(config-mgmt-security)#The management ssh command places the switch in SSH Management Configuration Mode to adjust SSH session connection parameters.
The no management ssh and default management ssh commands delete the SSH Management Configuration Mode statements from running-config.
The mgmt-ssh configuration mode does not provide a group change mode. The running-config changes immediately upon entering commands. Exiting the SSH Management Configuration Mode does not affect running-config. The exit command returns the switch to Global Configuration Mode.
Command Mode
Global Configuration
Command Syntax
management ssh
no management ssh
default management ssh
switch(config)# management ssh
switch(config-mgmt-ssh)#switch(config-mgmt-ssh)# exit
switch(config)#The management telnet command places the switch in Telnet Management Configuration Mode to adjust Telnet session connection parameters.
The no management telnet and default management telnet commands delete the Telnet ManagementConfiguration Mode statements from running-config.
The Telnet Management Configuration Mode does not provide a group change mode. The running-config changes immediately upon entering commands. Exiting the Telnet Management Configuration Mode does not affect the running-config. The exit command returns the switch to Global Configuration Mode.
Command Mode
Global Configuration
Command Syntax
management telnet
no management telnet
default management telnet
switch(config)# management telnet
switch(config-mgmt-telnet)#switch(config-mgmt-telnet)# exit
switch(config)#The protocol http command enables the hypertext transfer protocol (HTTP) server.
The no protocol http and default protocol http commands disable the HTTP server by removing the protocol http statement from running-config.
Command Mode
Mgmt-API Configuration
Command Syntax
protocol http [TCP_PORT]
no protocol http
default protocol http
Related Commands
management api http-commands places the switch in mgmt-api configuration mode.
Example
switch(config)# management api http-commands
switch(config-mgmt-api-http-cmds)#The protocol https command enables the HTTP secure server. The HTTP secure server is active by default.
The default protocol https command restores the default setting by removing the no protocol https statement from running-config. The no protocol https command disables the HTTP secure server.
Command Mode
API Management Configuration
Command Syntax
protocol https [TCP_PORT]
no protocol https
default protocol https
Related Commands
management api http-commands places the switch in API Management Configuration Mode.
switch(config)# management api http-commands
switch(config-mgmt-api-http-cmds)# protocol https
switch(config-mgmt-api-http-cmds)# no shutdownswitch(config)# management api http-commands
switch(config-mgmt-api-http-cmds)# protocol https port 52
switch(config-mgmt-api-http-cmds)# no shutdownThe protocol https certificate command configures the HTTP secure server to request an X.509 certificate from the client. The client then authenticates the certificate with a public key.
The no protocol https certificate and default protocol https certificate commands restore default behavior by removing the protocol https certificate statement from running-config.
Command Mode
API Management Configuration
Command Syntax
protocol https certificate
no protocol https certificate
default protocol https certificate
Related Command
management api http-commands places the switch in API Management Configuration Mode.
Example
switch(config)# management api http-commands
switch(config-mgmt-api-http-cmds)# protocol https certificate
switch(config-mgmt-api-http-cmds)#Use the reset system storage secure command to trigger the secure erase mechanism. Secure erase is a command that deliberately, permanently, and irreversibly removes and destroys the data stored on a storage device, rendering that data unrecoverable.
Command Mode
EXEC
Command Syntax
reset system storage secure
switch# reset system storage secure
WARNING! This will destroy all
data and will NOT be recoverable.
Device will reboot into Aboot, and
execution may take up to one hour.
Would you like to proceed? [y/N]switch#reset system storage secure
% Unavailable command (not supported on this hardware platform)The show inventory command displays the hardware components installed in the switch. Each component has a serial number and a description.
Command Mode
EXEC
Command Syntax
show inventory
Example
switch> show inventory
System information
Model Description
------------------------ ----------------------------------
DCS-7150S-52-CL 52-port SFP+ 10GigE 1RU + Clock
HW Version Serial Number Mfg Date
----------- -------------- ----------
02.00 JPE13120702 2013-03-27
System has 2 power supply slots
Slot Model Serial Number
---- ---------------- ----------------
1 PWR-460AC-F K192KU00241CZ
2 PWR-460AC-F K192L200751CZ
System has 4 fan modules
Module Number of Fans Model Serial Number
------- --------------- ---------------- ----------------
1 1 FAN-7000-F N/A
2 1 FAN-7000-F N/A
3 1 FAN-7000-F N/A
4 1 FAN-7000-F N/A
System has 53 ports
Type Count
---------------- ----
Management 1
Switched 52
System has 52 transceiver slots
Port Manufacturer Model Serial Number Rev
---- ---------------- ---------------- ---------------- ----
1 Arista Networks SFP-10G-SR XCW1225FD753 0002
2 Arista Networks SFP-10G-SR XCW1225FD753 0002
51 Arista Networks SFP-10G-SR XCW1225FD753 0002
52 Arista Networks SFP-10G-SR XCW1225FD753 0002
switch>The shutdown command disables management over API on the switch in API Management Configuration Mode. EOS disables API Management by default.
The no shutdown command enables the API managementaccess in mgmt-api configuration mode.
The default shutdown command disables the management API access in mgmt-api configuration mode.
Command Mode
Mgmt-API Configuration
Command Syntax
shutdown
no shutdown
default shutdown
Related Command
management api http-commands places the switch in mgmt-api configuration mode.
switch(config)# management api http-commands
switch(config-mgmt-api-http-cmds)# shutdown
switch(config-mgmt-api-http-cmds)#switch(config)# management api http-commands
switch(config-mgmt-api-http-cmds)# no shutdown
switch(config-mgmt-api-http-cmds)#Command Mode
Telnet Management Configuration
Command Syntax
shutdown
no shutdown
switch(config)# management telnet
switch(config-mgmt-telnet)# no shutdown
switch(config-mgmt-telnet)# exit
switch(config)#switch(config-mgmt-telnet)# shutdownThe timeout command in the SSH, Telnet, or Console Management Configuration Mode specifies the maximum length of a management session regardless of activity during the session. It prevents sessions from remaining open indefinitely on the switch and provides a separate behavior from the parameter idle-timeout. Both timers operate independently and the timer with the shortest session time ends the session.
The [no | default] versions of the command disable the feature and remove the configuration from the running-config.
Command Mode
Console Management Configuration
SSH Management Configuration
Telnet Management Configuration
Command Syntax
management [console | ssh | telnet]timeout timeout_period
[no | default] management [console | ssh | telnet] timeout
Parameters
Examples
Use the following commands to set the console timeout to 60 minutes.
switch(config)# management console
switch(config-mgmt-console)# timeout 60Use the following commands to set the SSH timeout to 60 minutes.
switch(config)# management ssh
switch(config-mgmt-ssh)# timeout 60Use the following commands to set the Telnet timeout to 60 minutes.
switch(config)# management telnet
switch(config-mgmt-telnet)# timeout 60The vrf command places the switch in the server's VRF configuration mode. If the named VRF does not already exist, this command creates it.
Command Mode
API Management Configuration
Command Syntax
vrf VRF_INSTANCE
Parameters
Related Command
management api http-commands places the switch in API Management Configuration.
Example
switch(config)# management api http-commands
switch(config-mgmt-api-http-cmds)# vrf management-vrf
switch(config-mgmt-api-http-cmds-vrf-management-vrf)#