The authentication x509 command in the SSH Management Authentication x509 configuration Mode configures x509 certificates for the SSH connection.

The no version of the command disables the configuration and removes it from the running-config.

Command Mode

SSH Management configuration

Authentication x509 configuration

Command Syntax

authentication x509 [server ssl profile profile_name] [username [domain | omit]]

no authentication x509

Parameters

Example

Use the following commands to allow SSH authentication match the SSH user name to a presented x509 certificate and ignore the domain presented in the certificate:

switch(config)# management ssh
switch(config-mgmt-ssh)# authentication x509
switch(config-mgmt-ssh-auth-x509)# username domain omit
switch(config-mgmt-ssh-auth-x509)#

The authentication command in the SSH Management configuration Mode configures authentication parameters for the SSH connection.

The no version of the command disables the configuration and removes it from the running-config.

Command Mode

SSH Management configuration

Command Syntax

authentication [empty-passwords [auto | deny | permit]] [protocol [keyboard-interactive | multi-factor | password | public-key]]

no authentication

Parameters

Example

Use the following commands to allow SSH authentication to use empty passwords:

switch(config)# management ssh
switch(config-mgmt-ssh)# authentication empty-passwords permit
switch(config-mgmt-ssh)#

The authorized-principals command in the SSH Management configuration Mode allows the configuration of authorized principals for SSH. The authorized-principals mechanism defines which identities or principals within a signed certificate have permission to log in as a specific local user.

The no version of the command disables the feature and removes the configuration from the running-config.

Command Mode

SSH Management configuration

Command Syntax

authorized-principals command WORD ARGUMENTS

no authorized-principals command

Parameters

Example

Use the following commands to run the script, /mnt/flash/scripts/get-principals.py:

switch(config)# management ssh
switch(config-mgmt-ssh)# authorized-principals command /mnt/flash/scripts/get-principals.py
switch(config-mgmt-ssh)#

The cipher command in the SSH Management configuration Mode defines the specific symmetric encryption algorithms used for SSH sessions. During the SSH handshake, the switch and client compare lists of supported ciphers and must find a common match to establish an encrypted tunnel. If no match found, the switch rejects the connection.

The no version of the command disables the feature and removes the configuration from the running-config.

Command Mode

SSH Management configuration

Command Syntax

cipher algorithm

no cipher

Parameters

Example

Use the following commands to add the algorithms, aes192-cbc and blowfish-cbc, to the configuration:

switch(config)# managment ssh
switch(config-mgmt-ssh)# cipher aes192-cbc blowfish-cbc
switch(config-mgmt-ssh)#

The client-alive command in the SSH Management configuration Mode manages the SSH session persistence and timeouts. The switch proactively checks if a connected client has an active session.

The no version of the command disables the feature and removes the configuration from the running-config.

Command Mode

SSH Management configuration

Command Syntax

client-alive [count-max number] interval time]

no client-alive

Parameters

Example

Use the following commands to configure a maximum count of 5 and an interval of 10 seconds:

switch(config)# management ssh
switch(config-mgmt-ssh)# client-alive count-max 5 interval 10
switch(config-mgmt-ssh)#

The commit timer command can automatically roll back changes performed during a configuration session if you haven't confirmed them within a preset time interval. This feature can prevent a user from committing configuration changes that could cause a network disruption. The no commit timer command deletes the session.

Command Mode

Configure Session configuration Mode

Command Syntax

commit timer hh:mm:ss

Parameters

hh:mm:ss - Specify the time interval for the commit session.

Example

switch(config-s-MySession)# commit timer 01:00:00
switch#

The compressionin the SSH Management configuration Mode controls compressing the data stream from the SSH server before encrypting it. This optimizes bandwidth on slow or congested management links such as out-of-band serials consoles over LTE or saturated WAN links.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

SSH Management configuration

Command Syntax

compression disable

Parameters

Example

Use the following commands to disable SSH compression algorithms:

switch(config)# management ssh
switch(config-mgmt-ssh)# compression disable
switch(config-mgmt-ssh)#

The connection command in the SSH Management configuration Mode configures session-handling and security for SSH connections.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

SSH Management configuration

Command Syntax

connection [limit number_sessions] per-host [ number_sessions]

no connection

default connection

Parameters

Example

Use the following commands to configure a limit of 50 concurrent SSH sessions:

switch(config)# management ssh
switch(config-mgmt-ssh)# connection limit 50
switch(config-mgmt-ssh)#

The fips command in the SSH Management configuration Mode configures the switch to strictly enforce FIPS 140-2/140-3 compliance for all incoming connections. When enabled, the switch disables all cryptographic algorithms not officially validated by Federal Information Processing Standards (FIPS).

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

SSH Management configuration

Command Syntax

fips restrictions

no fips restrictions

default fips restrictions

Parameters

Example

Use the following commands to enable FIPS algorithms for SSH connections on the switch:

switch(config)# management ssh
switch(config-mgmt-ssh)# fips restrictions
switch(config-mgmt-ssh)#

The hostkey command in the SSH Management configuration Mode configures the client connections and server connections host keys on the switch.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

SSH Management configuration

Command Syntax

hostkey [client strict-checking] [server [cert hostkey_filename] [ dsa | ecdsa-nistp256 | ecdsa-nistp521 | ed25519 | rsa] [ssh-key filename]

no hostkey

default hostkey

Parameters

Example

Use the following commands to enable the client strict host key checking for SSH connections on the switch:

switch(config)# management ssh
switch(config-mgmt-ssh)# hostkey client strict-checking
switch(config-mgmt-ssh)#

The ip command in the SSH or Telnet Management configuration Mode configures the IPv4 access group parameters for an SSH or Telnet session.

The [no | default] versions of the command disables the configuration and removes it from the running-config.

Command Mode

SSH Management configuration

Telnet Management configuration

Command Syntax

ip access-group list_name in [vrf vrf_name]

no access-group list_name

default access-group list_name

Parameters

Example

Use the following commands to apply the IPv6 access group list, MyAGL, to inbound packets on VRF, bluengreen, Telnet management sessions:

switch(config)# management telnet
switch(config-mgmt-telnet)# ip access-group MyAGL in vrf bluengreen
switch(config-mgmt-telnet)#

The ipv6 command in the SSH or Telnet Management configuration Mode configures the IPv6 access group parameters for an SSH or Telnet session.

The [no | default] versions of the command disables the configuration and removes it from the running-config.

Command Mode

SSH Management configuration

Telnet Management configuration

Command Syntax

ipv6 access-group list_name in [vrf vrf_name]

no access-group list_name

default access-group list_name

Parameters

Example

Use the following commands to apply the IPv6 access group list, MyAGL, to inbound packets on VRF, bluengreen, Telnet management sessions:

switch(config)# management telnet
            switch(config-mgmt-telnet)# ipv6 access-group MyAGL in vrf bluengreen
            switch(config-mgmt-telnet)#

The key-exchange command in the SSH Management configuration Mode specifies the mathematical algorithms used by the switch to securely negotiate a shared session key with an SSH peer. The command applies to client and server connections.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

SSH Management configuration

Command Syntax

key-exchange [This email address is being protected from spambots. You need JavaScript enabled to view it. | diffie-hellman-group-exchange-sha1 | diffie-hellman-group-exchange-sha256 | diffie-hellman-group1-sha1 | diffie-hellman-group14-sha | diffie-hellman-group14-sha256 | diffie-hellman-group16-sha512 | diffie-hellman-group18-sha512 | ecdh-sha2-nistp256 | ecdh-sha2-nistp384 | ecdh-sha2-nistp521 | gss-curve25519-sha256- |gss-gex-sha1- | gss-group1-sha1- | gss-group14-sha1- | gss-group14-sha256- | gss-group16-sha512- | gss-nistp256-sha256- | mlkem768x25519-sha25 | sntrup761x25519-sha512 | This email address is being protected from spambots. You need JavaScript enabled to view it.]

no key-exchange

default key-exchange

Parameters

Example

Use the following commands to select the algorithm, ecdh-sha2-nistp256, for key exchange for SSH connections on the switch:

switch(config)# management ssh
switch(config-mgmt-ssh)# key-exchange ecdh-sha2-nistp256
switch(config-mgmt-ssh)#

The log-level command in the SSH Management configuration Mode defines the verbosity of the SSH service messages sent to the system logs.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

SSH Management configuration

Command Syntax

log-level [debug | debug1 | debug2 | debug3 | error | fatal | info | quiet | verbose]

no log-level

default default

Parameters

Example

Use the following commands to set the log level for SSH connections on the switch to error:

switch(config)# management ssh
switch(config-mgmt-ssh)# log-level error
switch(config-mgmt-ssh)#

The logging command in the SSH Management configuration Mode directs SSH service log events to the eos system logging facility (syslog).

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

SSH Management configuration

Command Syntax

logging target system

no logging

default logging

Parameters

Example

Use the following commands to set the log messages destination to the syslogs on the switch:

switch(config)# management ssh
switch(config-mgmt-ssh)# logging target system
switch(config-mgmt-ssh)#

The login command in the Console, SSH, or Telnet Management configuration Mode allows the configuration of login parameters for the sessions.

The [no | default] versions of the command disables the configuration and removes it from the running-config.

Command Mode

Console Management configuration

SSH Management configuration

Telnet Management configuration

Command Syntax

login user match-list list_name [invert-result]

no login user match-list list_name

default login user match-list list_name

Parameters

Example

Use the following commands to match the user list, MyUsers, for a console management session:

switch(config)# managment console
switch(config-mgmt-console)# login user match-list MyUsers
switch(config-mgmt-console)#

The mac command in the SSH Management configuration Mode specifies the algorithms the switch uses to verify the data integrity of SSH packets, ensuring that traffic has not been tampered with in transit.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

SSH Management configuration

Command Syntax

mac [hmac-md5-96 | This email address is being protected from spambots. You need JavaScript enabled to view it. | This email address is being protected from spambots. You need JavaScript enabled to view it. | hmac-ripemd160 | hmac-sha1 | hmac-sha1-96 | This email address is being protected from spambots. You need JavaScript enabled to view it. | This email address is being protected from spambots. You need JavaScript enabled to view it. | hmac-sha2-256 | This email address is being protected from spambots. You need JavaScript enabled to view it. | hmac-sha2-512 | This email address is being protected from spambots. You need JavaScript enabled to view it. | This email address is being protected from spambots. You need JavaScript enabled to view it. | This email address is being protected from spambots. You need JavaScript enabled to view it. | This email address is being protected from spambots. You need JavaScript enabled to view it. | This email address is being protected from spambots. You need JavaScript enabled to view it.]

no mac

default mac

Parameters

Example

Use the following commands to add the MAC algorithm, hmac-sha2-256, on the switch:

switch(config)# management ssh
switch(config-mgmt-ssh)# mac hmac-sha2-256
switch(config-mgmt-ssh)#

The management accounts command enters the Accounts Management configuration Mode and allows the creation of user accounts on the switch.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

Accounts Management configuration

Command Syntax

management accounts

[no | default] management accounts

Parameters

Example

Use the following commands to enter Accounts Management configuration Mode and add a user tech_support1 with a session limit of 10:

switch(config)# management accounts
switch(config-mgmt-accounts)# account tech_support1
switch(config-mgmt-acct-tech_support1)# session limit 10

The management archive command enters the Archive Management configuration Mode and allows you to manage log archives and archive space.

Command Mode

Global configuration

Archive Management configuration

Command Syntax

management archive [destination flash:] [quotapct percentage] shutdown

Parameters

Example

Use the following commands to configure the quota percentage as 50:

switch(config)# management archive
switch(config-mgmt-archive)# quotapct 50
switch(config-mgmt-archive)#

The management cli command places the switch in CLI Management configuration Mode and allows you to configure command line options.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

CLI Management configuration

Command Syntax

management cli command deprecated log

[no | default] management cli command deprecated log

Parameters

Example

Use the following commands to create a syslog message when executing a deprecated command:

switch(config)# management cli
switch(config-mgmt-cli)# command deprecated log
switch(config-mgmt-cli)#

The management client command enters the Client Management configuration Mode and configures remote applications or scripts that utilize the switch powerful eAPI (eos API) to programmatically send configuration and show commands.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

Client Management configuration

Command Syntax

management client api gnmi [group group_name member server_name] [server server_name]

[no | default] management client api gnmi

Parameters

Example

Use the following commands to add the group, gnmi_group, and the member, gnmi_server1 to the client configuration:

switch(config)# management client api gnmi
switch(config-mgmt-client-api-gnmi)# group gnmi_group member gnmi_server1
switch(config-mgmt-client-api-gnmi)#

The management data source command enters the Data Source Management configuration Mode and allows defining the rules and actions taken on specific data streams.

Command Mode

Global configuration

Data Source Management configuration

Command Syntax

management data source [disable] [sensor sensor_name [disabled | ip address ip_address port port] [traffic-policies [disabled] [field-set [ipv4 prefix source_name] [ [ipv6 prefix source_name] [ service source_name]]

Parameters

Example

Use the following commands to configure a sensor, sensor_db, with the IPv4 address, 192.168.92.157, and port 443:

switch(config)# managment data source
switch(config-mgmt-ds)# sensor sensor_db
switch(config-mgmt-ds-sensor-sensor_db)# ip 192.168.96.157 port 443
switch(config-mgmt-ds-sensor-sensor_db)#

The management defaults command enters the Defaults Management configuration Mode and configures storing secrets on the switch.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

Defaults Management configuration

Command Syntax

management defaults secret hash [md5 | scrypt | sha-512 | yescrypt]

[no | default] management defaults

Parameters

Example

Use the following commands to add MD5 as the secret hash:

switch(config)# managment defaults
        switch(config-mgmt-defaults)# secret hash md5

The management dmf command in the DANZ Monitoring Fabric (DMF) configuration Mode allows the configuration of up to two DMF controllers on the network.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

DANZ Monitoring Fabric (DMF) configuration

Command Syntax

managment dmf [disabled] [controller address ip_address1 controller address ip_address2

[no | default]> managment dmf

Parameters

Example

Use the following commands to add a DMF controller, 172.16.23.47, to the switch:

switch(config)# manangement dmf
switch(config-mgmt-dmf)# controller 172.16.21.47
switch(config-mgmt-dmf)#

The management file-systems command in the File Systems Management configuration Mode allows the configuration and management of the file system on the switch.

Command Mode

Global configuration

File Systems Management configuration

Command Syntax

management file-systems nfs [crash: directory_name] [file: directory_name] [flash: directory_name]

Parameters

Example

Use the following commands to manage the crash files:

switch(config)# management file-systems
            switch(config-mgmt-file-systems)# nfs crash:

The management http-server command enters the HTTP Management configuration Mode of the switch to allow Application Programming Interface (API) access to the switch for programmatic commands.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

HTTP Management configuration

Command Syntax

management http-server [cors allowed-origin origin server_address | all | *]

management http-server default-services

management http-server header csp frame-ancestors uri

management http-server log-level [alert | crit | debug | emerg | error | info | notice | warn]

management http-server protocol [http [localhost | port port_number]] [https [port port_number | ssl profile_name]] [unix-socket]

management http-server qos dscp dscp_value

management http-server vrf [default | vrf_name

Parameters

Example

Use the following commands to specify using the default services for the HTTP Server:

switch(config)# management http-server
switch(config-mgmt-http-server)# default-services
switch(config-mgmt-http-server)#

The management ldap command in the Global configuration mode enters the switch into LDAP Management configuration Mode and allows the configuration of an LDAP group and server. This allows the switch to authenticate and authorize users against an external Lightweight Directory Access Protocol (LDAP) server and centralizes user management.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

LDAP Management configuration

Command Syntax

management ldap [group policy policy_name group group_name rolerole_name [after | before] group_name [privilege level]

Parameters

Example

Use the following commands to add the policy, policy1, to group, ldap_group, with the role of manager, and privilege level 10:

switch(config)# management ldap
switch(config-mgmt-ldap)# group policy policy1
switch(config-mgmt-ldap-gp-policy1)# group ldap_group role manager privilege 10
switch(config-mgmt-ldap-gp-policy1)#

The management ldap server command enters the LDAP Management configuration Mode and allows the configuration of an LDAP server for authentication on the switch.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

LDAP Management configuration

Command Syntax

management ldap server [defaults [authorization group policy policy_name] [base-dn domain_name] [rdn attribute user attr_name] [search username username password password] [ssl-profile profile_name] [timeout seconds]] [host host_name portport_number vrfvrf_name]

[no | default] management ldap server

Parameters

Example

Use the following commands to use arista.com as the base Domain Name:

switch(config)# management ldap
switch(config-mgmt-ldap)# server defaults
switch(config-ldap-defaults)# base-dn arista.com
switch(config-ldap-defaults)#

The management nic profiles command enters the Network Interface Card (NIC) Profile configuration Mode and allow configuration of an interface for an internal service client such as ZTP or an internal monitoring process that needs to reach a provisioning server.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

Network Interface Card (NIC) Profile configuration

Command Syntax

management nic profiles profile profile_name [connection [ssl profile profile_name] [timeout seconds ]] [job job_name metric path path_name] [port port_number] [system auto-discovered]] [polling interval interval

[no | default] management nic profiles profile profile_name

Parameters

Example

Use the following commands to add an SSL profile, secure_1, to the NIC profile, nic_mgmt:

switch(config)# management nic profiles profile nic_mgmt
switch(config-mgmt-nic-profile-nic_mgmt)# connection ssl profile secure_1
switch(config-mgmt-nic-profile-nic_mgmt)#       

The management package command in the Package Management configuration Mode configures a remote source for downloading optional software extension packages.

Command Mode

Global configuration

Package Management configuration

Command Syntax

management package repository repo_name [description description] [type description] [url url]

Parameters

Example

Use the following commands to create a repository, prod_ext, with the URL, https://10.11.10.27/arista/extensions/:

switch(config)# management package
            switch(config-mgmt-package)# management package repository pProd-Ext type url https://10.11.10.27/arista/extensions/

The management security auto-certificate command enters the Auto-Certificate Security Management configuration Mode and automates the management and renewal of the digital certificates used by the switch for various secure management services such HTTPS for APIs.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

Auto-Certificate Security Management configuration

Command Syntax

management security auto-certificate [profile profile_name [digest [sha256 | sha384 | sha512]] [key key_name ] [ parameters [distinguished-name [common-name name] [country name [email email ] [locality locality] [organizationorganization] [organization-unit unit] [serial-number number ] [state state]] [subject-alternative-name [dns dns_name] [email email] [ip ip_address] [uri uri] ] [protocol instance instance_name] [renewal seconds seconds]]

management security auto-certificate [protocol est profile_name [connection retry [count num_retries] [interval seconds seconds]] [credentials enroll [secret [0 | 7 | 8a] secret] [token [0 | 7 | 8a] token] [username username ]] [disabled] [server [ssl profile profile_name] [url url ] [vrf vrf_name

Parameters

The management security entropy command manages the source of cryptographic entropy (randomness) and provides high quality randomness for SSH keys, SSL/TLS certificates, and random session identifiers.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

Security Management configuration

Command Syntax

management security entropy source [cpu jitter] [hardware exclusive] [haveged]

[no | default] management security entropy

Parameters

Example

Use the following command to use cpu jitter for security entropy:

switch(config)# managment security
switch(config-mgmt-security)# entropy cpu jitter
switch(config-mgmt-security)#
        

The management security network command enters the Security Management configuration mode and then configures security policies that govern the access and behavior of various management applications on the switch. It defines rules to protect the control plane from unauthorized or malicious network activity.

The [no | default] versions of the command return the feature to its default settings.

Command Mode

Global configuration

Security Management configuration

Command Syntax

management security network client protocol [ftp | http | tftp] disabled

[no | default] management security network client protocol

Parameters

Example

Use the following commands to disable FTP client traffic:

switch(config)# management security
switch(config-mgmt-security)# network client protocol ftp disabled
switch(config-mgmt-security)#

The management security ocsp command enters the Security Online Certificate Status Protocol (OCSP) configuration Mode and quickly checks the revocations status of digital certificates used by management services such as HTTP or LDAP over TLS.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

Security Management configuration

Command Syntax

management security ocsp profile profile_name [chain certificate requirement responder [all | leaf | none]] [extension nonce request [disabled | response]] [response validity-time extended-by seconds] [timeout seconds] [url url] [vrf vrf]

[no | default] management security ocsp profile profile_name

Parameters

Example

Use the following commands to add the profile, OCSP_1, with an extension nonce request of disabled

switch(config)# management security
switch(config-mgmt-security)# ocsp profile OCSP_1
switch(config-mgmt-sec-ocsp-profile-OCSP_1)# extension nonce request disabled
switch(config-mgmt-sec-ocsp-profile-OCSP_1)#

The management security password command enters the Security Management configuration Mode and configures robust password policies for all local user accounts.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

Security Management configuration

Command Syntax

management security password [encryption reversible aes-256-gcm] [encryption-key common custom key] [minimum length num_char] [policy policy_name [deny last pw_count] [ maximum repetitive num_char sequential num_char] [ minimum [changed num_char] [digits num_char] [length num_char] [lower num_char] [ num_char] [uppernum_char]]

[no | default] management security password

Parameters

Example

Use the following commands to create a password policy, ldap_access, with the minimum length of 15 characters:

switch(config)# management security
switch(config-mgmt-security)# policy ldap_access
switch(config-pwd-policy-ldap_access)# minimum length 15
switch(config-pwd-policy-ldap_access)#

The management security session command enters the Security Management configuration Mode and configures the session parameters that govern the behavior, timeouts, and security of interactive management sessions.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

Security Management configuration

Command Syntax

management security session shared-secret profile profile_name secret secret_name [0 | 7 | 8a]password [infinite] [ mm/dd/yyyy hh:mm:ss [infinite | datelocal-time] [receive-lifetime mm/dd/yyyy hh:mm:ss [infinite |date local-time]] [transmit-lifetime [infinite mm/dd/yyyy hh:mm:ss date local-time]]

Parameters

Example

Use the following commands to configure a session to use the profile, mySession, with the secret name, mySecret, and the secret, qwerty, with an infinite receive-lifetime and transmit-lifetime, with the default local-time:

switch(config)# management security
switch(config-mgmt-security)# session shared-secret profile mySession
switch(config-mgmt-sec-sh-sec-profile-mySession)# secret mySecret 0 qwerty receive-lifetime infinite 
transmit-lifetime infinite local-time
switch(config-mgmt-sec-sh-sec-profile-mySession)#

The management security signature-verification command enters the Security Management configuration Mode and apply a named SSL profile that dictates the policies for verifying the integrity of the system files related to secure TLS/SSL communications.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

Security Management configuration

Command Syntax

management security signature-verification extension ssl profile profile_name

[no | default] management security signature-verification

Parameters

Example

Use the following commands to verify SWIX signatures using the SSL profile, swix_ca:

switch(config)# management security
switch(config-mgmt-security)# signature-verification extension ssl profile swix_ca
switch(config-mgmt-security)#

The management security ssl command enters the SSL Security Management configuration mode to configure and manage the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) parameters for all secure management services on the switch.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

SSL Security Management configuration

Command Syntax

management security ssl [monitor expiry time [days | hours] [log interval time [days | hours]]

management security ssl [profile profile_name [certificate cert_name [auto-certificate cert_name] [common-name [key key_name] [username regexp regex]] [local cert_name key cert_name] [policy [expiry-date ignore] [key key_name]] [requirement extended-key-usage [hostname match] [key key_name]] [chain [certificate cert_name] [local cert_name] [policy [expiry-date ignore]] [requirement [basic-constraint ca true] [include root-ca]] [cipher [v1.0 cipher_list] [v1.3 cipher_list] [diffie-hellman parameters [ffdhe2048 | ffdhe3072 | ffdhe4096 | generated]] [dtls version [1.0 | 1.2 | add | remove]] [fips restrictions] [key-establishment-group group_names] [peer certificate [format ip-address exact] [requirement [hostname match subject-alternative-name [common-name]]] [revocation [crl [name crl_name] [policy expiry-date ignore]] [ocsp profile profile_name]] [signature algorithm alg_list] [tls versions [1.0 | 1.1 | 1.2 | 1.3 | add | remove]] [trust [certificate cert_name] [policy expiry-date ignore]] [requirement [basic-constraint ca true] [hostname fqdn]] [system]

[no | default] management security ssl monitor

[no | default] management security ssl profile

Parameters

Example

Use the following commands to set the SSL monitoring of certificates to log warning for certificate expiration to 10 days and log the warning to syslog every 8 hours:

switch(config)# management security
switch(config-mgmt-security)# ssl monitor expiry 10 days log interval 8 hours
switch(config-mgmt-security)#

The management timeout command in the Console, SSH, or Telnet configuration Mode allows the configuration of the SSH, Telnet, and Console timeout parameter.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Console configuration

SSH configuration

Telnet configuration

Command Syntax

management [console | ssh | telnet] timeout minutes warning minutes]

no management [console | ssh | telnet] timeout

default management [console | ssh | telnet]

Parameters

Example

Specify a console timeout of 30 minutes and issue a warning 5 minutes before closing the session:

switch(config)# management console
switch(config-mgmt-console)# timeout 30 warning 25

The qos command in the SSH Management configuration Mode applies the Differentiated Services Code Point (DSCP) markings to SSH traffic and ensures prioritizing packets on the network.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

SSH Management configuration

Command Syntax

qos dscp dscp_value

no qos dscp

default qos dscp

Parameters

Example

Use the following commands to set the QoS DSCP value to 16 (Network Management) on the switch:

switch(config)# management ssh
switch(config-mgmt-ssh)# qos dscp 16
switch(config-mgmt-ssh)#

The rekey command in the SSH Management configuration Mode forces the SSH session to renegotiate new symmetric encryption keys after meeting a specific threshold.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

SSH Management configuration

Command Syntax

rekey [frequency data_amount [gbytes | kbytes | mbytes]] [interval time [days | hours | minutes | seconds | weeks]]

no qos dscp

default qos dscp

Parameters

Examples

Use the following commands to set the rekey frequency to 10 Gigabytes on the switch:

switch(config)# management ssh
switch(config-mgmt-ssh)# rekey frequency 10 gbytes
            switch(config-mgmt-ssh)#

Use the following commands to set the rekey interval to 8 hours on the switch:

switch(config)# management ssh
switch(config-mgmt-ssh)# rekey interval 8 hours
switch(config-mgmt-ssh)#

Use the reset system storage secure command to trigger the secure erase mechanism. Secure erase is a command that deliberately, permanently, and irreversibly removes and destroys the data stored on a storage device, rendering that data unrecoverable.

Command Mode

EXEC

Command Syntax

reset system storage secure

The server-port command in the SSH Management configuration Mode defines the TCP port or ports that SSH servers listen for incoming connections.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

SSH Management configuration

Command Syntax

server-port port_number

no server-port

default server-port

Parameters

Example

Use the following commands to set the port number to 80 on the switch:

switch(config)# management ssh
switch(config-mgmt-ssh)# server-port 80
switch(config-mgmt-ssh)#

The service configuration access-list command configures how the switch compiles, stages, or validates access lists when the lists receive modifications or pushed to the hardware ASICs.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

Command Syntax

service configuration access-list symbols

no service configuration access-list symbols

default service configuration access-list symbols

Parameters

Example

When the switch has symbols enabled, and you configure an access list with port 80, the display output for an access list has the following output:

switch(config-acl-TEST)# permit tcp any any eq 80

switch# show running-config section TEST
ip access-list TEST
    10 permit tcp any any eq www

When the switch has symbols disabled, the output removes human-readable text and all entries display literal numeric values:

switch# show running-config section TEST
ip access-list TEST
   10 permit tcp any any eq 80

The service configuration checkpoint command configures the number of system configuration checkpoints on the switch. By default, eos tracks and retains a maximum of 20 system configuration checkpoints.

If you make frequent configuration changes or want a deeper historical safety net of snapshots, you can increase or decrease the retention limits.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

Command Syntax

service configuration checkpoint max saved max_number

no service configuration checkpoint max

default service configuration checkpoint max

Parameters

Example

Use the following command to increase the number of saved checkpoints to 50:

switch(config)# service configuration checkpoint max saved 50
switch(config)#

To display the new limit, use the show configuration checkpoints command:

switch# show configuration checkpoints
Maximum number of checkpoints: 50
Hash    Name  Date                 User 
------- ---- -------------------- -----
b8ad7c5      2025-01-06 23:11:28  eos  
04fc850      2025-03-25 00:07:47  eos  
a4d90e4      2025-03-25 00:07:48  admin
62e76ba      2025-03-25 01:36:30  eos  
c812e22      2025-03-25 01:36:32  admin
932c042      2025-03-25 01:37:06  admin
dfbb566      2025-04-04 05:56:06  eos  
e09ea3a      2025-04-04 05:56:07  admin
263fa99      2025-04-24 15:51:25  eos  
3cfd199      2025-04-24 15:51:25  admin
278367f      2025-05-22 13:28:27  eos  
f25f264      2025-05-22 13:28:28  admin
ce72f7f      2025-06-10 11:36:27  eos  
889fe0e      2025-06-10 11:36:29  admin

If you decrease the saved checkpoint limit from your current limit, eos purges the extra saved checkpoint files to meet your new limit.

The service configuration session command manages the system limits for configuration sessions. configuration sessions allow you to stage, review, and test commands in a temporary workspace before committing them to the active running configuration. Use this command to configure the number of saved sessions in the switch memory.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

Command Syntax

service configuration session [commit [merge [save startup-config] [timer default hh:mm:ss interactive

no service configuration session

default service configuration session

Parameters

Example

Use the following command to configure a default timer of 1 hour apply it to the current running configuration:

switch(config)# service configuration session commit timer default 01:00:00 interactive
switch(config)#

The service configuration session logging command configures the switch to print the results, verification checks, or error logs of the session to the screen as the switch processes a commit.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

Command Syntax

service configuration session logging terminal

no service configuration session logging terminal

default service configuration session logging terminal

Parameters

Example

Use the following command to enable the feature:

switch(config)# service configuration session logging terminal
switch(config)#

The service configuration session max command sets the retention and concurrency limits for system configuration sessions. Configure the limit for pending and completed sessions.

Command Mode

Global configuration

Command Syntax

service configuration session max completed num_sessions pending num_sessions

no service configuration session max

default service configuration session max

Parameters

Examples

Use the following command to increase the number of pending sessions from 1 to 5:

switch(config)# service configuration session max pending 5
switch(config)#

Use the following command to increase the number of completed sessions from 1 to 15:

switch(config)# service configuration session max completed 15
switch(config)#

To display the configured maximums, use the show configuration sessions command:

switch# show configuration sessions
Maximum number of completed sessions: 50
Maximum number of pending sessions: 5

Name        State           User       Terminal    Time 
----------- --------------- ---------- ----------- -------------------
BGP_PEER    pending         admin      vty3        2026-04-28 11:45:12
OSPF_TUNE   completed       automation vty1        2026-04-27 09:12:45

The service configuration terminal command disables standard live configuration mode and dictates the use of configuration sessions instead. Before disabling the terminal feature, administrators can make immediate changes to the running configuration and alter the forwarding plane of the switch. When disabled, administrators must create configuration sessions to build a staged workplace to make changes and then explicitly use commit to add the configuration changes to the switch.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

Command Syntax

service configuration terminal disabled

no service configuration terminal

default service configuration terminal

Parameters

Examples

Use the following command to disable the standard terminal behavior on the switch:

switch(config)# service configuration terminal disabled
switch(config)#

The service configuration verification command dictates if the switch pre-validates the Quality of Service (QoS) configuration against the hardware physical capabilities before allowing you to successfully commit the change.

The physical silicon on the switch has deep ties to the QoS capabilities. When you create QoS policies, such as policy maps, class maps, or port shaping rates, the CLI may accept the commands, but the underlying hardware might not have enough TCAM space, hardware queues, or buffer memory to support it.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

Command Syntax

service configuration verification qos

no service configuration verification qos

default service configuration verification qos

Parameters

Examples

Use the following command to enable the strict QoS verification on the switch:

switch(config)# service configuration verification qos
switch(config)#

The service interface inactive command forces system level visibility and default state toggles to expose subordinate lanes.

By default, if you configure a port for breakout mode but have not physically plugged in the cable yet, eos suppresses the inactive subordinate lanes.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

Command Syntax

service interface inactive expose [port-id allocation disabled]

no service interface inactive

default service interface inactive

Parameters

Examples

Use the following command to expose subordinate lanes in the CLI:

switch(config)# service interface inactive expose
switch(config)#

Use the following command to free up unused IDs on the switch:

switch(config)# service interface inactive port-id allocation disabled
switch(config)#

The service interface shutdown command introduces a global, system-wide buffer window between entering a shutdown command and physically shutting down the link. During the delay, the physical link stays alive just long enough for the control plane to warn the connected neighbor of the intentional shutdown.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

Command Syntax

service interface shutdown delay milliseconds

no service interface shutdown delay

default service interface shutdown delay

Parameters

Example

Use the following command to configure a shutdown delay of 10 milliseconds:

switch(config)# service interface shutdown delay 10
switch(config)#

The service interface unconnected command exposes ethernet interfaces that do not physically exist on the switch, but instead exist as internally hardwired loopback ports. In eos, the interfaces have the designation Unconnected ethernet (Ue) ports and used by the hardware ASIC for packet recirculation. By default, eos does not display these interfaces, but in some cases, exposing them may assist with troubleshooting hardware recirculation and identify interfaces dropping packets on the switch.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

Command Syntax

service interface unconnected expose

no service interface shutdown delay

default service interface shutdown delay

Parameters

Example

Use the following command to expose unconnected interfaces:

switch(config)# service interface unconnected expose
switch(config)#

Use the show interfaces status command to display the interface status:

switch# show interfaces status
Port       Name        Status       Vlan     Duplex Speed  Type
...
Et48                   notconnect   1        auto   auto   10GBASE-CR
Ue1                    connected    1        full   10G    Unconnected
Ue2                    connected    1        full   10G    Unconnected

The service routing configuration command dictates the backend architecture of the routing daemon and determines how the switch parser compiles control-plane logic.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global configuration

Command Syntax

service routing configuration[bgp no-equals-default] [route-map [no-set-community explicit-members] [set-operations [merged | sequential]

no service routing configuration

default service routing configuration

Parameters

Examples

Use the following command to remove BGP default behavior from the running configuration output:

switch(config)# service routing configuration bgp no-equals-default
switch(config)#

The service routing protocols command dictates the underlying software architecture that the switch uses to process all Layer 3 routing protocols.

Command Mode

Global configuration

Command Syntax

service routing protocols model multi-agent

default routing protocols

Parameters

Example

Use the following command to enable multi-agent processing for routing protocols:

switch(config)# service routing protocols model multi-agent
switch(config)#

The service running-config command manages how the switch generates, processes, and displays the running configuration file. Executing the running configuration file on switches with very large configurations impacts the switch performance by spiking the CPU usage. Use this command to manage the running configuration file.

The [no | default] versions of the command cause the switch to dynamically compile the running configuration file for every request.

Command Mode

Global configuration

Command Syntax

service running-config [cache disabled] [copy use-config-session] [timestamp]

no service running-config

default service running-config

Parameters

Example

Use the following command to enable caching of the running-config file:

switch(config)# service running-config cache
switch(config)#

The session-limit command in the Telnet Management configuration Mode configures the maximum number of Telnet sessions from a single host and the maximum number of sessions.

The no version of the command removes the configuration from the running-config.

Command Mode

Telnet Management configuration

Command Syntax

session-limit num_sessions[per-host num_sessions]

no session-limit

default session

Parameters

Example

Use the following commands to configure a global Telnet sessions limit of 25:

switch(config)# managment telnet
switch(config-mgmt-telnet)# session-limit 25
switch(config-mgmt-telnet)#

The show configuration checkpoints command displays a high level table of all saved configuration snapshots currently stored on the switch.

Command Mode

EXEC

Command Syntax

show configuration checkpoints

Example

Use the following command to display all saved configuration snapshots:

switch# show configuration checkpoints
Maximum number of checkpoints: 20
Filename                        Date                 User
------------------------------- -------------------- ------
ckp-20231024-0                  2023-10-24 14:00:01  admin
ckp-20231024-1                  2023-10-24 15:30:22  admin
PRE_BGP_CHANGE                  2023-10-25 09:15:00  automation

The output displays the following information:

• Maximum number of checkpoints - Indicates the current system limit for the number of historical snapshots allowed for retention in memory. By default, eos limits 20 snapshots, but you can adjust it using the command service configuration checkpoint max. If the switch reaches the limit of snapshots, eos begins automatically purging the oldest checkpoints using a First-In, First-Out (FIFO) method.
• Filename - Displays the name of the checkpoint file stored in the flash memory.
  • Auto-generated checkpoints - If the switch creates the checkpoint automatically, for example, during a configuration session commit or an automated rollback, the file uses a standard naming convention of ckp-YYYYMMDD-X
  • Manual checkpoints - If an administrator or automated script generated the snapshot, eos uses a custom string as the filename.
• Date - The exact system timestamp in the format YYYY-MM-DD HH:MM:SS when created.
• User - Identifies the specific username or script name that executed the command or triggered the automated process to create the snapshot.

The show configuration sessions command displays information about configuration sessions created on the switch. If you rely on configuration sessions instead of live terminal configuration, use the output to manage the lifecycle of your staged configuration workspaces.

Command Mode

EXEC

Command Syntax

show configuration sessions [detail]

Example

Use the following command to display all saved configuration snapshots:

switch# show configuration sessions
Maximum number of completed sessions: 10
Maximum number of pending sessions: 5

  Name               State           User       Terminal    
  ------------------ --------------- ---------- ----------- 
  ADD_BGP_PEER       pending         admin      vty1        
  vlan-changes       completed       admin      vty1        
  ansible_10928      completed       automation eAPI        
  sess-20260430-1    aborted         jdoe       vty3

The shutdown command in the SSH or Telnet Management configuration Mode disables the SSH or Telnet service on the switch.

Command Mode

SSH Management configuration

Telnet Management configuration

Command Syntax

shutdown

Parameters

Example

Use the following commands to disable the SSH service.

switch(config)# management ssh
switch(config-mgmt-ssh)# shutdown
switch(config-mgmt-ssh)#

The shutdown command in the SSH Management configuration Mode and SSH VRF configuration Mode shuts down the SSH service on the switch.

Command Mode

SSH Management configuration

SSH VRF configuration

Command Syntax

shutdown

Parameters

Example

Use the following commands to shut down the SSH service on the switch:

switch(config)# management ssh
switch(config-mgmt-ssh)# shutdown
switch(config-mgmt-ssh)#

Use the following commands to shut down the SSH service for VRF bluengreen on the switch:

switch(config)# management ssh
switch(config-mgmt-ssh)# vrf bluengreen
switch(config-mgmt-ssh-vrf-bluengreen)# shutdown

The timeout command in the SSH, Telnet, or Console Management configuration Mode specifies the maximum length of a management session regardless of activity during the session. It prevents sessions from remaining open indefinitely on the switch and provides a separate behavior from the parameter idle-timeout. Both timers operate independently and the timer with the shortest session time ends the session.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Console Management configuration

SSH Management configuration

Telnet Management configuration

Command Syntax

management [console | ssh | telnet]timeout timeout_period warning warning_time

[no | default] management [console | ssh | telnet] timeout

Parameters

Examples

Use the following commands to set the console timeout to 60 minutes.

switch(config)# management console
switch(config-mgmt-console)# timeout 60
switch(config-mgmt-console)#

Use the following commands to set the SSH timeout to 60 minutes.

switch(config)# management ssh
switch(config-mgmt-ssh)# timeout 60
switch(config-mgmt-ssh)#

Use the following commands to set the Telnet timeout to 60 minutes.

switch(config)# management telnet
switch(config-mgmt-telnet)# timeout 60
switch(config-mgmt-telnet)#

The trusted-ca command in the SSH Management configuration Mode allows the switch to validate the identity of connections using standard X.509 PKI certificates.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

SSH Management configuration

Command Syntax

trusted-ca key public cert_filename

no trusted-ca

default trusted-ca

Parameters

Example

Use the following commands to add the CA certificate, MyCert, on the switch:

switch(config)# management ssh
switch(config-mgmt-ssh)# trusted-ca key public MyCert
switch(config-mgmt-ssh)#

The user-keys command in the SSH Management configuration Mode globally manages external files for user authentication and security.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

SSH Management configuration

Command Syntax

user-keys revoke-list list_name

no user-keys revoke-list

default user-keys revoke-list

Parameters

Example

Use the following commands to add the revoked list, NoAccess, on the switch:

switch(config)# management ssh
switch(config-mgmt-ssh)# user-keys revoke-list NoAccess
switch(config-mgmt-ssh)#

The username ssh-key command in the SSH Management configuration Mode enters the Username configuration Mode and allows the application of specific SSH key to a user when they connect to SSH.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

SSH Management configuration

SSH Username configuration

SSH Authorized Key configuration

Command Syntax

username username [ssh-key key_name] [option [agent-forwarding | cert-authority | command | environment | expiry-time | from | no-agent-forwarding | no-port-forwarding | no-pty | no-touch-required | no-user-rc | no-x11-forwarding | permit-listen | permit-open | port-forwarding | principals | pty | restrict | tunnel | user-rc | verify-required | x11-forwarding]] [public-key ssh_keystring

no username ssh-key

default username ssh-key

Parameters

Example

Use the following commands to apply the SSH key to a user admin on the switch:

switch(config)# management ssh
switch(config-mgmt-ssh)# username admin
switch(config-mgmt-ssh-user-admin)# ssh-key mykey
switch(config-mgmt-ssh-user-admin-mykey)#

The username ssh-principal command in the SSH Management configuration Mode enters the Username configuration Mode and defines which principals in a presented SSH certificate can login as the local user.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

SSH Management configuration

SSH Username configuration

SSH Authorized Principal configuration

Command Syntax

username username [ssh-principal key_name] [option [agent-forwarding | cert-authority | command | environment | expiry-time | from | no-agent-forwarding | no-port-forwarding | no-pty | no-touch-required | no-user-rc | no-x11-forwarding | permit-listen | permit-open | port-forwarding | principals | pty | restrict | tunnel | user-rc | verify-required | x11-forwarding]]

no username ssh-principal

default username ssh-principal

Parameters

Example

Use the following commands to add the SSH principal admin on the switch:

switch(config)# management ssh
switch(config-mgmt-ssh)# username admin
switch(config-mgmt-ssh-user-admin)# ssh-principal myprincipal
switch(config-mgmt-ssh-user-admin-myprincipal)#

The username tcp command in the SSH Management configuration Mode enters the SSH Username configuration Mode and controls if a specific user has permission to use the switch as a jump host or a tunnel endpoint using SSH Port Forwarding. It allows a user to tunnel a TCP connection through the encrypted SSH session and access devices that may otherwise be inaccessible. eos disables TCP forwarding by default.

The [no] version of the command disables the feature and removes the configuration from the running-config.

Command Mode

SSH Management configuration

SSH Username configuration

Command Syntax

username username tcp forwarding [all | local | remote]

no username tcp forwarding

default username tcp forwarding

Parameters

Example

Use the following commands for the user, admin, to allow TCP forwarding for local and remote SSH servers on the switch:

switch(config)# management ssh
switch(config-mgmt-ssh)# username admin
switch(config-mgmt-ssh-user-admin)# tcp forwarding all

The verify command in the SSH Management configuration Mode implements the SSH Fingerprint (SSHFP) verification mechanism and allows the switch to use DNS records to validate the identify of a remote server.

The [no] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

SSH Management configuration

Command Syntax

verify dns

no verify dns

Parameters

Example

Use the following commands to implement SSH Fingerprint verification on the switch:

switch(config)# management ssh
switch(config-mgmt-ssh)# verify dns
switch(config-mgmt-ssh)#

The vrf command in the SSH or Telnet Management configuration Mode applies the SSH or Telnet service to a specific VRF or the default VRF on the switch.

Command Mode

SSH Management configuration

Telnet Management configuration

Command Syntax

vrf [default | vrf_name]

Parameters

Example

Use the following commands to apply the SSH service to the VRF, bluengreen:

switch(config)# management ssh
switch(config-mgmt-ssh)# vrf bluengreen
switch(config-mgmt-ssh)#

The vrf known-hosts command in the SSH VRF configuration Mode allows you to define a specific trusted host key file for each routing domain. By assigning a unique known hosts file to a VRF, the switch trusts that only specific identities of servers within that network segment.

The [no] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

SSH VRF configuration

Command Syntax

known-hosts hostname_ip [dsa | ecdsa-nistp256 | ecdsa-nistp521 | ed25519 | rsa] base64_string

no vrf known-hosts

Parameters

Example

Use the following commands to add the host, 172.16.21.23, and the algorithm, dsa, to the VRF, bluengreen, on the switch:

switch(config)# management ssh
switch(config-mgmt-ssh)# vrf bluengreen
switch(config-mgmt-ssh-vrf-bluengreen)# known-hosts 172.16.1.23 dsa SGVsbG8gV29ybGQh
switch(config-mgmt-ssh-vrf-bluengreen)#

The vrf command in the SSH Management configuration Mode enters the SSH VRF configuration mode and allows the configuration of specific VRF parameters.

The [no] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

SSH Management configuration

SSH VRF configuration

Command Syntax

vrf [default | vrf_name] [tunnel vrf_name]

no vrf

Parameters

Example

Use the following commands to enter the SSH VRF configuration Mode for the VRF, bluengreen, on the switch:

switch(config)# management ssh
switch(config-mgmt-ssh)# vrf bluengreen
switch(config-mgmt-ssh-vrf-bluengreen)#