The commit timer command can automatically roll back changes performed during a configuration session if you haven't confirmed them within a preset time interval. This feature can prevent a user from committing configuration changes that could cause a network disruption. The no commit timer command deletes the session.

Command Mode

Configure Session Configuration Mode

Command Syntax

commit timer hh:mm:ss

Parameters

hh:mm:ss - Specify the time interval for the commit session.

Example

switch(config-s-MySession)# commit timer 01:00:00
switch#

The management accounts command enters the Accounts Management Configuration Mode and allows the creation of user accounts on the switch.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global Configuration

Accounts Management Configuration

Command Syntax

management accounts

[no | default] management accounts

Parameters

Example

Use the following commands to enter Accounts Management Configuration Mode and add a user tech_support1 with a session limit of 10:

switch(config)# management accounts
switch(config-mgmt-accounts)# account tech_support1
switch(config-mgmt-acct-tech_support1)# session limit 10

The management archive command enters the Archive Management Configuration Mode and allows you to manage log archives and archive space.

Command Mode

Global Configuration

Archive Management Configuration

Command Syntax

management archive [destination flash:] [quotapct percentage] shutdown

Parameters

Example

Use the following commands to configure the quota percentage as 50:

switch(config)# management archive
switch(config-mgmt-archive)# quotapct 50
switch(config-mgmt-archive)#

The management cli command places the switch in CLI Management Configuration Mode and allows you to configure command line options.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global Configuration

CLI Management Configuration

Command Syntax

management cli command deprecated log

[no | default] management cli command deprecated log

Parameters

Example

Use the following commands to create a syslog message when executing a deprecated command:

switch(config)# management cli
switch(config-mgmt-cli)# command deprecated log
switch(config-mgmt-cli)#

The management client command enters the Client Management Configuration Mode and configures remote applications or scripts that utilize the switch powerful eAPI (EOS API) to programmatically send configuration and show commands.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global Configuration

Client Management Configuration

Command Syntax

management client api gnmi [group group_name member server_name] [server server_name]

[no | default] management client api gnmi

Parameters

Example

Use the following commands to add the group, gnmi_group, and the member, gnmi_server1 to the client configuration:

switch(config)# management client api gnmi
switch(config-mgmt-client-api-gnmi)# group gnmi_group member gnmi_server1
switch(config-mgmt-client-api-gnmi)#

The management data source command enters the Data Source Management Configuration Mode and allows defining the rules and actions taken on specific data streams.

Command Mode

Global Configuration

Data Source Management Configuration

Command Syntax

management data source [disable] [sensor sensor_name [disabled | ip address ip_address port port] [traffic-policies [disabled] [field-set [ipv4 prefix source_name] [ [ipv6 prefix source_name] [ service source_name]]

Parameters

Example

Use the following commands to configure a sensor, sensor_db, with the IPv4 address, 192.168.92.157, and port 443:

switch(config)# managment data source
switch(config-mgmt-ds)# sensor sensor_db
switch(config-mgmt-ds-sensor-sensor_db)# ip 192.168.96.157 port 443
switch(config-mgmt-ds-sensor-sensor_db)#

The management defaults command enters the Defaults Management Configuration Mode and configures storing secrets on the switch.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global Configuration

Defaults Management Configuration

Command Syntax

management defaults secret hash [md5 | scrypt | sha-512 | yescrypt]

[no | default] management defaults

Parameters

Example

Use the following commands to add MD5 as the secret hash:

switch(config)# managment defaults
        switch(config-mgmt-defaults)# secret hash md5

The management dmf command in the DANZ Monitoring Fabric (DMF) Configuration Mode allows the configuration of up to two DMF controllers on the network.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global Configuration

DANZ Monitoring Fabric (DMF) Configuration

Command Syntax

managment dmf [disabled] [controller address ip_address1 controller address ip_address2

[no | default]> managment dmf

Parameters

Example

Use the following commands to add a DMF controller, 172.16.23.47, to the switch:

switch(config)# manangement dmf
switch(config-mgmt-dmf)# controller 172.16.21.47
switch(config-mgmt-dmf)#

The management file-systems command in the File Systems Management Configuration Mode allows the configuration and management of the file system on the switch.

Command Mode

Global Configuration

File Systems Management Configuration

Command Syntax

management file-systems nfs [crash: directory_name] [file: directory_name] [flash: directory_name]

Parameters

Example

Use the following commands to manage the crash files:

switch(config)# management file-systems
            switch(config-mgmt-file-systems)# nfs crash:

The management http-server command enters the HTTP Management Configuration Mode of the switch to allow Application Programming Interface (API) access to the switch for programmatic commands.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global Configuration

HTTP Management Configuration

Command Syntax

management http-server [cors allowed-origin origin server_address | all | *]

management http-server default-services

management http-server header csp frame-ancestors uri

management http-server log-level [alert | crit | debug | emerg | error | info | notice | warn]

management http-server protocol [http [localhost | port port_number]] [https [port port_number | ssl profile_name]] [unix-socket]

management http-server qos dscp dscp_value

management http-server vrf [default | vrf_name

Parameters

Example

Use the following commands to specify using the default services for the HTTP Server:

switch(config)# management http-server
switch(config-mgmt-http-server)# default-services
switch(config-mgmt-http-server)#

The management ldap command in the Global Configuration mode enters the switch into LDAP Management Configuration Mode and allows the configuration of an LDAP group and server. This allows the switch to authenticate and authorize users against an external Lightweight Directory Access Protocol (LDAP) server and centralizes user management.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global Configuration

LDAP Management Configuration

Command Syntax

management ldap [group policy policy_name group group_name rolerole_name [after | before] group_name [privilege level]

Parameters

Example

Use the following commands to add the policy, policy1, to group, ldap_group, with the role of manager, and privilege level 10:

switch(config)# management ldap
switch(config-mgmt-ldap)# group policy policy1
switch(config-mgmt-ldap-gp-policy1)# group ldap_group role manager privilege 10
switch(config-mgmt-ldap-gp-policy1)#

The management ldap server command enters the LDAP Management Configuration Mode and allows the configuration of an LDAP server for authentication on the switch.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global Configuration

LDAP Management Configuration

Command Syntax

management ldap server [defaults [authorization group policy policy_name] [base-dn domain_name] [rdn attribute user attr_name] [search username username password password] [ssl-profile profile_name] [timeout seconds]] [host host_name portport_number vrfvrf_name]

[no | default] management ldap server

Parameters

Example

Use the following commands to use arista.com as the base Domain Name:

switch(config)# management ldap
switch(config-mgmt-ldap)# server defaults
switch(config-ldap-defaults)# base-dn arista.com
switch(config-ldap-defaults)#

The management nic profiles command enters the Network Interface Card (NIC) Profile Configuration Mode and allow configuration of an interface for an internal service client such as ZTP or an internal monitoring process that needs to reach a provisioning server.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global Configuration

Network Interface Card (NIC) Profile Configuration

Command Syntax

management nic profiles profile profile_name [connection [ssl profile profile_name] [timeout seconds ]] [job job_name metric path path_name] [port port_number] [system auto-discovered]] [polling interval interval

[no | default] management nic profiles profile profile_name

Parameters

Example

Use the following commands to add an SSL profile, secure_1, to the NIC profile, nic_mgmt:

switch(config)# management nic profiles profile nic_mgmt
switch(config-mgmt-nic-profile-nic_mgmt)# connection ssl profile secure_1
switch(config-mgmt-nic-profile-nic_mgmt)#       

The management package command in the Package Management Configuration Mode configures a remote source for downloading optional software extension packages.

Command Mode

Global Configuration

Package Management Configuration

Command Syntax

management package repository repo_name [description description] [type description] [url url]

Parameters

Example

Use the following commands to create a repository, prod_ext, with the URL, https://10.11.10.27/arista/extensions/:

switch(config)# management package
            switch(config-mgmt-package)# management package repository pProd-Ext type url https://10.11.10.27/arista/extensions/

The management security auto-certificate command enters the Auto-Certificate Security Management Configuration Mode and automates the management and renewal of the digital certificates used by the switch for various secure management services such HTTPS for APIs.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global Configuration

Auto-Certificate Security Management Configuration

Command Syntax

management security auto-certificate [profile profile_name [digest [sha256 | sha384 | sha512]] [key key_name ] [ parameters [distinguished-name [common-name name] [country name [email email ] [locality locality] [organizationorganization] [organization-unit unit] [serial-number number ] [state state]] [subject-alternative-name [dns dns_name] [email email] [ip ip_address] [uri uri] ] [protocol instance instance_name] [renewal seconds seconds]]

management security auto-certificate [protocol est profile_name [connection retry [count num_retries] [interval seconds seconds]] [credentials enroll [secret [0 | 7 | 8a] secret] [token [0 | 7 | 8a] token] [username username ]] [disabled] [server [ssl profile profile_name] [url url ] [vrf vrf_name

Parameters

The management security entropy command manages the source of cryptographic entropy (randomness) and provides high quality randomness for SSH keys, SSL/TLS certificates, and random session identifiers.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global Configuration

Security Management Configuration

Command Syntax

management security entropy source [cpu jitter] [hardware exclusive] [haveged]

[no | default] management security entropy

Parameters

Example

Use the following command to use cpu jitter for security entropy:

switch(config)# managment security
switch(config-mgmt-security)# entropy cpu jitter
switch(config-mgmt-security)#
        

The management security network command enters the Security Management Configuration mode and then configures security policies that govern the access and behavior of various management applications on the switch. It defines rules to protect the control plane from unauthorized or malicious network activity.

The [no | default] versions of the command return the feature to its default settings.

Command Mode

Global Configuration

Security Management Configuration

Command Syntax

management security network client protocol [ftp | http | tftp] disabled

[no | default] management security network client protocol

Parameters

Example

Use the following commands to disable FTP client traffic:

switch(config)# management security
switch(config-mgmt-security)# network client protocol ftp disabled
switch(config-mgmt-security)#

The management security ocsp command enters the Security Online Certificate Status Protocol (OCSP) Configuration Mode and quickly checks the revocations status of digital certificates used by management services such as HTTP or LDAP over TLS.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global Configuration

Security Management Configuration

Command Syntax

management security ocsp profile profile_name [chain certificate requirement responder [all | leaf | none]] [extension nonce request [disabled | response]] [response validity-time extended-by seconds] [timeout seconds] [url url] [vrf vrf]

[no | default] management security ocsp profile profile_name

Parameters

Example

Use the following commands to add the profile, OCSP_1, with an extension nonce request of disabled

switch(config)# management security
switch(config-mgmt-security)# ocsp profile OCSP_1
switch(config-mgmt-sec-ocsp-profile-OCSP_1)# extension nonce request disabled
switch(config-mgmt-sec-ocsp-profile-OCSP_1)#

The management security password command enters the Security Management Configuration Mode and configures robust password policies for all local user accounts.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global Configuration

Security Management Configuration

Command Syntax

management security password [encryption reversible aes-256-gcm] [encryption-key common custom key] [minimum length num_char] [policy policy_name [deny last pw_count] [ maximum repetitive num_char sequential num_char] [ minimum [changed num_char] [digits num_char] [length num_char] [lower num_char] [ num_char] [uppernum_char]]

[no | default] management security password

Parameters

Example

Use the following commands to create a password policy, ldap_access, with the minimum length of 15 characters:

switch(config)# management security
switch(config-mgmt-security)# policy ldap_access
switch(config-pwd-policy-ldap_access)# minimum length 15
switch(config-pwd-policy-ldap_access)#

The management security session command enters the Security Management Configuration Mode and configures the session parameters that govern the behavior, timeouts, and security of interactive management sessions.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global Configuration

Security Management Configuration

Command Syntax

management security session shared-secret profile profile_name secret secret_name [0 | 7 | 8a]password [infinite] [ mm/dd/yyyy hh:mm:ss [infinite | datelocal-time] [receive-lifetime mm/dd/yyyy hh:mm:ss [infinite |date local-time]] [transmit-lifetime [infinite mm/dd/yyyy hh:mm:ss date local-time]]

Parameters

Example

Use the following commands to configure a session to use the profile, mySession, with the secret name, mySecret, and the secret, qwerty, with an infinite receive-lifetime and transmit-lifetime, with the default local-time:

switch(config)# management security
switch(config-mgmt-security)# session shared-secret profile mySession
switch(config-mgmt-sec-sh-sec-profile-mySession)# secret mySecret 0 qwerty receive-lifetime infinite 
transmit-lifetime infinite local-time
switch(config-mgmt-sec-sh-sec-profile-mySession)#

The management security signature-verification command enters the Security Management Configuration Mode and apply a named SSL profile that dictates the policies for verifying the integrity of the system files related to secure TLS/SSL communications.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global Configuration

Security Management Configuration

Command Syntax

management security signature-verification extension ssl profile profile_name

[no | default] management security signature-verification

Parameters

Example

Use the following commands to verify SWIX signatures using the SSL profile, swix_ca:

switch(config)# management security
switch(config-mgmt-security)# signature-verification extension ssl profile swix_ca
switch(config-mgmt-security)#

The management security ssl command enters the SSL Security Management Configuration mode to configure and manage the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) parameters for all secure management services on the switch.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Global Configuration

SSL Security Management Configuration

Command Syntax

management security ssl [monitor expiry time [days | hours] [log interval time [days | hours]]

management security ssl [profile profile_name [certificate cert_name [auto-certificate cert_name] [common-name [key key_name] [username regexp regex]] [local cert_name key cert_name] [policy [expiry-date ignore] [key key_name]] [requirement extended-key-usage [hostname match] [key key_name]] [chain [certificate cert_name] [local cert_name] [policy [expiry-date ignore]] [requirement [basic-constraint ca true] [include root-ca]] [cipher [v1.0 cipher_list] [v1.3 cipher_list] [diffie-hellman parameters [ffdhe2048 | ffdhe3072 | ffdhe4096 | generated]] [dtls version [1.0 | 1.2 | add | remove]] [fips restrictions] [key-establishment-group group_names] [peer certificate [format ip-address exact] [requirement [hostname match subject-alternative-name [common-name]]] [revocation [crl [name crl_name] [policy expiry-date ignore]] [ocsp profile profile_name]] [signature algorithm alg_list] [tls versions [1.0 | 1.1 | 1.2 | 1.3 | add | remove]] [trust [certificate cert_name] [policy expiry-date ignore]] [requirement [basic-constraint ca true] [hostname fqdn]] [system]

[no | default] management security ssl monitor

[no | default] management security ssl profile

Parameters

Example

Use the following commands to set the SSL monitoring of certificates to log warning for certificate expiration to 10 days and log the warning to syslog every 8 hours:

switch(config)# management security
switch(config-mgmt-security)# ssl monitor expiry 10 days log interval 8 hours
switch(config-mgmt-security)#

Use the reset system storage secure command to trigger the secure erase mechanism. Secure erase is a command that deliberately, permanently, and irreversibly removes and destroys the data stored on a storage device, rendering that data unrecoverable.

Command Mode

EXEC

Command Syntax

reset system storage secure

The timeout command in the SSH, Telnet, or Console Management Configuration Mode specifies the maximum length of a management session regardless of activity during the session. It prevents sessions from remaining open indefinitely on the switch and provides a separate behavior from the parameter idle-timeout. Both timers operate independently and the timer with the shortest session time ends the session.

The [no | default] versions of the command disable the feature and remove the configuration from the running-config.

Command Mode

Console Management Configuration

SSH Management Configuration

Telnet Management Configuration

Command Syntax

management [console | ssh | telnet]timeout timeout_period

[no | default] management [console | ssh | telnet] timeout

Parameters

Examples

Use the following commands to set the console timeout to 60 minutes.

switch(config)# management console
switch(config-mgmt-console)# timeout 60

Use the following commands to set the SSH timeout to 60 minutes.

switch(config)# management ssh
switch(config-mgmt-ssh)# timeout 60

Use the following commands to set the Telnet timeout to 60 minutes.

switch(config)# management telnet
switch(config-mgmt-telnet)# timeout 60