| Home Prev |  cOS Stream 4.00.05 CLI Reference Guide
|
Next |
|---|
Handles configuration/system backup.
Description
Backup, restore, or revert the status of current system.There are different types of backups: partial system backups, which only stores system configuration data, and complete system backup, which stores both the system software and configuration data. The configuration and/or software data is stored to a single backup file on the device as they are created. Backup files may also be transferred to the device remotely.
Using the restore command option, backup files can be used to restore the configuration and/or software from a previously backed up state. Following a backup restore, it is possible to revert to the previous configuration and/or software using the revert command option. Note that performing a complete system restore or complete system revert will require the system to be restarted.
Performing a factory reset will reset the configuration and/or software to the factory defaults of the device. Please consult the administrators guide before using this option.
Example 2.18. List all backup files
Device:/> backup (command output) Device:/> backup -list (command output)
Example 2.19. Perform a partial (configuration only) system backup and restore
Device:/> backup -create configuration_backup.bkp Backup file "configuration_backup.bkp" created (command output) Device:/> backup -restore configuration_backup.bkp (command output) Backup restore successful using "configuration_backup.bkp" Changes must be activated and committed to be applied
Example 2.20. Perform a complete system backup and restore
Device:/> backup -create complete_backup.bkp -system Creating full system backup. This may take some time... Backup file "complete_backup.bkp" created (command output) Device:/> backup -restore complete_backup.bkp -system This will restore the system backup "complete_backup.bkp". On completion the system will be rebooted. Are you sure you want to restore the system backup? [yes/no]: (command output)
Example 2.21. Revert the system following a partial system restore
Device:/> backup -revert (command output) Revert successful Changes must be activated and committed to be applied
Example 2.22. Revert the system following a complete system restore
Device:/> backup -revert This will revert the system to the point BEFORE the last backup restore. On completion the system will be rebooted. Are you sure you want to revert the system? [yes/no] (command output)
Example 2.23. Deleting backup files
Device:/> backup -delete backupfile.bkp Removed simplebackup.bkp successfully. Device:/> backup -delete backupfile-???.bkp Removed some files successfully. Device:/> backup -delete backupfile-2015*.bkp Removed some files successfully. Device:/> backup -delete all Removed all files successfully.
Example 2.24. Perform a partial factory reset (configuration only)
Device:/> backup -factoryreset This will reset the configuration (but not the firmware) to factory default. This change is not reversible. Are you sure you want to continue? [yes/no]: (command output)
Example 2.25. Perform a complete factory reset
Device:/> backup -factoryreset -system This will reset the whole system (both firmware and configuration) to factory default. This change is not reversible. Are you sure you want to continue? [yes/no]: (command output)
Usage
backup -listList backup files.
backup -create [<create filename>] [-system] [-force]Create backup.
backup -restore <restore filename> [-force] [-reboot]Restore backup.
backup -delete <delete filename>Delete backup.
backup -revertRevert applied restore.
backup -factoryreset [-system] [-force]Reset the configuration or system to default.
backupList backup files.
Options
![[Note]](images/note.png) |
Note |
|---|---|
| Requires Administrator privileges. |
Certificate management.
Description
Manages certificate retrieval and updates.An example of a "subject" string:
CN=name,O=organization,C=country
An example of a "subjectAltName" string:
172.22.36.1,fc01:2002::1,email@somewhere.com,fqdn.network.org
Usage
certmgr -initiate -clientcert=<Certificate> -username=<String>
-password=<String> -subject=<String>
[-subjectAltName=<String>] [-hex] Initiate certificate fetching from a CA.certmgr -update -clientcert=<Certificate>Update an existing valid certificate.
certmgr -revoke -clientcert=<Certificate> [-password=<String>]
[-hex] Revoke an existing valid certificate.
Options
Display Openstack config drive contents. (NOTE: Command not available when running as a container)
Description
This command is used to display Openstack config drive contents.Usage
cloudconfig -show <filename> [-nopages]Show config drive file contents.
cloudconfigDisplay config drive availability.
Options
Manage application crash dumps.
Description
The crashdump command is used to manage crashdump files. Crashdump files are binary files created if the system or subsystem crashes. They hold information on the state of the system at the time of the crash.Example 2.26. List all crashdump files
Device:/> crashdump (not shown here) Device:/> crashdump -list (not shown here)
Example 2.27. Delete a single crashdump file
Device:/> crashdump -delete 2016-04-21_13.54.25_dhcpserver.dump (not shown here)
Example 2.28. Delete a crashdump file using wildcards (*?[])
Device:/> crashdump -delete 2014-11-16_12.??.??_dhcpserver.dump (not shown here) Device:/> crashdump -delete *_dhcpserver.dump (not shown here)
Usage
crashdumpList all crash dump files.
crashdump -listList all crash dump files.
crashdump -delete {ALL | <filename>} Delete crash dump file(s).
Options
View Diagnostic messages generated by the system.
Description
The diagnostic console is used to help troubleshooting internal problems within the firewall.Using date, severity,app and category options it is possible to filter the diagnostic messages. Setting a date limit will only show entries from this date and forward. Setting Category(s) only will show entries with the specified Category(s).The categories will be the same as is used for logging. Setting a app(application name) will show only entries with the specified application. Setting severity will show only entries with specified severity and higher. Severity levels are (in order precedence from highest to lowest): Critical, High, Info(Informational) and Debug.
Aborting the dconsole command can be by pressing CTRL-C. Using CTRL-C will also terminate all other running CLI commands.
Usage
dconsoleShow all Dcon log entries.
dconsole -show [-severity={CRITICAL | HIGH | INFO | DEBUG}]
[-app=<String>] [-category=<String>] [-date=<String>] Show Dcon log entries.dconsole -cleanClears the event message list and removes event message disk file.
dconsole -flushFlushes the event message list to disk.
Options
IP echoserver.
Description
The echo server functionality is used to receive, interpret and echo back IP packets. The rules that are set up when enabling the echo server can be listed using the 'ruledb' CLI command. These rules are among the ones named 'socket'.IP protocols that are fully supported are the ones listed within the 'protocol' property - there protocol headers are parsed and modified accordingly when echoed back to the sender. It is however possible to set up a echo server for any IP protocol by specifying the IP protocol number and also specifying to use raw IP format.
The echo server statistics that can be listed using '-stats' show the number of received and echoed packets along with the sum of data sizes for received and sent packets. The packet data sizes are counted without packet headers. I.e. for UPD packets it the size of the UPD packet data and for any raw packet it is the size of the data without the IP header.
Usage
echoserver [-ip=<ip addr>] [-iface=<Interface>] [-stats] [-start]
[-stop] [-verbose] [-ipv6] [-protocol={UDP | ICMP |
ICMPV4 | ICMPV6 | ANY | <String>}] [-port=<port>]
[-flowcnt=<n>] [-raw]
Options
|
Note |
|---|---|
| Requires Administrator privileges. |
List ethernet devices and add new devices to the configuration.
Description
The ethupdate command detects available ethernet interfaces and allows for listing these as well as automatically creating the appropriate EthernetDevice configuration objects.Usage
ethupdateList all ethernet devices.
ethupdate -cfgupdateUpdate the configuration by adding new ethernet devices.
ethupdate -statusShow status of the ethernet devices configuration.
Options
Manage and show information about the license.
Description
Activate a new license, show information about the license, or remove the license.To activate a new license file, first upload it using scp.
Usage
licenseShow information about the license.
license removeRemove the license.
license activate [<Filename>]Activate new license.
Options
View log messages generated by the system.
Description
View log messages generated by the system.This command displays the system log messages. By specifying filter conditions (like 'category', 'action', 'srcip' etc), unwanted log messages can be filtered out. There are two modes, include and exclude mode. By default include mode is used, which means that only the log messages satisfying filter conditions will be shown. Specifying the switch 'excl' will turn on exclude mode. In this case only the log messages not satisfying the filter conditions will be displayed. If the command is already running, users can reset the filter conditions by submitting new ones.
Using 'rate' and 'num' display limits can prevent the console from message flooding. Setting a 'rate' limit will allow the system to show only the specified number of log messages per second, discarding the rest. When a 'num' limit is set, showing is automatically turned off as soon as the amount of log messages displayed reaches the specified limit.
Aborting the log command can be achieved by calling it without arguments or by pressing CTRL-C. Notice that using CTRL-C will also terminate all other running CLI commands.
Example 2.30. Show logs with different filter conditions setup
Destination IP address ranges from 192.168.1.1 to 192.168.1.254: System:/> log -on -destip=192.168.1.1-192.168.1.254 Actions is NOT drop: System:/> log -on -action=drop -excl Logs containing text "user" and limit to at most 10 logs per second: System:/> log -on -text=user -rate=10 First 9 logs with category either "IPv4" or "ARP": System:/> log -on -category=IPV4,ARP -num=9
Usage
log -on [-excl] [-text=<String>] [-regexp=<String>]
[-category=<String>] [-action=<String>] [-id=<String>] [-tag]
[-prio=<String>] [-srcip=<ip addr>] [-destip=<ip addr>]
[-ip=<ip addr>] [-srciface=<Interface>]
[-destiface=<Interface>] [-iface=<Interface>]
[-srcport=<Integer Range>] [-destport=<Integer Range>]
[-rate=<Integer>] [-num=<Integer>] [-event=<String>] Start displaying log messages, with specified filter conditions. If logging is already enabled, filter conditions will be
changed to the new ones specified.log -offStop receiving log messages.
logToggle logging on/off.
Options
Packet capture utility.
Description
Capture, save and view packets.Example 2.31. Perform packet capture on interface "if1". Packets will be written to a file with an auto-generated name when capture is stopped.
Device:/> pcapdump -start if1 Device:/> pcapdump -stop if1 Stopping packet capture: if1. Interface Pkts(In) Pkts(Out) Saved to file --------- -------- --------- --------------------------- if1 26 25 if1_2015-01-01_00.00.00.cap
Example 2.32. Perform packet capture on interface "if1". Write the packets to a file called "if1.cap".
Device:/> pcapdump -start if1 -nowrite Device:/> pcapdump -stop if1 Device:/> pcapdump -write if1 if1.cap
Example 2.33. Perform packet snoop on interface "if1" with filters.
Device:/> pcapdump -start if1 -out -nocap -ipsrc=192.168.0.1 -port=999 #1 >if1 IP 192.168.0.1->192.168.255.255 IHL:20 DataLen:48 TTL:255 Prot o:UDP UDP 999->999 DataLen:40 Device:/> pcapdump -stop if1
Example 2.34. Show the capture status.
System:/> pcapdump -status
PCAP Status
Interface Mode Packets(In) Packets(Out) Filter
--------- ------ ----------- ------------ ------
if1 Active 27 0
Explanation of the "Mode" column:
"Active" - The interface is being captured.
"Snoop" - Packets are being printed out but not captured.
"Idle" - Capture has stopped and packets can to be written to storag
e by using "pcapdump -write".Example 2.36. Show the content of a capture file in hexadecimal format.
Device:/> pcapdump -show if1_2015-01-01_00.00.00.cap -hex
Example 2.37. Remove the capture files and free the memory used by pcapdump.
Device:/> pcapdump -remove
Usage
pcapdumpShow capture status.
pcapdump -statusShow capture status.
pcapdump -listList capture files in the storage.
pcapdump -start [<interface>] [-eth=<EthernetAddress>]
[-ethsrc=<EthernetAddress>] [-ethdest=<EthernetAddress>]
[-ip=<IP>] [-ipsrc=<IP>] [-ipdest=<IP>] [-proto={ICMP |
IGMP | IPV4 | TCP | UDP | IPV6 | GRE | ESP | AH | ICMPV6 |
OSPF | MTP | L2TP | SCTP | <Integer Range>}]
[-port={BOOTPS | BOOTPC | FTP | SSH | TELNET | SMTP | HTTP
| NTP | SNMP | BGP | HTTPS | <Integer Range>}]
[-portsrc={BOOTPS | BOOTPC | FTP | SSH | TELNET | SMTP |
HTTP | NTP | SNMP | BGP | HTTPS | <Integer Range>}]
[-portdest={BOOTPS | BOOTPC | FTP | SSH | TELNET | SMTP |
HTTP | NTP | SNMP | BGP | HTTPS | <Integer Range>}]
[-bufsize=<Integer>] [-count=<Integer>]
[-snaplen=<Integer>] [-out] [-nocap] [-hex] [-k12]
[-nowrite] [-verbose] Start capture with specified filters and limits. If capture is already started, the filters and limits will be changed to
the new ones specified.pcapdump -stop [<interface>]Stop capture.
pcapdump -show [<interface>] [-filename=<filename>] [-num[={ALL |
<1...65535>}]] [-hex] [-k12] [-verbose] Show a brief of captured packets.pcapdump -write [<interface> [<filename>]]Write the captured packets to storage.
pcapdump -remove [<interface>] [-filename=<filename>]Remove the packets captured on an interface, or remove a capture file. If interface and filename are not specified, all captured packets and files will be removed.
Options
|
Note |
|---|---|
| Requires Administrator privileges. |
Ping host.
Description
Sends one or more ICMP ECHO, TCP or UDP packets to the specified IP address of a host. All datagrams are sent preloaded-style (all at once).
The data size -length given is the ICMP or UDP data size.
1472 bytes of ICMP data results in a 1500-byte IP datagram (1514 bytes ethernet).
When -srciface IS NOT specified, the outbound packet is routed using the "main" RoutingTable,
unless -routingtable is specified.
Once route lookup is done, the packet is always allowed to
be sent out, regardless of configured rule sets.
When -srciface IS specified, the system simulates that
it has received the packet from -srcip on -srciface and will perform route lookup according to the system configuration
(RoutingRules, InterfaceMembership, etc.).
Then the packet will be processed according to the configured rule sets.
It's possible to use -v or even -vv to show more information.
Example 2.38. Using TCP to probe network connectivity against a HTTP server.
gw-world:/> ping -tcp server_ip -port=80 -request="GET / HTTP/1.0\n\n"
Example 2.39. Using ICMP simulation to troubleshoot connectivity from an endpoint on the LAN network to a server on the WAN network.
gw-world:/> ping server_ip -srcip=ip-of-lan-endpoint -srciface=lan -vv
Usage
ping <host> [-sharedip] [-srciface=<interface>]
[-srcip=<ip address>] [-iface=<interface>]
[-routingtable=<table>] [-num=<1...10>] [-length=<4...59948>]
[-v] [-verbose] [-vv] Send an ICMP ping.ping -udp <host> [-sharedip] [-srciface=<interface>]
[-srcip=<ip address>] [-routingtable=<table>] [-num=<1...10>]
[-length=<4...59948>] [-srcport=<1...65535>]
[-port=<1...65535>] [-v] [-verbose] [-vv] Send a UDP ping.ping -tcp <host> [-iface=<interface>] [-srciface=<interface>]
[-srcip=<ip address>] [-routingtable=<table>]
[-port=<1...65535>] [-request=<String>] [-v] [-verbose] [-vv]
[-num=<1...10>] [-srcport=<1...65535>] Send a TCP ping.
Options
|
Note |
|---|---|
| Requires Administrator privileges. |
Run and manage script files.
Description
The script command can be used to create, run and manage scripts.Configuration script files are files that consists of CLI configuration commands, one per line. Script file comment lines begin with the character '#'. Arguments to scripts are available by variable substitution, where '$0' is replaced by the script file name and the variables $1-$N are replaced by the supplied arguments. Escaping the '$' sign is done as '\$'.
All or parts of the current running configuration that are not read-only can be created as a script file and either displayed to the console or stored to disk. When selecting to create a script of parts of the configuration this can be done with the granularity of object category e.g. [Address], object class e.g. IPAddress or a single object.
When a script is created from the configuration it will include any uncommitted objects. I.e. it is possible to create script files of changes without committing them to the system first.
Script files are transfered to and from the device by using the SCP protocol. On the device, script files must be stored in the "/scripts" folder in order for the script command to make use of them.
When adding or changing configuration objects using a script file it is possible to do the changes 'out-of-order'. I.e. if one object refers to another object, the first object can be added and refer to the second object even though that object has not yet been added. Normally when a configuration change is done through the CLI, it is immediately validated and any errors are reported back to the user. When running commands from a script file the reference validation is turned off during execution of consecutive 'add' and 'set' commands and turned back on again when any other command is executed, or the script ends.
It is not recommended running scripts while doing configuration modifications from other user sessions.
Example 2.41. Create and show script of Address objects
Show script of Address category objects: Device:/> script -create Address (not shown here) Show script of all IPAddress objects: Device:/> script -create Address IPAddress (not shown here) Show script of a single IPAddress object: Device:/> script -create Address IPAddress myaddress (not shown here)
Example 2.42. View and run the example script example.sgs
Show the file: Device:/> script -show example.sgs (not shown here) Running the script: Device:/> script -run example.sgs test 1.2.3.4 (not shown here)
Example 2.43. Script using substitution
"script.sgs": add Address IPAddress $1 Address=$2 Comments="$0: \$100". Device:/> script -run script.sgs ip_test 127.0.0.1 is executed as line: add Address IPAddress ip_test Address=127.0.0.1 Comments="script.sgs: $1 00"
Usage
scriptList script files.
script -listList script files.
script -create [[<Category>] <Type> [<Identifier>]]
[-filename=<script file>] Create a script containing the selected object types.script -run <script file> [-verbose] [-force] [<arguments>]...Run script.
script -delete <script file>Delete script.
script -show <script file>Show script in console window.
Options
|
Note |
|---|---|
| Requires Administrator privileges. |
SSH Server.
Description
Show SSH Server status, or restart SSH Server.Usage
sshserverShow server status and list all connected clients.
sshserver -status [-verbose]Show server status and list all connected clients.
sshserver -keygen [-bits=<bits>] [-type={RSA | DSA | ECDSA}] Generate SSH Server private keys.sshserver -fingerprint [-md5]Show the fingerprints of the SSH keys.
sshserver -restart [<ssh server>] [-full]Restart SSH Server.
Options
|
Note |
|---|---|
| Requires Administrator privileges. |
Handles system operations and shows system information.
Description
Handles system operations and shows system information.Usage
system -cpuinfo [-verbose]Show information about the CPU.
system -update-bootloader-configuration [-force]Update the bootloader configuration. This command should only be run when instructed to do so.
Options
Stores and views Technical Support Information.
Description
Used to collect technical support information from the system. Issuing the command without options will write the information to a file stored locally on the device. Any existing file will be overwritten.After successful storage, the file may be remotely copied over the SSH Remote Management interface (using SCP) or printed to console using the 'show' command option.
Usage
techsupportStore technical support information to file.
techsupport -show [-nopages]Display stored technical support information.
techsupport -printconf [-nopages]Display system configuration as XML.
techsupportStore technical support information to file.
Options
|
Note |
|---|---|
| Requires Administrator privileges. |
Display and set current system time.
Description
Display and set the system date and time.Usage
time -sleep=<Float>Pause CLI session for the specified number of seconds.
time -sync [-force]Synchronize time with timeserver(s) (specified in settings).
time -statusShow time synchronization status information.
time -set <date> <time>Set local system time: <YYYY-MM-DD> <HH:MM:SS>.
timeDisplay current system time.
Options
Show CPU usage of the system.
Description
Show CPU usage of the system.Time - The time measurement uses the format S.s, MM:SS or HH:MM:SS depending on the amount of time to display.
CPU - The system CPU measurement spans from zero to a hundred percent, measuring the current amount of CPU resources not beeing idle. When measuring the CPU usage per module a value above 100% indicates that this module utilizes resources from several CPU units.
Usage
topList processes and show CPU utilization.
top -list [-num=<n>] [-sort={ALPHA | TIME | TOP}] List processes and show CPU utilization.
Options
Trace the route to a destination.
Description
Print the route packets take to a network host.Usage
traceroute <host> [-timeout=<1...60000>] [-srcip=<ip address>]
[-iface=<interface>] [-routingtable=<table>]
[-interval=<0...60000>] [-length=<1...8192>] [-verbose]
[-queries=<1...10>] [-ttl=<1...255>] [-maxttl=<1...255>]
[-noresolve] [-ipver={4 | 6}] Send a ICMP probe.traceroute -udp <host> [-timeout=<1...60000>] [-srcip=<ip address>]
[-routingtable=<table>] [-queries=<1...10>]
[-length=<1...8192>] [-port=<1...65535>] [-verbose]
[-interval=<0...60000>] [-ttl=<1...255>]
[-maxttl=<1...255>] [-noresolve] [-ipver={4 | 6}] Send a UDP probe.traceroute -tcp <host> [-timeout=<1...60000>] [-srcip=<ip address>]
[-routingtable=<table>] [-queries=<1...10>]
[-length=<1...8192>] [-port=<1...65535>] [-verbose]
[-iface=<interface>] [-interval=<0...60000>]
[-ttl=<1...255>] [-maxttl=<1...255>] [-noresolve]
[-ipver={4 | 6}] Send a TCP probe.
Options
|
Note |
|---|---|
| Requires Administrator privileges. |
Upgrade system. (NOTE: Command not available when running as a container)
Description
Perform system upgrades and manage upgrade files.Upgrading the system software/firmware is performed by applying upgrade files stored on the device. Upgrade files are digitally signed software binary files created specifically for different hardware models. Apart from performing upgrades, the command also allows listing of upgrade files stored on the device as well as deleting the files.
NOTE: Make sure to select an upgrade file that matches the hardware model used.
NOTE: Upgrading the software/firmware will require a complete system restart and it is therefore highly recommended to perform a complete backup of the system before proceeding.
Example 2.45. Upgrade to a new software/firmware version
Device:/> upgrade firmware_v1_20.upg (command output)
Example 2.46. List all upgrade files
Device:/> upgrade (command output) Device:/> upgrade -list (command output)
Example 2.47. Delete upgrade files
Device:/> upgrade -delete firmware_v1_20.upg Removed firmware_version_x.upg successfully. Device:/> upgrade -delete firmware_v1_??.upg Removed some files successfully. Device:/> upgrade -delete firmware_*.upg Removed some files successfully. Device:/> upgrade -delete * Removed all files successfully.
Usage
upgradeList upgrade files.
upgrade -listList upgrade files.
upgrade <upgrade filename> [-force]Apply upgrade.
upgrade -delete <delete filename>Delete upgrade file.
upgradeList upgrade files.
Options
|
Note |
|---|---|
| Requires Administrator privileges. |
