System — settings#

The Settings tab of the System page holds the router's own settings in eight panels: General, Time synchronisation, SSH, Router accounts, Remote logging, SNMP, Kernel parameters and Scheduled tasks.

How the editors work#

Each panel shows what the router has now. Its Edit button, its Add button (Add time server, Add task and so on), or a row of its table opens an editor in a side panel.
The editor checks each value as it is entered and says under the field what is wrong. Its save button stays disabled until the entry is complete, valid, and different from what the router has.
The save button (Save changes, Add time server, Add account and so on) does not change the router. It adds the difference to the pending changes and closes the editor. A delete button (Delete time server, Delete task and so on) adds a removal the same way.
The pending changes are applied from the bar at the bottom of the page, with Apply changes or Apply with auto-revert. Review changes lists each one as a sentence, such as "Add time server time.cloudflare.com" with "With NTS" beneath it.
The panels read the router again once changes are applied.
The editors need the operator role. Other roles see the panels; the buttons are disabled and the rows do not open.

General#

The panel lists Host name, Domain name, Time zone (UTC when none is set), DNS servers and DNS servers from. Edit opens General settings:

Field	Accepts
Host name	Letters, digits, hyphens and dots, up to 63 characters, not beginning or ending with a hyphen or a dot, such as `edge-1`. It cannot be left empty.
Domain name	A domain name of letters, digits, hyphens and dots, such as `example.com`.
Time zone	A zone chosen from the list of time zones, such as Europe/London.
DNS servers	"The servers the router uses to look up names." IP addresses, added one at a time.
DNS servers from	"Uses the DNS servers an interface receives by DHCP." Only interfaces that take their address by DHCP are offered; with none, the field says "No interface takes its address by DHCP."

These are the servers the router uses for its own lookups. The DNS service the router offers its networks is on the DNS page.

Time synchronisation#

The table lists the time servers the router sets its clock from, with each server's options: Pool, Preferred and NTS. Below it, Serves time on and Allowed clients describe the time service the router offers its own networks. With no time servers the panel says "No time servers" and "The router’s clock is not synchronised."

Add time server:

Field	Accepts
Server	An IP address or a host name that is not already in the list.
Pool	"The name resolves to several servers."
Preferred	The router prefers this server to the others.
NTS	"Authenticated time. The server must support NTS."

Select a server in the table to change its switches, or to remove it with Delete time server. A server's name cannot be changed; delete it and add the new one.

Edit time service opens Time service ("The router can serve time to devices on its networks."):

Field	Accepts
Serve time on	"Addresses of this router that answer time requests." IP addresses.
Allowed clients	"Networks that may use this router as a time server." An address with its prefix length, such as `192.0.2.0/24`.

Whether the router's clock is actually synchronised is on Diagnostics — time. The whole procedure is Time synchronisation.

SSH#

With the SSH server on, the panel lists Ports (22 when none is set), Listens on (every address when none is set) and Password sign-in (Allowed or Keys only). With it off, the panel says Off. Edit opens SSH:

Field	Accepts
SSH server	On or off. Turning it off removes the ports, listen addresses and password setting with it.
Ports	Port numbers from 1 to 65535. "22 when none is set."
Listen addresses	Addresses of this router that accept SSH. "Every address when none is set."
Password sign-in	"Off allows sign-in with SSH keys only."

SSH changes are among those the bar marks as able to cut you off. The whole procedure is Turn SSH on, and restrict it.

Router accounts#

"Accounts for the router’s console and SSH." They are not the accounts that sign in to the web interface, which are on Users (Admin → Users).

The table lists each Account, its Full name, and how it signs in under Sign-in: Password, the number of SSH keys ("2 SSH keys"), or None.

Add account opens Add router account:

Field	Accepts
Account name	Letters, digits, dots, hyphens and underscores, up to 100 characters. A name in use is refused, and so are the names the system keeps for itself: root, daemon, bin, sys, nobody, sshd and vyattacfg.
Full name	Any text without a colon.
Password, Confirm password	The two must match.
SSH keys	A key is added by pasting its public key line into Public key, such as the contents of `id_ed25519.pub`, and pressing Add key.

A new account needs a password, an SSH key, or both; until it has one the editor says "Enter a password or add an SSH key."

The Public key field takes the line an SSH client writes: the key type, the key and an optional comment. It accepts Ed25519, RSA, DSA and ECDSA keys, and the two security-key types. Key name is taken from the key's comment when it is left empty ("From the key’s comment: alice@laptop"); it takes letters, digits, dots, hyphens, underscores and @, up to 64 characters, and must differ from the account's other keys.

Select an account to change it. The editor shows whether a password is Set, takes a New password ("Leave empty to keep the current password.") with Confirm password, lists each SSH key by name and type with Remove, and adds keys as above. The account's name cannot be changed.

Delete account asks "Delete account alice?" before it adds the removal to the pending changes. It is disabled for the only account: "The router needs at least one account."

A password is written to the router and never read back. The page shows only whether one is set, and the pending change says so without the password ("Change the password of router account alice").

Router account changes are among those the bar marks as able to cut you off. More on the console account: The console account and its SSH keys.

Remote logging#

The table lists each log server with its Server, Port (514 when none is set), Protocol (UDP when none is set) and Messages: the lowest severity it receives, such as Warning and above, or All messages. With none, the panel says "No remote log servers" and "Logs are kept on the router only."

Add log server:

Field	Accepts
Server	An IP address or a host name that is not already a log server.
Port	A port from 1 to 65535; 514 when empty.
Protocol	UDP or TCP.
Minimum severity	Emergency, Alert, Critical, Error, Warning, Notice, Informational, Debug, or All messages. A new server starts at Informational.

Select a server to change its port, protocol or severity, or to remove it with Delete log server. Where the router also sends a server messages by facility, the editor lists them under Also sent and leaves them as they are.

This sends the router's system log. The web interface's audit log has its own export, on Agent settings. Both are covered in Ship logs off the box.

SNMP#

With SNMP off, the panel says "SNMP is off" and "Add a community or an SNMPv3 user to turn it on.", with Add community and Add SNMPv3 user.

With it on, the panel lists Location, Contact and, once one is set or there are SNMPv3 users, Engine ID, with Edit; then the Communities and SNMPv3 users tables, and Add community, Add SNMPv3 user and Turn off SNMP. Turn off SNMP asks "Turn off SNMP?" and then adds the removal of every SNMP setting, communities and users included, to the pending changes.

Communities#

The table lists each Community with its Access (Read-only or Read-write) and Allowed from: the networks and clients it is limited to, or Anywhere.

A community works as a password. Below the admin role it is hidden: the table shows Hidden, the row does not open, and the panel says "Only an administrator can see or change a community."

Add community:

Field	Accepts
Community	Up to 100 letters, digits and `- _ ! @ * #`, not already in use. "Monitoring systems send it with every request."
Access	Read-only or Read-write.
Allowed networks	Networks, as an address with its prefix length.
Allowed clients	Single IP addresses.

"Anywhere when neither list has an entry." Select a community to change its access and where it is allowed from, or to remove it with Delete community. Its name cannot be changed. The pending change never names it: "Add an SNMP community".

SNMPv3 users#

The table lists each User with its Access, Authentication (SHA or MD5) and Privacy (AES or DES).

Add SNMPv3 user:

Field	Accepts
User name	A name without spaces, hyphens, parentheses or `\|`, not already in use.
Access	Read-only or Read-write.
Authentication	Algorithm: SHA or MD5. Password: at least 8 characters.
Privacy	Encryption: AES or DES. Password: at least 8 characters.

Every user has both passwords: the router refuses a user without either. Passwords are written and never shown. Editing a user asks for a new password only to change it ("Leave empty to keep the current password."); changing the algorithm or the encryption needs a new password, because the router ties the password to it.

For the first user, the page adds what the router needs beside it, as pending changes of their own: a random engine ID, a group for the user's access (readonly or readwrite), and a view named all that covers everything. A user in a group made some other way keeps that group, and the editor shows it.

SNMP settings#

Edit opens SNMP settings:

Field	Accepts
Location	Any text, such as Rack 2.
Contact	Any text, such as noc@example.com.
Engine ID	"Identifies the router to SNMPv3 clients. Set when the first SNMPv3 user is added." An even number of lower-case hex digits, at most 36. It cannot be emptied while there are SNMPv3 users.

The whole procedure is SNMP.

Kernel parameters#

The table lists each Parameter the configuration sets, and its Value. With none, the panel says "No kernel parameters" and "The kernel runs with the router’s defaults."

Add parameter opens Add kernel parameter:

Field	Accepts
Parameter	A kernel parameter's name, such as `net.ipv4.tcp_syncookies`, that is not already set. The page checks its form; the router checks that the parameter exists when the change is applied.
Value	The value to set. It cannot be left empty.

Select a parameter to change its value, or to remove it with Delete parameter.

The list shows what the configuration sets, not what the kernel is running with. Two connection-tracking parameters are the router's own: the per-connection byte counters (net.netfilter.nf_conntrack_acct) and the size of the connection table (net.netfilter.nf_conntrack_max). The router writes them from its connection-tracking settings at start-up and whenever changes to connection tracking, the firewall or NAT are applied, so a value set here holds only until the next such change. Sessions offers the setting that turns the byte counters on and keeps them on, and Diagnostics — health says whether the table is too small (Kernel tunables).

Scheduled tasks#

The table lists each Task with its Schedule (Every 1d, or a cron schedule) and the Program it runs, with its arguments. With none, the panel says "No scheduled tasks".

Add task opens Add scheduled task:

Field	Accepts
Name	Letters, digits, dots, hyphens and underscores, beginning with a letter or a digit, not already in use.
Schedule	Repeat at an interval or Cron schedule.
Interval	"Minutes, or a number with m, h or d." For example 30m, 6h or 1d; at most 60 minutes, 24 hours or 31 days.
Cron schedule	Five fields: minute, hour, day of month, month and day of week, such as `0 3 * * *`.
Program	The full path of a program on the router, such as `/config/scripts/backup.sh`. "It must exist on the router and be executable."
Arguments	What to pass to the program.

Select a task to change its schedule, program or arguments, or to remove it with Delete task.

The page runs a program that is already on the router; it does not upload one. Putting a script on the router takes SSH or the console. A program under /config is carried into a new system image. The whole procedure is Run something on a schedule.

What this tab does not do#

It does not manage the web interface's accounts. Users, roles, two-factor and API tokens are under Admin.
It does not configure the agent. Session lifetime, required two-factor authentication, the auto-revert window, the audit log's retention and export, and the management address are on Agent settings.
It does not hold the certificates. They are on Certificates.
It does not read the kernel. The Kernel parameters panel lists what the configuration sets.

In Advanced mode#

With Advanced mode turned on (Account → Preferences), the pending changes are also listed as the router's commands. The configuration these panels edit is system (with the router accounts under system login, remote logging under system syslog, kernel parameters under system sysctl and scheduled tasks under system task-scheduler), service ntp, service ssh and service snmp.