man/systemd.netdev.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4
   5 <!--
   6   SPDX-License-Identifier: LGPL-2.1+
   7
   8   Copyright © 2013 Tom Gundersen
   9 -->
  10
  11 <refentry id="systemd.netdev" conditional='ENABLE_NETWORKD'>
  12
  13   <refentryinfo>
  14     <title>systemd.network</title>
  15     <productname>systemd</productname>
  16   </refentryinfo>
  17
  18   <refmeta>
  19     <refentrytitle>systemd.netdev</refentrytitle>
  20     <manvolnum>5</manvolnum>
  21   </refmeta>
  22
  23   <refnamediv>
  24     <refname>systemd.netdev</refname>
  25     <refpurpose>Virtual Network Device configuration</refpurpose>
  26   </refnamediv>
  27
  28   <refsynopsisdiv>
  29     <para><filename><replaceable>netdev</replaceable>.netdev</filename></para>
  30   </refsynopsisdiv>
  31
  32   <refsect1>
  33     <title>Description</title>
  34
  35     <para>Network setup is performed by
  36     <citerefentry><refentrytitle>systemd-networkd</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
  37     </para>
  38
  39     <para>The main Virtual Network Device file must have the extension <filename>.netdev</filename>;
  40     other extensions are ignored. Virtual network devices are created as soon as networkd is
  41     started. If a netdev with the specified name already exists, networkd will use that as-is rather
  42     than create its own. Note that the settings of the pre-existing netdev will not be changed by
  43     networkd.</para>
  44
  45     <para>The <filename>.netdev</filename> files are read from the files located in the system
  46     network directory <filename>/usr/lib/systemd/network</filename>, the volatile runtime network
  47     directory <filename>/run/systemd/network</filename> and the local administration network
  48     directory <filename>/etc/systemd/network</filename>. All configuration files are collectively
  49     sorted and processed in lexical order, regardless of the directories in which they live.
  50     However, files with identical filenames replace each other. Files in <filename>/etc</filename>
  51     have the highest priority, files in <filename>/run</filename> take precedence over files with
  52     the same name in <filename>/usr/lib</filename>. This can be used to override a system-supplied
  53     configuration file with a local file if needed. As a special case, an empty file (file size 0)
  54     or symlink with the same name pointing to <filename>/dev/null</filename> disables the
  55     configuration file entirely (it is "masked").</para>
  56
  57     <para>Along with the netdev file <filename>foo.netdev</filename>, a "drop-in" directory
  58     <filename>foo.netdev.d/</filename> may exist. All files with the suffix <literal>.conf</literal>
  59     from this directory will be parsed after the file itself is parsed. This is useful to alter or
  60     add configuration settings, without having to modify the main configuration file. Each drop-in
  61     file must have appropriate section headers.</para>
  62
  63     <para>In addition to <filename>/etc/systemd/network</filename>, drop-in <literal>.d</literal>
  64     directories can be placed in <filename>/usr/lib/systemd/network</filename> or
  65     <filename>/run/systemd/network</filename> directories. Drop-in files in
  66     <filename>/etc</filename> take precedence over those in <filename>/run</filename> which in turn
  67     take precedence over those in <filename>/usr/lib</filename>. Drop-in files under any of these
  68     directories take precedence over the main netdev file wherever located. (Of course, since
  69     <filename>/run</filename> is temporary and <filename>/usr/lib</filename> is for vendors, it is
  70     unlikely drop-ins should be used in either of those places.)</para>
  71   </refsect1>
  72
  73   <refsect1>
  74     <title>Supported netdev kinds</title>
  75
  76     <para>The following kinds of virtual network devices may be
  77     configured in <filename>.netdev</filename> files:</para>
  78
  79     <table>
  80       <title>Supported kinds of virtual network devices</title>
  81
  82       <tgroup cols='2'>
  83         <colspec colname='kind' />
  84         <colspec colname='explanation' />
  85         <thead><row>
  86           <entry>Kind</entry>
  87           <entry>Description</entry>
  88         </row></thead>
  89         <tbody>
  90           <row><entry><varname>bond</varname></entry>
  91           <entry>A bond device is an aggregation of all its slave devices. See <ulink url="https://www.kernel.org/doc/Documentation/networking/bonding.txt">Linux Ethernet Bonding Driver HOWTO</ulink> for details.Local configuration</entry></row>
  92
  93           <row><entry><varname>bridge</varname></entry>
  94           <entry>A bridge device is a software switch, and each of its slave devices and the bridge itself are ports of the switch.</entry></row>
  95
  96           <row><entry><varname>dummy</varname></entry>
  97           <entry>A dummy device drops all packets sent to it.</entry></row>
  98
  99           <row><entry><varname>gre</varname></entry>
 100           <entry>A Level 3 GRE tunnel over IPv4. See <ulink url="https://tools.ietf.org/html/rfc2784">RFC 2784</ulink> for details.</entry></row>
 101
 102           <row><entry><varname>gretap</varname></entry>
 103           <entry>A Level 2 GRE tunnel over IPv4.</entry></row>
 104
 105           <row><entry><varname>ip6gre</varname></entry>
 106           <entry>A Level 3 GRE tunnel over IPv6.</entry></row>
 107
 108           <row><entry><varname>ip6tnl</varname></entry>
 109           <entry>An IPv4 or IPv6 tunnel over IPv6</entry></row>
 110
 111           <row><entry><varname>ip6gretap</varname></entry>
 112           <entry>A Level 2 GRE tunnel over IPv6.</entry></row>
 113
 114           <row><entry><varname>ipip</varname></entry>
 115           <entry>An IPv4 over IPv4 tunnel.</entry></row>
 116
 117           <row><entry><varname>ipvlan</varname></entry>
 118           <entry>An ipvlan device is a stacked device which receives packets from its underlying device based on IP address filtering.</entry></row>
 119
 120           <row><entry><varname>macvlan</varname></entry>
 121           <entry>A macvlan device is a stacked device which receives packets from its underlying device based on MAC address filtering.</entry></row>
 122
 123           <row><entry><varname>macvtap</varname></entry>
 124           <entry>A macvtap device is a stacked device which receives packets from its underlying device based on MAC address filtering.</entry></row>
 125
 126           <row><entry><varname>sit</varname></entry>
 127           <entry>An IPv6 over IPv4 tunnel.</entry></row>
 128
 129           <row><entry><varname>tap</varname></entry>
 130           <entry>A persistent Level 2 tunnel between a network device and a device node.</entry></row>
 131
 132           <row><entry><varname>tun</varname></entry>
 133           <entry>A persistent Level 3 tunnel between a network device and a device node.</entry></row>
 134
 135           <row><entry><varname>veth</varname></entry>
 136           <entry>An Ethernet tunnel between a pair of network devices.</entry></row>
 137
 138           <row><entry><varname>vlan</varname></entry>
 139           <entry>A VLAN is a stacked device which receives packets from its underlying device based on VLAN tagging. See <ulink url="http://www.ieee802.org/1/pages/802.1Q.html">IEEE 802.1Q</ulink> for details.</entry></row>
 140
 141           <row><entry><varname>vti</varname></entry>
 142           <entry>An IPv4 over IPSec tunnel.</entry></row>
 143
 144           <row><entry><varname>vti6</varname></entry>
 145           <entry>An IPv6 over IPSec tunnel.</entry></row>
 146
 147           <row><entry><varname>vxlan</varname></entry>
 148           <entry>A virtual extensible LAN (vxlan), for connecting Cloud computing deployments.</entry></row>
 149
 150           <row><entry><varname>geneve</varname></entry>
 151           <entry>A GEneric NEtwork Virtualization Encapsulation (GENEVE) netdev driver.</entry></row>
 152
 153           <row><entry><varname>vrf</varname></entry>
 154           <entry>A Virtual Routing and Forwarding (<ulink url="https://www.kernel.org/doc/Documentation/networking/vrf.txt">VRF</ulink>) interface to create separate routing and forwarding domains.</entry></row>
 155
 156           <row><entry><varname>vcan</varname></entry>
 157           <entry>The virtual CAN driver (vcan). Similar to the network loopback devices, vcan offers a virtual local CAN interface.</entry></row>
 158
 159           <row><entry><varname>vxcan</varname></entry>
 160           <entry>The virtual CAN tunnel driver (vxcan). Similar to the virtual ethernet driver veth, vxcan implements a local CAN traffic tunnel between two virtual CAN network devices. When creating a vxcan, two vxcan devices are created as pair. When one end receives the packet it appears on its pair and vice versa. The vxcan can be used for cross namespace communication.
 161           </entry></row>
 162
 163           <row><entry><varname>wireguard</varname></entry>
 164           <entry>WireGuard Secure Network Tunnel.</entry></row>
 165
 166           <row><entry><varname>netdevsim</varname></entry>
 167           <entry> A simulator. This simulated networking device is used for testing various networking APIs and at this time is particularly focused on testing hardware offloading related interfaces.</entry></row>
 168         </tbody>
 169       </tgroup>
 170     </table>
 171
 172   </refsect1>
 173
 174   <refsect1>
 175     <title>[Match] Section Options</title>
 176
 177     <para>A virtual network device is only created if the
 178     <literal>[Match]</literal> section matches the current
 179     environment, or if the section is empty. The following keys are
 180     accepted:</para>
 181
 182     <variablelist class='network-directives'>
 183       <varlistentry>
 184         <term><varname>Host=</varname></term>
 185         <listitem>
 186           <para>Matches against the hostname or machine ID of the
 187           host. See <literal>ConditionHost=</literal> in
 188           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 189           for details.
 190           </para>
 191         </listitem>
 192       </varlistentry>
 193       <varlistentry>
 194         <term><varname>Virtualization=</varname></term>
 195         <listitem>
 196           <para>Checks whether the system is executed in a virtualized
 197           environment and optionally test whether it is a specific
 198           implementation. See
 199           <literal>ConditionVirtualization=</literal> in
 200           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 201           for details.
 202           </para>
 203         </listitem>
 204       </varlistentry>
 205       <varlistentry>
 206         <term><varname>KernelCommandLine=</varname></term>
 207         <listitem>
 208           <para>Checks whether a specific kernel command line option
 209           is set (or if prefixed with the exclamation mark unset). See
 210           <literal>ConditionKernelCommandLine=</literal> in
 211           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 212           for details.
 213           </para>
 214         </listitem>
 215       </varlistentry>
 216       <varlistentry>
 217         <term><varname>KernelVersion=</varname></term>
 218         <listitem>
 219           <para>Checks whether the kernel version (as reported by <command>uname -r</command>) matches a certain
 220           expression (or if prefixed with the exclamation mark does not match it). See
 221           <literal>ConditionKernelVersion=</literal> in
 222           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details.
 223           </para>
 224         </listitem>
 225       </varlistentry>
 226       <varlistentry>
 227         <term><varname>Architecture=</varname></term>
 228         <listitem>
 229           <para>Checks whether the system is running on a specific
 230           architecture. See <literal>ConditionArchitecture=</literal> in
 231           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 232           for details.
 233           </para>
 234         </listitem>
 235       </varlistentry>
 236     </variablelist>
 237
 238   </refsect1>
 239
 240   <refsect1>
 241     <title>[NetDev] Section Options</title>
 242
 243       <para>The <literal>[NetDev]</literal> section accepts the
 244       following keys:</para>
 245
 246       <variablelist class='network-directives'>
 247         <varlistentry>
 248           <term><varname>Description=</varname></term>
 249           <listitem>
 250             <para>A free-form description of the netdev.</para>
 251           </listitem>
 252         </varlistentry>
 253         <varlistentry>
 254           <term><varname>Name=</varname></term>
 255           <listitem>
 256             <para>The interface name used when creating the netdev.
 257             This option is compulsory.</para>
 258           </listitem>
 259         </varlistentry>
 260         <varlistentry>
 261           <term><varname>Kind=</varname></term>
 262           <listitem>
 263             <para>The netdev kind. This option is compulsory. See the
 264             <literal>Supported netdev kinds</literal> section for the
 265             valid keys.</para>
 266           </listitem>
 267         </varlistentry>
 268         <varlistentry>
 269           <term><varname>MTUBytes=</varname></term>
 270           <listitem>
 271             <para>The maximum transmission unit in bytes to set for
 272             the device. The usual suffixes K, M, G, are supported and
 273             are understood to the base of 1024. This key is not
 274             currently supported for <literal>tun</literal> or
 275             <literal>tap</literal> devices.
 276             </para>
 277           </listitem>
 278         </varlistentry>
 279         <varlistentry>
 280           <term><varname>MACAddress=</varname></term>
 281           <listitem>
 282             <para>The MAC address to use for the device. If none is
 283             given, one is generated based on the interface name and
 284             the
 285             <citerefentry><refentrytitle>machine-id</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
 286             This key is not currently supported for
 287             <literal>tun</literal> or <literal>tap</literal> devices.
 288             </para>
 289           </listitem>
 290         </varlistentry>
 291       </variablelist>
 292   </refsect1>
 293
 294     <refsect1>
 295     <title>[Bridge] Section Options</title>
 296
 297       <para>The <literal>[Bridge]</literal> section only applies for
 298       netdevs of kind <literal>bridge</literal>, and accepts the
 299       following keys:</para>
 300
 301       <variablelist class='network-directives'>
 302         <varlistentry>
 303           <term><varname>HelloTimeSec=</varname></term>
 304           <listitem>
 305             <para>HelloTimeSec specifies the number of seconds between two hello packets
 306             sent out by the root bridge and the designated bridges. Hello packets are
 307             used to communicate information about the topology throughout the entire
 308             bridged local area network.</para>
 309           </listitem>
 310         </varlistentry>
 311         <varlistentry>
 312           <term><varname>MaxAgeSec=</varname></term>
 313           <listitem>
 314             <para>MaxAgeSec specifies the number of seconds of maximum message age.
 315             If the last seen (received) hello packet is more than this number of
 316             seconds old, the bridge in question will start the takeover procedure
 317             in attempt to become the Root Bridge itself.</para>
 318           </listitem>
 319         </varlistentry>
 320         <varlistentry>
 321           <term><varname>ForwardDelaySec=</varname></term>
 322           <listitem>
 323             <para>ForwardDelaySec specifies the number of seconds spent in each
 324             of the Listening and Learning states before the Forwarding state is entered.</para>
 325           </listitem>
 326         </varlistentry>
 327         <varlistentry>
 328           <term><varname>AgeingTimeSec=</varname></term>
 329           <listitem>
 330             <para>This specifies the number of seconds a MAC Address will be kept in
 331             the forwarding database after having a packet received from this MAC Address.</para>
 332           </listitem>
 333         </varlistentry>
 334         <varlistentry>
 335           <term><varname>Priority=</varname></term>
 336           <listitem>
 337             <para>The priority of the bridge. An integer between 0 and 65535. A lower value
 338             means higher priority. The bridge having the lowest priority will be elected as root bridge.</para>
 339           </listitem>
 340         </varlistentry>
 341         <varlistentry>
 342           <term><varname>GroupForwardMask=</varname></term>
 343           <listitem>
 344             <para>A 16-bit bitmask represented as an integer which allows forwarding of link
 345             local frames with 802.1D reserved addresses (01:80:C2:00:00:0X). A logical AND
 346             is performed between the specified bitmask and the exponentiation of 2^X, the
 347             lower nibble of the last octet of the MAC address. For example, a value of 8
 348             would allow forwarding of frames addressed to 01:80:C2:00:00:03 (802.1X PAE).</para>
 349           </listitem>
 350         </varlistentry>
 351         <varlistentry>
 352           <term><varname>DefaultPVID=</varname></term>
 353           <listitem>
 354             <para>This specifies the default port VLAN ID of a newly attached bridge port.
 355             Set this to an integer in the range 1–4094 or <literal>none</literal> to disable the PVID.</para>
 356           </listitem>
 357         </varlistentry>
 358         <varlistentry>
 359           <term><varname>MulticastQuerier=</varname></term>
 360           <listitem>
 361             <para>A boolean. This setting controls the IFLA_BR_MCAST_QUERIER option in the kernel.
 362             If enabled, the kernel will send general ICMP queries from a zero source address.
 363             This feature should allow faster convergence on startup, but it causes some
 364             multicast-aware switches to misbehave and disrupt forwarding of multicast packets.
 365             When unset, the kernel's default setting applies.
 366             </para>
 367           </listitem>
 368         </varlistentry>
 369         <varlistentry>
 370           <term><varname>MulticastSnooping=</varname></term>
 371           <listitem>
 372             <para>A boolean. This setting controls the IFLA_BR_MCAST_SNOOPING option in the kernel.
 373             If enabled, IGMP snooping monitors the Internet Group Management Protocol (IGMP) traffic
 374             between hosts and multicast routers. When unset, the kernel's default setting applies.
 375             </para>
 376           </listitem>
 377         </varlistentry>
 378         <varlistentry>
 379           <term><varname>VLANFiltering=</varname></term>
 380           <listitem>
 381             <para>A boolean. This setting controls the IFLA_BR_VLAN_FILTERING option in the kernel.
 382             If enabled, the bridge will be started in VLAN-filtering mode. When unset, the kernel's
 383             default setting applies.
 384             </para>
 385           </listitem>
 386         </varlistentry>
 387           <varlistentry>
 388           <term><varname>STP=</varname></term>
 389           <listitem>
 390             <para>A boolean. This enables the bridge's Spanning Tree Protocol (STP). When unset,
 391             the kernel's default setting applies.
 392             </para>
 393           </listitem>
 394         </varlistentry>
 395       </variablelist>
 396   </refsect1>
 397
 398   <refsect1>
 399     <title>[VLAN] Section Options</title>
 400
 401       <para>The <literal>[VLAN]</literal> section only applies for
 402       netdevs of kind <literal>vlan</literal>, and accepts the
 403       following key:</para>
 404
 405       <variablelist class='network-directives'>
 406         <varlistentry>
 407           <term><varname>Id=</varname></term>
 408           <listitem>
 409             <para>The VLAN ID to use. An integer in the range 0–4094.
 410             This option is compulsory.</para>
 411           </listitem>
 412         </varlistentry>
 413         <varlistentry>
 414           <term><varname>GVRP=</varname></term>
 415           <listitem>
 416             <para>The Generic VLAN Registration Protocol (GVRP) is a protocol that
 417             allows automatic learning of VLANs on a network. A boolean. When unset,
 418             the kernel's default setting applies.</para>
 419           </listitem>
 420         </varlistentry>
 421         <varlistentry>
 422           <term><varname>MVRP=</varname></term>
 423           <listitem>
 424             <para>Multiple VLAN Registration Protocol (MVRP) formerly known as GARP VLAN
 425             Registration Protocol (GVRP) is a standards-based Layer 2 network protocol,
 426             for automatic configuration of VLAN information on switches. It was defined
 427             in the 802.1ak amendment to 802.1Q-2005. A boolean. When unset, the kernel's
 428             default setting applies.</para>
 429           </listitem>
 430         </varlistentry>
 431         <varlistentry>
 432           <term><varname>LooseBinding=</varname></term>
 433           <listitem>
 434             <para>The VLAN loose binding mode, in which only the operational state is passed
 435             from the parent to the associated VLANs, but the VLAN device state is not changed.
 436             A boolean. When unset, the kernel's default setting applies.</para>
 437           </listitem>
 438         </varlistentry>
 439         <varlistentry>
 440           <term><varname>ReorderHeader=</varname></term>
 441           <listitem>
 442             <para>The VLAN reorder header is set VLAN interfaces behave like physical interfaces.
 443             A boolean. When unset, the kernel's default setting applies.</para>
 444           </listitem>
 445         </varlistentry>
 446       </variablelist>
 447   </refsect1>
 448
 449   <refsect1>
 450     <title>[MACVLAN] Section Options</title>
 451
 452     <para>The <literal>[MACVLAN]</literal> section only applies for
 453     netdevs of kind <literal>macvlan</literal>, and accepts the
 454     following key:</para>
 455
 456     <variablelist class='network-directives'>
 457       <varlistentry>
 458         <term><varname>Mode=</varname></term>
 459         <listitem>
 460           <para>The MACVLAN mode to use. The supported options are
 461           <literal>private</literal>,
 462           <literal>vepa</literal>,
 463           <literal>bridge</literal>, and
 464           <literal>passthru</literal>.
 465           </para>
 466         </listitem>
 467       </varlistentry>
 468     </variablelist>
 469
 470   </refsect1>
 471
 472     <refsect1>
 473     <title>[MACVTAP] Section Options</title>
 474
 475     <para>The <literal>[MACVTAP]</literal> section applies for
 476     netdevs of kind <literal>macvtap</literal> and accepts the
 477     same key as <literal>[MACVLAN]</literal>.</para>
 478
 479     </refsect1>
 480
 481   <refsect1>
 482     <title>[IPVLAN] Section Options</title>
 483
 484     <para>The <literal>[IPVLAN]</literal> section only applies for
 485     netdevs of kind <literal>ipvlan</literal>, and accepts the
 486     following key:</para>
 487
 488     <variablelist class='network-directives'>
 489       <varlistentry>
 490         <term><varname>Mode=</varname></term>
 491           <listitem>
 492             <para>The IPVLAN mode to use. The supported options are
 493             <literal>L2</literal>,<literal>L3</literal> and <literal>L3S</literal>.
 494             </para>
 495           </listitem>
 496       </varlistentry>
 497        <varlistentry>
 498         <term><varname>Flags=</varname></term>
 499           <listitem>
 500             <para>The IPVLAN flags to use. The supported options are
 501             <literal>bridge</literal>,<literal>private</literal> and <literal>vepa</literal>.
 502             </para>
 503           </listitem>
 504       </varlistentry>
 505     </variablelist>
 506
 507   </refsect1>
 508
 509   <refsect1>
 510     <title>[VXLAN] Section Options</title>
 511     <para>The <literal>[VXLAN]</literal> section only applies for
 512     netdevs of kind <literal>vxlan</literal>, and accepts the
 513     following keys:</para>
 514
 515     <variablelist class='network-directives'>
 516       <varlistentry>
 517         <term><varname>Id=</varname></term>
 518         <listitem>
 519           <para>The VXLAN ID to use.</para>
 520         </listitem>
 521       </varlistentry>
 522       <varlistentry>
 523         <term><varname>Remote=</varname></term>
 524         <listitem>
 525           <para>Configures destination IP address.</para>
 526         </listitem>
 527       </varlistentry>
 528       <varlistentry>
 529         <term><varname>Local=</varname></term>
 530         <listitem>
 531           <para>Configures local IP address.</para>
 532         </listitem>
 533       </varlistentry>
 534         <varlistentry>
 535         <term><varname>TOS=</varname></term>
 536         <listitem>
 537           <para>The Type Of Service byte value for a vxlan interface.</para>
 538         </listitem>
 539       </varlistentry>
 540       <varlistentry>
 541         <term><varname>TTL=</varname></term>
 542         <listitem>
 543           <para>A fixed Time To Live N on Virtual eXtensible Local
 544           Area Network packets. N is a number in the range 1–255. 0
 545           is a special value meaning that packets inherit the TTL
 546           value.</para>
 547         </listitem>
 548       </varlistentry>
 549       <varlistentry>
 550         <term><varname>MacLearning=</varname></term>
 551         <listitem>
 552           <para>A boolean. When true, enables dynamic MAC learning
 553           to discover remote MAC addresses.</para>
 554         </listitem>
 555       </varlistentry>
 556       <varlistentry>
 557         <term><varname>FDBAgeingSec=</varname></term>
 558         <listitem>
 559           <para>The lifetime of Forwarding Database entry learnt by
 560           the kernel, in seconds.</para>
 561         </listitem>
 562       </varlistentry>
 563       <varlistentry>
 564         <term><varname>MaximumFDBEntries=</varname></term>
 565         <listitem>
 566           <para>Configures maximum number of FDB entries.</para>
 567         </listitem>
 568       </varlistentry>
 569       <varlistentry>
 570         <term><varname>ReduceARPProxy=</varname></term>
 571         <listitem>
 572           <para>A boolean. When true, bridge-connected VXLAN tunnel
 573           endpoint answers ARP requests from the local bridge on behalf
 574           of remote Distributed Overlay Virtual Ethernet
 575           <ulink url="https://en.wikipedia.org/wiki/Distributed_Overlay_Virtual_Ethernet">
 576           (DVOE)</ulink> clients. Defaults to false.</para>
 577         </listitem>
 578       </varlistentry>
 579       <varlistentry>
 580         <term><varname>L2MissNotification=</varname></term>
 581         <listitem>
 582           <para>A boolean. When true, enables netlink LLADDR miss
 583           notifications.</para>
 584         </listitem>
 585       </varlistentry>
 586       <varlistentry>
 587         <term><varname>L3MissNotification=</varname></term>
 588         <listitem>
 589           <para>A boolean. When true, enables netlink IP address miss
 590           notifications.</para>
 591         </listitem>
 592       </varlistentry>
 593       <varlistentry>
 594         <term><varname>RouteShortCircuit=</varname></term>
 595         <listitem>
 596           <para>A boolean. When true, route short circuiting is turned
 597           on.</para>
 598         </listitem>
 599       </varlistentry>
 600       <varlistentry>
 601         <term><varname>UDPChecksum=</varname></term>
 602         <listitem>
 603           <para>A boolean. When true, transmitting UDP checksums when doing VXLAN/IPv4 is turned on.</para>
 604         </listitem>
 605       </varlistentry>
 606       <varlistentry>
 607         <term><varname>UDP6ZeroChecksumTx=</varname></term>
 608         <listitem>
 609           <para>A boolean. When true, sending zero checksums in VXLAN/IPv6 is turned on.</para>
 610         </listitem>
 611       </varlistentry>
 612       <varlistentry>
 613         <term><varname>UDP6ZeroChecksumRx=</varname></term>
 614         <listitem>
 615           <para>A boolean. When true, receiving zero checksums in VXLAN/IPv6 is turned on.</para>
 616         </listitem>
 617       </varlistentry>
 618       <varlistentry>
 619         <term><varname>RemoteChecksumTx=</varname></term>
 620         <listitem>
 621           <para>A boolean. When true, remote transmit checksum offload of VXLAN is turned on.</para>
 622         </listitem>
 623       </varlistentry>
 624       <varlistentry>
 625         <term><varname>RemoteChecksumRx=</varname></term>
 626         <listitem>
 627           <para>A boolean. When true, remote receive checksum offload in VXLAN is turned on.</para>
 628         </listitem>
 629       </varlistentry>
 630     <varlistentry>
 631       <term><varname>GroupPolicyExtension=</varname></term>
 632       <listitem>
 633         <para>A boolean. When true, it enables Group Policy VXLAN extension security label mechanism
 634         across network peers based on VXLAN. For details about the Group Policy VXLAN, see the
 635         <ulink url="https://tools.ietf.org/html/draft-smith-vxlan-group-policy">
 636         VXLAN Group Policy </ulink> document. Defaults to false.</para>
 637       </listitem>
 638     </varlistentry>
 639     <varlistentry>
 640       <term><varname>DestinationPort=</varname></term>
 641       <listitem>
 642         <para>Configures the default destination UDP port on a per-device basis.
 643         If destination port is not specified then Linux kernel default will be used.
 644         Set destination port 4789 to get the IANA assigned value. If not set or if the
 645         destination port is assigned the empty string the default port of 4789 is used.</para>
 646       </listitem>
 647     </varlistentry>
 648     <varlistentry>
 649       <term><varname>PortRange=</varname></term>
 650         <listitem>
 651           <para>Configures VXLAN port range. VXLAN bases source
 652           UDP port based on flow to help the receiver to be able
 653           to load balance based on outer header flow. It
 654           restricts the port range to the normal UDP local
 655           ports, and allows overriding via configuration.</para>
 656         </listitem>
 657       </varlistentry>
 658     <varlistentry>
 659       <term><varname>FlowLabel=</varname></term>
 660         <listitem>
 661           <para>Specifies the flow label to use in outgoing packets.
 662           The valid range is 0-1048575.
 663           </para>
 664         </listitem>
 665       </varlistentry>
 666     </variablelist>
 667   </refsect1>
 668   <refsect1>
 669     <title>[GENEVE] Section Options</title>
 670     <para>The <literal>[GENEVE]</literal> section only applies for
 671     netdevs of kind <literal>geneve</literal>, and accepts the
 672     following keys:</para>
 673
 674     <variablelist class='network-directives'>
 675       <varlistentry>
 676         <term><varname>Id=</varname></term>
 677         <listitem>
 678           <para>Specifies the Virtual Network Identifier (VNI) to use. Ranges [0-16777215].</para>
 679         </listitem>
 680       </varlistentry>
 681       <varlistentry>
 682         <term><varname>Remote=</varname></term>
 683         <listitem>
 684           <para>Specifies the unicast destination IP address to use in outgoing packets.</para>
 685         </listitem>
 686       </varlistentry>
 687       <varlistentry>
 688         <term><varname>TOS=</varname></term>
 689         <listitem>
 690           <para>Specifies the TOS value to use in outgoing packets. Ranges [1-255].</para>
 691         </listitem>
 692       </varlistentry>
 693       <varlistentry>
 694         <term><varname>TTL=</varname></term>
 695         <listitem>
 696           <para>Specifies the TTL value to use in outgoing packets. Ranges [1-255].</para>
 697         </listitem>
 698       </varlistentry>
 699       <varlistentry>
 700         <term><varname>UDPChecksum=</varname></term>
 701         <listitem>
 702           <para>A boolean. When true, specifies if UDP checksum is calculated for transmitted packets over IPv4.</para>
 703         </listitem>
 704       </varlistentry>
 705       <varlistentry>
 706         <term><varname>UDP6ZeroChecksumTx=</varname></term>
 707         <listitem>
 708           <para>A boolean. When true, skip UDP checksum calculation for transmitted packets over IPv6.</para>
 709         </listitem>
 710       </varlistentry>
 711       <varlistentry>
 712         <term><varname>UDP6ZeroChecksumRx=</varname></term>
 713         <listitem>
 714           <para>A boolean. When true, allows incoming UDP packets over IPv6 with zero checksum field.</para>
 715         </listitem>
 716       </varlistentry>
 717     <varlistentry>
 718       <term><varname>DestinationPort=</varname></term>
 719       <listitem>
 720         <para>Specifies destination port. Defaults to 6081. If not set or assigned the empty string, the default
 721         port of 6081 is used.</para>
 722       </listitem>
 723     </varlistentry>
 724     <varlistentry>
 725       <term><varname>FlowLabel=</varname></term>
 726         <listitem>
 727           <para>Specifies the flow label to use in outgoing packets.</para>
 728         </listitem>
 729       </varlistentry>
 730     </variablelist>
 731   </refsect1>
 732   <refsect1>
 733     <title>[Tunnel] Section Options</title>
 734
 735     <para>The <literal>[Tunnel]</literal> section only applies for
 736     netdevs of kind
 737     <literal>ipip</literal>,
 738     <literal>sit</literal>,
 739     <literal>gre</literal>,
 740     <literal>gretap</literal>,
 741     <literal>ip6gre</literal>,
 742     <literal>ip6gretap</literal>,
 743     <literal>vti</literal>,
 744     <literal>vti6</literal>, and
 745     <literal>ip6tnl</literal> and accepts
 746     the following keys:</para>
 747
 748     <variablelist class='network-directives'>
 749       <varlistentry>
 750         <term><varname>Local=</varname></term>
 751         <listitem>
 752           <para>A static local address for tunneled packets. It must
 753           be an address on another interface of this host.</para>
 754         </listitem>
 755       </varlistentry>
 756       <varlistentry>
 757         <term><varname>Remote=</varname></term>
 758         <listitem>
 759           <para>The remote endpoint of the tunnel.</para>
 760         </listitem>
 761       </varlistentry>
 762       <varlistentry>
 763         <term><varname>TOS=</varname></term>
 764         <listitem>
 765           <para>The Type Of Service byte value for a tunnel interface.
 766           For details about the TOS, see the
 767           <ulink url="http://tools.ietf.org/html/rfc1349"> Type of
 768           Service in the Internet Protocol Suite </ulink> document.
 769           </para>
 770         </listitem>
 771       </varlistentry>
 772       <varlistentry>
 773         <term><varname>TTL=</varname></term>
 774         <listitem>
 775           <para>A fixed Time To Live N on tunneled packets. N is a
 776           number in the range 1–255. 0 is a special value meaning that
 777           packets inherit the TTL value. The default value for IPv4
 778           tunnels is: inherit. The default value for IPv6 tunnels is
 779           64.</para>
 780         </listitem>
 781       </varlistentry>
 782       <varlistentry>
 783         <term><varname>DiscoverPathMTU=</varname></term>
 784         <listitem>
 785           <para>A boolean. When true, enables Path MTU Discovery on
 786           the tunnel.</para>
 787         </listitem>
 788       </varlistentry>
 789       <varlistentry>
 790         <term><varname>IPv6FlowLabel=</varname></term>
 791         <listitem>
 792           <para>Configures the 20-bit flow label (see <ulink url="https://tools.ietf.org/html/rfc6437">
 793           RFC 6437</ulink>) field in the IPv6 header (see <ulink url="https://tools.ietf.org/html/rfc2460">
 794           RFC 2460</ulink>), which is used by a node to label packets of a flow.
 795           It is only used for IPv6 tunnels.
 796           A flow label of zero is used to indicate packets that have
 797           not been labeled.
 798           It can be configured to a value in the range 0–0xFFFFF, or be
 799           set to <literal>inherit</literal>, in which case the original flowlabel is used.</para>
 800         </listitem>
 801       </varlistentry>
 802       <varlistentry>
 803         <term><varname>CopyDSCP=</varname></term>
 804         <listitem>
 805           <para>A boolean. When true, the Differentiated Service Code
 806           Point (DSCP) field will be copied to the inner header from
 807           outer header during the decapsulation of an IPv6 tunnel
 808           packet. DSCP is a field in an IP packet that enables different
 809           levels of service to be assigned to network traffic.
 810           Defaults to <literal>no</literal>.
 811           </para>
 812         </listitem>
 813       </varlistentry>
 814       <varlistentry>
 815         <term><varname>EncapsulationLimit=</varname></term>
 816         <listitem>
 817           <para>The Tunnel Encapsulation Limit option specifies how many additional
 818           levels of encapsulation are permitted to be prepended to the packet.
 819           For example, a Tunnel Encapsulation Limit option containing a limit
 820           value of zero means that a packet carrying that option may not enter
 821           another tunnel before exiting the current tunnel.
 822           (see <ulink url="https://tools.ietf.org/html/rfc2473#section-4.1.1"> RFC 2473</ulink>).
 823           The valid range is 0–255 and <literal>none</literal>. Defaults to 4.
 824         </para>
 825         </listitem>
 826       </varlistentry>
 827       <varlistentry>
 828         <term><varname>Key=</varname></term>
 829         <listitem>
 830           <para>The <varname>Key=</varname> parameter specifies the same key to use in
 831           both directions (<varname>InputKey=</varname> and <varname>OutputKey=</varname>).
 832           The <varname>Key=</varname> is either a number or an IPv4 address-like dotted quad.
 833           It is used as mark-configured SAD/SPD entry as part of the lookup key (both in data
 834           and control path) in ip xfrm (framework used to implement IPsec protocol).
 835           See <ulink url="http://man7.org/linux/man-pages/man8/ip-xfrm.8.html">
 836           ip-xfrm — transform configuration</ulink> for details. It is only used for VTI/VTI6
 837           tunnels.</para>
 838         </listitem>
 839       </varlistentry>
 840       <varlistentry>
 841         <term><varname>InputKey=</varname></term>
 842         <listitem>
 843           <para>The <varname>InputKey=</varname> parameter specifies the key to use for input.
 844           The format is same as <varname>Key=</varname>. It is only used for VTI/VTI6 tunnels.</para>
 845         </listitem>
 846       </varlistentry>
 847       <varlistentry>
 848         <term><varname>OutputKey=</varname></term>
 849         <listitem>
 850           <para>The <varname>OutputKey=</varname> parameter specifies the key to use for output.
 851           The format is same as <varname>Key=</varname>. It is only used for VTI/VTI6 tunnels.</para>
 852         </listitem>
 853       </varlistentry>
 854       <varlistentry>
 855         <term><varname>Mode=</varname></term>
 856         <listitem>
 857           <para>An <literal>ip6tnl</literal> tunnel can be in one of three
 858           modes
 859           <literal>ip6ip6</literal> for IPv6 over IPv6,
 860           <literal>ipip6</literal> for IPv4 over IPv6 or
 861           <literal>any</literal> for either.
 862           </para>
 863         </listitem>
 864       </varlistentry>
 865       <varlistentry>
 866         <term><varname>Independent=</varname></term>
 867         <listitem>
 868           <para>A boolean. When true tunnel does not require .network file. Created as "tunnel@NONE".
 869           Defaults to <literal>false</literal>.
 870           </para>
 871         </listitem>
 872       </varlistentry>
 873       <varlistentry>
 874         <term><varname>AllowLocalRemote=</varname></term>
 875         <listitem>
 876           <para>A boolean. When true allows tunnel traffic on <varname>ip6tnl</varname> devices where the remote endpoint is a local host address.
 877           Defaults to unset.
 878           </para>
 879         </listitem>
 880       </varlistentry>
 881     </variablelist>
 882   </refsect1>
 883   <refsect1>
 884     <title>[Peer] Section Options</title>
 885
 886       <para>The <literal>[Peer]</literal> section only applies for
 887       netdevs of kind <literal>veth</literal> and accepts the
 888       following keys:</para>
 889
 890       <variablelist class='network-directives'>
 891         <varlistentry>
 892           <term><varname>Name=</varname></term>
 893           <listitem>
 894             <para>The interface name used when creating the netdev.
 895             This option is compulsory.</para>
 896           </listitem>
 897         </varlistentry>
 898         <varlistentry>
 899           <term><varname>MACAddress=</varname></term>
 900           <listitem>
 901             <para>The peer MACAddress, if not set, it is generated in
 902             the same way as the MAC address of the main
 903             interface.</para>
 904           </listitem>
 905         </varlistentry>
 906       </variablelist>
 907   </refsect1>
 908   <refsect1>
 909   <title>[VXCAN] Section Options</title>
 910       <para>The <literal>[VXCAN]</literal> section only applies for
 911       netdevs of kind <literal>vxcan</literal> and accepts the
 912       following key:</para>
 913
 914       <variablelist class='network-directives'>
 915         <varlistentry>
 916           <term><varname>Peer=</varname></term>
 917           <listitem>
 918             <para>The peer interface name used when creating the netdev.
 919             This option is compulsory.</para>
 920           </listitem>
 921         </varlistentry>
 922       </variablelist>
 923   </refsect1>
 924   <refsect1>
 925     <title>[Tun] Section Options</title>
 926
 927     <para>The <literal>[Tun]</literal> section only applies for
 928     netdevs of kind <literal>tun</literal>, and accepts the following
 929     keys:</para>
 930
 931     <variablelist class='network-directives'>
 932       <varlistentry>
 933         <term><varname>OneQueue=</varname></term>
 934         <listitem><para>Takes a boolean argument. Configures whether
 935         all packets are queued at the device (enabled), or a fixed
 936         number of packets are queued at the device and the rest at the
 937         <literal>qdisc</literal>. Defaults to
 938         <literal>no</literal>.</para>
 939         </listitem>
 940       </varlistentry>
 941       <varlistentry>
 942         <term><varname>MultiQueue=</varname></term>
 943         <listitem><para>Takes a boolean argument. Configures whether
 944         to use multiple file descriptors (queues) to parallelize
 945         packets sending and receiving. Defaults to
 946         <literal>no</literal>.</para>
 947         </listitem>
 948       </varlistentry>
 949       <varlistentry>
 950         <term><varname>PacketInfo=</varname></term>
 951         <listitem><para>Takes a boolean argument. Configures whether
 952         packets should be prepended with four extra bytes (two flag
 953         bytes and two protocol bytes). If disabled, it indicates that
 954         the packets will be pure IP packets. Defaults to
 955         <literal>no</literal>.</para>
 956         </listitem>
 957       </varlistentry>
 958       <varlistentry>
 959         <term><varname>VNetHeader=</varname></term>
 960         <listitem><para>Takes a boolean argument. Configures
 961         IFF_VNET_HDR flag for a tap device. It allows sending
 962         and receiving larger Generic Segmentation Offload (GSO)
 963         packets. This may increase throughput significantly.
 964         Defaults to
 965         <literal>no</literal>.</para>
 966         </listitem>
 967       </varlistentry>
 968       <varlistentry>
 969         <term><varname>User=</varname></term>
 970         <listitem><para>User to grant access to the
 971         <filename>/dev/net/tun</filename> device.</para>
 972         </listitem>
 973       </varlistentry>
 974       <varlistentry>
 975         <term><varname>Group=</varname></term>
 976         <listitem><para>Group to grant access to the
 977         <filename>/dev/net/tun</filename> device.</para>
 978         </listitem>
 979       </varlistentry>
 980
 981     </variablelist>
 982
 983   </refsect1>
 984
 985   <refsect1>
 986     <title>[Tap] Section Options</title>
 987
 988     <para>The <literal>[Tap]</literal> section only applies for
 989     netdevs of kind <literal>tap</literal>, and accepts the same keys
 990     as the <literal>[Tun]</literal> section.</para>
 991   </refsect1>
 992
 993   <refsect1>
 994     <title>[WireGuard] Section Options</title>
 995
 996     <para>The <literal>[WireGuard]</literal> section accepts the following
 997     keys:</para>
 998
 999     <variablelist class='network-directives'>
1000       <varlistentry>
1001         <term><varname>PrivateKey=</varname></term>
1002         <listitem>
1003           <para>The Base64 encoded private key for the interface. It can be
1004             generated using the <command>wg genkey</command> command
1005             (see <citerefentry project="wireguard"><refentrytitle>wg</refentrytitle><manvolnum>8</manvolnum></citerefentry>).
1006             This option is mandatory to use WireGuard.
1007             Note that because this information is secret, you may want to set
1008             the permissions of the .netdev file to be owned by <literal>root:systemd-networkd</literal>
1009             with a <literal>0640</literal> file mode.</para>
1010         </listitem>
1011       </varlistentry>
1012       <varlistentry>
1013         <term><varname>ListenPort=</varname></term>
1014         <listitem>
1015           <para>Sets UDP port for listening. Takes either value between 1 and 65535
1016             or <literal>auto</literal>. If <literal>auto</literal> is specified,
1017             the port is automatically generated based on interface name.
1018             Defaults to <literal>auto</literal>.</para>
1019         </listitem>
1020       </varlistentry>
1021       <varlistentry>
1022         <term><varname>FwMark=</varname></term>
1023         <listitem>
1024           <para>Sets a firewall mark on outgoing WireGuard packets from this interface.</para>
1025         </listitem>
1026       </varlistentry>
1027     </variablelist>
1028   </refsect1>
1029
1030   <refsect1>
1031     <title>[WireGuardPeer] Section Options</title>
1032
1033     <para>The <literal>[WireGuardPeer]</literal> section accepts the following
1034     keys:</para>
1035
1036     <variablelist class='network-directives'>
1037       <varlistentry>
1038         <term><varname>PublicKey=</varname></term>
1039         <listitem>
1040           <para>Sets a Base64 encoded public key calculated by <command>wg pubkey</command>
1041             (see <citerefentry project="wireguard"><refentrytitle>wg</refentrytitle><manvolnum>8</manvolnum></citerefentry>)
1042             from a private key, and usually transmitted out of band to the
1043             author of the configuration file. This option is mandatory for this
1044             section.</para>
1045         </listitem>
1046       </varlistentry>
1047       <varlistentry>
1048         <term><varname>PresharedKey=</varname></term>
1049         <listitem>
1050           <para>Optional preshared key for the interface. It can be generated
1051             by the <command>wg genpsk</command> command. This option adds an
1052             additional layer of symmetric-key cryptography to be mixed into the
1053             already existing public-key cryptography, for post-quantum
1054             resistance.
1055             Note that because this information is secret, you may want to set
1056             the permissions of the .netdev file to be owned by <literal>root:systemd-networkd</literal>
1057             with a <literal>0640</literal> file mode.</para>
1058         </listitem>
1059       </varlistentry>
1060       <varlistentry>
1061         <term><varname>AllowedIPs=</varname></term>
1062         <listitem>
1063           <para>Sets a comma-separated list of IP (v4 or v6) addresses with CIDR masks
1064             from which this peer is allowed to send incoming traffic and to
1065             which outgoing traffic for this peer is directed. The catch-all
1066             0.0.0.0/0 may be specified for matching all IPv4 addresses, and
1067             ::/0 may be specified for matching all IPv6 addresses. </para>
1068         </listitem>
1069       </varlistentry>
1070       <varlistentry>
1071         <term><varname>Endpoint=</varname></term>
1072         <listitem>
1073           <para>Sets an endpoint IP address or hostname, followed by a colon, and then
1074             a port number. This endpoint will be updated automatically once to
1075             the most recent source IP address and port of correctly
1076             authenticated packets from the peer at configuration time.</para>
1077         </listitem>
1078       </varlistentry>
1079       <varlistentry>
1080         <term><varname>PersistentKeepalive=</varname></term>
1081         <listitem>
1082           <para>Sets a seconds interval, between 1 and 65535 inclusive, of how often
1083             to send an authenticated empty packet to the peer for the purpose
1084             of keeping a stateful firewall or NAT mapping valid persistently.
1085             For example, if the interface very rarely sends traffic, but it
1086             might at anytime receive traffic from a peer, and it is behind NAT,
1087             the interface might benefit from having a persistent keepalive
1088             interval of 25 seconds. If set to 0 or "off", this option is
1089             disabled. By default or when unspecified, this option is off.
1090             Most users will not need this.</para>
1091         </listitem>
1092       </varlistentry>
1093     </variablelist>
1094   </refsect1>
1095
1096   <refsect1>
1097     <title>[Bond] Section Options</title>
1098
1099     <para>The <literal>[Bond]</literal> section accepts the following
1100     key:</para>
1101
1102     <variablelist class='network-directives'>
1103       <varlistentry>
1104         <term><varname>Mode=</varname></term>
1105         <listitem>
1106           <para>Specifies one of the bonding policies. The default is
1107           <literal>balance-rr</literal> (round robin). Possible values are
1108           <literal>balance-rr</literal>,
1109           <literal>active-backup</literal>,
1110           <literal>balance-xor</literal>,
1111           <literal>broadcast</literal>,
1112           <literal>802.3ad</literal>,
1113           <literal>balance-tlb</literal>, and
1114           <literal>balance-alb</literal>.
1115           </para>
1116         </listitem>
1117       </varlistentry>
1118
1119       <varlistentry>
1120         <term><varname>TransmitHashPolicy=</varname></term>
1121         <listitem>
1122           <para>Selects the transmit hash policy to use for slave
1123           selection in balance-xor, 802.3ad, and tlb modes. Possible
1124           values are
1125           <literal>layer2</literal>,
1126           <literal>layer3+4</literal>,
1127           <literal>layer2+3</literal>,
1128           <literal>encap2+3</literal>, and
1129           <literal>encap3+4</literal>.
1130           </para>
1131         </listitem>
1132       </varlistentry>
1133
1134       <varlistentry>
1135         <term><varname>LACPTransmitRate=</varname></term>
1136         <listitem>
1137           <para>Specifies the rate with which link partner transmits
1138           Link Aggregation Control Protocol Data Unit packets in
1139           802.3ad mode. Possible values are <literal>slow</literal>,
1140           which requests partner to transmit LACPDUs every 30 seconds,
1141           and <literal>fast</literal>, which requests partner to
1142           transmit LACPDUs every second. The default value is
1143           <literal>slow</literal>.</para>
1144         </listitem>
1145       </varlistentry>
1146
1147       <varlistentry>
1148         <term><varname>MIIMonitorSec=</varname></term>
1149         <listitem>
1150           <para>Specifies the frequency that Media Independent
1151           Interface link monitoring will occur. A value of zero
1152           disables MII link monitoring. This value is rounded down to
1153           the nearest millisecond. The default value is 0.</para>
1154         </listitem>
1155       </varlistentry>
1156
1157       <varlistentry>
1158         <term><varname>UpDelaySec=</varname></term>
1159         <listitem>
1160           <para>Specifies the delay before a link is enabled after a
1161           link up status has been detected. This value is rounded down
1162           to a multiple of MIIMonitorSec. The default value is
1163           0.</para>
1164         </listitem>
1165       </varlistentry>
1166
1167       <varlistentry>
1168         <term><varname>DownDelaySec=</varname></term>
1169         <listitem>
1170           <para>Specifies the delay before a link is disabled after a
1171           link down status has been detected. This value is rounded
1172           down to a multiple of MIIMonitorSec. The default value is
1173           0.</para>
1174         </listitem>
1175       </varlistentry>
1176
1177       <varlistentry>
1178         <term><varname>LearnPacketIntervalSec=</varname></term>
1179         <listitem>
1180           <para>Specifies the number of seconds between instances where the bonding
1181           driver sends learning packets to each slave peer switch.
1182           The valid range is 1–0x7fffffff; the default value is 1. This option
1183           has an effect only for the balance-tlb and balance-alb modes.</para>
1184         </listitem>
1185       </varlistentry>
1186
1187       <varlistentry>
1188         <term><varname>AdSelect=</varname></term>
1189         <listitem>
1190           <para>Specifies the 802.3ad aggregation selection logic to use. Possible values are
1191           <literal>stable</literal>,
1192           <literal>bandwidth</literal> and
1193           <literal>count</literal>.
1194           </para>
1195         </listitem>
1196       </varlistentry>
1197
1198       <varlistentry>
1199         <term><varname>FailOverMACPolicy=</varname></term>
1200         <listitem>
1201           <para>Specifies whether the active-backup mode should set all slaves to
1202           the same MAC address at the time of enslavement or, when enabled, to perform special handling of the
1203           bond's MAC address in accordance with the selected policy. The default policy is none.
1204           Possible values are
1205           <literal>none</literal>,
1206           <literal>active</literal> and
1207           <literal>follow</literal>.
1208           </para>
1209         </listitem>
1210       </varlistentry>
1211
1212       <varlistentry>
1213         <term><varname>ARPValidate=</varname></term>
1214         <listitem>
1215           <para>Specifies whether or not ARP probes and replies should be
1216           validated in any mode that supports ARP monitoring, or whether
1217           non-ARP traffic should be filtered (disregarded) for link
1218           monitoring purposes. Possible values are
1219           <literal>none</literal>,
1220           <literal>active</literal>,
1221           <literal>backup</literal> and
1222           <literal>all</literal>.
1223           </para>
1224         </listitem>
1225       </varlistentry>
1226
1227       <varlistentry>
1228         <term><varname>ARPIntervalSec=</varname></term>
1229         <listitem>
1230           <para>Specifies the ARP link monitoring frequency in milliseconds.
1231           A value of 0 disables ARP monitoring. The default value is 0.
1232           </para>
1233         </listitem>
1234       </varlistentry>
1235
1236       <varlistentry>
1237         <term><varname>ARPIPTargets=</varname></term>
1238         <listitem>
1239           <para>Specifies the IP addresses to use as ARP monitoring peers when
1240           ARPIntervalSec is greater than 0. These are the targets of the ARP request
1241           sent to determine the health of the link to the targets.
1242           Specify these values in IPv4 dotted decimal format. At least one IP
1243           address must be given for ARP monitoring to function. The
1244           maximum number of targets that can be specified is 16. The
1245           default value is no IP addresses.
1246           </para>
1247         </listitem>
1248       </varlistentry>
1249
1250       <varlistentry>
1251         <term><varname>ARPAllTargets=</varname></term>
1252         <listitem>
1253           <para>Specifies the quantity of ARPIPTargets that must be reachable
1254           in order for the ARP monitor to consider a slave as being up.
1255           This option affects only active-backup mode for slaves with
1256           ARPValidate enabled. Possible values are
1257           <literal>any</literal> and
1258           <literal>all</literal>.
1259           </para>
1260         </listitem>
1261       </varlistentry>
1262
1263       <varlistentry>
1264         <term><varname>PrimaryReselectPolicy=</varname></term>
1265         <listitem>
1266           <para>Specifies the reselection policy for the primary slave.  This
1267           affects how the primary slave is chosen to become the active slave
1268           when failure of the active slave or recovery of the primary slave
1269           occurs. This option is designed to prevent flip-flopping between
1270           the primary slave and other slaves.  Possible values are
1271           <literal>always</literal>,
1272           <literal>better</literal> and
1273           <literal>failure</literal>.
1274           </para>
1275         </listitem>
1276       </varlistentry>
1277
1278       <varlistentry>
1279         <term><varname>ResendIGMP=</varname></term>
1280         <listitem>
1281           <para>Specifies the number of IGMP membership reports to be issued after
1282           a failover event. One membership report is issued immediately after
1283           the failover, subsequent packets are sent in each 200ms interval.
1284           The valid range is 0–255. Defaults to 1. A value of 0
1285           prevents the IGMP membership report from being issued in response
1286           to the failover event.
1287           </para>
1288         </listitem>
1289       </varlistentry>
1290
1291       <varlistentry>
1292         <term><varname>PacketsPerSlave=</varname></term>
1293         <listitem>
1294           <para>Specify the number of packets to transmit through a slave before
1295             moving to the next one. When set to 0, then a slave is chosen at
1296             random. The valid range is 0–65535. Defaults to 1. This option
1297             only has effect when in balance-rr mode.
1298           </para>
1299         </listitem>
1300       </varlistentry>
1301
1302       <varlistentry>
1303         <term><varname>GratuitousARP=</varname></term>
1304         <listitem>
1305           <para>Specify the number of peer notifications (gratuitous ARPs and
1306             unsolicited IPv6 Neighbor Advertisements) to be issued after a
1307             failover event.  As soon as the link is up on the new slave,
1308             a peer notification is sent on the  bonding device and each
1309             VLAN sub-device.  This is repeated at each link monitor interval
1310             (ARPIntervalSec or MIIMonitorSec, whichever is active) if the number is
1311             greater than 1. The valid range is 0–255. The default value is 1.
1312             These options affect only the active-backup mode.
1313           </para>
1314         </listitem>
1315       </varlistentry>
1316
1317       <varlistentry>
1318         <term><varname>AllSlavesActive=</varname></term>
1319         <listitem>
1320           <para>A boolean. Specifies that duplicate frames (received on inactive ports)
1321           should be dropped when false, or delivered when true. Normally, bonding will drop
1322           duplicate frames (received on inactive ports), which is desirable for
1323           most users. But there are some times it is nice to allow duplicate
1324           frames to be delivered. The default value is false (drop duplicate frames
1325           received on inactive ports).
1326           </para>
1327         </listitem>
1328       </varlistentry>
1329
1330       <varlistentry>
1331         <term><varname>MinLinks=</varname></term>
1332         <listitem>
1333           <para>Specifies the minimum number of links that must be active before
1334           asserting carrier. The default value is 0.
1335           </para>
1336         </listitem>
1337       </varlistentry>
1338     </variablelist>
1339
1340     <para>For more detail information see
1341     <ulink url="https://www.kernel.org/doc/Documentation/networking/bonding.txt">
1342     Linux Ethernet Bonding Driver HOWTO</ulink></para>
1343
1344   </refsect1>
1345
1346   <refsect1>
1347     <title>Example</title>
1348     <example>
1349       <title>/etc/systemd/network/25-bridge.netdev</title>
1350
1351       <programlisting>[NetDev]
1352 Name=bridge0
1353 Kind=bridge</programlisting>
1354     </example>
1355
1356     <example>
1357       <title>/etc/systemd/network/25-vlan1.netdev</title>
1358
1359       <programlisting>[Match]
1360 Virtualization=no
1361
1362 [NetDev]
1363 Name=vlan1
1364 Kind=vlan
1365
1366 [VLAN]
1367 Id=1</programlisting>
1368     </example>
1369     <example>
1370       <title>/etc/systemd/network/25-ipip.netdev</title>
1371       <programlisting>[NetDev]
1372 Name=ipip-tun
1373 Kind=ipip
1374 MTUBytes=1480
1375
1376 [Tunnel]
1377 Local=192.168.223.238
1378 Remote=192.169.224.239
1379 TTL=64</programlisting>
1380     </example>
1381     <example>
1382       <title>/etc/systemd/network/25-tap.netdev</title>
1383       <programlisting>[NetDev]
1384 Name=tap-test
1385 Kind=tap
1386
1387 [Tap]
1388 MultiQueue=true
1389 PacketInfo=true</programlisting> </example>
1390
1391     <example>
1392       <title>/etc/systemd/network/25-sit.netdev</title>
1393       <programlisting>[NetDev]
1394 Name=sit-tun
1395 Kind=sit
1396 MTUBytes=1480
1397
1398 [Tunnel]
1399 Local=10.65.223.238
1400 Remote=10.65.223.239</programlisting>
1401     </example>
1402
1403     <example>
1404       <title>/etc/systemd/network/25-gre.netdev</title>
1405       <programlisting>[NetDev]
1406 Name=gre-tun
1407 Kind=gre
1408 MTUBytes=1480
1409
1410 [Tunnel]
1411 Local=10.65.223.238
1412 Remote=10.65.223.239</programlisting>
1413     </example>
1414
1415     <example>
1416       <title>/etc/systemd/network/25-vti.netdev</title>
1417
1418       <programlisting>[NetDev]
1419 Name=vti-tun
1420 Kind=vti
1421 MTUBytes=1480
1422
1423 [Tunnel]
1424 Local=10.65.223.238
1425 Remote=10.65.223.239</programlisting>
1426     </example>
1427
1428     <example>
1429       <title>/etc/systemd/network/25-veth.netdev</title>
1430       <programlisting>[NetDev]
1431 Name=veth-test
1432 Kind=veth
1433
1434 [Peer]
1435 Name=veth-peer</programlisting>
1436     </example>
1437
1438     <example>
1439       <title>/etc/systemd/network/25-bond.netdev</title>
1440       <programlisting>[NetDev]
1441 Name=bond1
1442 Kind=bond
1443
1444 [Bond]
1445 Mode=802.3ad
1446 TransmitHashPolicy=layer3+4
1447 MIIMonitorSec=1s
1448 LACPTransmitRate=fast
1449 </programlisting>
1450     </example>
1451
1452     <example>
1453       <title>/etc/systemd/network/25-dummy.netdev</title>
1454       <programlisting>[NetDev]
1455 Name=dummy-test
1456 Kind=dummy
1457 MACAddress=12:34:56:78:9a:bc</programlisting>
1458     </example>
1459     <example>
1460       <title>/etc/systemd/network/25-vrf.netdev</title>
1461       <para>Create a VRF interface with table 42.</para>
1462       <programlisting>[NetDev]
1463 Name=vrf-test
1464 Kind=vrf
1465
1466 [VRF]
1467 Table=42</programlisting>
1468     </example>
1469
1470     <example>
1471       <title>/etc/systemd/network/25-macvtap.netdev</title>
1472       <para>Create a MacVTap device.</para>
1473       <programlisting>[NetDev]
1474 Name=macvtap-test
1475 Kind=macvtap
1476       </programlisting>
1477     </example>
1478     <example>
1479       <title>/etc/systemd/network/25-wireguard.netdev</title>
1480       <programlisting>[NetDev]
1481 Name=wg0
1482 Kind=wireguard
1483
1484 [WireGuard]
1485 PrivateKey=EEGlnEPYJV//kbvvIqxKkQwOiS+UENyPncC4bF46ong=
1486 ListenPort=51820
1487
1488 [WireGuardPeer]
1489 PublicKey=RDf+LSpeEre7YEIKaxg+wbpsNV7du+ktR99uBEtIiCA=
1490 AllowedIPs=fd31:bf08:57cb::/48,192.168.26.0/24
1491 Endpoint=wireguard.example.com:51820</programlisting>
1492     </example>
1493   </refsect1>
1494   <refsect1>
1495     <title>See Also</title>
1496     <para>
1497       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1498       <citerefentry><refentrytitle>systemd-networkd</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1499       <citerefentry><refentrytitle>systemd.link</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1500       <citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1501     </para>
1502   </refsect1>
1503
1504 </refentry>