man/systemd.netdev.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   3   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4 <!-- SPDX-License-Identifier: LGPL-2.1+ -->
   5
   6 <refentry id="systemd.netdev" conditional='ENABLE_NETWORKD'>
   7
   8   <refentryinfo>
   9     <title>systemd.network</title>
  10     <productname>systemd</productname>
  11   </refentryinfo>
  12
  13   <refmeta>
  14     <refentrytitle>systemd.netdev</refentrytitle>
  15     <manvolnum>5</manvolnum>
  16   </refmeta>
  17
  18   <refnamediv>
  19     <refname>systemd.netdev</refname>
  20     <refpurpose>Virtual Network Device configuration</refpurpose>
  21   </refnamediv>
  22
  23   <refsynopsisdiv>
  24     <para><filename><replaceable>netdev</replaceable>.netdev</filename></para>
  25   </refsynopsisdiv>
  26
  27   <refsect1>
  28     <title>Description</title>
  29
  30     <para>Network setup is performed by
  31     <citerefentry><refentrytitle>systemd-networkd</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
  32     </para>
  33
  34     <para>The main Virtual Network Device file must have the extension <filename>.netdev</filename>;
  35     other extensions are ignored. Virtual network devices are created as soon as networkd is
  36     started. If a netdev with the specified name already exists, networkd will use that as-is rather
  37     than create its own. Note that the settings of the pre-existing netdev will not be changed by
  38     networkd.</para>
  39
  40     <para>The <filename>.netdev</filename> files are read from the files located in the system
  41     network directory <filename>/usr/lib/systemd/network</filename>, the volatile runtime network
  42     directory <filename>/run/systemd/network</filename> and the local administration network
  43     directory <filename>/etc/systemd/network</filename>. All configuration files are collectively
  44     sorted and processed in lexical order, regardless of the directories in which they live.
  45     However, files with identical filenames replace each other. Files in <filename>/etc</filename>
  46     have the highest priority, files in <filename>/run</filename> take precedence over files with
  47     the same name in <filename>/usr/lib</filename>. This can be used to override a system-supplied
  48     configuration file with a local file if needed. As a special case, an empty file (file size 0)
  49     or symlink with the same name pointing to <filename>/dev/null</filename> disables the
  50     configuration file entirely (it is "masked").</para>
  51
  52     <para>Along with the netdev file <filename>foo.netdev</filename>, a "drop-in" directory
  53     <filename>foo.netdev.d/</filename> may exist. All files with the suffix <literal>.conf</literal>
  54     from this directory will be parsed after the file itself is parsed. This is useful to alter or
  55     add configuration settings, without having to modify the main configuration file. Each drop-in
  56     file must have appropriate section headers.</para>
  57
  58     <para>In addition to <filename>/etc/systemd/network</filename>, drop-in <literal>.d</literal>
  59     directories can be placed in <filename>/usr/lib/systemd/network</filename> or
  60     <filename>/run/systemd/network</filename> directories. Drop-in files in
  61     <filename>/etc</filename> take precedence over those in <filename>/run</filename> which in turn
  62     take precedence over those in <filename>/usr/lib</filename>. Drop-in files under any of these
  63     directories take precedence over the main netdev file wherever located. (Of course, since
  64     <filename>/run</filename> is temporary and <filename>/usr/lib</filename> is for vendors, it is
  65     unlikely drop-ins should be used in either of those places.)</para>
  66   </refsect1>
  67
  68   <refsect1>
  69     <title>Supported netdev kinds</title>
  70
  71     <para>The following kinds of virtual network devices may be
  72     configured in <filename>.netdev</filename> files:</para>
  73
  74     <table>
  75       <title>Supported kinds of virtual network devices</title>
  76
  77       <tgroup cols='2'>
  78         <colspec colname='kind' />
  79         <colspec colname='explanation' />
  80         <thead><row>
  81           <entry>Kind</entry>
  82           <entry>Description</entry>
  83         </row></thead>
  84         <tbody>
  85           <row><entry><varname>bond</varname></entry>
  86           <entry>A bond device is an aggregation of all its slave devices. See <ulink url="https://www.kernel.org/doc/Documentation/networking/bonding.txt">Linux Ethernet Bonding Driver HOWTO</ulink> for details.Local configuration</entry></row>
  87
  88           <row><entry><varname>bridge</varname></entry>
  89           <entry>A bridge device is a software switch, and each of its slave devices and the bridge itself are ports of the switch.</entry></row>
  90
  91           <row><entry><varname>dummy</varname></entry>
  92           <entry>A dummy device drops all packets sent to it.</entry></row>
  93
  94           <row><entry><varname>gre</varname></entry>
  95           <entry>A Level 3 GRE tunnel over IPv4. See <ulink url="https://tools.ietf.org/html/rfc2784">RFC 2784</ulink> for details.</entry></row>
  96
  97           <row><entry><varname>gretap</varname></entry>
  98           <entry>A Level 2 GRE tunnel over IPv4.</entry></row>
  99
 100           <row><entry><varname>erspan</varname></entry>
 101           <entry>ERSPAN mirrors traffic on one or more source ports and delivers the mirrored traffic to one or more destination ports on another switch. The traffic is encapsulated in generic routing encapsulation (GRE) and is therefore routable across a layer 3 network between the source switch and the destination switch.</entry></row>
 102
 103           <row><entry><varname>ip6gre</varname></entry>
 104           <entry>A Level 3 GRE tunnel over IPv6.</entry></row>
 105
 106           <row><entry><varname>ip6tnl</varname></entry>
 107           <entry>An IPv4 or IPv6 tunnel over IPv6</entry></row>
 108
 109           <row><entry><varname>ip6gretap</varname></entry>
 110           <entry>A Level 2 GRE tunnel over IPv6.</entry></row>
 111
 112           <row><entry><varname>ipip</varname></entry>
 113           <entry>An IPv4 over IPv4 tunnel.</entry></row>
 114
 115           <row><entry><varname>ipvlan</varname></entry>
 116           <entry>An ipvlan device is a stacked device which receives packets from its underlying device based on IP address filtering.</entry></row>
 117
 118           <row><entry><varname>ipvtap</varname></entry>
 119           <entry>An ipvtap device is a stacked device which receives packets from its underlying device based on IP address filtering and can be accessed using the tap user space interface.</entry></row>
 120
 121           <row><entry><varname>macvlan</varname></entry>
 122           <entry>A macvlan device is a stacked device which receives packets from its underlying device based on MAC address filtering.</entry></row>
 123
 124           <row><entry><varname>macvtap</varname></entry>
 125           <entry>A macvtap device is a stacked device which receives packets from its underlying device based on MAC address filtering.</entry></row>
 126
 127           <row><entry><varname>sit</varname></entry>
 128           <entry>An IPv6 over IPv4 tunnel.</entry></row>
 129
 130           <row><entry><varname>tap</varname></entry>
 131           <entry>A persistent Level 2 tunnel between a network device and a device node.</entry></row>
 132
 133           <row><entry><varname>tun</varname></entry>
 134           <entry>A persistent Level 3 tunnel between a network device and a device node.</entry></row>
 135
 136           <row><entry><varname>veth</varname></entry>
 137           <entry>An Ethernet tunnel between a pair of network devices.</entry></row>
 138
 139           <row><entry><varname>vlan</varname></entry>
 140           <entry>A VLAN is a stacked device which receives packets from its underlying device based on VLAN tagging. See <ulink url="http://www.ieee802.org/1/pages/802.1Q.html">IEEE 802.1Q</ulink> for details.</entry></row>
 141
 142           <row><entry><varname>vti</varname></entry>
 143           <entry>An IPv4 over IPSec tunnel.</entry></row>
 144
 145           <row><entry><varname>vti6</varname></entry>
 146           <entry>An IPv6 over IPSec tunnel.</entry></row>
 147
 148           <row><entry><varname>vxlan</varname></entry>
 149           <entry>A virtual extensible LAN (vxlan), for connecting Cloud computing deployments.</entry></row>
 150
 151           <row><entry><varname>geneve</varname></entry>
 152           <entry>A GEneric NEtwork Virtualization Encapsulation (GENEVE) netdev driver.</entry></row>
 153
 154           <row><entry><varname>l2tp</varname></entry>
 155           <entry>A Layer 2 Tunneling Protocol (L2TP) is a tunneling protocol used to support virtual private networks (VPNs) or as part of the delivery of services by ISPs. It does not provide any encryption or confidentiality by itself</entry></row>
 156
 157           <row><entry><varname>macsec</varname></entry>
 158           <entry>Media Access Control Security (MACsec) is an 802.1AE IEEE industry-standard security technology that provides secure communication for all traffic on Ethernet links. MACsec provides point-to-point security on Ethernet links between directly connected nodes and is capable of identifying and preventing most security threats.</entry></row>
 159
 160           <row><entry><varname>vrf</varname></entry>
 161           <entry>A Virtual Routing and Forwarding (<ulink url="https://www.kernel.org/doc/Documentation/networking/vrf.txt">VRF</ulink>) interface to create separate routing and forwarding domains.</entry></row>
 162
 163           <row><entry><varname>vcan</varname></entry>
 164           <entry>The virtual CAN driver (vcan). Similar to the network loopback devices, vcan offers a virtual local CAN interface.</entry></row>
 165
 166           <row><entry><varname>vxcan</varname></entry>
 167           <entry>The virtual CAN tunnel driver (vxcan). Similar to the virtual ethernet driver veth, vxcan implements a local CAN traffic tunnel between two virtual CAN network devices. When creating a vxcan, two vxcan devices are created as pair. When one end receives the packet it appears on its pair and vice versa. The vxcan can be used for cross namespace communication.
 168           </entry></row>
 169
 170           <row><entry><varname>wireguard</varname></entry>
 171           <entry>WireGuard Secure Network Tunnel.</entry></row>
 172
 173           <row><entry><varname>netdevsim</varname></entry>
 174           <entry>A simulator. This simulated networking device is used for testing various networking APIs and at this time is particularly focused on testing hardware offloading related interfaces.</entry></row>
 175
 176           <row><entry><varname>nlmon</varname></entry>
 177           <entry>A Netlink monitor device. Use an nlmon device when you want to monitor system Netlink messages.</entry></row>
 178
 179           <row><entry><varname>fou</varname></entry>
 180           <entry>Foo-over-UDP tunneling.</entry></row>
 181
 182           <row><entry><varname>xfrm</varname></entry>
 183           <entry>A virtual tunnel interface like vti/vti6 but with several advantages.</entry></row>
 184
 185         </tbody>
 186       </tgroup>
 187     </table>
 188
 189   </refsect1>
 190
 191   <refsect1>
 192     <title>[Match] Section Options</title>
 193
 194     <para>A virtual network device is only created if the
 195     <literal>[Match]</literal> section matches the current
 196     environment, or if the section is empty. The following keys are
 197     accepted:</para>
 198
 199     <variablelist class='network-directives'>
 200       <varlistentry>
 201         <term><varname>Host=</varname></term>
 202         <listitem>
 203           <para>Matches against the hostname or machine ID of the host. See
 204           <literal>ConditionHost=</literal> in
 205           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 206           for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
 207           If an empty string is assigned, then previously assigned value is cleared.
 208           </para>
 209         </listitem>
 210       </varlistentry>
 211       <varlistentry>
 212         <term><varname>Virtualization=</varname></term>
 213         <listitem>
 214           <para>Checks whether the system is executed in a virtualized environment and optionally test
 215           whether it is a specific implementation. See <literal>ConditionVirtualization=</literal> in
 216           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 217           for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
 218           If an empty string is assigned, then previously assigned value is cleared.
 219           </para>
 220         </listitem>
 221       </varlistentry>
 222       <varlistentry>
 223         <term><varname>KernelCommandLine=</varname></term>
 224         <listitem>
 225           <para>Checks whether a specific kernel command line option is set. See
 226           <literal>ConditionKernelCommandLine=</literal> in
 227           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 228           for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
 229           If an empty string is assigned, then previously assigned value is cleared.
 230           </para>
 231         </listitem>
 232       </varlistentry>
 233       <varlistentry>
 234         <term><varname>KernelVersion=</varname></term>
 235         <listitem>
 236           <para>Checks whether the kernel version (as reported by <command>uname -r</command>) matches a
 237           certain expression. See <literal>ConditionKernelVersion=</literal> in
 238           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 239           for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
 240           If an empty string is assigned, then previously assigned value is cleared.
 241           </para>
 242         </listitem>
 243       </varlistentry>
 244       <varlistentry>
 245         <term><varname>Architecture=</varname></term>
 246         <listitem>
 247           <para>Checks whether the system is running on a specific architecture. See
 248           <literal>ConditionArchitecture=</literal> in
 249           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 250           for details. When prefixed with an exclamation mark (<literal>!</literal>), the result is negated.
 251           If an empty string is assigned, then previously assigned value is cleared.
 252           </para>
 253         </listitem>
 254       </varlistentry>
 255     </variablelist>
 256   </refsect1>
 257
 258   <refsect1>
 259     <title>[NetDev] Section Options</title>
 260
 261     <para>The <literal>[NetDev]</literal> section accepts the
 262     following keys:</para>
 263
 264     <variablelist class='network-directives'>
 265       <varlistentry>
 266         <term><varname>Description=</varname></term>
 267         <listitem>
 268           <para>A free-form description of the netdev.</para>
 269         </listitem>
 270       </varlistentry>
 271       <varlistentry>
 272         <term><varname>Name=</varname></term>
 273         <listitem>
 274           <para>The interface name used when creating the netdev.
 275           This option is compulsory.</para>
 276         </listitem>
 277       </varlistentry>
 278       <varlistentry>
 279         <term><varname>Kind=</varname></term>
 280         <listitem>
 281           <para>The netdev kind. This option is compulsory. See the
 282           <literal>Supported netdev kinds</literal> section for the
 283           valid keys.</para>
 284         </listitem>
 285       </varlistentry>
 286       <varlistentry>
 287         <term><varname>MTUBytes=</varname></term>
 288         <listitem>
 289           <para>The maximum transmission unit in bytes to set for the device. The usual suffixes K, M, G,
 290           are supported and are understood to the base of 1024. For <literal>tun</literal> or
 291           <literal>tap</literal> devices, <varname>MTUBytes=</varname> setting is not currently supported in
 292           <literal>[NetDev]</literal> section. Please specify it in <literal>[Link]</literal> section of
 293           corresponding
 294           <citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 295           files.</para>
 296         </listitem>
 297       </varlistentry>
 298       <varlistentry>
 299         <term><varname>MACAddress=</varname></term>
 300         <listitem>
 301           <para>The MAC address to use for the device. For <literal>tun</literal> or <literal>tap</literal>
 302           devices, setting <varname>MACAddress=</varname> in the <literal>[NetDev]</literal> section is not
 303           supported. Please specify it in <literal>[Link]</literal> section of the corresponding
 304           <citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 305           file. If this option is not set, <literal>vlan</literal> devices inherit the MAC address of the
 306           physical interface. For other kind of netdevs, if this option is not set, then MAC address is
 307           generated based on the interface name and the
 308           <citerefentry><refentrytitle>machine-id</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
 309           </para>
 310         </listitem>
 311       </varlistentry>
 312     </variablelist>
 313   </refsect1>
 314
 315   <refsect1>
 316     <title>[Bridge] Section Options</title>
 317
 318     <para>The <literal>[Bridge]</literal> section only applies for
 319     netdevs of kind <literal>bridge</literal>, and accepts the
 320     following keys:</para>
 321
 322     <variablelist class='network-directives'>
 323       <varlistentry>
 324         <term><varname>HelloTimeSec=</varname></term>
 325         <listitem>
 326           <para>HelloTimeSec specifies the number of seconds between two hello packets
 327           sent out by the root bridge and the designated bridges. Hello packets are
 328           used to communicate information about the topology throughout the entire
 329           bridged local area network.</para>
 330         </listitem>
 331       </varlistentry>
 332       <varlistentry>
 333         <term><varname>MaxAgeSec=</varname></term>
 334         <listitem>
 335           <para>MaxAgeSec specifies the number of seconds of maximum message age.
 336           If the last seen (received) hello packet is more than this number of
 337           seconds old, the bridge in question will start the takeover procedure
 338           in attempt to become the Root Bridge itself.</para>
 339         </listitem>
 340       </varlistentry>
 341       <varlistentry>
 342         <term><varname>ForwardDelaySec=</varname></term>
 343         <listitem>
 344           <para>ForwardDelaySec specifies the number of seconds spent in each
 345           of the Listening and Learning states before the Forwarding state is entered.</para>
 346         </listitem>
 347       </varlistentry>
 348       <varlistentry>
 349         <term><varname>AgeingTimeSec=</varname></term>
 350         <listitem>
 351           <para>This specifies the number of seconds a MAC Address will be kept in
 352           the forwarding database after having a packet received from this MAC Address.</para>
 353         </listitem>
 354       </varlistentry>
 355       <varlistentry>
 356         <term><varname>Priority=</varname></term>
 357         <listitem>
 358           <para>The priority of the bridge. An integer between 0 and 65535. A lower value
 359           means higher priority. The bridge having the lowest priority will be elected as root bridge.</para>
 360         </listitem>
 361       </varlistentry>
 362       <varlistentry>
 363         <term><varname>GroupForwardMask=</varname></term>
 364         <listitem>
 365           <para>A 16-bit bitmask represented as an integer which allows forwarding of link
 366           local frames with 802.1D reserved addresses (01:80:C2:00:00:0X). A logical AND
 367           is performed between the specified bitmask and the exponentiation of 2^X, the
 368           lower nibble of the last octet of the MAC address. For example, a value of 8
 369           would allow forwarding of frames addressed to 01:80:C2:00:00:03 (802.1X PAE).</para>
 370         </listitem>
 371       </varlistentry>
 372       <varlistentry>
 373         <term><varname>DefaultPVID=</varname></term>
 374         <listitem>
 375           <para>This specifies the default port VLAN ID of a newly attached bridge port.
 376           Set this to an integer in the range 1–4094 or <literal>none</literal> to disable the PVID.</para>
 377         </listitem>
 378       </varlistentry>
 379       <varlistentry>
 380         <term><varname>MulticastQuerier=</varname></term>
 381         <listitem>
 382           <para>Takes a boolean. This setting controls the IFLA_BR_MCAST_QUERIER option in the kernel.
 383           If enabled, the kernel will send general ICMP queries from a zero source address.
 384           This feature should allow faster convergence on startup, but it causes some
 385           multicast-aware switches to misbehave and disrupt forwarding of multicast packets.
 386           When unset, the kernel's default will be used.
 387           </para>
 388         </listitem>
 389       </varlistentry>
 390       <varlistentry>
 391         <term><varname>MulticastSnooping=</varname></term>
 392         <listitem>
 393           <para>Takes a boolean. This setting controls the IFLA_BR_MCAST_SNOOPING option in the kernel.
 394           If enabled, IGMP snooping monitors the Internet Group Management Protocol (IGMP) traffic
 395           between hosts and multicast routers. When unset, the kernel's default will be used.
 396           </para>
 397         </listitem>
 398       </varlistentry>
 399       <varlistentry>
 400         <term><varname>VLANFiltering=</varname></term>
 401         <listitem>
 402           <para>Takes a boolean. This setting controls the IFLA_BR_VLAN_FILTERING option in the kernel.
 403           If enabled, the bridge will be started in VLAN-filtering mode. When unset, the kernel's default will be used.
 404           </para>
 405         </listitem>
 406       </varlistentry>
 407       <varlistentry>
 408         <term><varname>STP=</varname></term>
 409         <listitem>
 410           <para>Takes a boolean. This enables the bridge's Spanning Tree Protocol (STP).
 411           When unset, the kernel's default will be used.
 412           </para>
 413         </listitem>
 414       </varlistentry>
 415       <varlistentry>
 416         <term><varname>MulticastIGMPVersion=</varname></term>
 417         <listitem>
 418           <para>Allows to change bridge's multicast Internet Group Management Protocol (IGMP) version.
 419           Takes an interger 2 or 3. When unset, the kernel's default will be used.
 420           </para>
 421         </listitem>
 422       </varlistentry>
 423     </variablelist>
 424   </refsect1>
 425
 426   <refsect1>
 427     <title>[VLAN] Section Options</title>
 428
 429     <para>The <literal>[VLAN]</literal> section only applies for
 430     netdevs of kind <literal>vlan</literal>, and accepts the
 431     following key:</para>
 432
 433     <variablelist class='network-directives'>
 434       <varlistentry>
 435         <term><varname>Id=</varname></term>
 436         <listitem>
 437           <para>The VLAN ID to use. An integer in the range 0–4094.
 438           This option is compulsory.</para>
 439         </listitem>
 440       </varlistentry>
 441       <varlistentry>
 442         <term><varname>GVRP=</varname></term>
 443         <listitem>
 444           <para>Takes a boolean. The Generic VLAN Registration Protocol (GVRP) is a protocol that
 445           allows automatic learning of VLANs on a network.
 446           When unset, the kernel's default will be used.
 447           </para>
 448         </listitem>
 449       </varlistentry>
 450       <varlistentry>
 451         <term><varname>MVRP=</varname></term>
 452         <listitem>
 453           <para>Takes a boolean. Multiple VLAN Registration Protocol (MVRP) formerly known as GARP VLAN
 454           Registration Protocol (GVRP) is a standards-based Layer 2 network protocol,
 455           for automatic configuration of VLAN information on switches. It was defined
 456           in the 802.1ak amendment to 802.1Q-2005. When unset, the kernel's default will be used.
 457           </para>
 458         </listitem>
 459       </varlistentry>
 460       <varlistentry>
 461         <term><varname>LooseBinding=</varname></term>
 462         <listitem>
 463           <para>Takes a boolean. The VLAN loose binding mode, in which only the operational state is passed
 464           from the parent to the associated VLANs, but the VLAN device state is not changed.
 465           When unset, the kernel's default will be used.</para>
 466         </listitem>
 467       </varlistentry>
 468       <varlistentry>
 469         <term><varname>ReorderHeader=</varname></term>
 470         <listitem>
 471           <para>Takes a boolean. The VLAN reorder header is set VLAN interfaces behave like physical interfaces.
 472           When unset, the kernel's default will be used.</para>
 473         </listitem>
 474       </varlistentry>
 475     </variablelist>
 476   </refsect1>
 477
 478   <refsect1>
 479     <title>[MACVLAN] Section Options</title>
 480
 481     <para>The <literal>[MACVLAN]</literal> section only applies for
 482     netdevs of kind <literal>macvlan</literal>, and accepts the
 483     following key:</para>
 484
 485     <variablelist class='network-directives'>
 486       <varlistentry>
 487         <term><varname>Mode=</varname></term>
 488         <listitem>
 489           <para>The MACVLAN mode to use. The supported options are
 490           <literal>private</literal>,
 491           <literal>vepa</literal>,
 492           <literal>bridge</literal>, and
 493           <literal>passthru</literal>.
 494           </para>
 495         </listitem>
 496       </varlistentry>
 497     </variablelist>
 498   </refsect1>
 499
 500   <refsect1>
 501     <title>[MACVTAP] Section Options</title>
 502
 503     <para>The <literal>[MACVTAP]</literal> section applies for
 504     netdevs of kind <literal>macvtap</literal> and accepts the
 505     same key as <literal>[MACVLAN]</literal>.</para>
 506   </refsect1>
 507
 508   <refsect1>
 509     <title>[IPVLAN] Section Options</title>
 510
 511     <para>The <literal>[IPVLAN]</literal> section only applies for
 512     netdevs of kind <literal>ipvlan</literal>, and accepts the
 513     following key:</para>
 514
 515     <variablelist class='network-directives'>
 516       <varlistentry>
 517         <term><varname>Mode=</varname></term>
 518         <listitem>
 519           <para>The IPVLAN mode to use. The supported options are
 520           <literal>L2</literal>,<literal>L3</literal> and <literal>L3S</literal>.
 521           </para>
 522         </listitem>
 523       </varlistentry>
 524       <varlistentry>
 525         <term><varname>Flags=</varname></term>
 526         <listitem>
 527           <para>The IPVLAN flags to use. The supported options are
 528           <literal>bridge</literal>,<literal>private</literal> and <literal>vepa</literal>.
 529           </para>
 530         </listitem>
 531       </varlistentry>
 532     </variablelist>
 533   </refsect1>
 534
 535   <refsect1>
 536     <title>[IPVTAP] Section Options</title>
 537
 538     <para>The <literal>[IPVTAP]</literal> section only applies for
 539     netdevs of kind <literal>ipvtap</literal> and accepts the
 540     same key as <literal>[IPVLAN]</literal>.</para>
 541   </refsect1>
 542
 543   <refsect1>
 544     <title>[VXLAN] Section Options</title>
 545
 546     <para>The <literal>[VXLAN]</literal> section only applies for
 547     netdevs of kind <literal>vxlan</literal>, and accepts the
 548     following keys:</para>
 549
 550     <variablelist class='network-directives'>
 551       <varlistentry>
 552         <term><varname>VNI=</varname></term>
 553         <listitem>
 554           <para>The VXLAN Network Identifier (or VXLAN Segment ID). Takes a number in the range 1-16777215.</para>
 555         </listitem>
 556       </varlistentry>
 557       <varlistentry>
 558         <term><varname>Remote=</varname></term>
 559         <listitem>
 560           <para>Configures destination IP address.</para>
 561         </listitem>
 562       </varlistentry>
 563       <varlistentry>
 564         <term><varname>Local=</varname></term>
 565         <listitem>
 566           <para>Configures local IP address.</para>
 567         </listitem>
 568       </varlistentry>
 569       <varlistentry>
 570         <term><varname>Group=</varname></term>
 571         <listitem>
 572           <para>Configures VXLAN multicast group IP address. All members of a VXLAN must use the same multicast group address.</para>
 573         </listitem>
 574       </varlistentry>
 575       <varlistentry>
 576         <term><varname>TOS=</varname></term>
 577         <listitem>
 578           <para>The Type Of Service byte value for a vxlan interface.</para>
 579         </listitem>
 580       </varlistentry>
 581       <varlistentry>
 582         <term><varname>TTL=</varname></term>
 583         <listitem>
 584           <para>A fixed Time To Live N on Virtual eXtensible Local Area Network packets.
 585           Takes <literal>inherit</literal> or a number in the range 0–255. 0 is a special
 586           value meaning inherit the inner protocol's TTL value. <literal>inherit</literal>
 587           means that it will inherit the outer protocol's TTL value.</para>
 588         </listitem>
 589       </varlistentry>
 590       <varlistentry>
 591         <term><varname>MacLearning=</varname></term>
 592         <listitem>
 593           <para>Takes a boolean. When true, enables dynamic MAC learning
 594           to discover remote MAC addresses.</para>
 595         </listitem>
 596       </varlistentry>
 597       <varlistentry>
 598         <term><varname>FDBAgeingSec=</varname></term>
 599         <listitem>
 600           <para>The lifetime of Forwarding Database entry learnt by
 601           the kernel, in seconds.</para>
 602         </listitem>
 603       </varlistentry>
 604       <varlistentry>
 605         <term><varname>MaximumFDBEntries=</varname></term>
 606         <listitem>
 607           <para>Configures maximum number of FDB entries.</para>
 608         </listitem>
 609       </varlistentry>
 610       <varlistentry>
 611         <term><varname>ReduceARPProxy=</varname></term>
 612         <listitem>
 613           <para>Takes a boolean. When true, bridge-connected VXLAN tunnel
 614           endpoint answers ARP requests from the local bridge on behalf
 615           of remote Distributed Overlay Virtual Ethernet
 616           <ulink url="https://en.wikipedia.org/wiki/Distributed_Overlay_Virtual_Ethernet">
 617           (DVOE)</ulink> clients. Defaults to false.</para>
 618         </listitem>
 619       </varlistentry>
 620       <varlistentry>
 621         <term><varname>L2MissNotification=</varname></term>
 622         <listitem>
 623           <para>Takes a boolean. When true, enables netlink LLADDR miss
 624           notifications.</para>
 625         </listitem>
 626       </varlistentry>
 627       <varlistentry>
 628         <term><varname>L3MissNotification=</varname></term>
 629         <listitem>
 630           <para>Takes a boolean. When true, enables netlink IP address miss
 631           notifications.</para>
 632         </listitem>
 633       </varlistentry>
 634       <varlistentry>
 635         <term><varname>RouteShortCircuit=</varname></term>
 636         <listitem>
 637           <para>Takes a boolean. When true, route short circuiting is turned
 638           on.</para>
 639         </listitem>
 640       </varlistentry>
 641       <varlistentry>
 642         <term><varname>UDPChecksum=</varname></term>
 643         <listitem>
 644           <para>Takes a boolean. When true, transmitting UDP checksums when doing VXLAN/IPv4 is turned on.</para>
 645         </listitem>
 646       </varlistentry>
 647       <varlistentry>
 648         <term><varname>UDP6ZeroChecksumTx=</varname></term>
 649         <listitem>
 650           <para>Takes a boolean. When true, sending zero checksums in VXLAN/IPv6 is turned on.</para>
 651         </listitem>
 652       </varlistentry>
 653       <varlistentry>
 654         <term><varname>UDP6ZeroChecksumRx=</varname></term>
 655         <listitem>
 656           <para>Takes a boolean. When true, receiving zero checksums in VXLAN/IPv6 is turned on.</para>
 657         </listitem>
 658       </varlistentry>
 659       <varlistentry>
 660         <term><varname>RemoteChecksumTx=</varname></term>
 661         <listitem>
 662           <para>Takes a boolean. When true, remote transmit checksum offload of VXLAN is turned on.</para>
 663         </listitem>
 664       </varlistentry>
 665       <varlistentry>
 666         <term><varname>RemoteChecksumRx=</varname></term>
 667         <listitem>
 668           <para>Takes a boolean. When true, remote receive checksum offload in VXLAN is turned on.</para>
 669         </listitem>
 670       </varlistentry>
 671       <varlistentry>
 672         <term><varname>GroupPolicyExtension=</varname></term>
 673         <listitem>
 674           <para>Takes a boolean. When true, it enables Group Policy VXLAN extension security label mechanism
 675           across network peers based on VXLAN. For details about the Group Policy VXLAN, see the
 676           <ulink url="https://tools.ietf.org/html/draft-smith-vxlan-group-policy">
 677           VXLAN Group Policy </ulink> document. Defaults to false.</para>
 678         </listitem>
 679       </varlistentry>
 680       <varlistentry>
 681         <term><varname>GenericProtocolExtension=</varname></term>
 682         <listitem>
 683           <para>Takes a boolean. When true, Generic Protocol Extension extends the existing VXLAN protocol
 684           to provide protocol typing, OAM, and versioning capabilities. For details about the VXLAN GPE
 685           Header, see the <ulink url="https://tools.ietf.org/html/draft-ietf-nvo3-vxlan-gpe-07">
 686           Generic Protocol Extension for VXLAN </ulink> document. If destination port is not specified and
 687           Generic Protocol Extension is set then default port of 4790 is used. Defaults to false.</para>
 688         </listitem>
 689       </varlistentry>
 690       <varlistentry>
 691         <term><varname>DestinationPort=</varname></term>
 692         <listitem>
 693           <para>Configures the default destination UDP port on a per-device basis.
 694           If destination port is not specified then Linux kernel default will be used.
 695           Set destination port 4789 to get the IANA assigned value. If not set or if the
 696           destination port is assigned the empty string the default port of 4789 is used.</para>
 697         </listitem>
 698       </varlistentry>
 699       <varlistentry>
 700         <term><varname>PortRange=</varname></term>
 701         <listitem>
 702           <para>Configures VXLAN port range. VXLAN bases source
 703           UDP port based on flow to help the receiver to be able
 704           to load balance based on outer header flow. It
 705           restricts the port range to the normal UDP local
 706           ports, and allows overriding via configuration.</para>
 707         </listitem>
 708       </varlistentry>
 709       <varlistentry>
 710         <term><varname>FlowLabel=</varname></term>
 711         <listitem>
 712           <para>Specifies the flow label to use in outgoing packets.
 713           The valid range is 0-1048575.
 714           </para>
 715         </listitem>
 716       </varlistentry>
 717       <varlistentry>
 718         <term><varname>IPDoNotFragment=</varname></term>
 719         <listitem>
 720           <para>Allows to set the IPv4 Do not Fragment (DF) bit in outgoing packets, or to inherit its
 721           value from the IPv4 inner header. Takes a boolean value, or <literal>inherit</literal>. Set
 722           to <literal>inherit</literal> if the encapsulated protocol is IPv6. When unset, the kernel's
 723           default will be used.</para>
 724         </listitem>
 725       </varlistentry>
 726     </variablelist>
 727   </refsect1>
 728
 729   <refsect1>
 730     <title>[GENEVE] Section Options</title>
 731
 732     <para>The <literal>[GENEVE]</literal> section only applies for
 733     netdevs of kind <literal>geneve</literal>, and accepts the
 734     following keys:</para>
 735
 736     <variablelist class='network-directives'>
 737       <varlistentry>
 738         <term><varname>Id=</varname></term>
 739         <listitem>
 740           <para>Specifies the Virtual Network Identifier (VNI) to use. Ranges [0-16777215]. This field is mandatory.</para>
 741         </listitem>
 742       </varlistentry>
 743       <varlistentry>
 744         <term><varname>Remote=</varname></term>
 745         <listitem>
 746           <para>Specifies the unicast destination IP address to use in outgoing packets.</para>
 747         </listitem>
 748       </varlistentry>
 749       <varlistentry>
 750         <term><varname>TOS=</varname></term>
 751         <listitem>
 752           <para>Specifies the TOS value to use in outgoing packets. Ranges [1-255].</para>
 753         </listitem>
 754       </varlistentry>
 755       <varlistentry>
 756         <term><varname>TTL=</varname></term>
 757         <listitem>
 758           <para>Accepts the same key in <literal>[VXLAN]</literal> section except when unset or
 759           set to 0, the kernel's default will be used meaning that packets TTL will be set from
 760           <filename>/proc/sys/net/ipv4/ip_default_ttl</filename>.</para>
 761         </listitem>
 762       </varlistentry>
 763       <varlistentry>
 764         <term><varname>UDPChecksum=</varname></term>
 765         <listitem>
 766           <para>Takes a boolean. When true, specifies if UDP checksum is calculated for transmitted packets over IPv4.</para>
 767         </listitem>
 768       </varlistentry>
 769       <varlistentry>
 770         <term><varname>UDP6ZeroChecksumTx=</varname></term>
 771         <listitem>
 772           <para>Takes a boolean. When true, skip UDP checksum calculation for transmitted packets over IPv6.</para>
 773         </listitem>
 774       </varlistentry>
 775       <varlistentry>
 776         <term><varname>UDP6ZeroChecksumRx=</varname></term>
 777         <listitem>
 778           <para>Takes a boolean. When true, allows incoming UDP packets over IPv6 with zero checksum field.</para>
 779         </listitem>
 780       </varlistentry>
 781       <varlistentry>
 782         <term><varname>DestinationPort=</varname></term>
 783         <listitem>
 784           <para>Specifies destination port. Defaults to 6081. If not set or assigned the empty string, the default
 785           port of 6081 is used.</para>
 786         </listitem>
 787       </varlistentry>
 788       <varlistentry>
 789         <term><varname>FlowLabel=</varname></term>
 790         <listitem>
 791           <para>Specifies the flow label to use in outgoing packets.</para>
 792         </listitem>
 793       </varlistentry>
 794       <varlistentry>
 795         <term><varname>IPDoNotFragment=</varname></term>
 796         <listitem>
 797           <para>Accepts the same key in <literal>[VXLAN]</literal> section.</para>
 798         </listitem>
 799       </varlistentry>
 800     </variablelist>
 801   </refsect1>
 802
 803   <refsect1>
 804     <title>[L2TP] Section Options</title>
 805
 806     <para>The <literal>[L2TP]</literal> section only applies for
 807     netdevs of kind <literal>l2tp</literal>, and accepts the
 808     following keys:</para>
 809
 810     <variablelist class='network-directives'>
 811       <varlistentry>
 812         <term><varname>TunnelId=</varname></term>
 813         <listitem>
 814           <para>Specifies the tunnel id. The value used must match the <literal>PeerTunnelId=</literal> value being used at the peer.
 815           Ranges a number between 1 and 4294967295). This option is compulsory.</para>
 816         </listitem>
 817       </varlistentry>
 818       <varlistentry>
 819         <term><varname>PeerTunnelId=</varname></term>
 820         <listitem>
 821           <para>Specifies the peer tunnel id. The value used must match the <literal>PeerTunnelId=</literal> value being used at the peer.
 822           Ranges a number between 1 and 4294967295). This option is compulsory.</para>
 823         </listitem>
 824       </varlistentry>
 825       <varlistentry>
 826         <term><varname>Remote=</varname></term>
 827         <listitem>
 828           <para>Specifies the IP address of the remote peer. This option is compulsory.</para>
 829         </listitem>
 830       </varlistentry>
 831       <varlistentry>
 832         <term><varname>Local=</varname></term>
 833         <listitem>
 834           <para>Specifies the IP address of the local interface. Takes an IP address, or the special values
 835           <literal>auto</literal>, <literal>static</literal>, or <literal>dynamic</literal>. When an address
 836           is set, then the local interface must have the address. If <literal>auto</literal>, then one of the
 837           addresses on the local interface is used. Similarly, if <literal>static</literal> or
 838           <literal>dynamic</literal> is set, then one of the static or dynamic addresses on the local
 839           interface is used. Defaults to <literal>auto</literal>.</para>
 840         </listitem>
 841       </varlistentry>
 842       <varlistentry>
 843         <term><varname>EncapsulationType=</varname></term>
 844         <listitem>
 845           <para>Specifies the encapsulation type of the tunnel. Takes one of <literal>udp</literal> or <literal>ip</literal>.</para>
 846         </listitem>
 847       </varlistentry>
 848       <varlistentry>
 849         <term><varname>UDPSourcePort=</varname></term>
 850         <listitem>
 851           <para>Specifies the UDP source port to be used for the tunnel. When UDP encapsulation is selected it's mandotory. Ignored when ip
 852           encapsulation is selected.</para>
 853         </listitem>
 854       </varlistentry>
 855       <varlistentry>
 856         <term><varname>DestinationPort=</varname></term>
 857         <listitem>
 858           <para>Specifies destination port. When UDP encapsulation is selected it's mandotory. Ignored when ip
 859           encapsulation is selected.</para>
 860         </listitem>
 861       </varlistentry>
 862       <varlistentry>
 863         <term><varname>UDPChecksum=</varname></term>
 864         <listitem>
 865           <para>Takes a boolean. When true, specifies if UDP checksum is calculated for transmitted packets over IPv4.</para>
 866         </listitem>
 867       </varlistentry>
 868       <varlistentry>
 869         <term><varname>UDP6ZeroChecksumTx=</varname></term>
 870         <listitem>
 871           <para>Takes a boolean. When true, skip UDP checksum calculation for transmitted packets over IPv6.</para>
 872         </listitem>
 873       </varlistentry>
 874       <varlistentry>
 875         <term><varname>UDP6ZeroChecksumRx=</varname></term>
 876         <listitem>
 877           <para>Takes a boolean. When true, allows incoming UDP packets over IPv6 with zero checksum field.</para>
 878         </listitem>
 879       </varlistentry>
 880     </variablelist>
 881   </refsect1>
 882
 883   <refsect1>
 884     <title>[L2TPSession] Section Options</title>
 885
 886     <para>The <literal>[L2TPSession]</literal> section only applies for
 887     netdevs of kind <literal>l2tp</literal>, and accepts the
 888     following keys:</para>
 889     <variablelist class='network-directives'>
 890       <varlistentry>
 891         <term><varname>Name=</varname></term>
 892         <listitem>
 893           <para>Specifies the name of the session. This option is compulsory.</para>
 894         </listitem>
 895       </varlistentry>
 896       <varlistentry>
 897         <term><varname>SessionId=</varname></term>
 898         <listitem>
 899           <para>Specifies the session id. The value used must match the <literal>SessionId=</literal> value being used at the peer.
 900           Ranges a number between 1 and 4294967295). This option is compulsory.</para>
 901         </listitem>
 902       </varlistentry>
 903       <varlistentry>
 904         <term><varname>PeerSessionId=</varname></term>
 905         <listitem>
 906           <para>Specifies the peer session id. The value used must match the <literal>PeerSessionId=</literal> value being used at the peer.
 907           Ranges a number between 1 and 4294967295). This option is compulsory.</para>
 908         </listitem>
 909       </varlistentry>
 910       <varlistentry>
 911         <term><varname>Layer2SpecificHeader=</varname></term>
 912         <listitem>
 913           <para>Specifies layer2specific header type of the session. One of <literal>none</literal> or <literal>default</literal>. Defaults to <literal>default</literal>.</para>
 914         </listitem>
 915       </varlistentry>
 916     </variablelist>
 917   </refsect1>
 918
 919   <refsect1>
 920     <title>[MACsec] Section Options</title>
 921
 922     <para>The <literal>[MACsec]</literal> section only applies for network devices of kind
 923     <literal>macsec</literal>, and accepts the following keys:</para>
 924
 925     <variablelist class='network-directives'>
 926       <varlistentry>
 927         <term><varname>Port=</varname></term>
 928         <listitem>
 929           <para>Specifies the port to be used for the MACsec transmit channel. The port is used to make
 930           secure channel identifier (SCI). Takes a value between 1 and 65535. Defaults to unset.
 931           </para>
 932         </listitem>
 933       </varlistentry>
 934       <varlistentry>
 935         <term><varname>Encrypt=</varname></term>
 936         <listitem>
 937           <para>Takes a boolean. When true, enable encryption. Defaults to unset.</para>
 938         </listitem>
 939       </varlistentry>
 940     </variablelist>
 941   </refsect1>
 942
 943   <refsect1>
 944     <title>[MACsecReceiveChannel] Section Options</title>
 945     <para>The <literal>[MACsecReceiveChannel]</literal> section only applies for network devices of
 946     kind <literal>macsec</literal>, and accepts the following keys:</para>
 947
 948     <variablelist class='network-directives'>
 949       <varlistentry>
 950         <term><varname>Port=</varname></term>
 951         <listitem>
 952           <para>Specifies the port to be used for the MACsec receive channel. The port is used to make
 953           secure channel identifier (SCI). Takes a value between 1 and 65535. This option is
 954           compulsory, and is not set by default.</para>
 955         </listitem>
 956       </varlistentry>
 957       <varlistentry>
 958         <term><varname>MACAddress=</varname></term>
 959         <listitem>
 960           <para>Specifies the MAC address to be used for the MACsec receive channel. The MAC address
 961           used to make secure channel identifier (SCI). This option is compulsory, and is not set by
 962           default.</para>
 963         </listitem>
 964       </varlistentry>
 965     </variablelist>
 966   </refsect1>
 967
 968   <refsect1>
 969     <title>[MACsecTransmitAssociation] Section Options</title>
 970
 971     <para>The <literal>[MACsecTransmitAssociation]</literal> section only applies for network devices
 972     of kind <literal>macsec</literal>, and accepts the following keys:</para>
 973
 974     <variablelist class='network-directives'>
 975       <varlistentry>
 976         <term><varname>PacketNumber=</varname></term>
 977         <listitem>
 978           <para>Specifies the packet number to be used for replay protection and the construction of
 979           the initialization vector (along with the secure channel identifier [SCI]). Takes a value
 980           between 1-4,294,967,295. Defaults to unset.
 981           </para>
 982         </listitem>
 983       </varlistentry>
 984       <varlistentry>
 985         <term><varname>KeyId=</varname></term>
 986         <listitem>
 987           <para>Specifies the identification for the key. Takes a number between 0-255. This option
 988           is compulsory, and is not set by default.</para>
 989         </listitem>
 990       </varlistentry>
 991       <varlistentry>
 992         <term><varname>Key=</varname></term>
 993         <listitem>
 994           <para>Specifies the encryption key used in the transmission channel. The same key must be
 995           configured on the peer’s matching receive channel. This option is compulsory, and is not set
 996           by default. Takes a 128-bit key encoded in a hexadecimal string, for example
 997           <literal>dffafc8d7b9a43d5b9a3dfbbf6a30c16</literal>.</para>
 998         </listitem>
 999       </varlistentry>
1000       <varlistentry>
1001         <term><varname>KeyFile=</varname></term>
1002         <listitem>
1003           <para>Takes a absolute path to a file which contains a 128-bit key encoded in a hexadecimal
1004           string, which will be used in the transmission channel. When this option is specified,
1005           <varname>Key=</varname> is ignored. Note that the file must be readable by the user
1006           <literal>systemd-network</literal>, so it should be, e.g., owned by
1007           <literal>root:systemd-network</literal> with a <literal>0640</literal> file mode.</para>
1008         </listitem>
1009       </varlistentry>
1010       <varlistentry>
1011         <term><varname>Activate=</varname></term>
1012         <listitem>
1013           <para>Takes a boolean. If enabled, then the security association is activated. Defaults to
1014           unset.</para>
1015         </listitem>
1016       </varlistentry>
1017       <varlistentry>
1018         <term><varname>UseForEncoding=</varname></term>
1019         <listitem>
1020           <para>Takes a boolean. If enabled, then the security association is used for encoding. Only
1021           one <literal>[MACsecTransmitAssociation]</literal> section can enable this option. When enabled,
1022           <varname>Activate=yes</varname> is implied. Defaults to unset.</para>
1023         </listitem>
1024       </varlistentry>
1025     </variablelist>
1026   </refsect1>
1027
1028   <refsect1>
1029     <title>[MACsecReceiveAssociation] Section Options</title>
1030
1031     <para>The <literal>[MACsecReceiveAssociation]</literal> section only applies for
1032     network devices of kind <literal>macsec</literal>, and accepts the
1033     following keys:</para>
1034
1035     <variablelist class='network-directives'>
1036       <varlistentry>
1037         <term><varname>Port=</varname></term>
1038         <listitem>
1039           <para>Accepts the same key in <literal>[MACsecReceiveChannel]</literal> section.</para>
1040         </listitem>
1041       </varlistentry>
1042       <varlistentry>
1043         <term><varname>MACAddress=</varname></term>
1044         <listitem>
1045           <para>Accepts the same key in <literal>[MACsecReceiveChannel]</literal> section.</para>
1046         </listitem>
1047       </varlistentry>
1048       <varlistentry>
1049         <term><varname>PacketNumber=</varname></term>
1050         <listitem>
1051           <para>Accepts the same key in <literal>[MACsecTransmitAssociation]</literal> section.</para>
1052         </listitem>
1053       </varlistentry>
1054       <varlistentry>
1055         <term><varname>KeyId=</varname></term>
1056         <listitem>
1057           <para>Accepts the same key in <literal>[MACsecTransmitAssociation]</literal> section.</para>
1058         </listitem>
1059       </varlistentry>
1060       <varlistentry>
1061         <term><varname>Key=</varname></term>
1062         <listitem>
1063           <para>Accepts the same key in <literal>[MACsecTransmitAssociation]</literal> section.</para>
1064         </listitem>
1065       </varlistentry>
1066       <varlistentry>
1067         <term><varname>KeyFile=</varname></term>
1068         <listitem>
1069           <para>Accepts the same key in <literal>[MACsecTransmitAssociation]</literal> section.</para>
1070         </listitem>
1071       </varlistentry>
1072       <varlistentry>
1073         <term><varname>Activate=</varname></term>
1074         <listitem>
1075           <para>Accepts the same key in <literal>[MACsecTransmitAssociation]</literal> section.</para>
1076         </listitem>
1077       </varlistentry>
1078     </variablelist>
1079   </refsect1>
1080
1081   <refsect1>
1082     <title>[Tunnel] Section Options</title>
1083
1084     <para>The <literal>[Tunnel]</literal> section only applies for
1085     netdevs of kind
1086     <literal>ipip</literal>,
1087     <literal>sit</literal>,
1088     <literal>gre</literal>,
1089     <literal>gretap</literal>,
1090     <literal>ip6gre</literal>,
1091     <literal>ip6gretap</literal>,
1092     <literal>vti</literal>,
1093     <literal>vti6</literal>,
1094     <literal>ip6tnl</literal>, and
1095     <literal>erspan</literal> and accepts
1096     the following keys:</para>
1097
1098     <variablelist class='network-directives'>
1099       <varlistentry>
1100         <term><varname>Local=</varname></term>
1101         <listitem>
1102           <para>A static local address for tunneled packets. It must be an address on another interface of
1103           this host, or the special value <literal>any</literal>.</para>
1104         </listitem>
1105       </varlistentry>
1106       <varlistentry>
1107         <term><varname>Remote=</varname></term>
1108         <listitem>
1109           <para>The remote endpoint of the tunnel. Takes an IP address or the special value
1110           <literal>any</literal>.</para>
1111         </listitem>
1112       </varlistentry>
1113       <varlistentry>
1114         <term><varname>TOS=</varname></term>
1115         <listitem>
1116           <para>The Type Of Service byte value for a tunnel interface.
1117           For details about the TOS, see the
1118           <ulink url="http://tools.ietf.org/html/rfc1349"> Type of
1119           Service in the Internet Protocol Suite </ulink> document.
1120           </para>
1121         </listitem>
1122       </varlistentry>
1123       <varlistentry>
1124         <term><varname>TTL=</varname></term>
1125         <listitem>
1126           <para>A fixed Time To Live N on tunneled packets. N is a
1127           number in the range 1–255. 0 is a special value meaning that
1128           packets inherit the TTL value. The default value for IPv4
1129           tunnels is: inherit. The default value for IPv6 tunnels is
1130           64.</para>
1131         </listitem>
1132       </varlistentry>
1133       <varlistentry>
1134         <term><varname>DiscoverPathMTU=</varname></term>
1135         <listitem>
1136           <para>Takes a boolean. When true, enables Path MTU Discovery on
1137           the tunnel.</para>
1138         </listitem>
1139       </varlistentry>
1140       <varlistentry>
1141         <term><varname>IPv6FlowLabel=</varname></term>
1142         <listitem>
1143           <para>Configures the 20-bit flow label (see <ulink url="https://tools.ietf.org/html/rfc6437">
1144           RFC 6437</ulink>) field in the IPv6 header (see <ulink url="https://tools.ietf.org/html/rfc2460">
1145           RFC 2460</ulink>), which is used by a node to label packets of a flow.
1146           It is only used for IPv6 tunnels.
1147           A flow label of zero is used to indicate packets that have
1148           not been labeled.
1149           It can be configured to a value in the range 0–0xFFFFF, or be
1150           set to <literal>inherit</literal>, in which case the original flowlabel is used.</para>
1151         </listitem>
1152       </varlistentry>
1153       <varlistentry>
1154         <term><varname>CopyDSCP=</varname></term>
1155         <listitem>
1156           <para>Takes a boolean. When true, the Differentiated Service Code
1157           Point (DSCP) field will be copied to the inner header from
1158           outer header during the decapsulation of an IPv6 tunnel
1159           packet. DSCP is a field in an IP packet that enables different
1160           levels of service to be assigned to network traffic.
1161           Defaults to <literal>no</literal>.
1162           </para>
1163         </listitem>
1164       </varlistentry>
1165       <varlistentry>
1166         <term><varname>EncapsulationLimit=</varname></term>
1167         <listitem>
1168           <para>The Tunnel Encapsulation Limit option specifies how many additional
1169           levels of encapsulation are permitted to be prepended to the packet.
1170           For example, a Tunnel Encapsulation Limit option containing a limit
1171           value of zero means that a packet carrying that option may not enter
1172           another tunnel before exiting the current tunnel.
1173           (see <ulink url="https://tools.ietf.org/html/rfc2473#section-4.1.1"> RFC 2473</ulink>).
1174           The valid range is 0–255 and <literal>none</literal>. Defaults to 4.
1175         </para>
1176         </listitem>
1177       </varlistentry>
1178       <varlistentry>
1179         <term><varname>Key=</varname></term>
1180         <listitem>
1181           <para>The <varname>Key=</varname> parameter specifies the same key to use in
1182           both directions (<varname>InputKey=</varname> and <varname>OutputKey=</varname>).
1183           The <varname>Key=</varname> is either a number or an IPv4 address-like dotted quad.
1184           It is used as mark-configured SAD/SPD entry as part of the lookup key (both in data
1185           and control path) in ip xfrm (framework used to implement IPsec protocol).
1186           See <ulink url="http://man7.org/linux/man-pages/man8/ip-xfrm.8.html">
1187           ip-xfrm — transform configuration</ulink> for details. It is only used for VTI/VTI6,
1188           GRE, GRETAP, and ERSPAN tunnels.</para>
1189         </listitem>
1190       </varlistentry>
1191       <varlistentry>
1192         <term><varname>InputKey=</varname></term>
1193         <listitem>
1194           <para>The <varname>InputKey=</varname> parameter specifies the key to use for input.
1195           The format is same as <varname>Key=</varname>. It is only used for VTI/VTI6, GRE, GRETAP,
1196           and ERSPAN tunnels.</para>
1197         </listitem>
1198       </varlistentry>
1199       <varlistentry>
1200         <term><varname>OutputKey=</varname></term>
1201         <listitem>
1202           <para>The <varname>OutputKey=</varname> parameter specifies the key to use for output.
1203           The format is same as <varname>Key=</varname>. It is only used for VTI/VTI6, GRE, GRETAP,
1204           and ERSPAN tunnels.</para>
1205         </listitem>
1206       </varlistentry>
1207       <varlistentry>
1208         <term><varname>Mode=</varname></term>
1209         <listitem>
1210           <para>An <literal>ip6tnl</literal> tunnel can be in one of three
1211           modes
1212           <literal>ip6ip6</literal> for IPv6 over IPv6,
1213           <literal>ipip6</literal> for IPv4 over IPv6 or
1214           <literal>any</literal> for either.
1215           </para>
1216         </listitem>
1217       </varlistentry>
1218       <varlistentry>
1219         <term><varname>Independent=</varname></term>
1220         <listitem>
1221           <para>Takes a boolean. When true tunnel does not require .network file. Created as "tunnel@NONE".
1222           Defaults to <literal>false</literal>.
1223           </para>
1224         </listitem>
1225       </varlistentry>
1226       <varlistentry>
1227         <term><varname>AssignToLoopback=</varname></term>
1228         <listitem>
1229           <para>Takes a boolean. If set to <literal>yes</literal>, the loopback interface <literal>lo</literal>
1230           is used as the underlying device of the tunnel interface. Defaults to <literal>no</literal>.</para>
1231         </listitem>
1232       </varlistentry>
1233       <varlistentry>
1234         <term><varname>AllowLocalRemote=</varname></term>
1235         <listitem>
1236           <para>Takes a boolean. When true allows tunnel traffic on <varname>ip6tnl</varname> devices where the remote endpoint is a local host address.
1237           When unset, the kernel's default will be used.
1238           </para>
1239         </listitem>
1240       </varlistentry>
1241       <varlistentry>
1242         <term><varname>FooOverUDP=</varname></term>
1243         <listitem>
1244           <para>Takes a boolean. Specifies whether <varname>FooOverUDP=</varname> tunnel is to be configured.
1245           Defaults to false. This takes effects only for IPIP, SIT, GRE, and GRETAP tunnels.
1246           For more detail information see
1247           <ulink url="https://lwn.net/Articles/614348">Foo over UDP</ulink></para>
1248         </listitem>
1249       </varlistentry>
1250       <varlistentry>
1251         <term><varname>FOUDestinationPort=</varname></term>
1252         <listitem>
1253           <para>This setting specifies the UDP destination port for encapsulation.
1254           This field is mandatory when <varname>FooOverUDP=yes</varname>, and is not set by default.</para>
1255         </listitem>
1256       </varlistentry>
1257       <varlistentry>
1258         <term><varname>FOUSourcePort=</varname></term>
1259         <listitem>
1260           <para>This setting specifies the UDP source port for encapsulation. Defaults to <constant>0</constant>
1261           — that is, the source port for packets is left to the network stack to decide.</para>
1262         </listitem>
1263       </varlistentry>
1264       <varlistentry>
1265         <term><varname>Encapsulation=</varname></term>
1266         <listitem>
1267           <para>Accepts the same key as in the <literal>[FooOverUDP]</literal> section.</para>
1268         </listitem>
1269       </varlistentry>
1270       <varlistentry>
1271         <term><varname>IPv6RapidDeploymentPrefix=</varname></term>
1272         <listitem>
1273           <para>Reconfigure the tunnel for <ulink url="https://tools.ietf.org/html/rfc5569">IPv6 Rapid
1274           Deployment</ulink>, also known as 6rd. The value is an ISP-specific IPv6 prefix with a non-zero length. Only
1275           applicable to SIT tunnels.</para>
1276         </listitem>
1277       </varlistentry>
1278       <varlistentry>
1279         <term><varname>ISATAP=</varname></term>
1280         <listitem>
1281           <para>Takes a boolean. If set, configures the tunnel as Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) tunnel.
1282           Only applicable to SIT tunnels. When unset, the kernel's default will be used.</para>
1283         </listitem>
1284       </varlistentry>
1285       <varlistentry>
1286         <term><varname>SerializeTunneledPackets=</varname></term>
1287         <listitem>
1288           <para>Takes a boolean. If set to yes, then packets are serialized. Only applies for GRE,
1289           GRETAP, and ERSPAN tunnels. When unset, the kernel's default will be used.
1290           </para>
1291         </listitem>
1292       </varlistentry>
1293       <varlistentry>
1294         <term><varname>ERSPANIndex=</varname></term>
1295         <listitem>
1296           <para>Specifies the ERSPAN index field for the interface, an integer in the range 1-1048575 associated with
1297           the ERSPAN traffic's source port and direction. This field is mandatory.
1298           </para>
1299         </listitem>
1300       </varlistentry>
1301     </variablelist>
1302   </refsect1>
1303
1304   <refsect1>
1305     <title>[FooOverUDP] Section Options</title>
1306
1307     <para>The <literal>[FooOverUDP]</literal> section only applies for
1308     netdevs of kind <literal>fou</literal> and accepts the
1309     following keys:</para>
1310
1311     <variablelist class='network-directives'>
1312       <varlistentry>
1313         <term><varname>Encapsulation=</varname></term>
1314         <listitem>
1315           <para>Specifies the encapsulation mechanism used to store networking packets of various protocols inside the UDP packets. Supports the following values:
1316
1317           <literal>FooOverUDP</literal> provides the simplest no frills model of UDP encapsulation, it simply encapsulates
1318           packets directly in the UDP payload.
1319           <literal>GenericUDPEncapsulation</literal> is a generic and extensible encapsulation, it allows encapsulation of packets for any IP
1320           protocol and optional data as part of the encapsulation.
1321           For more detailed information see <ulink url="https://lwn.net/Articles/615044">Generic UDP Encapsulation</ulink>.
1322           Defaults to <literal>FooOverUDP</literal>.
1323           </para>
1324         </listitem>
1325       </varlistentry>
1326       <varlistentry>
1327         <term><varname>Port=</varname></term>
1328         <listitem>
1329           <para>Specifies the port number, where the IP encapsulation packets will arrive. Please take note that the packets
1330           will arrive with the encapsulation will be removed. Then they will be manually fed back into the network stack, and sent ahead
1331           for delivery to the real destination. This option is mandatory.</para>
1332         </listitem>
1333       </varlistentry>
1334       <varlistentry>
1335         <term><varname>PeerPort=</varname></term>
1336         <listitem>
1337           <para>Specifies the peer port number. Defaults to unset. Note that when peer port is set <literal>Peer=</literal> address is mandotory.</para>
1338         </listitem>
1339       </varlistentry>
1340       <varlistentry>
1341         <term><varname>Protocol=</varname></term>
1342         <listitem>
1343           <para>The <varname>Protocol=</varname> specifies the protocol number of the packets arriving
1344           at the UDP port. When <varname>Encapsulation=FooOverUDP</varname>, this field is mandatory
1345           and is not set by default. Takes an IP protocol name such as <literal>gre</literal> or
1346           <literal>ipip</literal>, or an integer within the range 1-255. When
1347           <varname>Encapsulation=GenericUDPEncapsulation</varname>, this must not be specified.</para>
1348         </listitem>
1349       </varlistentry>
1350       <varlistentry>
1351         <term><varname>Peer=</varname></term>
1352         <listitem>
1353           <para>Configures peer IP address. Note that when peer address is set <literal>PeerPort=</literal> is mandotory.</para>
1354         </listitem>
1355       </varlistentry>
1356       <varlistentry>
1357         <term><varname>Local=</varname></term>
1358         <listitem>
1359           <para>Configures local IP address.</para>
1360         </listitem>
1361       </varlistentry>
1362     </variablelist>
1363   </refsect1>
1364
1365   <refsect1>
1366     <title>[Peer] Section Options</title>
1367
1368     <para>The <literal>[Peer]</literal> section only applies for
1369     netdevs of kind <literal>veth</literal> and accepts the
1370     following keys:</para>
1371
1372     <variablelist class='network-directives'>
1373       <varlistentry>
1374         <term><varname>Name=</varname></term>
1375         <listitem>
1376           <para>The interface name used when creating the netdev.
1377           This option is compulsory.</para>
1378         </listitem>
1379       </varlistentry>
1380       <varlistentry>
1381         <term><varname>MACAddress=</varname></term>
1382         <listitem>
1383           <para>The peer MACAddress, if not set, it is generated in
1384           the same way as the MAC address of the main
1385           interface.</para>
1386         </listitem>
1387       </varlistentry>
1388     </variablelist>
1389   </refsect1>
1390
1391   <refsect1>
1392     <title>[VXCAN] Section Options</title>
1393
1394     <para>The <literal>[VXCAN]</literal> section only applies for
1395     netdevs of kind <literal>vxcan</literal> and accepts the
1396     following key:</para>
1397
1398     <variablelist class='network-directives'>
1399       <varlistentry>
1400         <term><varname>Peer=</varname></term>
1401         <listitem>
1402           <para>The peer interface name used when creating the netdev.
1403           This option is compulsory.</para>
1404         </listitem>
1405       </varlistentry>
1406     </variablelist>
1407   </refsect1>
1408
1409   <refsect1>
1410     <title>[Tun] Section Options</title>
1411
1412     <para>The <literal>[Tun]</literal> section only applies for
1413     netdevs of kind <literal>tun</literal>, and accepts the following
1414     keys:</para>
1415
1416     <variablelist class='network-directives'>
1417       <varlistentry>
1418         <term><varname>MultiQueue=</varname></term>
1419         <listitem><para>Takes a boolean. Configures whether
1420         to use multiple file descriptors (queues) to parallelize
1421         packets sending and receiving. Defaults to
1422         <literal>no</literal>.</para>
1423         </listitem>
1424       </varlistentry>
1425       <varlistentry>
1426         <term><varname>PacketInfo=</varname></term>
1427         <listitem><para>Takes a boolean. Configures whether
1428         packets should be prepended with four extra bytes (two flag
1429         bytes and two protocol bytes). If disabled, it indicates that
1430         the packets will be pure IP packets. Defaults to
1431         <literal>no</literal>.</para>
1432         </listitem>
1433       </varlistentry>
1434       <varlistentry>
1435         <term><varname>VNetHeader=</varname></term>
1436         <listitem><para>Takes a boolean. Configures
1437         IFF_VNET_HDR flag for a tun or tap device. It allows sending
1438         and receiving larger Generic Segmentation Offload (GSO)
1439         packets. This may increase throughput significantly.
1440         Defaults to
1441         <literal>no</literal>.</para>
1442         </listitem>
1443       </varlistentry>
1444       <varlistentry>
1445         <term><varname>User=</varname></term>
1446         <listitem><para>User to grant access to the
1447         <filename>/dev/net/tun</filename> device.</para>
1448         </listitem>
1449       </varlistentry>
1450       <varlistentry>
1451         <term><varname>Group=</varname></term>
1452         <listitem><para>Group to grant access to the
1453         <filename>/dev/net/tun</filename> device.</para>
1454         </listitem>
1455       </varlistentry>
1456     </variablelist>
1457   </refsect1>
1458
1459   <refsect1>
1460     <title>[Tap] Section Options</title>
1461
1462     <para>The <literal>[Tap]</literal> section only applies for
1463     netdevs of kind <literal>tap</literal>, and accepts the same keys
1464     as the <literal>[Tun]</literal> section.</para>
1465   </refsect1>
1466
1467   <refsect1>
1468     <title>[WireGuard] Section Options</title>
1469
1470     <para>The <literal>[WireGuard]</literal> section accepts the following
1471     keys:</para>
1472
1473     <variablelist class='network-directives'>
1474       <varlistentry>
1475         <term><varname>PrivateKey=</varname></term>
1476         <listitem>
1477           <para>The Base64 encoded private key for the interface. It can be
1478           generated using the <command>wg genkey</command> command
1479           (see <citerefentry project="wireguard"><refentrytitle>wg</refentrytitle><manvolnum>8</manvolnum></citerefentry>).
1480           This option or <varname>PrivateKeyFile=</varname> is mandatory to use WireGuard.
1481           Note that because this information is secret, you may want to set
1482           the permissions of the .netdev file to be owned by <literal>root:systemd-network</literal>
1483           with a <literal>0640</literal> file mode.</para>
1484         </listitem>
1485       </varlistentry>
1486       <varlistentry>
1487         <term><varname>PrivateKeyFile=</varname></term>
1488         <listitem>
1489           <para>Takes an absolute path to a file which contains the Base64 encoded private key for the interface.
1490           When this option is specified, then <varname>PrivateKey=</varname> is ignored.
1491           Note that the file must be readable by the user <literal>systemd-network</literal>, so it
1492           should be, e.g., owned by <literal>root:systemd-network</literal> with a
1493           <literal>0640</literal> file mode.</para>
1494         </listitem>
1495       </varlistentry>
1496       <varlistentry>
1497         <term><varname>ListenPort=</varname></term>
1498         <listitem>
1499           <para>Sets UDP port for listening. Takes either value between 1 and 65535
1500           or <literal>auto</literal>. If <literal>auto</literal> is specified,
1501           the port is automatically generated based on interface name.
1502           Defaults to <literal>auto</literal>.</para>
1503         </listitem>
1504       </varlistentry>
1505       <varlistentry>
1506         <term><varname>FirewallMark=</varname></term>
1507         <listitem>
1508           <para>Sets a firewall mark on outgoing WireGuard packets from this interface. Takes a number between 1 and 4294967295.</para>
1509         </listitem>
1510       </varlistentry>
1511     </variablelist>
1512   </refsect1>
1513
1514   <refsect1>
1515     <title>[WireGuardPeer] Section Options</title>
1516
1517     <para>The <literal>[WireGuardPeer]</literal> section accepts the following
1518     keys:</para>
1519
1520     <variablelist class='network-directives'>
1521       <varlistentry>
1522         <term><varname>PublicKey=</varname></term>
1523         <listitem>
1524           <para>Sets a Base64 encoded public key calculated by <command>wg pubkey</command>
1525           (see <citerefentry project="wireguard"><refentrytitle>wg</refentrytitle><manvolnum>8</manvolnum></citerefentry>)
1526           from a private key, and usually transmitted out of band to the
1527           author of the configuration file. This option is mandatory for this
1528           section.</para>
1529         </listitem>
1530       </varlistentry>
1531       <varlistentry>
1532         <term><varname>PresharedKey=</varname></term>
1533         <listitem>
1534           <para>Optional preshared key for the interface. It can be generated
1535           by the <command>wg genpsk</command> command. This option adds an
1536           additional layer of symmetric-key cryptography to be mixed into the
1537           already existing public-key cryptography, for post-quantum
1538           resistance.
1539           Note that because this information is secret, you may want to set
1540           the permissions of the .netdev file to be owned by <literal>root:systemd-networkd</literal>
1541           with a <literal>0640</literal> file mode.</para>
1542         </listitem>
1543       </varlistentry>
1544       <varlistentry>
1545         <term><varname>PresharedKeyFile=</varname></term>
1546         <listitem>
1547           <para>Takes an absolute path to a file which contains the Base64 encoded preshared key for the
1548           peer. When this option is specified, then <varname>PresharedKey=</varname> is ignored.
1549           Note that the file must be readable by the user <literal>systemd-network</literal>, so it
1550           should be, e.g., owned by <literal>root:systemd-network</literal> with a
1551           <literal>0640</literal> file mode.</para>
1552         </listitem>
1553       </varlistentry>
1554       <varlistentry>
1555         <term><varname>AllowedIPs=</varname></term>
1556         <listitem>
1557           <para>Sets a comma-separated list of IP (v4 or v6) addresses with CIDR masks
1558           from which this peer is allowed to send incoming traffic and to
1559           which outgoing traffic for this peer is directed. The catch-all
1560           0.0.0.0/0 may be specified for matching all IPv4 addresses, and
1561           ::/0 may be specified for matching all IPv6 addresses. </para>
1562         </listitem>
1563       </varlistentry>
1564       <varlistentry>
1565         <term><varname>Endpoint=</varname></term>
1566         <listitem>
1567           <para>Sets an endpoint IP address or hostname, followed by a colon, and then
1568           a port number. This endpoint will be updated automatically once to
1569           the most recent source IP address and port of correctly
1570           authenticated packets from the peer at configuration time.</para>
1571         </listitem>
1572       </varlistentry>
1573       <varlistentry>
1574         <term><varname>PersistentKeepalive=</varname></term>
1575         <listitem>
1576           <para>Sets a seconds interval, between 1 and 65535 inclusive, of how often
1577           to send an authenticated empty packet to the peer for the purpose
1578           of keeping a stateful firewall or NAT mapping valid persistently.
1579           For example, if the interface very rarely sends traffic, but it
1580           might at anytime receive traffic from a peer, and it is behind NAT,
1581           the interface might benefit from having a persistent keepalive
1582           interval of 25 seconds. If set to 0 or "off", this option is
1583           disabled. By default or when unspecified, this option is off.
1584           Most users will not need this.</para>
1585         </listitem>
1586       </varlistentry>
1587     </variablelist>
1588   </refsect1>
1589
1590   <refsect1>
1591     <title>[Bond] Section Options</title>
1592
1593     <para>The <literal>[Bond]</literal> section accepts the following
1594     key:</para>
1595
1596     <variablelist class='network-directives'>
1597       <varlistentry>
1598         <term><varname>Mode=</varname></term>
1599         <listitem>
1600           <para>Specifies one of the bonding policies. The default is
1601           <literal>balance-rr</literal> (round robin). Possible values are
1602           <literal>balance-rr</literal>,
1603           <literal>active-backup</literal>,
1604           <literal>balance-xor</literal>,
1605           <literal>broadcast</literal>,
1606           <literal>802.3ad</literal>,
1607           <literal>balance-tlb</literal>, and
1608           <literal>balance-alb</literal>.
1609           </para>
1610         </listitem>
1611       </varlistentry>
1612
1613       <varlistentry>
1614         <term><varname>TransmitHashPolicy=</varname></term>
1615         <listitem>
1616           <para>Selects the transmit hash policy to use for slave
1617           selection in balance-xor, 802.3ad, and tlb modes. Possible
1618           values are
1619           <literal>layer2</literal>,
1620           <literal>layer3+4</literal>,
1621           <literal>layer2+3</literal>,
1622           <literal>encap2+3</literal>, and
1623           <literal>encap3+4</literal>.
1624           </para>
1625         </listitem>
1626       </varlistentry>
1627
1628       <varlistentry>
1629         <term><varname>LACPTransmitRate=</varname></term>
1630         <listitem>
1631           <para>Specifies the rate with which link partner transmits
1632           Link Aggregation Control Protocol Data Unit packets in
1633           802.3ad mode. Possible values are <literal>slow</literal>,
1634           which requests partner to transmit LACPDUs every 30 seconds,
1635           and <literal>fast</literal>, which requests partner to
1636           transmit LACPDUs every second. The default value is
1637           <literal>slow</literal>.</para>
1638         </listitem>
1639       </varlistentry>
1640
1641       <varlistentry>
1642         <term><varname>MIIMonitorSec=</varname></term>
1643         <listitem>
1644           <para>Specifies the frequency that Media Independent
1645           Interface link monitoring will occur. A value of zero
1646           disables MII link monitoring. This value is rounded down to
1647           the nearest millisecond. The default value is 0.</para>
1648         </listitem>
1649       </varlistentry>
1650
1651       <varlistentry>
1652         <term><varname>UpDelaySec=</varname></term>
1653         <listitem>
1654           <para>Specifies the delay before a link is enabled after a
1655           link up status has been detected. This value is rounded down
1656           to a multiple of MIIMonitorSec. The default value is
1657           0.</para>
1658         </listitem>
1659       </varlistentry>
1660
1661       <varlistentry>
1662         <term><varname>DownDelaySec=</varname></term>
1663         <listitem>
1664           <para>Specifies the delay before a link is disabled after a
1665           link down status has been detected. This value is rounded
1666           down to a multiple of MIIMonitorSec. The default value is
1667           0.</para>
1668         </listitem>
1669       </varlistentry>
1670
1671       <varlistentry>
1672         <term><varname>LearnPacketIntervalSec=</varname></term>
1673         <listitem>
1674           <para>Specifies the number of seconds between instances where the bonding
1675           driver sends learning packets to each slave peer switch.
1676           The valid range is 1–0x7fffffff; the default value is 1. This option
1677           has an effect only for the balance-tlb and balance-alb modes.</para>
1678         </listitem>
1679       </varlistentry>
1680
1681       <varlistentry>
1682         <term><varname>AdSelect=</varname></term>
1683         <listitem>
1684           <para>Specifies the 802.3ad aggregation selection logic to use. Possible values are
1685           <literal>stable</literal>,
1686           <literal>bandwidth</literal> and
1687           <literal>count</literal>.
1688           </para>
1689         </listitem>
1690       </varlistentry>
1691
1692       <varlistentry>
1693         <term><varname>AdActorSystemPriority=</varname></term>
1694         <listitem>
1695           <para>Specifies the 802.3ad actor system priority. Ranges [1-65535].</para>
1696         </listitem>
1697       </varlistentry>
1698
1699       <varlistentry>
1700         <term><varname>AdUserPortKey=</varname></term>
1701         <listitem>
1702           <para>Specifies the 802.3ad user defined portion of the port key. Ranges [0-1023].</para>
1703         </listitem>
1704       </varlistentry>
1705
1706       <varlistentry>
1707         <term><varname>AdActorSystem=</varname></term>
1708         <listitem>
1709           <para>Specifies the 802.3ad system mac address. This can not be either NULL or Multicast.</para>
1710         </listitem>
1711       </varlistentry>
1712
1713       <varlistentry>
1714         <term><varname>FailOverMACPolicy=</varname></term>
1715         <listitem>
1716           <para>Specifies whether the active-backup mode should set all slaves to
1717           the same MAC address at the time of enslavement or, when enabled, to perform special handling of the
1718           bond's MAC address in accordance with the selected policy. The default policy is none.
1719           Possible values are
1720           <literal>none</literal>,
1721           <literal>active</literal> and
1722           <literal>follow</literal>.
1723           </para>
1724         </listitem>
1725       </varlistentry>
1726
1727       <varlistentry>
1728         <term><varname>ARPValidate=</varname></term>
1729         <listitem>
1730           <para>Specifies whether or not ARP probes and replies should be
1731           validated in any mode that supports ARP monitoring, or whether
1732           non-ARP traffic should be filtered (disregarded) for link
1733           monitoring purposes. Possible values are
1734           <literal>none</literal>,
1735           <literal>active</literal>,
1736           <literal>backup</literal> and
1737           <literal>all</literal>.
1738           </para>
1739         </listitem>
1740       </varlistentry>
1741
1742       <varlistentry>
1743         <term><varname>ARPIntervalSec=</varname></term>
1744         <listitem>
1745           <para>Specifies the ARP link monitoring frequency in milliseconds.
1746           A value of 0 disables ARP monitoring. The default value is 0.
1747           </para>
1748         </listitem>
1749       </varlistentry>
1750
1751       <varlistentry>
1752         <term><varname>ARPIPTargets=</varname></term>
1753         <listitem>
1754           <para>Specifies the IP addresses to use as ARP monitoring peers when
1755           ARPIntervalSec is greater than 0. These are the targets of the ARP request
1756           sent to determine the health of the link to the targets.
1757           Specify these values in IPv4 dotted decimal format. At least one IP
1758           address must be given for ARP monitoring to function. The
1759           maximum number of targets that can be specified is 16. The
1760           default value is no IP addresses.
1761           </para>
1762         </listitem>
1763       </varlistentry>
1764
1765       <varlistentry>
1766         <term><varname>ARPAllTargets=</varname></term>
1767         <listitem>
1768           <para>Specifies the quantity of ARPIPTargets that must be reachable
1769           in order for the ARP monitor to consider a slave as being up.
1770           This option affects only active-backup mode for slaves with
1771           ARPValidate enabled. Possible values are
1772           <literal>any</literal> and
1773           <literal>all</literal>.
1774           </para>
1775         </listitem>
1776       </varlistentry>
1777
1778       <varlistentry>
1779         <term><varname>PrimaryReselectPolicy=</varname></term>
1780         <listitem>
1781           <para>Specifies the reselection policy for the primary slave.  This
1782           affects how the primary slave is chosen to become the active slave
1783           when failure of the active slave or recovery of the primary slave
1784           occurs. This option is designed to prevent flip-flopping between
1785           the primary slave and other slaves.  Possible values are
1786           <literal>always</literal>,
1787           <literal>better</literal> and
1788           <literal>failure</literal>.
1789           </para>
1790         </listitem>
1791       </varlistentry>
1792
1793       <varlistentry>
1794         <term><varname>ResendIGMP=</varname></term>
1795         <listitem>
1796           <para>Specifies the number of IGMP membership reports to be issued after
1797           a failover event. One membership report is issued immediately after
1798           the failover, subsequent packets are sent in each 200ms interval.
1799           The valid range is 0–255. Defaults to 1. A value of 0
1800           prevents the IGMP membership report from being issued in response
1801           to the failover event.
1802           </para>
1803         </listitem>
1804       </varlistentry>
1805
1806       <varlistentry>
1807         <term><varname>PacketsPerSlave=</varname></term>
1808         <listitem>
1809           <para>Specify the number of packets to transmit through a slave before
1810           moving to the next one. When set to 0, then a slave is chosen at
1811           random. The valid range is 0–65535. Defaults to 1. This option
1812           only has effect when in balance-rr mode.
1813           </para>
1814         </listitem>
1815       </varlistentry>
1816
1817       <varlistentry>
1818         <term><varname>GratuitousARP=</varname></term>
1819         <listitem>
1820           <para>Specify the number of peer notifications (gratuitous ARPs and
1821           unsolicited IPv6 Neighbor Advertisements) to be issued after a
1822           failover event.  As soon as the link is up on the new slave,
1823           a peer notification is sent on the  bonding device and each
1824           VLAN sub-device.  This is repeated at each link monitor interval
1825           (ARPIntervalSec or MIIMonitorSec, whichever is active) if the number is
1826           greater than 1. The valid range is 0–255. The default value is 1.
1827           These options affect only the active-backup mode.
1828           </para>
1829         </listitem>
1830       </varlistentry>
1831
1832       <varlistentry>
1833         <term><varname>AllSlavesActive=</varname></term>
1834         <listitem>
1835           <para>Takes a boolean. Specifies that duplicate frames (received on inactive ports)
1836           should be dropped when false, or delivered when true. Normally, bonding will drop
1837           duplicate frames (received on inactive ports), which is desirable for
1838           most users. But there are some times it is nice to allow duplicate
1839           frames to be delivered. The default value is false (drop duplicate frames
1840           received on inactive ports).
1841           </para>
1842         </listitem>
1843       </varlistentry>
1844
1845       <varlistentry>
1846         <term><varname>DynamicTransmitLoadBalancing=</varname></term>
1847         <listitem>
1848           <para>Takes a boolean. Specifies if dynamic shuffling of flows is enabled. Applies only
1849           for balance-tlb mode. Defaults to unset.
1850           </para>
1851         </listitem>
1852       </varlistentry>
1853
1854       <varlistentry>
1855         <term><varname>MinLinks=</varname></term>
1856         <listitem>
1857           <para>Specifies the minimum number of links that must be active before
1858           asserting carrier. The default value is 0.
1859           </para>
1860         </listitem>
1861       </varlistentry>
1862     </variablelist>
1863
1864     <para>For more detail information see
1865     <ulink url="https://www.kernel.org/doc/Documentation/networking/bonding.txt">
1866     Linux Ethernet Bonding Driver HOWTO</ulink></para>
1867   </refsect1>
1868
1869   <refsect1>
1870     <title>[Xfrm] Section Options</title>
1871
1872     <para>The <literal>[Xfrm]</literal> section accepts the following
1873     keys:</para>
1874
1875     <variablelist class='network-directives'>
1876       <varlistentry>
1877         <term><varname>InterfaceId=</varname></term>
1878         <listitem>
1879           <para>Sets the ID/key of the xfrm interface which needs to be associated with a SA/policy.
1880           Can be decimal or hexadecimal, valid range is 0-0xffffffff, defaults to 0.</para>
1881         </listitem>
1882       </varlistentry>
1883       <varlistentry>
1884         <term><varname>Independent=</varname></term>
1885         <listitem>
1886           <para>Takes a boolean. If set to <literal>no</literal>, the xfrm interface should have an
1887           underlying device which can be used for hardware offloading. Defaults to <literal>no</literal>.
1888           See <citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1889           for how to configure the underlying device.</para>
1890         </listitem>
1891       </varlistentry>
1892     </variablelist>
1893
1894     <para>For more detail information see
1895       <ulink url="https://lwn.net/Articles/757391">
1896         Virtual xfrm interfaces</ulink></para>
1897   </refsect1>
1898
1899   <refsect1>
1900     <title>[VRF] Section Options</title>
1901     <para>The <literal>[VRF]</literal> section only applies for
1902     netdevs of kind <literal>vrf</literal> and accepts the
1903     following key:</para>
1904
1905     <variablelist class='network-directives'>
1906       <varlistentry>
1907         <term><varname>Table=</varname></term>
1908         <listitem>
1909           <para>The numeric routing table identifier. This option is compulsory.</para>
1910         </listitem>
1911       </varlistentry>
1912     </variablelist>
1913   </refsect1>
1914
1915   <refsect1>
1916     <title>Examples</title>
1917     <example>
1918       <title>/etc/systemd/network/25-bridge.netdev</title>
1919
1920       <programlisting>[NetDev]
1921 Name=bridge0
1922 Kind=bridge</programlisting>
1923     </example>
1924
1925     <example>
1926       <title>/etc/systemd/network/25-vlan1.netdev</title>
1927
1928       <programlisting>[Match]
1929 Virtualization=no
1930
1931 [NetDev]
1932 Name=vlan1
1933 Kind=vlan
1934
1935 [VLAN]
1936 Id=1</programlisting>
1937     </example>
1938     <example>
1939       <title>/etc/systemd/network/25-ipip.netdev</title>
1940       <programlisting>[NetDev]
1941 Name=ipip-tun
1942 Kind=ipip
1943 MTUBytes=1480
1944
1945 [Tunnel]
1946 Local=192.168.223.238
1947 Remote=192.169.224.239
1948 TTL=64</programlisting>
1949     </example>
1950     <example>
1951       <title>/etc/systemd/network/1-fou-tunnel.netdev</title>
1952       <programlisting>[NetDev]
1953 Name=fou-tun
1954 Kind=fou
1955
1956 [FooOverUDP]
1957 Port=5555
1958 Protocol=4
1959       </programlisting>
1960     </example>
1961     <example>
1962       <title>/etc/systemd/network/25-fou-ipip.netdev</title>
1963       <programlisting>[NetDev]
1964 Name=ipip-tun
1965 Kind=ipip
1966
1967 [Tunnel]
1968 Independent=yes
1969 Local=10.65.208.212
1970 Remote=10.65.208.211
1971 FooOverUDP=yes
1972 FOUDestinationPort=5555
1973       </programlisting>
1974     </example>
1975     <example>
1976       <title>/etc/systemd/network/25-tap.netdev</title>
1977       <programlisting>[NetDev]
1978 Name=tap-test
1979 Kind=tap
1980
1981 [Tap]
1982 MultiQueue=yes
1983 PacketInfo=yes</programlisting> </example>
1984
1985     <example>
1986       <title>/etc/systemd/network/25-sit.netdev</title>
1987       <programlisting>[NetDev]
1988 Name=sit-tun
1989 Kind=sit
1990 MTUBytes=1480
1991
1992 [Tunnel]
1993 Local=10.65.223.238
1994 Remote=10.65.223.239</programlisting>
1995     </example>
1996
1997     <example>
1998       <title>/etc/systemd/network/25-6rd.netdev</title>
1999       <programlisting>[NetDev]
2000 Name=6rd-tun
2001 Kind=sit
2002 MTUBytes=1480
2003
2004 [Tunnel]
2005 Local=10.65.223.238
2006 IPv6RapidDeploymentPrefix=2602::/24</programlisting>
2007     </example>
2008
2009     <example>
2010       <title>/etc/systemd/network/25-gre.netdev</title>
2011       <programlisting>[NetDev]
2012 Name=gre-tun
2013 Kind=gre
2014 MTUBytes=1480
2015
2016 [Tunnel]
2017 Local=10.65.223.238
2018 Remote=10.65.223.239</programlisting>
2019     </example>
2020
2021     <example>
2022       <title>/etc/systemd/network/25-vti.netdev</title>
2023
2024       <programlisting>[NetDev]
2025 Name=vti-tun
2026 Kind=vti
2027 MTUBytes=1480
2028
2029 [Tunnel]
2030 Local=10.65.223.238
2031 Remote=10.65.223.239</programlisting>
2032     </example>
2033
2034     <example>
2035       <title>/etc/systemd/network/25-veth.netdev</title>
2036       <programlisting>[NetDev]
2037 Name=veth-test
2038 Kind=veth
2039
2040 [Peer]
2041 Name=veth-peer</programlisting>
2042     </example>
2043
2044     <example>
2045       <title>/etc/systemd/network/25-bond.netdev</title>
2046       <programlisting>[NetDev]
2047 Name=bond1
2048 Kind=bond
2049
2050 [Bond]
2051 Mode=802.3ad
2052 TransmitHashPolicy=layer3+4
2053 MIIMonitorSec=1s
2054 LACPTransmitRate=fast
2055 </programlisting>
2056     </example>
2057
2058     <example>
2059       <title>/etc/systemd/network/25-dummy.netdev</title>
2060       <programlisting>[NetDev]
2061 Name=dummy-test
2062 Kind=dummy
2063 MACAddress=12:34:56:78:9a:bc</programlisting>
2064     </example>
2065     <example>
2066       <title>/etc/systemd/network/25-vrf.netdev</title>
2067       <para>Create a VRF interface with table 42.</para>
2068       <programlisting>[NetDev]
2069 Name=vrf-test
2070 Kind=vrf
2071
2072 [VRF]
2073 Table=42</programlisting>
2074     </example>
2075
2076     <example>
2077       <title>/etc/systemd/network/25-macvtap.netdev</title>
2078       <para>Create a MacVTap device.</para>
2079       <programlisting>[NetDev]
2080 Name=macvtap-test
2081 Kind=macvtap
2082       </programlisting>
2083     </example>
2084     <example>
2085       <title>/etc/systemd/network/25-wireguard.netdev</title>
2086       <programlisting>[NetDev]
2087 Name=wg0
2088 Kind=wireguard
2089
2090 [WireGuard]
2091 PrivateKey=EEGlnEPYJV//kbvvIqxKkQwOiS+UENyPncC4bF46ong=
2092 ListenPort=51820
2093
2094 [WireGuardPeer]
2095 PublicKey=RDf+LSpeEre7YEIKaxg+wbpsNV7du+ktR99uBEtIiCA=
2096 AllowedIPs=fd31:bf08:57cb::/48,192.168.26.0/24
2097 Endpoint=wireguard.example.com:51820</programlisting>
2098     </example>
2099
2100     <example>
2101       <title>/etc/systemd/network/27-xfrm.netdev</title>
2102       <programlisting>[Xfrm]
2103 Name=xfrm0
2104 Kind=xfrm
2105
2106 [Xfrm]
2107 Independent=yes</programlisting>
2108     </example>
2109   </refsect1>
2110
2111   <refsect1>
2112     <title>See Also</title>
2113     <para>
2114       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
2115       <citerefentry><refentrytitle>systemd-networkd</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
2116       <citerefentry><refentrytitle>systemd.link</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
2117       <citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>
2118     </para>
2119   </refsect1>
2120
2121 </refentry>